The Rise of Cyber Warfare The Digital Age and American Decline Hanyu Chwe

In May 2007, unknown attackers de- advantages in cyberspace; the increasing clared cyberwar on Estonia. Estonians importance of cyberwarfare will accelerate woke up to find that the websites of their the relative decline of American military banks, newspapers, and government agen- power. cies had been systematically dismantled. This was one of the world’s first cyberwar- For the purposes of this paper, I define fare attacks; I argue that it won’t be the cyberwarfare as the use of computer pro- last. grams to attack, disrupt, destroy, disable, In the future, the amount of cyberwar- or steal anything of military, economic or fare will increase drastically. First, the in- general strategic value or e↵orts to defend creased value of cyberspace increases the against such attacks. I am not considering incentives to wage cyberwarfare. Second, industrial corporate espionage, cyber at- the logic of cyberwarfare nullifies several tacks meant to aid the use of conventional mechanisms that constrain territorial war. military force, or the use of internet media Finally, the o↵ensive advantage inherent to organize social action. In my definition, in cyberwarfare exacerbates the security cyberwarfare is not intentionally accompa- dilemma. The United States lacks many nied by corresponding actions in the real of its traditional military and economic world.

Cyberwarfare Incentives

The strategic and economic value of state needs to guard its cyberspace in order cyberspace is huge. Facebook and to ensure stability. Google were worth 200 billion dollars It’s unlikely internet reliance will de- and 400 billion dollars in 2014 respec- crease. Humanity’s relationship with the tively. (Bloomberg.com, 2014) Billions of internet changes rapidly—as new technol- people use the Internet daily, hundreds of ogy develops, more opportunities exist for billions of dollars are traded yearly (Pew companies and inventions to a↵ect our Research Centers, 2013)—cyberspace is lu- lives. For example, the rise of smart- crative. However, the value of cyberspace phones provided opportunities for dozens is limited in internet companies or transac- of new start-ups and another way for tions; almost every large organization uses humans to interact digitally. (Dougherty, the internet to communicate. (Meltzer, 2015) Finally, millions of people have yet 2014) A corporation or government can to come online. In the United States, cell- be crippled by the loss of their digi- phone usage almost doubled from 2011 to tal infrastructure from su↵ering cyberat- 2014. (Pew Research Centers, 2013) Mi- tacks, Sony was completely shut down for crosoft predicts that there will be 4 bil- four days. (Cunningham & Waxman, 2014) lion internet users by 2020, most new users Four days of no internal communication coming from developing countries. (Cyber in the American federal government would Trust Blog, 2013) As the internet popula- be a disaster. Few human activities don’t tion increases, the value of cyberspace will go through the internet: it controls every- increase even more. thing from our bank accounts to television shows, from Facebook to large swathes of Cyberspace is valuable today and will the American power grid. (Tucker, 2014) A almost certainly be more valuable tomor- The rise of Cyber Warfare 44

row.1 States need to protect their own attackers. “digital territory” in order to shield their The increasing strategic value of cy- governments, militaries, and corporations berspace does not, by itself, imply a cor- from disruption. As the value of cy- responding rise in cyberwarfare. However, berspace increases, the incentives to wage the anonymous nature of cyberwarfare re- cyberwarfare increase as well. The stakes moves three causal mechanisms that dis- have risen—states need allocate more re- courage conventional conflict. Without sources to cyberwarfare, either in hopes of these conflict-reducing e↵ects, increased hurting other states or defending against conflict becomes more likely.

