Gongol.com Archives: May 2022
May 5, 2022
The spontaneous formation of volunteer cyber-armies eager to aid Ukraine in its resistance against Russian aggression seems like a pleasing development on the surface -- people with useful computing skills want to offer assistance to the defensive side in an utterly unjust war. But to our great misfortune (and possible risk), policy and doctrine haven't caught up with the practical development of cyberwarfare, and that gap could create troublesome costs. ■ The history of "irregulars", foreign volunteers, and mercenaries in warfare goes back a long way. What would the lore about the American Revolutionary War be without Lafayette (for the Americans) and the Hessians (who fought for the British)? But in cyberwarfare, people can enter digital combat from their living rooms, and that complicates things. ■ Some degree of confusion is inevitable, considering the blurry contours of cyberwarfare and the strained relationship that the Russian government maintains with the truth. But matters are complicated far more than they should be by the absence of a clear outlet, at least under the US Department of Defense, for engagement in online conflict. ■ Yes, we have a Cyber Command, but we do not have a clear Cyber Force, and that's a problem to be rectified. If we have the resources to create a dedicated Space Force, we absolutely possess the wherewithal to spin up a dedicated, standalone organization for conflict in cyberspace. ■ This isn't to say that cyberwarfare exists entirely apart from the other spheres of conflict. But it behaves differently, it has different consequences, and it is far more permeable by people from the outside. No household owns a littoral combat ship or a heavy-lifting helicopter. But 93% of American adults are online. ■ It's long overdue for the United States to develop a clear, deliberately considered doctrine on the use of cyberwarfare -- who commands it, which "battlefields" are permissible, who qualifies as a combatant, and above all, what rules ought to govern such conflict. ■ And far more than any of the other armed forces, a dedicated Cyber Force would need to have an unusual degree of permeability with the private sector. This goes even beyond letters of marque and reprisal, though that Constitutional mechanism surely has a part to play, too. The people and skill sets we need to develop for this new kind of conflict just aren't the same as who and what we need for an amphibious assault. Different needs call for appropriate structures. ■ But America certainly needs an organized, deliberate approach to not only an active-duty Cyber Force, but also to reserve resources that could be called upon as needed. We need hardened defenses, public-private cooperation (and delineation of roles), and thoughtful doctrines on matters like escalation, deterrence, and rules of engagement. ■ The effort, resources, and focus required should not be left to afterthought status. It's hard to see the requisite focus happening without raising the status of our responses to full branch status. Whether we formalize the structure or not, people are going to "volunteer" for the fight -- so there's no time to waste in seeking to get it well-organized and managed in a way that promotes national interests. ■ Cyber conflict has become a key domain of Russia's war against Ukraine, as well as a valuable tool for the Ukrainian defense. There is absolutely zero reason to believe that cyberspace will ever become less important to warfare, now that the threshold has been crossed. The question is not whether but when the United States will acknowledge the the new era and escalate our posture accordingly.
