From Sea Power to Cyber Power Learning from the Past to Craft a Strategy for the Future
By Kris E. Barcomb
U.S. Navy cryptologic technicians preview Integrated System for Language Education and Training program at Center for Language, Regional Expertise, and Culture, Pensacola, Florida U.S. Navy (Gary Nichols)
78 JFQ / issue 69, 2 nd quarter 2013 ndupress.ndu.edu BARCOMB
Naval strength involves, unquestionably, the possession of strategic points. —Alfred Thayer Mahan
lfred Thayer Mahan saw the both economic growth and security akin to and overcome resource constraints: “The ocean for what it is. While it Mahan’s approach to sea power a century ago. search for and establishment of leading prin- spans the globe and covers a ciples—always few—around which consider- A predominant portion of the A Mahanian Approach to Cyberspace ations of detail group themselves, will tend to Earth, not all parts of it are equally impor- Mahan did not view the Navy as an reduce confusion of impression to simplicity tant. Mahan offered a focused naval strategy end unto itself, but as a key component of and directness of thought, with consequent in an era when America was struggling to the larger economic welfare of the Nation. facility of comprehension.”3 In accordance define itself as either isolated from, or an He tied the very existence of the Navy to with these two principles, this article identi- integral part of, the larger international com- commerce when he wrote, “The necessity of fies seven strategic points of concentration munity. The force structure of the U.S. Navy a navy, in the restricted sense of the word, in cyberspace: operating systems (OSs), hinged upon leaders deciding between pro- springs, therefore, from the existence of search engines, physical communications tectionism and expansionism. Rather than a peaceful shipping, and disappears with infrastructure, cloud computing, governance simply a mechanism to defend the coasts, it.”1 Similarly, while cyberspace originated forums, cryptography, and Internet Protocol Mahan envisioned the Navy as a powerful through U.S. Government investment, version 6 (IPv6). means for promoting American economic the domain owes its rapid expansion and Each of these categories has unique prosperity. In one sense, his strategy allowed modern character to commerce. In this challenges, and some are more established the Nation to achieve both objectives simul- sense, sea power and cyber power share a than others. Fortunately, the United States taneously. By projecting naval power at key common objective. They both primarily exist holds dominant roles in many of these points around the globe, Mahan’s approach to protect economic interests within their categories, such as operating systems and allowed for economic expansion and had the respective domains. search engines, and it must define strategies second-order effect of pushing conflict away from U.S. shores. Cyberspace represents a similar chal- sea power and cyber power both primarily exist to protect lenge. The United States now faces a contem- economic interests within their respective domains porary struggle between expansionism and protectionism in this domain. We can learn a great deal from Mahan’s methodology for Two principles guided Mahan’s analy- to maintain those positions. In others, such delineating and prioritizing the sea domain sis. First, Mahan looked for strategic points as physical communications infrastructure into actionable terms. Thus, this article of convergence and concentration. He stated, and cloud computing, the United States has identifies strategic categories in cyberspace “In general . . . it will be found that by sea, as played a leading role in their early develop- by adopting Mahan’s approach. In doing so, by land, useful strategic points will be where ment, but the future share of influence is still it seeks to identify similarities and differ- highways pass, and especially where they uncertain. Here, more proactive measures ences between sea power and cyber power. cross and converge.”2 As a result of his fore- must be taken to help assert U.S. influence. The aim is to provide senior leaders with a sight and the willingness of key U.S. leaders better understanding of the salient aspects of to act on it, such as President Theodore Roos- Key Differences cyberspace, offer insights for securing those evelt, American influence secured the Hawai- Before continuing with a detailed points, and suggest a new paradigm for the ian Islands, the Philippines, Guantanamo review of each category, it is important to proper role of the military in this domain. Bay, Puerto Rico, and the Panama Canal, to evaluate the salient differences between the This tailored expansionist strategy for cyber- name a few. Despite both the realities and nature of the sea and the essence of cyber- space should provide the United States with perceptions of the decentralized nature of space. First, while the government played a cyberspace, careful inspection reveals several key role in helping establish the technological points of concentration. foundations of the Internet, commercial Major Kris E. Barcomb, USAF, is a Cyberspace Second, Mahan emphasized the need interest quickly surpassed the government in Strategist for 24th Air Force at Lackland Air Force to minimize the total number of points con- terms of influence over the domain. Martin Base, Texas. sidered important to communicate priorities Libicki, a senior policy analyst at the RAND ndupress.ndu.edu issue 69, 2 nd quarter 2013 / JFQ 79 FEATURES | From Sea Power to Cyber Power
