Dec. 22, 2021

Tallying Unlearned Lessons from the First Cybered Conflict Decade, 2010-2020

The world is now ten years into the age of overt cybered conflict. The "Cyber Westphalian" world is well past infancy, and the newly conflictual world arena faces emerging great power competition across all domains. It is time to tally up the learning. These essays engage that challenge with a twist. They look at what was missed, ignored, mistaken, or simply not learned despite the indicators and experience. This issue reflects most of a conversation held at the U.S. Naval War College in November 2020 where a small group of senior cyber and security practitioners and scholars met for three half-days to share and discuss the lessons of the first decade of cybered conflict. Included among the attendees were former commanders of the various U.S. cyber commands, as well as senior scholars of international relations with considerable cyber research experience. Others averaged a decade or several in involvement with and study of cyberspace, cybered conflict, and cyber campaigns.

Dec. 22, 2021

Bringing the Law In: Unlearned Lessons for Diplomats and Others

For over twenty years, "developments in the field of information and telecommunication in the context of international security" has been on the agenda of the United Nations (UN). In 2003, the UN General Assembly established the first formal group of governmental experts (UN GGE) to study existing and potential threats in the sphere of information security and possible cooperative measures to address them. From the beginning of this process, the role of international law has been part of the discussions about existing threats in cyberspace and what measures could be taken to minimize those threats. Indeed, at the conclusion of the first UN GGE in 2004, the Chairman explained that the group was unable to conclude a consensus report because, among other reasons, there were "differing interpretations of current international law in the area of international information security." Since the conclusion of this first UN GGE, there have been six more GGEs, with the last one wrapped up in May 2021. Each of these groups were tasked with studying the potential threats from State malicious actions in cyberspace and how international law applied to such State actions, among other topics. In 2018, to expand the representation of States involved in the study, a parallel process–the Open-Ended Working Group (OEWG) on Information and Communication Technology Developments in the Context of International Security–was established at the UN. It is fully composed of UN members. The OEWG was directed to study, among other issues, how international law applies in cyberspace. On March 12, 2021, the OEWG adopted its Final Substantive Report.

Dec. 22, 2021

Private Actors’ Roles in International Cybersecurity Agreements – Unlearned Lessons

Vocal communities in the West demand a role in international public policy for cyberspace. In some areas of activity, such as privacy, controls on social media content, commercial issues like anti-trust or digital taxation, this private sector involvement is essential. But the unlearned lesson is that it is equally important for national security, as is the effective negotiation on security, which is still the purview of states. One reason for these demands is the erosion of the clear division between internet security and internet governance. Internet governance has been the domain of a multistakeholder community. The members of the multistakeholders community increasingly expect to play a similar role in questions of international cybersecurity. Conversely, most governments had been content to leave internet governance to civil society and corporations, but now, as governance affects their economies and safety, some want a more prominent or even guiding role in the digital world. This confluence - it could even be described as a collision - over roles and responsibilities is complicated by China and Russia’s differing visions for security, data governance, and sovereignty. The tensions between multistakeholders and government and between democracy and authoritarian views of digital governance complicate the discussions of the role of the private sector.

Dec. 22, 2021

Power Versus Pragmatism: Unlearned Lessons in Dealing with China

The prevailing China trope in Washington is that US engagement with China has been a failure. The argument goes that far from turning China into a status quo power aligned with western interests and values, engagement has provided the Chinese Communist Party with the wherewithal to promote an illiberal agenda that poses an existential challenge to the US-led international order. This is both true and an oversimplification that masks the lessons about China unlearned as yet by most Western leaders. It is true in the sense that China has in the past decade taken a markedly illiberal turn and is now demanding that the international order should be modified to accommodate its emergence as a major global power. But it is an oversimplification in that US expectations were at least initially more realistic about what engagement might produce. Any review of past official US pronouncements on the rationale for engagement with China makes it abundantly clear that this was never about promotion of democracy or regime change. Rather the hope was that engagement would result in a China that would play a constructive and stabilizing role in world affairs, in contrast to the highly disruptive role it had played in the Mao era, and evolve towards an "autocracy-lite" regime. The US government’s China experts were under few illusions about the nature of a regime that had demonstrated in June 1989 how far it was prepared to go to maintain its hold on power. Meanwhile China’s Party-state had made no secret that the main aim of China's by-then dramatic economic development was to strengthen the Party’s hold on power, a reality that western policy-makers chose to ignore.