No More Restrictions

Scholars have discussed multiple reasons skilled not only at hiding their identity for the current decline in conventional war- but also making it look as if someone fare. Unfortunately, three proposed expla- else was responsible”. (International Re- nations for why conflict is discouraged in lations And Security Network, 2009) At- the modern system are rendered invalid by tackers can disguise their IP addresses or cyberwarfare. “transmit their attacks through multiple First, as hegemon armed with dom- nodes of transmission” (Rattray, 2001, 66) inant conventional military force, the in order to disguise themselves or blame United States has the incentive and the other actors. It’s almost impossible for means to quash weaker states’ attempts to cyber defenders to be completely certain expand or balance against it. (Wohlforth, about an attacker’s identity—even if the 1999) It is possible that the threat of evidence clearly points to one actor, it American retaliation and intervention has may just be an attempt to shift blame prevented dozens of potential armed con- by a sophisticated attacker. Gregory Rat- flicts. Second, nuclear deterrence discour- tray adds, “Depending on the sophistica- ages war. The threat of mutually as- tion of the attacker, it’s possible to leave sured destruction prevented conventional the defender unsure if an attack actually warfare during the Cold War. Third, in- occurred”. (Rattray, 2001) The ability for creased economic interdependence makes attackers to completely disguise themselves economic costs from war too high—the cur- completely topples conventional security rent system of global trade is so intertwined logics. that few countries would gain from conflict. Actors can attack in cyberspace with- Any one of these factors, or more likely a out fearing retaliation. Without knowing combination, may drastically reduce con- the attacker’s identity, the United States flict in the modern era. However, these ob- can’t intervene. Similarly, if states don’t stacles simply don’t apply to cyberwarfare. know the identity of their attacker, nu- clear deterrence is useless. It would be For the first time in history, it irresponsible to threaten nuclear reprisal is possible for a state to weather at- over cyberattacks when it is so dicult to tacks that damage their military, eco- accurately determine the identity of the nomic, or industrial infrastructures and attacker. Even if the identity of the at- not be able to confidently determine tacker seems obvious, it’s impossible to the identity of their attacker. James completely rule out the possibility of an- Lewis states, “Identity is easily concealed other actor shifting blame onto an innocent in cyberspace...sophisticated attackers are party. Finally, in cyberwarfare, a state can 1Iwouldarguethatthevalueofphysicalspaceisdecreasingaswell.Afull-fledgedexplanation is outside the scope (and word count) of this paper, but the decreased value of physical territory also increases the value of cyberspace. 45 Hanyu Chwe

attack another state and trade with it at By itself, the increased value of cy- the same time. States can engage in cyber- berspace and the increased ease of con- warfare without risking losses from trade; flict doesn’t guarantee more cyberwarfare. defending states wouldn’t know with whom However, due to the o↵ensive advantage of they should stop trading. Cyberwarfare cyberwarfare, the security dilemma in cy- doesn’t invalidate all possible reasons for berspace is greatly exacerbated. Even if the reduction of conflict, but it completely states don’t intend to wage o↵ensive cyber- dismantles three major ones. warfare, it is dicult for states to escape the security dilemma.

O↵ensive Advantage and the Security Dilemma

The security dilemma states that when protect thousands of nodes in a network; states attempt to increase their security, attackers need only to gain access through they almost always inadvertently threaten one. Accordingly, the amount of code other states. This causes other states to needed to construct defense towers over attempt to increase their own security, ul- the few hundred lines of code needed to timately decreasing security for the first conduct an attack. (Singer & Friedman, state and increasing the likelihood of con- 2014) Defensive programs cost more time, flict. There are two variables that tend money, and e↵ort. Not only is it easy to exacerbate or ameliorate the security to find holes in opponents’ defenses, but dilemma. the locations of those vulnerabilities is eas- First, the relative advantage of of- ily disseminated, making it easy for even fensive weapons, tactics, and strategies unsophisticated attackers: Rattray says, over their defensive equivalents exacerbates “Widely used products contain vulnerabil- the security dilemma. Robert Jervis ex- ities to digital disruption that are easily plains that when o↵ensive advantage ex- identified...the tools and techniques to ex- ists, even status-quo states “must then ploit them are quickly disseminated among act like aggressors; the fact that they potential attackers”. (Rattray, 2001, 470) would gladly agree to forego the oppor- Finally, o↵ensive advantage is bolstered tunity for expansion in return for guaran- by the rapidly changing nature of cyber tees for their security has no implications weapons. It’s easy for attackers to de- for their behavior”. (Jervis, 1978, 87) In sign new weapons; when a government a world with o↵ensive advantage, it is dif- agency or corporation designs an e↵ective ficult for states to defend themselves; the counter to one o↵ensive technique, several best way to maintain security is to attack. more weapons can be created. David T. Clearly, this greatly exacerbates the secu- Fahrenkrug says, “The current o↵ensive rity dilemma—if states are more likely to advantage results from the ability to ma- attack than defend, any perceived increase neuver against a network combined with in military power is extremely dangerous. rapidly adaptive tools to attack networks Furthermore, the expectation of easy vic- and information”. (Czosseck, 2012) O↵ense tory increases the incentives for o↵ensive is more e↵ective, easier, and cheaper. war. Perception of o↵ensive advantage is ar- In cyberspace, o↵ense has a clear ad- guably more important than the actual ex- vantage. According to Robert Ghanea- istence of o↵ensive advantage. After all, Hercock, “O↵ense is favored over de- states act according to their perceptions of fense. . . since only a single point of fail- the world, not necessarily the real world. ure in a cyber network, or process, is re- Major actors still believe that o↵ensive has quired for a successful attack”. (Ghanea- the advantage. In 2010, when describing Hercock, 2012) Cyber defenders need to the Pentagon’s new cyberdefense strategy, The rise of Cyber Warfare 46

