Calhoun: The NPS Institutional Archive DSpace Repository Theses and Dissertations 1. Thesis and Dissertation Collection, all items 2018-12 BITS AND BULLETS: CYBER WARFARE IN MILITARY OPERATIONS Deterding, Stephen L.; Safko, Blake Monterey, CA; Naval Postgraduate School http://hdl.handle.net/10945/61347 Downloaded from NPS Archive: Calhoun NAVAL POSTGRADUATE SCHOOL MONTEREY, CALIFORNIA THESIS BITS AND BULLETS: CYBER WARFARE IN MILITARY OPERATIONS by Stephen L. Deterding and Blake Safko December 2018 Thesis Advisor: John J. Arquilla Second Reader: Ryan Maness Approved for public release. Distribution is unlimited. THIS PAGE INTENTIONALLY LEFT BLANK Form Approved OMB REPORT DOCUMENTATION PAGE No. 0704-0188 Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instruction, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188) Washington, DC 20503. 1. AGENCY USE ONLY 2. REPORT DATE 3. REPORT TYPE AND DATES COVERED (Leave blank) December 2018 Master's thesis 4. TITLE AND SUBTITLE 5. FUNDING NUMBERS BITS AND BULLETS: CYBER WARFARE IN MILITARY OPERATIONS 6. AUTHOR(S) Stephen L. Deterding and Blake Safko 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING Naval Postgraduate School ORGANIZATION REPORT Monterey, CA 93943-5000 NUMBER 9. SPONSORING / MONITORING AGENCY NAME(S) AND 10. SPONSORING / ADDRESS(ES) MONITORING AGENCY N/A REPORT NUMBER 11. SUPPLEMENTARY NOTES The views expressed in this thesis are those of the author and do not reflect the official policy or position of the Department of Defense or the U.S. Government. 12a. DISTRIBUTION / AVAILABILITY STATEMENT 12b. DISTRIBUTION CODE Approved for public release. Distribution is unlimited. A 13. ABSTRACT (maximum 200 words) Experts have been predicting the onset of cyber warfare for decades. Yet, despite the relative ease and anonymity with which cyber-attacks can be conducted on military targets, the preponderance of historical cyber-related actions has been largely confined to the realms of espionage and crime. So far, close integration of cyberspace operations with terrestrial military operations is a rare, if slightly growing, occurrence in warfare. While discussions about cyber warfare have raged in academia and government in recent years, they have primarily focused on the impacts and implications that cyberspace operations have at the strategic level of war. Comparatively little research has been done to analyze how cyberspace operations will impact the battlefield. We propose a framework for military planners to envision ways that cyberspace operations can be used to affect the battlefield and integrate with terrestrial combat operations. We then apply that framework to analyze a thought experiment involving a hypothetical conflict on the Korean peninsula in an attempt to catch a glimpse of what cyberspace operations may mean for the future of land warfare. 14. SUBJECT TERMS 15. NUMBER OF cyber, Internet, cyber-war, MDB, CYBERCOM PAGES 87 16. PRICE CODE 17. SECURITY 18. SECURITY 19. SECURITY 20. LIMITATION OF CLASSIFICATION OF CLASSIFICATION OF THIS CLASSIFICATION OF ABSTRACT REPORT PAGE ABSTRACT Unclassified Unclassified Unclassified UU NSN 7540-01-280-5500 Standard Form 298 (Rev. 2-89) Prescribed by ANSI Std. 239-18 i THIS PAGE INTENTIONALLY LEFT BLANK ii Approved for public release. Distribution is unlimited. BITS AND BULLETS: CYBER WARFARE IN MILITARY OPERATIONS Stephen L. Deterding Major, United States Army BS, University of Central Missouri, 2007 Blake Safko Major, United States Army BA, The Citadel, 2007 Submitted in partial fulfillment of the requirements for the degrees of MASTER OF SCIENCE IN DEFENSE ANALYSIS (IRREGULAR WARFARE) and MASTER OF SCIENCE IN INFORMATION STRATEGY AND POLITICAL WARFARE from the NAVAL POSTGRADUATE SCHOOL December 2018 Approved by: John J. Arquilla Advisor Ryan Maness Second Reader John J. Arquilla Chair, Department of Defense Analysis iii THIS PAGE INTENTIONALLY LEFT BLANK iv ABSTRACT Experts have been predicting the onset of cyber warfare for decades. Yet, despite the relative ease and anonymity with which cyber-attacks can be conducted on military targets, the preponderance of historical cyber-related actions has been largely confined to the realms of espionage and crime. So far, close integration of cyberspace operations with terrestrial military operations is a rare, if slightly growing, occurrence in warfare. While discussions about cyber warfare have raged in academia and government in recent years, they have primarily focused on the impacts