Dec. 22, 2021

Unlearned Lessons Behind Building a Shared Cyber Framework - with your Geo-Political Adversaries – the Hacker Perspective

Even in times of seemingly intractable geo-political conflict, geo-political competitors can find opportunities to develop a common cyber framework – the "Shared Cyber Framework." Achieving cyber stability between two or more nations is not predicated on congruence across all domains of cyber engagement, nor can silence among adversaries advance international stability. From a hacker perspective, this observation seems obvious. Indeed, the technical exchanges during the Cold War between the United States (US) and the former Soviet Union are said to have measurably contributed to both the stability of the bipolar world and, ultimately, the end of the conflict. Yet the current generation of leaders in the major cyber powers have neglected this lesson, both those who exploit access to westernized technologies and those who have responded by attempting to freeze out the attacking nation. For the past few years, the US and China, for example, have increasingly withdrawn from fruitful bilateral discussions. The January 2021 revelations of the Chinese Hafnium Zero Day hack riding shotgun after the December 2020 Russian SolarWinds campaign discoveries suggest few major cyber powers have progressed in finding even small areas of agreement on which to build confidence and a common framework.

Dec. 22, 2021

Unlearned Lessons: Why They are so Hard to Learn, and What Could Actually Help

Cybersecurity is an old problem, and even though many approaches of the last decade had interesting effects, we’re still far from solving it. Self-iterative, dark complexity is in the way—an intriguing new plague of our age—and only high talents in the right places with leeway for real-world experiments can rescue us from being outpaced by authoritarian models of innovation. To build that, we will have to break some rules.

Dec. 22, 2021

Fighting Alone is called Losing: The Unlearned Lessons of Fragmented Systems

Cyberspace is a man-made, contested, and competitive domain that is continuously evolving and adapting at speeds and scales difficult to comprehend or imagine. While hardware is geographically located in a physical layer somewhere on earth or in space, the software and data can move freely in a logical layer unless otherwise constrained. The result is a global surface that requires a globally coordinated defense by a global team. Therefore, within the context of cyberspace, the idea of "defending alone" seems ludicrous. Yet, that is exactly how people, firms, and governments have been left alone to approach cybersecurity. As noted in his comments on the SolarWinds hack in March 2021, General Paul Nakasone, the commander of the United States Cyber Command stated that, "[I]t’s not that you can’t connect the dots. You can’t see all the dots. And when defenders can’t see all the dots, security gaps and breaches happen." Ultimately, the cyber domain’s primary lesson is that leaving everyone to defend alone leaves everyone to lose.

Dec. 22, 2021

Ally or Die: The Unlearned Joint Organizing Lesson and Key to Survival

Joint is better than single service; allied is better than alone; coalition is better than isolation. Neither the United States nor its allies are currently where any would want to be or should be operationally; none are as secure or assured as they should be; and none are performing as efficiently or effectively as required. Given the gravity of national security and the pace of cybersecurity, neither is served by an avoidance of a new call to joining forces in cyberspace. History has repeatedly shown the value of having allies in a tough fight; cyberspace presents that tough fight today.

Dec. 22, 2021

Small States Learn Different Survival Lessons

Every state wants to learn lessons from the multitude of cyber incidents that strike it and others, so that it can protect itself in the future. But when international cyber incidents are viewed together with geopolitical contestation, the lessons learned by small states are very different from those recognized by the global superpowers. Large states in NATO or the EU need to understand these other lessons to achieve their initiatives in the UN and elsewhere internationally. This chapter conveys five key lessons from the perspective of one small, highly connected state, and its small state neighbors in Southeast Asia. These lessons need to be recognized by the larger, globally dominant nations which seek the support of, or to support, the smaller nations in global cyber conflicts.

Dec. 22, 2021

Some Things the Giant Could Learn from the Small: Unlearned Cyber Lessons for the US from Israel

Over the last decade, cyber threats have grown in magnitude and diversity, and governments devote massive efforts towards adjusting their cyber stance to the evolving threats of the next decade, developing multiple national cyber strategies and dedicated governmental entities to address cyber threats. The responses build on their own and sometimes other countries' experience. For many small nations, however, modest budgets and resources disadvantage their responses. In contrast, Israel succeeded in becoming a cyber success by deliberately leveraging the advantages of being small – Making quick decisions, having the dexterity to change course rapidly, and centralizing national efforts with relative ease. Israel has focused on organizational processes and thoughtful cyber strategy, offering some lessons that could be useful for other nations that are much larger in scale.