Corporation, succinctly described the current William McNeill wrote about how European for centuries.9 Europeans recognized that state of government influence: “As it is, the sea power in the 16th century was quasi- they could not control the outcome of the days when governments were leading-edge private in character. Neither the British Royal economy as a whole. Instead, they established consumers and manipulators of information Navy nor Spanish Armada significantly dif- policies to facilitate economic growth. In con- technology are long past. . . . Man for man, it ferentiated themselves from their respective trast, China’s attempt to control its economy cannot compete with Microsoft.”4 merchant shipping enterprises until after too tightly led to its decline. Given that The second important difference is the 1600.7 The utility of a government-led navy commercial interests dominate cyberspace, relationship between hard and soft power was not realized until the barriers to self- and influence is based largely on merit, the in each domain. Mahan emphasized hard protection increased beyond practical limits United States must act more like the Europe- power, and he viewed the threat or use of of individual commercial entities. As barriers ans than the Chinese of the middle ages. force as foundational to protecting maritime to entry increased, the security paradigm So far, we have established conver- interests. He also tied sea power to command shifted from a distributed model to a central- gence and simplicity as key components of a when he asserted, “These national and ized one. This belief in a centralized security Mahanian-style analysis for cyberspace. We international functions can be discharged, model persists today, even though it may not have also established how the proper employ- certainly, only by command of the sea.”5 Yet be relevant in cyberspace. Instead, the much ment of both sea power and cyber power is his view of command and the role of force lower barriers to entry into cyberspace may intimately linked to promoting economic do not translate well into cyberspace, where require the reversion to a distributed security growth. Yet the two also have important soft power plays a predominant role. In model dominated by private interests. differences. Commercial entities wield more influence over cyberspace technology than governments, power and influence in cyber- USS George H.W. Bush in Naples, Italy, in support of maritime security operations and space are based on attraction and coopera- theater security cooperation tion rather than command, and low barriers to entry into cyberspace likely require a decentralized security model.
Seven Strategic Points in Cyberspace The first strategic point is operating systems. While cyberspace is distributed and lacks a centralized authority, a single company has tremendous influence over nearly every desktop computer on the planet. Microsoft Windows commands 92 percent of the global market share, followed by Apple’s Mac OS at a distant 6 percent, and Linux trailing at only slightly more than 1 percent.10 In real numbers, this equates to over 1.25 billion computers running versions of the Windows OS.11 Despite the complaints about security flaws and functionality restrictions in Microsoft product offerings, the United States can be thankful that Microsoft is a U.S.-based company subject to its own laws
U.S. Navy (Betsy Lynn Knapper) U.S. Navy (Betsy Lynn and cultural norms. Similarly, U.S. companies currently cyberspace, strategies centered on relation- While Western navies were expanding dominate the global market share of mobile ship-building, performance, and legitimacy the sphere of European influence, events in operating systems, although not to the degree will be more effective than those based on the East were unfolding differently. In 1433, of concentration seen in the desktop market. force. In contrast to Mahan, Joseph Nye in an attempt to inhibit the link between The breakdown of the top four companies stated, “To succeed in a networked world military and commercial enterprises, the is Google Android at 43 percent, Nokia requires leaders to think in terms of attrac- Chinese imperial court halted naval expedi- Symbian 22 percent, Apple iOS at 18 percent, tion and co-option rather than command.”6 tions. Then, in 1436, the Chinese government and Research in Motion at 12 percent (Micro- The final differentiator is ease of access. banned the construction of new seagoing soft carries less than a 2-percent share).12 Cyberspace has much lower barriers to entry ships.8 Because the Chinese economy was The U.S. position in the mobile OS space is a than the sea. Perhaps this key difference will only allowed to function within the narrow relatively recent development. Nokia ceded lead to a devolution of norms with respect to limits defined by the government, commerce the top spot in 2010 as a result of the transfor- the proper role of government and military failed to expand, thereby allowing European mation of cellular phones from simple voice in protecting private interests in cyberspace. interests to dominate the global economy communication devices to “smart phones.”13
80 JFQ / issue 69, 2 nd quarter 2013 ndupress.ndu.edu BARCOMB
