NAVAL POSTGRADUATE SCHOOL MONTEREY, CALIFORNIA CYBER ANALOGIES Edited by Emily O. Goldman and John Arquilla February 28, 2014 Approved for public release; distribution is unlimited. THIS PAGE INTENTIONALLY LEFT BLANK Form Approved REPORT DOCUMENTATION PAGE OMB No. 0704-0188 Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing this collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS. 1. REPORT DATE (DD-MM-YYYY) 2. REPORT TYPE 3. DATES COVERED (From-To) 28-02-2014 Technical Report 2013-2014 4. TITLE AND SUBTITLE 5a. CONTRACT NUMBER Cyber Analogies 5b. GRANT NUMBER 5c. PROGRAM ELEMENT NUMBER 6. AUTHOR(S) 5d. PROJECT NUMBER Editors: Emily Goldman and John Arquilla 5e. TASK NUMBER 5f. WORK UNIT NUMBER 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) AND ADDRESS(ES) 8. PERFORMING Department of Defense Analysis ORGANIZATION REPORT Naval Postgraduate School, NUMBER Monterey, CA 93943 9. SPONSORING / MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSOR/MONITOR’S ACRONYM(S) US Cyber Command 9800 Savage Road Fort Meade, MD 20755 11. SPONSOR/MONITOR’S REPORT NUMBER(S) 12. DISTRIBUTION / AVAILABILITY STATEMENT Approved for Public release; distribution is unlimited 13. SUPPLEMENTARY NOTES 14. ABSTRACT This anthology of cyber analogies will resonate with readers whose duties call for them to set strategies to protect the virtual domain and determine the policies that govern it. Our belief it that learning is most effective when concepts under consideration can be aligned with already-existing understanding or knowledge. Cyber issues are inherently tough to explain in layman’s terms. The future is always open and undetermined, and the numbers of actors and the complexity of their relations are too great to give definitive guidance about future developments. In this report, historical analogies, carefully developed and properly applied, help indicate a direction for action by reducing complexity and making the future at least cognately manageable. 15. SUBJECT TERMS Cyber analogies, Cyber, US Cybercom, Cyber Pearl Harbor, Cyber warfare, Cyber security 16. SECURITY CLASSIFICATION OF: 17. LIMITATION 18. NUMBER 19a. NAME OF a. REPORT b. ABSTRACT c. THIS PAGE OF ABSTRACT OF PAGES RESPONSIBLE PERSON Dr. John Arquilla Unclassified Unclassified Unclassified UU 132 19b. TELEPHONE NUMBER (include area code) 831-656-2097 Standard Form 298 (Rev. 8-98) Prescribed by ANSI Std. Z39.18 i THIS PAGE INTENTIONALLY LEFT BLANK ii NAVAL POSTGRADUATE SCHOOL Monterey, California 93943-5000 Ronald A. Route Douglas A. Hensler President Provost The report entitled “Cyber Analogies” was prepared for U.S. Cyber Command, 9800 Savage Road, Fort Meade, MD 20755 and funded by the department of Defense Analysis at the Naval Postgraduate School. Further distribution of all or part of this report is authorized. This report was prepared by: Emily Goldman John Arquilla Senior Advisor, U.S Cyber Command Chair, Defense Analysis Reviewed by: Released by: John Arquilla Jeffrey D. Paduan Chairman Dean of Research Department of Defense Analysis iii THIS PAGE INTENTIONALLY LEFT BLANK iv ABSTRACT This anthology of cyber analogies will resonate with readers whose duties call for them to set strategies to protect the virtual domain and determine the policies that govern it. Our belief is that learning is most effective when the concepts under consideration can be aligned with already-existing understanding or knowledge. Cyber issues are inherently tough to explain in layman’s terms. The future is always open and undetermined, and the number of actors and the complexity of their relations are too great to give definitive guidance about future developments. In this report, historical analogies, carefully developed and properly applied, help indicate a direction for action by reducing complexity and making the future at least cognitively manageable. v THIS PAGE INTENTIONALLY LEFT BLANK vi This Technical Report was sponsored by United States Cyber Command, and produced under the aegis of the Department of Defense Information Operations Center for Research at the Naval Postgraduate School. The views expressed herein are those of the contributors. For reprint permissions or copies, please contact: Rebecca Lorentz, Administrator DoD IO Center for Research Naval Postgraduate School 589 Dyer Road, Room 102 Monterey, CA 93943 [email protected] 831.656.7788 Technical Report: NPS-DA-14-001 TABLE OF CONTENTS 1 Introduction Emily O. Goldman & John Arquilla 7 The Cyber Pearl Harbor James J. Wirtz 15 Applying the Historical Lessons of Surprise Attack to the Cyber Domain: The Example of the United Kingdom Dr Michael S. Goodman 26 The Cyber Pearl Harbor Analogy: An Attacker’s Perspective Emily O. Goldman, John Surdu, & Michael Warner 33 “When the Urgency of Time and Circumstances Clearly Does Not Permit...”: Redelegation in Nuclear and Cyber Scenarios Peter Feaver & Kenneth Geers 46 Comparing Airpower and Cyberpower Dr. Gregory Rattray 64 Active Cyber Defense: Applying Air Defense to the Cyber Domain Dorothy E. Denning & Bradley J. Strawser 76 The Strategy of Economic Warfare: A Historical Case Study and Possible Analogy to Contemporary Cyber Warfare Nicholas A. Lambert 90 Silicon Valley: Metaphor for Cybersecurity, Key to Understanding Innovation War John Kao 96 The Offense-Defense Balance and Cyber Warfare Keir Lieber 108 A Repertory of Cyber Analogies Robert Axelrod 118 About the Contributors 119 About the Editors Introduction Introduction e Cyber Analogies Project was launched in to assist U.S. Cyber Command in identifying and developing relevant histori- cal, economic, and other useful metaphors that could be used to enrich the discourse about cyber strategy, doctrine, and policy. e intent of the project is to provide useful insights, both for those with little technical background in or direct connection to cyberwar and cyber security and for those whose job it is to think about the spectrum of cyber-related issues every day. e project was conceived and carried out to help very senior, busy, responsible people understand topics and issues that are fast-moving and dynamic, and have potentially great consequences for society, security, and world aairs. e President has identied the cyber security threat as one of e cyber threat continues to evolve swiftly. ings we the most serious we face as a nation. Events in cyberspace con- value—personal wealth, national economic prosperity, in- tinue to accelerate, as both nation-states and non-state actors tellectual property, national security secrets—are all targets. seek to exploit asymmetrical advantages in this virtual domain. More and more, these treasures reside in or depend upon e risks and costs of failing to act skillfully and eectively are cyberspace—the new battleground or, in Pentagon parlance, likely to be widespread, cascading, and almost surely highly the “warghting domain where adversaries are already operat- disruptive. Many small-scale attacks can be—and are being— ing.” Ability to keep pace with the cyber evolutionary curve, prevented; but a major, mass-disruptive attack is a growing or perhaps to stay a step ahead of those who wish to do harm, possibility against which current defenses are inadequate. depends on the ability to visualize how to ght in this new domain, just as strategists from earlier eras had to imagine how operating in the air, or with nuclear weapons, changed ere are several reasons for saying this. First, the nation’s military aairs. Analogies drawn from earlier eras and dier- cyber architecture relies on a multitude of asset types, congu- ent disciplines have the potential to help with visualization, rations of those assets, and multiple organizations pursuing allowing us to think through new or dicult subjects. ey strategies and policies—not always in concert. Second, there oer us an inductive approach to developing an understand- is no shared situational awareness across all networks, the ing of high-level conceptual and operational issues related to absence of which minimizes chances of detecting adversarial cyber security and cyber warfare. Scrutiny of historical cases, activities. ird, the authorities, policies, rules of engagement, which makes up much of this anthology, can at the very least and division of eort to act in defense of cyberspace are not lead to identication of similar problems and ways to address fully articulated, implemented, or even properly delegated. them—that either “worked” or did not. No historical example Fourth, there are insucient trained and ready forces to act. provides a perfect t for current challenges, so any analogy Fifth, the information systems architecture has been built for must be carefully developed and not used in isolation. Still, availability, functionality, and ease of use, with considerations historical analogizing is essential to the learning process. As of security all too often an afterthought. Sixth, commercial H.G. Wells put it, “History is a race between education and rms in the private sector are reluctant to divulge penetra- catastrophe.” tions, as this would acknowledge vulnerability and possibly cause a loss of customer and shareholder condence. Finally, and most closely related to the military sphere, cyberwar has SURPRISE ATTACK not yet been fully integrated into more traditional concepts e primarily history-based analogies contained herein begin of operations. ese gaps increase vulnerability to malicious with a re-examination of Pearl Harbor. Teasing out implica- 1 .