July 27, 2020 — The doctrinal history of information operations, cyber operations, and psychological operations within DoD is tangled and confused. Moreover, those military specialties rank lower in the DoD pecking order, and those with such specialties are accorded less respect than those specializing in traditional combat arts. These two realities have led to inconsistent usage of these and related terms within DoD and the larger national security community in government as well as in public discourse and, arguably, a misallocation of resources given the importance of the information environment in military operations. MORE
|
July 27, 2020 — The information environment (IE) and operations in and through the IE are currently a particular point of emphasis within the Department of Defense (DoD). Information is the newest joint function (joining command and control, intelligence, fires, movement and maneuver, protection, and sustainment). The Marine Corps has followed suit and made information a warfighting function, and the Army is considering a similar move. 2016 saw the first DoD Strategy for Operations in the Information Environment, and 2017 saw the development of the Joint Concept for Operating in the Information Environment, signed and released (and the subject of a capabilities-based assessment) in 2018. Senior leaders across the department have repeatedly expounded on the importance of the IE for military operations and declared it a priority. MORE
|
July 27, 2020 — For many years now, Russia has defined and even expanded its concept of “information weapons (IWes).”[1] At one point, Russia attempted to get the concept introduced into United Nations resolutions, which at the time helped to guarantee Russian information and national security. This occurred in the 1990s when Russia was at its weakest and unable to compete with other nations in information warfare capabilities. MORE
|
March 23, 2020 — Welcome to the Spring edition of The Cyber Defense Review (CDR), and the exciting publication of the CyCon U.S. 2019 conference papers. This edition of the CDR will feature 6 policy and 5 technical papers that dramatically provide texture and insight into the complicated Defending Forward strategy. The 11 papers were presented on November 18-20, at the Crystal Gateway Marriott in Alexandria, VA. The CyCon U.S. conference is the premier forum on cyber conflict. It is a collaborative effort between the Army Cyber Institute (ACI) at West Point and the NATO Cooperative Cyber Defence Centre of Excellence and complements the CyCon Conference held every spring in Estonia. MORE
|
March 23, 2020 — The persistent engagement strategy in cyberspace requires partnership between the public and private sectors. This whole-of-society approach is greatly needed, as cyber threats are holistic. Partnership can yield a number of good outcomes that all parties seek to achieve. However, having truly productive partnership requires a significant amount of time and effort. There are different partnership methods that ask for different amount of time, effort, and resources. Hence, it is crucial to have a better understanding of the requirements of each partnership method. To this end, this article proposes a framework that incorporates various partnership methods with aims to achieve various goals. It demonstrates that this framework can provide guidance for selecting an appropriate partnership method based on specific conditions, needs, and requirements. MORE
|
March 23, 2020 — Examining the ‘defending forward’ concept and the intersection between DoD and the private sector speaks to aligning instruments of national power to set the stage for the consolidation of Internet connectivity and an expansion of that capability. Both outcomes feed a new understanding of what a professional military does in the cyber age to safeguard a civilian interface that is revamping the norms of government across state boundaries. Implementing an effective cyber strategy necessitates recasting the US military’s cyber operations to support civilian efforts. A dramatic point of departure from the current emphasis, this change in focus will prevent the US military from leading a non-violent conflict at odds with war in the corporal world. Instead, civilians will be charged with winning the fight in the cognitive arena of cyberspace. MORE
|
March 23, 2020 — The search for norms has proven to be one of the most frustrating elements of cyberspace operations. Informed consensus holds that there should be norms of international behavior to tame the Wild West of cyberspace. Yet, if norms are defined to exist when a country refrains from operations otherwise in its interest[1] (taking domestic and international politics into account) they do not exist. That is, there are zero such norms that enjoy adherence that matters. In light of such disappointments, this paper mulls a different approach to thinking about norms. Rather than focusing on what responsible governments should not do, it looks at what they actually do as a guide to what activities in cyberspace have effectively been normalized (that is, within de facto norms)—and may remain normalized until the rewards from such activities no longer merit the effort. This argument has three parts. The first part discusses the lack of progress towards norms. The second defines normalization and examines the extent to which the behaviors of specific countries establish what has, in effect, been normalized. The third part focuses on one particular activity—implanting malware into the weapons systems of potential adversaries—as a candidate for normalization. MORE
|
March 23, 2020 — The 2018 DoD Defense Strategy seeks to deter and defeat adversaries through a policy of forward engagement.[1] The Strategy and the related USCYBERCOM Vision mark a significant change in how the US intends to contest the emerging complexity of cyberspace in an environment where the rules will be more restrictive for the US and its allies than those of adversaries. Recognizing an ingrained military culture of geographically driven maneuver warfare, it will be important that USCYBERCOM considers the temporal as well as the spatial elements required to defend forward. A combination of timely, better and more coherent-decision making across a pan-government and industry ecosystem must exploit rather than attempt to control chaos; the effective adoption and application of decisive innovative capabilities will be a related essential element of this strategy. Through a UK lens, this paper considers the temporal implications of a strategy of Defending Forward.
MORE
|
March 23, 2020 — The United States has provided extended deterrence, backed by U.S. nuclear weapons, to South Korea since the end of the Korean War in 1953, and despite repeated low-level provocations by North Korea, the U.S.-ROK alliance has successfully deterred strategic attack on South Korea. The allies now face a growing asymmetric threat from North Korea in the cyber domain, and the alliance has yet to incorporate the cyber domain into the allied strategic deterrence posture. This paper examines cyber deterrence thinking and analyzes how to formulate a cyber deterrence posture as part of the overall strategic deterrence posture of the U.S.-ROK alliance. As with kinetic attacks, the alliance should focus on deterring cyber-attacks that produce cross-domain strategic effects and divide responsibilities to leverage each other’s capabilities and interests. Even for cyber-attacks that do not reach the threshold of producing strategic effects, U.S. Defense Department cyber concepts like “defending forward” and “persistent engagement” can be operationalized to reduce the threat to South Korea posed by the range of North Korea’s malicious cyber activity. MORE
|
March 23, 2020 — The decision-making behind cyber operations is complex. Dynamics around issues such as cyber arsenal management, target assessment, and the timing of dropping a destructive payload are still ill-understood. Yet, limited published research has thus far explored formal theoretic constructs for better understanding decision-making in cyber operations. Multiple models help to understand and explain the courses of action through which state cyber missions are executed, including conduct or restraint of cyber effects operations against target systems and networks. This paper evaluates four models - surprise model, duelist model, mating-choice model, and the BlackScholes model. Each model offers specific advantages and suffers characteristic drawbacks. While these models differ in application and complexity, each may provide insights into how the unique nature of cyber operations impacts the decision dynamics of cyber conflict. MORE
|