Cyberdeterrence and Cyberwar by Martin C. Libicki. RAND, 2009, 244 pp.
A cynic might sum up the US approach to information-age national security by paraphrasing Mark Twain’s observation about weather—everybody talks about cyberspace, but nobody does anything about it. To refute such an observation, Cyberdeterrence and Cyberwar aims to inform the establishment of US Cyber Command and its service components. This monograph, based on Air Force–contracted research by the RAND Corporation, examines whether deterrence and war-fighting tenets established in traditional combat media (air, sea, and land) translate into the medium of cyberspace. Dr. Martin Libicki, is a senior management scientist at RAND who focuses on security impacts of information technology. His portfolio includes many cyberspace-related works; Defending Cyberspace and Other Metaphors (1997), written during his 12 years at the National Defense University, contains essays that foreshadow the findings of this book.
Libicki’s thesis is straightforward: “to focus on the policy dimension of cyberwar” and explore “key aspects of cyberwar to establish a framework for considering cyberdeterrence.” His primary audience is USAF leadership tasked to create its new cyberspace structure. Many of Libicki’s findings are controversial. He argues that “there is no forced entry in cyberspace” because “organizations are vulnerable to cyberattack only to the extent they want to be.” He also asserts that “cyberwar operations neither directly harm individuals nor destroy equipment” and thus can only play a niche role. Further, he contends, “strategic cyberwar is unlikely to be decisive” to induce political compliance, as compared to strategic airpower. Regarding deterrence, he concludes, “cyberdeterrence may not work as well as nuclear deterrence” due largely to its ambiguities compared to the “clarity of nuclear deterrence.”
While there are weaknesses in Libicki’s supporting arguments, there is considerable merit to the structure of his analysis. The initial chapters establish a systematic framework for subsequent examination. Cyberspace is a virtual medium of three layers—physical (hardware), syntactic (machine operating software), and semantic (the actual information). Cyber attack is the “deliberate disruption or corruption by one state of a system of interest to another state;” it does not include computer network exploitation (spying). This monograph limits cyberdeterrence to the principles of deterrence by punishment, defining it as “a capability in cyberspace to do unto others what others may want to do unto us.” Libicki devotes a chapter to “Why Cyberdeterrence is Different,” in which he assesses nine simple yet profound questions that flesh out his views and biases. These questions deserve extensive dialogue within the national security community. Other chapters on cyber attack motivations and responses offer thoughtful reflections considered from the defender’s and attacker’s perspectives.
Turning to strategic cyberwar, Libicki restricts his arguments to state-on-state cyber attacks and excludes physical warfare as well as legal, diplomatic, and economic elements. He claims that cyberwar cannot “disarm, much less destroy, the enemy” and minimizes its consequences with debatable statements such as “most government computers can go down for several weeks with only minor inconvenience to the average citizen” and “systems can be set straight painlessly.” Posing that strategic cyberwar activities are more likely to agitate than frighten an opponent, Libicki concludes it is “hard to argue that the ability to wage strategic cyberwar should be a priority area for U.S. investment.”
The author presents operational cyberwar as a possible “decisive force multiplier” but elects not to include physical attacks on networks, electronic warfare, and psychological operations in his discussion. Not surprisingly, Libicki declares that operational cyberwar “cannot win an overall war on its own,” therefore “the question of cybersupremacy is meaningless.” Similarly, his discussion of cyber defense specifically distinguishes between military and nonmilitary system defense measures, proposing that only militaries have enemies, thus the need to be prepared for extraordinary circumstances. Ironically, many principles of defense he presents could easily be applied to nonmilitary systems as well.
Understanding the context of state (or nonstate) conflict apropos to developing cyberspace policy requires an integrated approach. A significant element of deterrence and war missed by Libicki regards how state sovereignty is defined in cyberspace. Another shortfall is his choice to compartmentalize military aspects of cyberspace from other instruments of national power (diplomatic, economic, information). Libicki’s book also builds on a critical oversimplification: the prevalent assumption that nuclear deterrence and physical warfare are linear and well-defined, but in contrast, deterrence and war in cyberspace are uniquely ambiguous (and therefore not subject to historical analysis). To exacerbate the contentious nature of his premise, the author downplays the primary impacts of cyberspace activities without fully characterizing possible second- and third-order effects—to wit, his claim that “the effects of cyberattack are temporary” is hard to accept at face value.
Granted, Libicki has courage to advocate views at odds with popular “gloom and doom” cyberspace scenarios painted by many authors. In reality the truth lies somewhere in between, and perhaps advocates of both extremes first should evaluate where cyberspace notions are similar before espousing perceived differences. Sadly, Libicki falls into a common trap among present authors—his text often confuses and dilutes his arguments with new words created simply by adding “cyber” as a prefix and providing no definition. For clarity, future discourse should refrain from the cyber–name game and only use the term cyberspace, if possible (for example, by changing this book title to Deterrence and War in Cyberspace). This serves more than semantic niceties; having intentional nomenclature can help achieve unity of effort within a fledgling unified Cyber Command.
Despite its foibles, Cyberdeterrence and Cyberwar is not a feckless work. It identifies many issues and concepts relevant to strategic and operational cyberspace operations which require thoughtful and collaborative discourse. However, readers should realize that many of its arguments downplay the significance of cyberspace in a military environment and do not address complex interactions among all elements of national power. As such, it does not provide sufficient analysis upon which decision makers should act, but it can provide value as one voice within a broader dialogue.
COL Jeffrey L. Caton, USA, Retired
Army War College