From a national security standpoint, To maintain its dominant position in of driving that traffic to infrastructure even if the government or military cannot both operating systems and search engines, outside of U.S. control.21 directly control the software powering the the United States must continue to adhere Additionally, some U.S. companies bulk of the world’s desktop and mobile to economic principles that promote growth have been shortsighted with regard to devices, it is far better to at least have the and innovation. It must also be extremely expanding their services. After the dot-com preponderance of software come from a cautious in exerting hard power in either of bubble of 2000 burst, these companies were U.S.-based company. Imagine if we woke up these categories. For example, antitrust regu- either not in a financial position to invest tomorrow and 92 percent of the world’s per- lation that fostered U.S. competition in the in physical communications infrastructure sonal computers ran on an operating system industrial era may now open a door for global or were unwilling to take another chance designed by a strategic competitor to the competitors to rise to the top. The United on risky technology. This myopic stance United States. We would quickly wish for the States should also guard against mandating allowed non-U.S. interests to attain those good old days of Microsoft. controls or censorship within either of these resources and open independently owned Search engines are the second strategic areas. Too much government interference and operated communications paths.22 A point in cyberspace. While operating systems could delegitimize companies such as Micro- more farsighted investment strategy com- define the technical performance character- soft, Apple, and Google and subsequently bined with targeted financial incentives istics of systems, search engines exert tre- facilitate the ability of non-U.S. companies to could have helped the United States retain mendous influence over ideas. In many ways, take their place. the preponderance of ownership. they embody Nye’s concept of soft power; they must attract users through superior performance, and the results they return are antitrust regulation that fostered U.S. competition a powerful form of agenda-setting and pref- in the industrial era may now open a door for global erence-shaping. Most users can easily switch competitors to rise to the top from one search engine to another, yet they often choose only one: Google. The company commands 91 percent of the global market A third strategic point in cyberspace The fourth strategic point is cloud share for search.14 Google’s search algorithm is physical communications infrastructure. computing. While physical communications returns what it believes are the most relevant In particular, this category relates to those infrastructure established the need to main- matches to a user’s request from its index of physical systems supporting the backbone tain influence over the global communica- over 1 trillion unique URLs.15 Since people of the Internet. Only a handful of com- tions paths, this category deals with main- generally only review the top three to five panies, known as Tier 1 Internet Service taining similar influence over the current results, the company wields historically Providers, control the bulk of the com- trend to centralize processing and storage on unprecedented ability to shape preferences. munications passing through cyberspace. the Web. Cloud computing providers such as Over 1 billion times every day, Google The United States has historically held the Amazon, Microsoft, and Google allow users decides what is and is not important across majority stake in this category, and until to rent storage and processing capacity on the Internet.16 That is power. recently, nearly all Internet traffic has been hosted infrastructures. While the current The struggle for control of this strategic routed through U.S.-owned infrastructure. market for this category is relatively small, point in cyberspace has already begun. For In an address to Congress in 2006, former it is an emerging aspect of cyberspace that example, China and Google have had a public Central Intelligence Agency Director will be important in the near future. As the dispute over the Chinese government’s efforts Michael Hayden acknowledged this point: market for cloud services grows, more and to censor Google’s search results within “Because of the nature of global telecom- more data will flow across the infrastructures its borders and the government’s attempts munications, we are playing with a tremen- of a handful of providers, making it a strate- to hack into Google’s infrastructure.17 In dous home-field advantage, and we need to gic concentration point in cyberspace. a demonstration of corporate soft power, exploit that edge.”20 For now, U.S. companies are the cloud Google withdrew its search services from Unfortunately, from a national security computing market leaders, but that could mainland China in 2010 and rehosted them standpoint, this situation is rapidly changing change. If it does, it could mean that an in Hong Kong. Google’s absence in mainland as information technology costs decrease increasing share of cyberspace data, includ- China opened the door for the government and the legal environment governing the ing