the U.S. Deputy Secretary of Defense made them—it’s impossible to di↵erentiate be- clear that “In cyberspace, the o↵ense has tween “o↵ensive” and “defensive” cyber- the upper hand”. (Lynn, 2010) Conven- soldiers. Computers can be used for both tional wisdom favors the o↵ensive in cy- o↵ensive and defensive maneuvers. There berspace. is no meaningful distinction. The na- ture of the security dilemma makes cy- The second variable that impacts the berspace conflict more likely. In an o↵ense- security dilemma is the perceivable dif- dominated world with no distinction be- ferentiation between o↵ense and defensive tween o↵ense and defense, even status-quo weapons or postures. If a state can see states are likely to resort to aggression and that other states are increasing their se- cyberattacks. curity through defensive means, it is less In the 21st century, actors have the likely to feel threatened. The more dif- incentive and the means to increase cy- ferentiation, the more informations states berwarfare: the value of cyberspace will have about other states’ intentions. increase, providing incentives for o↵en- Unfortunately, it is impossible to dif- sive cyberwarfare, and several mechanisms ferentiate o↵ensive cyberwarfare from de- that have traditionally constrained conflict fensive cyberwarfare. Investment in cyber won’t apply, giving actors the opportunity warfare simply cannot be divided into of- to wage war. Even status quo actors will fense and defense. Both involve investment be unable to escape the security dilemma, in trained personnel and powerful comput- causing more conflict. In a future char- ers. Personnel trained in cyber defense acterized by increased cyberwarfare, the need to be intimately familiar with meth- United States loses several key advantages. ods of attack in order to defend against

American Loss

The United States loses its advantageous won’t dissuade cyberattacks. In cy- geographical position. The Atlantic and berspace, all countries are neighbors —the Pacific oceans form natural lines of defense United States’ threat level will increase, for the United States and make conven- sparking increased balancing against the tional land attacks dicult. The United United States. States’ two neighbors have never posed Additionally, the United States’ diplo- substantial military threats, easing the matic advantage will be mitigated. More path to regional hegemony. Furthermore, than any other state in the system, the the United States’ relative isolation enables United States benefits from a large net- it to possess substantial power without be- work of formal and informal military al- ing incredibly threatening. Since a state’s liances. However, since cyberwarfare con- capacity to project power declines over fuses traditional definitions of war, the distance, far o↵ powerful states become United States cannot rely heavily on al- less threatening than weaker neighboring liances like NATO for support. For exam- states. If states do balance against threat ple, it’s unclear whether a cyberattack on and not necessarily power, as Stephen Walt the United States would trigger NATO’s surmises, then the United States is able to collective security clause. Allies of the enjoy substantial military capacities with- United States could shirk their responsi- out threatening other states and provoking bilities to the United States, arguing that balancing. (Walt, 1985) cyberattacks do not constitute war. As Unfortunately for the United States, cyberwarfare becomes more common, 20th physical geography is irrelevant in cy- century organizations have to adjust for a berspace. The United States’ “moats” 21st century world. Traditional military al- 47 Hanyu Chwe