and implications that cyberspace operations have at the strategic level of war. Comparatively little research has been done to analyze how cyberspace operations will impact the battlefield. We propose a framework for military planners to envision ways that cyberspace operations can be used to affect the battlefield and integrate with terrestrial combat operations. We then apply that framework to analyze a thought experiment involving a hypothetical conflict on the Korean peninsula in an attempt to catch a glimpse of what cyberspace operations may mean for the future of land warfare. v THIS PAGE INTENTIONALLY LEFT BLANK vi TABLE OF CONTENTS I. THE GROWING IMPORTANCE OF CYBERSPACE ON THE MODERN BATTLEFIELD ..................................................................................1 A. INTRODUCTION......................................................................................1 B. RESEARCH QUESTION .........................................................................4 C. METHODOLOGY ....................................................................................5 II. INVESTIGATING CYBER AND ITS EFFECTS ON THE BATTLEFIELD .....................................................................................................7 A. WHAT IS CYBER? ...................................................................................7 B. WHAT ARE THE BATTLEFIELD EFFECTS OF “CYBER”? ........10 C. BUILDING A CONCEPTUAL FRAMEWORK ..................................13 D. CONCLUSIONS FROM THE LITERATURE REVIEW ..................15 III. THOUGHT EXPERIMENT—PART I .............................................................17 A. INTRODUCTION....................................................................................17 B. WHAT IS THE DODIN? ........................................................................17 1. How Dependent Are U.S. Land Forces on the DODIN? ..........18 2. How Vulnerable Is the DODIN to Attack? ................................19 C. HOW DO BATTLEFIELD CYBERSPACE OPERATIONS IMPACT LAND FORCES? A KOREAN SCENARIO PART 1 ........23 D. CONCLUSION ........................................................................................29 IV. THOUGHT EXPERIMENT—PART II ............................................................33 A. INTRODUCTION....................................................................................33 B. HOW DO BATTLEFIELD CYBERSPACE OPERATIONS IMPACT LAND FORCES? A KOREAN SCENARIO PART 2 ........33 C. CONCLUSION .........................................................................................45 V. ANALYSIS AND CONCLUSION .....................................................................49 A. INTRODUCTION....................................................................................49 B. SUMMARY OF FINDINGS ...................................................................49 C. IMPLICATIONS .....................................................................................53 D. A WAY AHEAD: ORGANIZATIONAL PARALLELS TO HUMAN INTELLIGENCE OPERATIONS .........................................57 E. MERGING BITS WITH BULLETS ......................................................58 LIST OF REFERENCES ................................................................................................61 vii INITIAL DISTRIBUTION LIST ...................................................................................71 viii LIST OF FIGURES Figure 1. Framework .................................................................................................14 ix THIS PAGE INTENTIONALLY LEFT BLANK x LIST OF ACRONYMS AND ABBREVIATIONS APT Advanced Persistent Threat CCTV Closed-Circuit Television CIA Central Intelligence Agency CJSOTF Combined Joint Special Operations Task Force USCYBERCOM United States Cyber Command DDoS Distributed Denial of Service DMZ Demilitarized Zone DNS Domain Name System DODIN Department of Defense Information Network GAO Government Accountability Office HUMINT Human Intelligence ISP Internet Service Providers ISR Intelligence, Surveillance, and Reconnaissance JFHQ-DODIN Joint Force Headquarters – Department of Defense Information Network MACV-SOG Military Assistance Command Vietnam-Studies and Observation Group NIPRNET Non-classified Internet Protocol Router Network OODA Observe, Orient, Decide, and Act OPM Office of Personnel Management SECDEF Secretary of Defense USSOCOM United States Special Operations Command SOF Special Operations Forces TC-AIMS II Transportation