By Lt Col David T. Fahrenkrug
Cyberspace is clearly the buzzword of the day. As the Air Force moves forward with its vision to fly and fight in cyberspace, however, there are some emerging misperceptions about what warfighting in this new domain actually means. Depending on how you define or interpret cyberspace determines what you think warfighting in the domain will look like. Rather than engage in a debate on how we should define cyberspace, this article uses the definition of cyberspace recently adopted by the Department of Defense and the Air Force to address two common misperceptions about cyber warfare.
The Department of Defense officially codified its understanding of cyberspace as a warfighting domain with the publication of the National Military Strategy for Cyberspace Operations. In this document, cyberspace is defined as a domain characterized by the use of electronics and the electromagnetic spectrum to store, modify, and exchange data via networked systems and associated physical infrastructures. According to this definition, cyberspace is a very real, physical domain that is comprised of electronics and networked systems that use electromagnetic energy. Cyberspace exists across the other domains of air, land, sea, and space and connects these physical domains with the cognitive processes that use the data that is stored, modified, or exchanged. Cyberspace is therefore distinct from the information that may be resident in or transferred through the domain. Using this understanding of cyberspace, the following sections discuss misperceptions about the boundaries of the domain and operations conducted in the domain.
There is a wide range of thoughts about the extent of cyberspace or what should be included in cyber warfare. A typical response to “What is cyberspace” usually involves some description of computer networks or the internet. For the more network savvy, cyberspace may even be equated to the global information grid (GIG). The military’s definition of cyberspace, however, recognizes that cyberspace is more than just these computer networks. More importantly, because networked systems are created through the use of electromagnetic energy, warfighting in cyberspace will necessarily involve capabilities that are currently considered electronic warfare. Even networks that are not directly connected to the internet may be potentially accessed or attacked using electromagnetic energy to interrogate or disrupt the electronic components of the network. This is an important distinction for the military.
While the internet is important and certainly has clear vulnerabilities that could impact national security, there are a large number of networked systems that are not connected to the internet. Many military command and control networks and air defense systems are isolated or closed networks that are not directly accessible to those outside of the military. Yet, from a warfighting perspective, if we want to diminish an adversary’s capability to wage war, these are precisely the types of strategic systems we must be able to hold at risk. Airpower strategists have long recognized the value of directly attacking these strategic capabilities and warfighting in cyberspace potentially provides another way to achieve the same effects.
Since cyberspace is defined as a physical domain within the electro-magnetic environment, then warfighting in cyberspace is also about physical operations. It is not about creating virtual effects or attacking adversaries in some kind of virtual reality. Therefore, treating cyberspace as a warfighting domain means developing those capabilities that can ensure our continued use of the domain. As the conduct of warfare becomes increasingly more dependent on cyberspace, a key objective of every joint force commander will be ensuring our freedom of action while denying that same freedom to our adversaries. In the past, we have used some of our cyber capabilities to create effects, but we did not use these capabilities to ensure freedom of action in cyberspace. Attaining this freedom of action in cyberspace will ensure that the joint force commander can conduct other operations to achieve strategic, operational, and tactical objectives.
Recent wargaming efforts have demonstrated the extent to which operations in cyberspace will create very real effects to support the joint force commander. A series of Cybervision Wargaming Conferences is studying the concepts of cyber warfare and the planning and execution of operations in cyberspace. The intent is to apply the current concept of cyber warfare to an operational scenario using current and planned capabilities, in order to identify objectives and effects that can be accomplished using Air Force cyber capabilities. The conferences have produced some robust and innovative solutions for delivering integrated effects across the spectrum of conflict. In particular, the conferences have shown that the concept of cyberspace superiority goes well beyond just network security or defense. Further, effective cyber operations will require robust “cyber-craft” weapon systems coupled with a superior understanding of the cyberspace environment.
A second misperception about cyberspace concerns the relationship between the domain and operations in it. Specifically, there is confusion between the current doctrine on Information Operations (IO) and warfighting in cyberspace. There are many who believe that IO is simply being repackaged and re-designated as Cyberspace Operations. Others see cyberspace as simply a subset of IO. Neither of these understandings of cyberspace and its relationship to IO are accurate. Resistance to the concept of cyber warfare seems to come from a misunderstanding of cyberspace as a domain rather than an operation.
Information Operations is the integrated employment of specific capabilities through all domains with the ultimate purpose of influencing our adversaries' decision making while protecting our own. Information Operations is a mission set and current doctrine has identified five core capabilities that are used to achieve effects in support of these missions. Yet, these capabilities are not exclusively used for Information Operations nor are they necessarily sufficient for achieving an information objective. But that is how they are currently perceived. More importantly, while we have used these capabilities to create effects in support of a commander’s objectives, we have not used these capabilities to ensure freedom of action in cyberspace.
What may be confusing is that cyberspace is characterized as a physical domain which contains electronics (electronic networks, not just computers) and the electromagnetic spectrum. Two of the five core operational capabilities of information operations are Computer Network Operations (CNO), which primarily focuses on computer networks—electronics; and, Electronic Warfare (EW), which conducts operations within the electromagnetic spectrum. These are operations, not physical entities.
Information Operations are not relegated to employment within any specific domain—in fact they are most effective when employed through multiple domains. We deliver leaflets from aircraft through the air domain. Ground forces disseminate handbills, talk to local populations through interpreters, and conduct tactical operations to reinforce national strategic objectives on land. Naval forces conduct operations in a similar manner, and we have space assets which enable information operations as well. Cyberspace is the latest recognized domain to be defined and needs to be harnessed to support all missions.
Recognizing cyberspace as a warfighting domain is not simply an effort to harness Air Force network operations and electronic warfare in one location or organization. Rather, the Air Force has recognized that it must now ensure freedom of action in cyberspace while denying that same freedom of action to our adversaries. This is also not an attempt to marginalize information operations as a core military capability - to the contrary, this really is a means to further operationalize these types of operations by ensuring that the military has the freedom to operate in the cyber domain.
Cyberspace is a warfighting domain and operations will be executed within and through it, just as the other domains of land, sea, air, and space. Cyberspace is not in competition with information operations; instead, cyberspace is a domain in which to conduct operations to achieve information objectives. When viewed from the perspective of a warfighting domain, cyber operations will improve our efforts to influence our adversaries and others using information operations in all the domains.
The Air Force, under direction of the Secretary and Chief of Staff, intends to provide the joint warfighter with options to create very real effects in cyberspace that affect the adversary’s ability to orient his forces, command and control, or even fire weapons. These are not effects that simply occur in the adversary’s mind. In other words, these are not virtual or imagined effects—the adversary can in fact die or be harmed through warfighting in cyberspace. The establishment of an Air Force Cyber Command is an effort to harness capabilities resident in the Air Force in order to conduct operations in cyberspace.
Using the definition of cyberspace, the Air Force has identified three mission areas for operations in cyberspace: countercyber operations, cross domain operations, and support to civil authorities and the defense industry. These mission areas form the core of the current theory of cyber warfare that is described in the AF Concept of Cyber Warfare. These concepts are being reviewed and evaluated by the Air Force through various exercises and wargames. In the not too distant future, there will be a career force of cyber warriors who are the guardians and defenders of our freedom in cyberspace. They will be the recognized experts who understand the principals and techniques for conducting combat operations in cyberspace so that the Air Force can deliver sovereign options for the defense of the United States of America and its global interests.