Strategic Deterrence based upon a credible proactive defence, offensive and information peacekeeping capability in which to project power, security and influence globally through Cyberspace in the defence of Canada.
OUTLINE
Retro-futurism and the anachronism that is security
Until now, security has been treated more as a compliance audit rather than a science. It is risky to apply one-dimensional thinking against a pan-dimensional villain.
Convergence and the Internet-of-Everything
Convergence has created a state of hyper-connectivity, enhanced capability and risk.
Cyber security begins foremost with a strategic understanding of the domain
The converged doctrine of CyberISR can enable, secure, sense, exploit and warfight in the Internet-of-Everything.
Informationalized Warfare
In this age, the mouse has proved mightier than the missile in its ability to deliver measured strategic real-world effects.
The cyber defence innovation cycle is driven by the threat and offensive doctrine.
Strategic Deterrence
Strategic listening, core intelligence and a proactive defence provide time and precision. Conversely, reacting in surprise is ineffective, costly and leaves few options.
Strategic deterrence needs a credible offensive, proactive defence and information peacekeeping capability in which to project power and influence globally through Cyberspace in the defence of Canada.
Deterrence and diplomacy are required in the right dosage to dissuade purposeful interference with Canadian national critical cyber infrastructures by foreign states.
A national capability for cyber defence is decades behind, yet weeks away.
Three decades ago, the Cold War was still raging. The national security community was preoccupied with sedition, sleeper agents and mutually assured destruction. Conflict between states represented the principal threat to international security and nuclear deterrence was the game in theory. Then came the collapse of the Soviet bloc, the rise of transnational terrorism and the Internet. Fast-forward to today and we have a multitude of security challenges that were never envisioned, from cyber-espionage to super-empowered non-state actors, insurgency, hybrid warfare and global warming. In a few short years, technology gone from teletype messages to mobile phones, social media and personal drones. Today’s national security challenges are more diverse yet interdependent:
Conflict Zones, Contented environments, unstable regions;
Proliferation of Weapons of mass destruction and disruption;
Propaganda and the war on truth
Espionage and foreign influence and interference of the democratic process;
Radicalization, foreign fighters and terrorism;
Weaponization of cyberspace;
Competitive and military interests of China and Russia;
Climate Change arctic sovereignty; and
Globalization supply chains.
Fog and Friction
Nowadays, our World is principally described by data, and subject to global influence at the speed-of-light. We are entering a period of instability, rapid convergence, quantification and risk within a complex system where social media has created a frictionless state between the human terrain, the network and Internet-of-Things. It is a world where thought is communicated by disruptive technology has both enabled open-empowerment of global commons and precipitated the collapse of nations. The cyber dialog has been elevated from hackers, to matters of strategic deterrence, coercive signaling, and purposeful interference of critical infrastructure.
Information Warfare 1.0
The notion of cyber has been around for over 180 years. The military played the central role in creating of the Internet and has been involved since 1960. In fact, militaries progressively developed a conceptual framework for Information Warfare in the early 1990’s, and provided much of the thought-leadership in this space. Yet, Information warfare and peacekeeping are often over studied and under executed. Whereas countries like old adversaries have maintained persistent focus on informationized warfare - the same leaders have been on the file since the early 1980’s. We have been admiring the problem for quite some time.
Information Warfare is the result of the large number of qualitative discontinuities in the technical, social, and economic dimensions of information systems. Information Warfare is not a continuation of what was warfare. It is not just Command and Control Warfare nor is it Computer Warfare. Information Warfare is an emergent reality that comes from a self-organization process. A car is more than a “horseless carriage." Old words do not explain something new. The danger is that the use of familiar words misrepresents and mask the true extend of the revolution that will have to take place if we are to be able to retain a military capacity in a new physical, social and cognitive space. - Information Warfare in the CF. Developing a Conceptual Framework 1994, Department of National Defence, Dr. Robert Garigue.
