The views and opinions expressed or implied in WBY are those of the authors and should not be construed as carrying the official sanction of the Department of Defense, Air Force, Air Education and Training Command, Air University, or other agencies or departments of the US government or their international equivalents.
By Elizabeth L. B. Peifer, PhD
/ Published February 19, 2021
As news emerged of the massive hack of United States government agencies, holiday shopping occupied my mind.1 Surprisingly, both offer lessons for future conflicts. While the quest for the latest gaming console might represent the epitome of a self-indulgent first-world problem, my efforts underscore the impact of changing technology and hold lessons for great power competition. Cybersecurity professionals understand the myriad advantages and threats of current and developing technologies, but I suspect fewer policymakers and strategists fully comprehend how they will alter the character of future conflicts. Despite academic knowledge of these prognostications, it took a desperate personal campaign to secure a coveted PlayStation 5 (PS5) console to drive that reality home.
Christmas season heralds for many parents a frenzied search for the hottest toy item, but the chaos around this year’s release of the PS5 far exceeded previous madness inspired by Cabbage Patch Kids, Tickle Me Elmo or Teddy Ruxpin. The Coronavirus pandemic compounded the mayhem, increasing demand as well as complicating production and distribution. My tenacity might prompt images of the desperate father played by Arnold Schwarzenegger in Jingle All the Way, but the experience felt closer to the struggle against the futuristic unhuman adversary in The Terminator. This recent deployment in the dog-eat-dog world of Christmas shopping serves as a cautionary tale for US military priorities.
Initially, the magnitude of my children’s request was lost on my middle-aged mind. All signs indicated conventional tactics might not suffice, but clouded by self-delusions of being a super-shopper, my confidence survived pre-order and release date failures. By Cyber Monday, however, the inadequacy of my capabilities was apparent. Facing unseen competitors in unfamiliar terrain, I panicked. No longer would sheer will and determination ensure success. Traditional sources of intelligence like Black Friday advertising flyers proved quaintly outdated. While attrition (camping overnight in line) and ambush (rushing to stores as inventory was unloaded) worked in localized scenarios, these strategies no longer promised inevitable success. As I delved beyond my suburban middle-aged world of Facebook and Google in the internet universe, and deepened my understanding of artificial intelligence and bots, I gained a more personal and fundamental appreciation of the age of intelligence and security we now inhabit.
My quest for the PS5 offers a microcosm of the wicked problem described by Christian Brose in The Kill Chain: Defending America in the Future of High-Tech Warfare. Referring to the structure of military attack, the “kill chain” links the steps of locating a target, dispatching forces to it, deciding to attack, and destroying the target. Brose warns the United States is losing the battle for speed in executing the “kill chain,” its battle network and communications structure failing to keep pace with more efficient adversarial networks. Securing a PS5 posed similar problems, with purchase rather than destruction as the goal. The first step was finding inventory. Physically checking store shelves was a fool’s errand and subscribing to retail notifications, though more efficient, was still too slow. Inventory tracking sites (BrickSeek, Popfindr) identified in-store availability in real time until stifled by retailers. Although in-person shopping posed health risks, hero stories circulated about consumers driving hours to distant stores and, after locating inventory, I seriously considered driving across three counties in the wee hours of the night. Much like an intelligence analyst, I questioned information accuracy, weighed personal risks, and pondered how many competitors possessed the same data.
Online sales demonstrated more dramatically the impact of technology. After locating the target, the next challenge was adding to cart and checking out before stock disappeared. A few seconds separated success from frustration. Lacking superior processing speed, I streamlined where I could, downloading store apps, preloading payment information and experimenting with both WIFI and cell data. Open browser tabs bore the legacy of failed attempts. Average American consumers stood little chance against bots executing this kill chain with unrivaled speed.
Retailers have developed security protocols for the massive rush of Black Friday shoppers, but proved ill-equipped to handle the influx of bots. Given months of product hype and pandemic-driven online shopping, why weren’t they better prepared? Sadly, the same features that enable smooth, user-friendly online sales left the sites vulnerable to bots. Like much of American military strategy, retailers focused on offensive capabilities and neglected defensive planning. As hackers breached the US government and security apparatus, businesses battled bots. Sites routinely crashed and disgruntled customers watched as thousands of units disappeared from mainstream commercial sites only to appear on eBay and StockX for double or triple the retail price. Retailers scrambled to develop defensive strategies while providing safe and equitable distribution to consumers. Reverting to old-school methods, GameStop accepted in-person orders, but lists filled in minutes. Others combined CAPTCHA/reCAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) and local pick-up. New players like Antonline.com outmatched larger retailers. Even clothing retailer Urban Outfitters entered the fray, while mega-retailer Amazon remained notably absent. At the center, PlayStation Direct developed a unique process of online announcements, reCAPTCHA verifications, and random queuing. For the six weeks between the launch of the new platform and Christmas, PS5 sales became an online battlespace, highly dynamic both offensively and defensively.
