RETHINKING SECURITY

1. Most of what is described as cyberwar is not “war” but espionage, crime, or covert operations.

2. Cyberwar in the strictly military context is command and control warfare. Being able to disable a crucial logistics hub with the virus is impressive, but we were already able to do it with a JDAM.

3. Much of information operations theory over-emphasizes cyber and propaganda and neglects military deception and the coercive use of the electromagnetic spectrum for offensive operations.

4. The American public may be concerned about the government tapping its phones, but it is bizarrely unconcerned about, or unaware of, hostile or at the very minimum adversarial foreign governments directly taking its intellectual property, business secrets, and technologies. The Man may have tapped your phone, but economic cyber-spies took your money.

5. Standalone cyberwar is unlikely. Send a virus our way that will function as the electronic equivalent of a countervalue attack and we will retaliate with missiles.

6. Stuxnet showed that covert operations can be automated—which means that espionage and covert operations are the largest immediate beneficiary of cyber.

7. A special operation in cyberspace for covert purposes also does not require special operations and covert personnel, which are perpetually in short supply. Code, however, is not. Hence many high risk-operations can be carried out without regard to human concerns as long as vulnerabilities exist to be exploited.

8. Cyber crimes are hard to solve because all crime is hard to solve. If the police have a hard time tracking down car thieves in real life, there is no reason to believe they will have a better success with virtual ones.

9. War by nature is reciprocal. If one side is unaware that is in a war, then it’s not at war. This holds true even for proxy wars. We know that the ISI is supplying weapons to the Taliban, and the ISI knows we are contesting political control of Afghan with them.