Aviation electronics technician 3rd class conducts maintenance on aircraft targeting systems in aircraft intermediate maintenance department maintenance shop on USS Ronald Reagan, Philippine Sea, July 25, 2020 (U.S. Navy/Jason Tarleton) principles for shows of force, deter- Differentiating rence, proportionality, and rules for warfare that rely on predictable and repeatable characteristics of the physical weapons employed. The advent of cyber Kinetic and Cyber warfare in the modern era, however, has illustrated that the assumptions used for the employment of kinetic weapons Weapons to Improve do not necessarily apply to the employ- ment of cyber capabilities. For example, unlike a physical missile or bomb, it is Integrated Combat difficult to predict the precise effects, measure the resulting proportionality, or estimate the collateral effects atten- By Josiah Dykstra, Chris Inglis, and Thomas S. Walcott dant to the use of a computer virus. As we discuss, the differences between kinetic weapons and cyber weapons arfare, with a history as old are discernible, manageable, and have as humanity itself, has been far-reaching implications for strate- Dr. Josiah Dykstra is a Technical Fellow in the predominantly conducted gic military doctrine, planning, and Cybersecurity Collaboration Center at the National W Security Agency. Chris Inglis is the Robert and through the application of physical operational employment in both power Mary M. Looker Professor in Cyber Security Studies force to disrupt, degrade, or destroy projection and defense. at the U.S. Naval Academy. Thomas S. Walcott is the Technical Director in the Cyber National physical assets. That long history has In order to wage and win modern Mission Force at U.S. Cyber Command. led to well-developed doctrine and conflict, the attributes of kinetic and 116 Features / Differentiating Kinetic and Cyber Weapons JFQ 99, 4th Quarter 2020 cyber weapons must be fully understood • Is it possible to limit the weapon’s that are grouped as differences in weap- singly and in combination. To date, dis- effects to those desired with accept- ons characteristics, targeting, and policy cussion and debate about the attributes able impact to innocent parties and and practice between cyber weapons and of cyber weapons have focused on a few assets? their kinetic counterparts. The table sum- basic characteristics, such as perishabil- • Will the use of the weapon contrib- marizes these differences. ity—that is, making it difficult to achieve ute to, or risk undermining, stability, the same precision, let alone confidence, the ability of the employing organi- Differences in Weapons that typically results from the use of ki- zation to manage escalation, and/ Characteristics netic weapons. For military leaders, and or other desired characteristics of Many discussions about cyber weapons the policymakers who determine the pur- adversary engagement? have focused on the basic attributes of poses and applications of military power, the cyber domain, such as the global The answers to these questions depend, the differences between kinetic and cyber interconnected network; the highly fluid in part, not only on situational factors weapons prompt a reevaluation of how interplay of its constituent components but also on a firm understanding of these individuals employ weapons and of hardware, software, and configura- weapon nuances. We draw out those measure their effectiveness, which foun- tion; and the resulting fragility of access details in the following sections. dationally relies on a clear articulation of paths needed by cyber operators to To frame the discussion, we must differences and similarities between the reach their intended targets. Contem- consider the weapons’ definitions. kinetic and cyber environments. We pro- porary discussions of cyber weapons Unfortunately, the Department of pose and describe a strategic framework, have also explored their high degree of Defense (DOD) does not explicitly define though not exhaustive, that could be perishability and rapid obsolescence.5 weapon in doctrine, though DOD does applied to any instrument of power em- These traits are becoming commonly use the word within other definitions. We ployed by a nation-state; we then describe understood today but are alone insuffi- start, therefore, with a dictionary defini- distinctions between kinetic and cyber cient to allow for a comparison of cyber tion for weapon as “an instrument of any weapons to draw out both differences and kinetic weapons. The additional kind used in warfare or in combat to at- and strategic implications. differences below can aid tactical and tack and overcome an enemy.”2 Notably, This article compares instruments of strategic thinking. weapons are traditionally employed to offensive kinetic and cyber power across Kinetic weapons typically gener- create both lethal and nonlethal effects. three key areas: weapons characteristics, ate access and effect (by force) nearly Joint Publication (JP) 3-12, Cyberspace targeting, and policy/practice.1 These instantaneously, while cyber weapons Operations, defines cyberspace capability as thematic categories emerged as we identi- necessarily separate access and effect into “a device or computer program, including fied 18 individual differences between two distinct actions, often divided by any combination of software, firmware, or kinetic and cyber weapons. The weapons a significant expanse of time (in some hardware, designed to create an effect in characteristics category includes differ- cases, cyber access is developed weeks or through cyberspace.”3 For the purposes ences in the inherent properties of the or months in advance of the intended of this discussion, we consider a cyberspace weapons as well as in the effects they can effect). In the Joint Operational Access capability distinct from (yet predicated deliver. The targeting category highlights Concept, the phrase operational access is on) some mechanism that enables access divergences in how the weapon influences defined as “the ability to project military to the system within which the intended target selection and pursuit. The policy force into an operational area with suf- effect will be achieved. JP 3-0, Joint and practice category covers differences ficient freedom of action to accomplish Operations, acknowledges that cyberspace in the current environment and maturity the mission.”6 Kinetic weapons can pro- attack is one capability that could create of the weapons. duce such access for force projection and nonlethal effects; other examples include As we unpack these areas, military provide antiaccess and area denial against electronic attack, military information sup- leaders should keep in mind three fram- opposing forces. Cyber weapons typically port operations, and nonlethal weapons. ing questions that can help guide the separate access from effect, and they often The military action known as fires, states selection and application of any weapon require a significant effort to construct JP 3-0, is to “use available weapons and and that apply equally well to kinetic and access tailored to the given target and other systems to create a specific effect on cyber: its environment. For example, denial- a target.”4 Cyberspace attack actions are a of-service attacks leverage the access Is the weapon able to achieve the form of fires and “create noticeable denial • provided by a path from the aggressor desired effect within the constraints effects (that is, degradation, disruption, or to functioning networks. Data destruc- of time available for planning and destruction) in cyberspace or manipulation tion attacks control access provided by execution, the professional skills of that leads to denial effects in the physical another means, such as remote exploita- the human operators, and materiel domains.” tion or social engineering, but the key to resources? In the following sections we intro- their success remains an access path from duce and differentiate 18 characteristics the attacker to the intended target. The JFQ 99, 4th Quarter 2020 Dykstra, Inglis, and Walcott 117 Gunner and cannon crewmember, assigned to Chaos Battery, 4th Battalion, 319th Airborne Field Artillery Regiment, 173rd Airborne Brigade, dials in target of M777 Howitzer during live-fire exercise as part of Saber Junction 19, at 7th Army Training Command’s Grafenwoehr Training Area, Germany, September 11, 2019 (U.S. Army/Thomas Mort) implication is that cyber weapons require correct decryption key. Indeed, ransom- be observed and copied using playback significant tailoring, prepositioning, and/ ware relies on reversibility in order to be capabilities of digital systems designed or bundling with a target-specific, access- effective; demonstration of the capability to monitor the flow and storage of data creating capability. to deny access and the subject’s belief and software, even if it requires the cyber Kinetic weapons almost always pro- that it can be undone are the predicate attack to highlight the significance of duce irreversible physical effects, whereas to the victim’s willingness to pay ransom. a recorded session. The result is a high cyber weapons can produce completely Importantly, reversibility can be an asset likelihood that the cyber weapon will be reversible effects. Although a small frac- or limitation of cyber weapons, depend- copied intact and studied by an adversary, tion of weapons (for example, rubber ing on the objective of their use.7 even if the capture itself is after the attack. bullets) can deliver