liances are less e↵ective. digital attacks require relatively little ca- Furthermore, because of the nature of pacity in terms of commercially available cyberwarfare, the United States’ economic computational power, storage space, and and military advantages are diminished. transmission capacity”. (Kennedy, 1987, In this case, the disadvantaging e↵ect of 138) Cyber conflict privileges quality of cyberwarfare does not apply only to the programming, not necessarily industrial United States, but all conventionally pow- strength and material wealth. Individ- erful states. First, more technologically ual programmers with outdated comput- developed states are inherently more vul- ers can wreak havoc. Rattray explains, nerable in cyberwarfare. Large developed “Some of the most disruptive viruses un- countries have more electronic infrastruc- leashed in the early 1990s were produced ture to defend; the larger your network, the by students using computers with 286 pro- more vulnerabilities you present to your at- cessors at a technical high school in Bul- tacker. Stronger actors have more to lose garia”. (Kennedy, 1987, 138) than weaker actors do in cyberwarfare. In the same way, the number of soldiers The United States is “the society most are less important in cyber conflict. Train- reliant on its information systems and in- ing and creativity trumps quantity of com- frastructures”. (Rattray, 2001, 8) Accord- batants. The infiltrators of Rome Labora- ing to Pentagon ocials, “massive net- tory, the R&D lab and technological heart working makes the U.S. the world’s most of the United States Air Force, turned vulnerable target for information warfare... out to be a lone teenager armed with The U.S. has orders of magnitude more to a home computer. (Kennedy, 1987, 138) lose from information warfare than its com- Rattray mentions that “Human expertise petitors”. (Clapper, 1997) Not only does and organizational coordination will likely the United States more vulnerable to at- prove the constraining factors in planning tacks, but it also risks more when attack- and execution of strategic information war- ing—because American cyber infrastruc- fare attacks, not availability of hardware ture is so large, American cyber attacks and software tools”. (Kennedy, 1987, 138) can cause collateral damage to American The main quantitative constraint in cy- digital infrastructure. (Rattray, 2001, 191) berwarfare is the accumulation of enough If the USA engages in sustained cyberwar- trained individuals: “personnel shortages fare, it simply has more to lose than any and changing skill requirements consti- other actor in the system. tute a major barrier to successful informa- Second, the United States’ great indus- tion technology assimilation in the United trial and population advantage is dimin- States and elsewhere”. (Kennedy, 1987, ished. Political historians often use indus- 178) To be sure, large industrial capac- trial capacity and population to measure ity and population don’t hurt the United power—Paul Kennedy uses industrial and States—in fact, because of its large, well- population measures to determine great educated population, the United States power status in The Rise and Fall of the is more likely to produce talented hack- Great Powers.(Kennedy,1987)Thehuge ers—but in cyberwarfare, they’re much less industrial capacity of the United States important than they used to be. contributes to its status as hegemon. In In part because of the low quantita- cyberspace, however, industry and popula- tive requirements, the cost to enter cyber- tion are much less important. warfare is low. Rattray writes, “The cost In conventional warfare, the number of of acquiring the necessary means [for dig- tanks or planes a state possesses is a good ital attacks] is low, especially in relation indicator of its military power. In cyber- to conventional forces and most WMD al- warfare, the number of computers doesn’t ternatives. A much wider range of ac- matter: “The tools and techniques used for tors can consider employing such a form The rise of Cyber Warfare 48

of warfare”. (Kennedy, 1987, 469) This di- ritory” is an another avenue for attack. In minishes the relative military advantage order to e↵ectively protect such an area, of the United States. Although highly- the space needs to be completely isolated, trained individuals are important, even a rendering it e↵ectively useless. Without modicum of skill gives actors the ability to the ability to completely secure spaces in wage cyberwarfare: “acquiring the techni- cyberspace, powerful actors lose another cal knowledge to conduct digital warfare advantage. has become increasingly easy”. (Kennedy, Some of the United States’ advantages 1987, 190) Cyberspace is the great level- will translate beautifully into cyberwar- ing ground; actors without large popula- fare. The United States is the most techno- tions or industrial might can wield undue logically advanced country in the world. It influence. Because so many weak actors houses the vast majority of the world’s top can participate in cyberwarfare, the United technical universities and internet compa- States’ relative military strength declines. nies. Those universities and companies are Finally, it will be dicult for the a major producer of top-level cyberwarfare United States to completely control certain talent. regions of cyberspace. In territorial con- The high skill level of the United flict, strong countries can attempt to se- States’ cyberwarriors ensures that United cure strategically important areas in order States will be the strongest state in cy- to protect vulnerabilities or maintain prime berspace, However, due to the United attacking position. The United States can States’ disadvantages, it is unlikely that secure its borders or control the “com- the United States will enjoy dominance in mons”— the sea, air, or space. (Posen, cyberspace to the same degree that it does 2003) However, it’s impossible to com- in real space. The United States is a con- pletely protect “space” in cyberspace. Any ventional military hegemon; it will not be connection in and out of a cyberspace “ter- a military hegemon in cyberspace.