Convergence
Through convergence, cyber has evolved to a complex ecosystem of information and systems. Information warfare has advanced particularly in highly-contested environments and fragile states. Our adversaries are sophisticated and aggressive. Their operations are agile, adaptive, and dispersed. They have the capability to do us harm.
Pervasiveness of the Domain
Cyber represents a unique 5th Dimension to warfare but also the nervous system for all operational domains. Cyber has the ability to achieve strategic balance between deterrence, containment, intervention, influence, and the projection of soft or hard power while maintaining the legitimacy of force.
Perceptive Dissidence
Computer Defence and traditional IT Security, policy, standards and doctrine, are largely driven only by the threat we perceive clearly within our field of view, and most obvious tangible impacts felt to the business. [1] The Canadian picture is also distorted by our own constrained competitive capabilities, organizational boundaries, sparse fiscal investments and legal constraints, onto an adversary that shares none of these restrictions. Countries like Russia and China frame the issue principally as information security or warfare, because much of the countries network technology is of foreign origin and control. Cyber has expanded the grey zone of peace, conflict and warfare.
Strategic Understanding
Accomplishing mission assurance amidst risk, uncertainty and the adversarial dynamics in global Cyberspace first requires a strategic understanding of the domain. Such a cyber-capable force would use cyber to enable, secure, sense, exploit and war-fight in the Internet-of-Everything (IOE).
"I will say categorically from my experience that the cyber-threat is real, it's extremely significant, and it's having a big impact on both public and private-sector interests. And it is fundamentally undermining our future prosperity as a nation. In an age of asymmetrical threats, and in a space where threat actors have achieved unprecedented capability, agility and speed; effective or successful governance means having the ability to develop situational understanding, truly deployable capability and low response latency." – Ray Boisvert, former assistant director of the Canadian Security Intelligence Service.
Cyberspace has undergone dramatic global disruptive changes in the past few years, particularly in highly-contested areas of the network. There is a change of sea-state globally; a perfect storm, the repercussions of which have begun to undermine legitimacy of government, the projection of military force and viability of business in the global market. Borders are not what they used to be with cyber. There has been a profound shift-of-power and control of the Internet from West to East and from nation-states to service providers.[2]The private sector is an intermediary of all actions between the government and citizens. Similarly, global Internet demographics are migrating towards the digital natives of emerging states. The balance between privacy of the individual and security is in a state is in flux.
“TIME magazine dubbed Snowden the dark prophet triggered a much-needed global debate about the necessary checks and balances of the surveillance state in the information age.
But all of this is so 2013. A quantum shift in technological change is underway that makes the debate on metadata surveillance look antiquated. The breathtaking fusion of the cloud, big data, genomics, robotics, artificial intelligence and wearables is changing the rules of the game. Consider that within five years the human race will collectively generate more than 40 zettabytes of data a day. We are moving from the surveillance state to the Quantified Society. Quite simply, this is the unblinking, unrelenting and uncensored exposure to systems and devices designed to monitor and measure every aspect of human existence. In some ways it is like Bentham’s Panopticon wherein we eagerly volunteer our information in return for access to (near) total awareness. It thrives on our smart phones, smart scales and Fitbits. It digests the digital shadow of our loved ones on social media. It follows our teens and their online tribes. We tolerate the quantification of ourselves for very human reasons: vanity, a sense of belonging, and convenience. And as with previous generations roiled by revolution, it is exceedingly difficult to recognize the transformative consequences of disruptive change in real-time.” – Dr. Rafal Rohozinski, CEO, Secdev Group and Senior Consulting Fellow at International Institute for Strategic Studies.
Cyberspace is ultimately owned and operated by the private sector. Entities may be doing things that are potentially provocative for purely defensive reasons. States may miscalculate tactical responses in cyberspace because they don't appreciate the proactive defence game and the multi-stakeholder ecosystem. Thus, revesting sovereignty to the nation state within this domain will need to be done wisely.