In addition to the need for speed, the mission required a new approach to intelligence gathering, one in which traditional experts played a diminished role. As P.W. Singer and Emerson T. Brooking argue in LikeWar, social media and open-source investigations can often produce more accurate results than conventional secret intelligence gathering, as bellingcat has demonstrated.2 In the search for a PS5, market analysts (Newsweek, Forbes, Wired, TechRadar) and gaming websites like GameSpot offered weekly or daily updates in a battle decided in minutes or seconds. After joining Twitter and Discord, I followed live streaming on YouTube and tracked PS5 stock internationally. Through my Bluetooth enabled hearing aids, the voices of Darren and his buddy Pringel (@SpielTimes) provided my afternoon soundtrack as they streamed from their respective apartments in India. Playfully competing with @LinusWilson, @ChitoGamingYT, @JakeRandall and others over bragging rights for accurate predictions, they monitored commercial websites and official statements, but also crowdsourced information on inventory, rumors, and tips. The community of PS5 hunters collectively gathered and analyzed information for patterns: PlayStation Direct releases weekdays between 3:00 and 6:00 pm; Walmart synchronizes drops to reduce site traffic; and an incognito browser reduces CAPTCHAS meaning faster checkout. They provided useful intel reports on which payment methods had issues, which retailers oversell, and who had the fastest shipping. Traditional experts in technology, marketing or gaming provided little in comparable information. From a defensive perspective, however, this wealth of open-source information threatens military secrecy, exposing troop and asset movements as easily as inventory shipments by Walmart, Target or Best Buy.
My brief foray into this online community also confirmed the power of online social bonding, demonstrating how effective social media can be as a tool in the arsenal of terrorists and insurgents, both in terms of recruitment as well as command and control capabilities. Camaraderie developed quickly between strangers in pursuit of a common goal. By highlighting success stories, live-streamers built credibility, but they also needed to project authenticity by convincing audiences that their purpose was altruistic and not profit-driven. In the extended limbo between inventory drops, they entertained their captive audiences with tips and tricks, personal stories and advocacy, silly dances, and pet photos. With credibility and authenticity established, these individuals possessed substantial command and control capabilities. All they needed to say was “Walmart is unloading a truck at X location.” The power of social media to spread both credible information and disinformation, and coordinate actions should not be underestimated.
While my saga reflects personal naivete, many policymakers and strategists also cling to outmoded conceptions of war that thwart meaningful preparation for future conflicts. War termination depends on an adversary’s willingness to continue the fight. Tactics from siege warfare to bombing campaigns are designed to destroy an enemy’s morale. As political and military leaders delay preparing for the new realities of conflict, they should consider the soul-crushing sense of futility in battling bots whose superior speed seems insurmountable.
On the afternoon of 15 December, I readied myself once more. With six different devices and a pair of extra hands, I furiously pounded the “add to cart” button each time it shifted to yellow. Suddenly it went through, and I checked out with pre-saved payment and shipping information. My partner and I looked at each other in disbelief—had it really happened? A January (post-Christmas) shipping date tempered our joy, but as Clausewitz noted, chance can often change the course of battle. The fog of this battle lifted with updated shipping information, and as luck would have it, the console arrived 21 December. Good fortune or excessive expenditures sometimes compensate for poor planning but adapting to new rules of the game increases probability of success. If my victory with the PS5 is any indication, a chance still exists to alter our military thinking in preparation for the next big “drop.”
The views expressed in this article are those of the author and do not reflect the official policy or position of the United States Air Force, Air University, the Department of Defense, or the United States Government.
Elizabeth L. B. Peifer, PhD
Assistant Professor of Regional and Cultural Studies (Europe)
US Air Force Culture and Language Center
Department of Strategy, US Air War College
1 Fung, Brian, and Alex Marquardt. “US Agencies Investigating Hacking of Government Networks,” CNN, 13 December 2020, https://www.cnn.com.
2 P.W. Singer, “LikeWar: The Weaponization of Social Media,” Eamon Dolan/Houghton Mifflin Harcourt, 2 October 2018, https://www.likewarbook.com; Bellingcat, https://www.bellingcat.com.
Wild Blue Yonder Home