Conclusion

As seen above, states have two di↵er- ent military capacities; cyberspace military power and conventional military power. As This paper predicts rampant cyber- cyberwarfare assumes a higher proportion warfare and a United States with dimin- of all conflicts, states’ cyberspace militaries ished cyberwarfare capabilities. However, will begin to matter more than conven- the continually changing nature of cy- tional militaries. This won’t make Amer- berspace makes prediction particularly dif- ica’s conventional military edge completely ficult. Technological advances might re- irrelevant;2 however, the United State’s move anonymity and ensure e↵ective retal- overall military dominance will diminish. iation. Internet predictions must consider Although the United States will still be the possibility of rapid change. Still, given the strongest state in the system, it will present facts, increased conflict seems cer- no longer enjoy military hegemonic status. tain.

2In fact, it might be the case that the United States’ overwhelming conventional military dom- inance discourages conventional war, thereby encouraging increased cyberwarfare. 49 Hanyu Chwe

References

Bloomberg.com. 2014. Facebook Valuation Tops $200 Billion. Bloomberg, September.

Clapper, James R. 1997. Seminar on Intelligence, Command, and Control. Cambridge, MA: Program on Information Resources Policy, Harvard U, Center for Information Policy Research.

Cunningham, Todd, & Waxman, Sharon. 2014. Sony Struggles to Fight #GOP Hackers Who Claim Stolen Data Includes Stars’ IDs, Budget and Contract Figures. TheWrap, November.

Cyber Trust Blog. 2013. Linking Cybersecurity Policy and Performance: Microsoft Re- leases Special Edition Security Intelligence Report. Cyber Trust Blog, February.

Czosseck, Christian. 2012. Countering the O↵ensive Advantage in Cyberspace: An Inte- grated Defensive Strategy. 2012 4th International Conference on Cyber Conflict.

Dougherty, Conor. 2015. Start-Ups Try to Challenge Google, at Least on Mobile Search. New York Times,May.

Ghanea-Hercock, Robert. 2012. Why Cyber Security Is Hard. Georgetown Journal of International A↵airs,81–89.

International Relations And Security Network. 2009. Discouraging Deterrence. Interna- tional Relations And Security Network, November.

Jervis, Robert. 1978. Cooperation under the Security Dilemma. World Politics, 30(2), 167–214.

Kennedy, Paul M. 1987. The Rise and Fall of the Great Powers: Economic Change and Military Conflict from 1500 to 2000. New York, NY: Random House.

Lynn, William J. 2010. Defending a New Domain. Foreign A↵airs, September.

Meltzer, Joshua. 2014. Supporting the Internet as a Platform for International Trade. Global Economy and Development at Brookings, February.

Pew Research Centers. 2013. Device Ownership Over Time. Pew Research Centers Internet American Life Project RSS, November.

Posen, Barry R. 2003. Command of the Commons: The Military Foundation of U.S. Hegemony. International Security, 28(1), 5–46.

Rattray, Gregory J. 2001. Strategic Warfare in Cyberspace. Cambridge, MA: MIT.

Singer, P.W., & Friedman, Allan. 2014. Cybersecurity and Cyberwar: What Everyone Needs to Know.

Tucker, Patrick. 2014. Forget the Sony Hack, This Could Be the Biggest Cyber Attack Yet. Quartz, December.

Walt, Stephen M. 1985. Alliance Formation and the Balance of World Power. International Security, 9(4), 3–43.

Wohlforth, William C. 1999. The Stability of a Unipolar World. International Security, 24(1), 5–41.