Cyber War, Cont.

I wanted to add something else before continuing. In the army we talk about 'key terrain', 'center of gravity', 'decisive point', and so on and so forth. I like to start out by giving a conventional example, particularly the mountain pass scenario (if you haven't noticed already), because it's a simple setup where the ideas are fairly easy to grasp.

Or maybe that's just me... I dunno, the way a mountain pass makes it easier for a small force to defend against a larger force makes a lot of intuitive sense to me, as does the possibility that the enemy would get around those defenses by using a lesser known (and probably riskier, but unexpected) smaller pass.

Anyways, starting with that simplified example - controlling the pass, and/or high ground around the pass, makes it key terrain because whoever controls it has a significant advantage. When you control a pass (and the enemy is trying to use it) they generally can't maneuver around you. The mountain itself blocks their way. They also can't spread themselves out too widely, again because of the mountain(s) itself. So if they choose to come down that pass, they are forced to fight you on your terms... forced to present only a small fraction of their force at any one time, which turns a potential 3-on-1 fight into something more like a 1-on-1 fight, three different times. (The larger force still has an advantage, in that the people too far behind to fight are more rested and uninjured and can replace any casualties up front, but a small force holding a mountain pass can slow or stop a larger force for a significant amount of time. Think the Spartans at Thermopylae.)

Controlling high ground is important, too... since whoever has the high ground has better visibility (and thus situational awareness), a better chance that their weapons will successfully hit (archers, artillery... etc), an easier time charging (try running up a hill vs running down... it's pretty obvious which is easier) and gravity can make even unsophisticated weapons like rocks and boulders do quite a bit of damage. I'm sure there's other reasons why high ground is important, but these are the ones I can think of off the top of my head.

Anyways, conventional battles make it easy to get the concepts... but the same concepts can be applied to less conventional situations.

In urban warfare, for example, key terrain might include radio stations and television stations, since controlling the flow of communication is important. It can include city hall, police headquarters... and in the US it could also include any store selling guns and ammo. Which, like, means all the Wal-marts, Dick's Sporting Goods, Field & Stream, and local gun shops. (Really, I sort of pity anyone stupid enough to invade us directly, assuming they get past our navy, air force, and army and that we're not reeling from nuclear explosions and/or EMP attacks, or internal issues, or somesuch. I won't say it's impossible, just... well, Red Dawn doesn't seem completely unbelievable.)

High ground can mean taking over skyscrapers or tall buildings (which you can use to create a kill zone, which you can sucker an enemy into.)

So what does that mean for cyber? What is the 'key terrain' when you're not trying to get into a specific organizations network, but are attacking an entire nation/state?

I'd probably be looking at things like those underwater sea cables (which sharks apparently like to eat), the DNS system (since we wouldn't be able to get anywhere if we couldn't translate website names into IP addresses), data centers (as more and more companies store their data on the cloud, a critical data center could shut down who knows how much of the internet?) and more.

Most businesses, of course, are aware of their vulnerabilities and have disaster recovery plans of some sort. I'm not entirely sure how good those plans are, or whether they're enough to continue services in the face of a determined attack, but they're there in some form of fashion.

Though, well... cutting power cables can cause electrical outages just as much as bombing a power plant, and both are physical actions that can be used to take out power in conjunction with (or instead) of cyber attacks.

If you're talking cyber war as an element of a declared war (instead of a euphemism for antagonistic behavior in strictly the cyber realm), you have to consider that sort of thing. And, to be fair, some of it already is (i.e. we know that there's 'critical infrastructure', like the electrical grid, financial services, and more... so I'm trying to throw out a few obvious and less obvious things to think about.)

There's more to it than that, even. I know John Ringo (in his Posleen science fiction) suggested hacking attacks that might, for example, affect GPS targeting so that artillery attacks hit friendly forces instead of the enemy. Again, I don't really know enough about our GPS system, or cyber defenses, to say whether that's realistic or not. But I sure as heck hope that it's a risk people are aware of, and have countermeasures in place for.

That's assuming you can use GPS in the first place, ofc. Which (with jamming and hacking and other things) is not a given. How many people know how to use their equipment if they can't get GPS, anyway?

I also read somewhere (I forget where) that Russia used hacking in conjunction with more conventional forces in their attack on Georgia, where they disabled servers and attacked various government and news sites in coordination with ground forces.

I'd probably also consider how much of our system relies on just-in-time shipping, and what would happen if Wal-mart (and other companies, particularly grocery stores) lost the ability to tell when they're getting low on something. How long could a city last before it ran out of food, and what are the contingency plans that ensure critical stores can continue to function if/when the internet goes down?

I could probably go on and on about the possibilities, but I think the gist of it has come across... and anything further a) depends on specifics that really require expertise and b) is probably not something I'd want to post even if I did have that sort of expertise.

Cyber War

I heard some good news recently, though I'm going to wait until everything is locked into place before saying anything further.

I have a few more ideas floating around about my most recent series of posts, but a recent cyber attack on an electrical grid reminded me that I never got around to talking about cyber war. So I'm setting aside all the other stuff for a bit to knock this out.

The thing is, cyber is still a pretty new realm... and everyone's trying to figure out what the rules are for using it. I mentioned before that I thought our current understanding was misleading, and I'll explain that in a bit. Just remember that I'm not an expert by any means, I am not involved in defending our systems at this point in time (and I'm sure some measures are classified, so even if I did know I couldn't talk about them) and just because I mention it here doesn't necessarily mean it's a cause for concern.