that of U.S. citizens, could be hosted on to increase its own authority over Internet protection of electronic communications machines operating outside the boundar- searching. The state-run search engine Baidu grows more uncertain. In this environment, ies of U.S. law. The United States should became a de facto monopoly over the coun- lawmakers must be mindful of unintended encourage the development of these services try’s 400 million Internet users.18 Prior to effects as nations become increasingly within regions covered by U.S. jurisdiction. pulling its search engine out of the mainland, willing to recreate their own communica- It should incentivize U.S. cloud service Google had over 35 percent of the Chinese tions backbones to reduce the need to pass providers through both appropriate fiscal market share. As of June 2011, Google’s through U.S. infrastructure. For example, policy and continue to participate in the dispute caused them to slip to an 11 percent Congress passed the USA PATRIOT Act in governance bodies defining standards for share, while Baidu rose to over 83 percent of part to help monitor nefarious cyber activity, this emerging capability. U.S. Government the Chinese search engine market.19 but the law had the unintended consequence organizations such as the National Institute ndupress.ndu.edu issue 69, 2 nd quarter 2013 / JFQ 81 FEATURES | From Sea Power to Cyber Power of Standards and Technology (NIST) have strategic point, cryptography. The mathemat- II, provides an excellent historical case study performed well in building a foundation of ical underpinnings of cryptography provide to support this point. R.A. Ratcliff describes legitimacy and credibility in the cloud com- the foundation of security in cyberspace. If the negative consequences of decentralizing puting arena. These kinds of activities need the modern methods for securing data were the management of cryptography and how encouragement. broken, the entire economic engine of the it undermined the German war effort.24 A The fifth strategic point is governance Internet would crumble almost overnight. similar problem would arise if individual forums. Governance in cyberspace is more Fortunately, the odds of that happening are companies were left to define their own cryp- like a cultural phenomenon than a means of extremely low because of the NIST’s trans- tography standards. Cryptography also rep- control. There are many consortiums made parent process for defining cryptographic resents the elements of soft power in cyber- up of various interested parties that work standards. Since 1972, NIST, in coordination space since the government cannot dictate its together to decide the standards for com- with the National Security Agency, has been implementation outside its own networks. Yet municating in cyberspace. The Institute of instrumental in testing and certifying cryp- NIST’s open, competitive process for defin- Electrical and Electronics Engineers, Inter- tographic standards and making them avail- ing standards helps attract security conscious national Telecommunications Union, World able to the general public. A 2001 economic private entities that recognize the value of Wide Web Consortium, Internet Assigned assessment determined their efforts had such a process. Numbers Authority, and many others play improved the U.S. economy by $1.2 billion as The United States must also continue integral roles in shaping the characteristics of 2000. 23 While more recent data were not to support research and development efforts of the cyber domain. A detailed description available, given the exponential growth of into quantum computing as a subset of the of each forum and its relevance to the cyber- e-commerce, it seems clear that this number cryptography category. Quantum computers space is beyond the scope of this article, but it has grown tremendously since then. have the potential to undermine the fun- is enough to emphasize that the United States The U.S. Government has an important damental security assumptions of modern must make a concerted effort to support, role to play in this field because of the fragil- encryption. Fortunately, quantum computers participate with, and help set the direction for ity of cryptography when poor practices are currently too immature to achieve this these governing bodies. or design implementations undercut its feat, but when and if they do reach that level Another area where NIST has been theoretical foundations. Enigma, the cypher of complexity, it is in the best interest of the instrumental in exercising U.S. Government machine used by the German military to United States to be at the forefront of this soft power in cyberspace has been in the sixth encrypt communications during World War next generation of computing technology.
Deputy Secretary of Defense William J. Lynn briefed on cloud computing by Google representatives U.S. Air Force (Jerry Morrison) U.S. Air Force
82 JFQ / issue 69, 2 nd quarter 2013 ndupress.ndu.edu BARCOMB
The final strategic point, IPv6 (the next Hard power will be secondary to soft 14 “Browser, OS, Search Engine including generation standard), is associated with the power in cyberspace for the foreseeable Mobile Market Share,” Statcounter.com, available fundamental routing protocol of the Internet. future. Strategies aimed at attracting and at
ndupress.ndu.edu issue 69, 2 nd quarter 2013 / JFQ 83