So why bother? Eh, it's mostly just drawing on my own personal experiences to try to envision what could be, and what I hope experts are already aware of and working to prevent.

All right, enough with the caveats and disclaimers, on to the good stuff.

As a veteran, I am somewhat familiar with the army's doctrine of joint warfare. Much though we enjoy teasing each other, we really do need all the branches of the DoD to do their job. We need the navy to control the sea, because we just can't carry enough of what we need via air. (Ships can carry the equipment a battalion or division needs, to include tanks and other equipment that... well... it'd take far too many cargo planes to do, if you even could configure all the necessary equipment for loading on a plane.)

There's a lot of material out there on how important control of the seas is, and maritime strategy, and although I haven't read all of them and was never in the navy I can see the importance of it. (England was a naval superpower. Athens was a naval superpower. And with our borders basically being two large oceans, Canada, and Mexico, a strong navy is critical for defense as well as offense.)

We need air superiority, even if we like to tease them about being corporate goons in uniform, or for focusing more on fancy and ridiculously expensive fighter jets and less on things like air support for ground forces. Still, I wouldn't want to worry that enemy bombers (or fighters) would bomb or strafe us, so we really do need the air force to do their thing. (Just, you know, also keep the warthog or something similar to support the ground troops... or give them to the army. We need that capability somewhere in the DoD.)

We need the marines, because using the navy to carry your resources somewhere isn't enough... you also need people who know how to secure beachheads or landings or whatever. (I don't really have a lot of experience with their doctrine, most of the time when I've worked with marines they've been used a lot like our army... but my understanding of their role, and the reason they work so closely with the navy, is that they basically specialize in that sort of thing. Ground forces that understand and work with the navy, useful for bringing forces into an area from the sea.)

And, of course, we need the army. We need forces on the ground to secure an area. Troops on the ground. Because somehow, well, people can treat bombing attacks like natural disasters. Blockades act a bit like famine, again... a natural disaster. People don't necessarily feel defeated when faced with those sorts of threats. Not the way they do when they can see enemy troops as a real, living presence. (The Nazis may have been able to gain strength after WWI in part because so many Germans didn't feel like they were truly defeated, and there was a widespread perception that they had been stabbed in the back.)

One of the great strengths of the US military is that all these different forces are able to work together, creating a synergistic effect. That is, troops on the ground can call in an air strike to take out massed enemies. The air force and navy can draw on experienced ground forces to secure air bases and sea ports. The navy can provide mobile ranged weapons to support ground forces...

And so on, and so forth. (Part of our problem with training Iraq and Afghan forces, if what I've heard is correct, is that we're so comfortable with joint exercises that we rely on them... whereas the Iraqi and Afghan militaries are not, and don't have the resources to fight that way. So if we teach them a method that relies on air strikes, then after we leave we still need to provide the air power they're incapable of doing on their own.)

Now, each of these battlespaces have their own tactics, techniques, strategies, etc... and they can also fight without the synergistic effect. That is, there are purely naval battles, purely air battles, and purely ground battles that may or may not influence how the military acts in a joint environment. Or rather, they help define what the base capabilities are, which can then be used for that synergistic effect. (I'm not sure I'm explaining that right, but I wanted to make the point because I'm finally going to bring cyber into this.)

Cyber is it's own battlespace, and we're still learning the tactics, techniques, and strategies for using it on it's own... but we also have to start thinking about where it fits, synergistically, in a joint environment.

As it's own battlespace, well.  Most of what we've been learning is how criminals use it. That is, hacking and methods to prevent, identify, and/or monitor attempts to exploit a system. In some ways it doesn't really matter whether the attacker is a  nation/state, criminal organization, or lone wolf... they all mostly use the same tactics, techniques and strategies to find and exploit vulnerabilities (they just may exploit the vulnerability in different ways... from stealing credit card information, to intellectual property, to ransomware, spyware, etc.)

But criminals are parasitic. That is, highway bandits may attack merchants along the road... but they ultimately depend on that commerce to survive, so they don't really want to stop trade altogether. Criminals may hold contempt for the average law-abiding citizen, but they also need them to prey upon. (I don't think they necessarily think about this strategically, or deliberately think "I'd better leave merchants enough money/trade goods/etc to make the risk of traveling this way worth it or they'll stop coming entirely", but if they were too successful they'd probably have to move locations because nobody would risk taking a trading caravan through their area of control.)

A military, on the other hand, doesn't care about that sort of thing. In fact, if they've got the logistics they need, they may burn crops, block all trade, and practice a scorched-earth policy to make it more difficult for their enemies to fight. Bandits (who need to eat, too) would probably be less likely to do this on a consistent basis... unless their banditry is blurring the line between warfare and criminal behavior, which can happen.

So most of what we've been seeing is nation/states (and other entities) sort of feeling things out... and the difficulty in definitively saying a specific entity conducted a specific attack (and therefore justifying a response) means it's also been a somewhat 'safe' way of attacking each other without quite risking war. The recent Israeli physical response to a cyber attack is another reason I decided to write about this topic, as it may be setting some sort of limit on just how much entities can get away with before their cyber attacks become cause for war. Or, in this case at least, physical retaliation.

So... what happens when we take purely cyber tactics and techniques, and start using them in conjunction with more familiar air, land, and sea forces?