Internet-of-Everything
We must now think in terms of Securing the Internet-of-Everything. Consider that the largest mobile device you will soon own will be your car. Picture an aircraft as software with wings, a spaceship as a rocket-propelled supercomputer and navy ships as floating data-centres. Look at augmented reality gaming on our sidewalks, drones in the sky, bitcoins in our wallet and semantic botnets influencing mass-populations as we sleep. The always-on Quantum Internet will sense human civilization to extraordinary precision.
Machines
Cyberspace will soon be dominated by continuous stream telemetry and machine moderated communications. Operating in a global hyper-competitive market necessarily means addressing complexity and big-data. Introduction of automation into a complex environment requires more sophisticated human interaction. In 2016, algorithms are fighting algorithms.
Strategic Calculus
A Cyber Strategy has multiple dimensions: the enablement of operations with information communications technology (ICT), mission assurance, securing information and technology (ITS), conducting cyber intelligence surveillance and reconnaissance (ISR) to sense a quantified world.
The Strategic Military Significance of Cyber
In this age, the mouse has proved mightier than the missile in its ability to deliver measured strategic real-world effects. The annual costs of cyber-attacks on Canada rivals the entire defence budget.[3] In this domain, the innovation cycle is driven by the threat and offensive doctrine. Arms control inspection is nearly impossible for cyber weapons of mass disruption and there are no DMZs in cyberspace. Authoritative regimes are self-limiting their soft-power options. Subsequent actions can be sudden and violent. Nations are therefore at more susceptible to strategic surprise and horizontal proliferation of conflict. The vector of disruptive change will come cross-domain, and for this we need a winning strategy.
“Offensive must inform defence.” – Melissa Hathaway, Senior Advisor to the Director of National Intelligence, Senior Director for Cyberspace for the National Security and Homeland Security Councils, Commissioner for the Global Commission on Internet Governance.
Disaster Continuity
Yet, there appears to be an over emphasis on resiliency, emergency management and disaster recovery, thus establishing a policy of failure as the starting point to a strategy on cyber and critical infrastructure protection.[4]
Risk Deferment.
Security is foremost a delay tactic; to increase the operational risk for the malicious actor and degrade the adversary’s line-of-attack until one can counter-attack either through law enforcement or military strike. Without the consequence of detection and retaliation, the threat is undeterred.
“IW will need to be further developed by DND if we want to be able to maintain world-wide near real-time awareness and participation in the full range of conflict resolution activities”. - Information Warfare in the CF. Developing a Conceptual Framework 1994, Department of National Defence, Dr. Robert Garigue.
Cyber is not office equipment
The consequence of "convergence" is that information can no longer be pre-defined in its nature as being solely strategic, tactical, operational or organizational. Emerging implications and that the military considered cyber to be more of an administrative issue not directly related to the core business of bullets and battleships. Cyber is not just about mission assurance and platform protection. It is a domain. Defence is well positioned to take a leadership role in cyber owning to the asymmetric nature of this domain. Cyber ideally fulfills the doctrine of adaptive dispersed operations and allows our military to operate effectively in highly-contested environments. The next generation of militaries will go to war with an inventory of floating, flying, and rolling computers.
Contested Environments
Operational experience has demonstrated the high-likelihood that internal conflicts in fragile and ungoverned regions and countries with porous and poorly controlled borders will be the norm for which our military will have to prepare for deployment. At the same time of increasing potential for involvement in ungoverned and unstable regions, these societies are increasingly connected to the Internet. “Cyber is indistinct in terms of boundaries, be they physical, political, socio-economic, or otherwise.”[5] Cyberspace is a pervasive aspect of individuals’, groups’ and states’ activities. Civil society, criminal and violent actors, and states are using cyberspace to empower themselves and to support and conduct operations. Our enemies do not have self-imposed restrictions upon their behaviour. Industry is a proxy target of state cyber-warfare and espionage. The effects are measureable. Consider, the real and measured consequences of long term espionage on Canada’s ICT supply chain. Cyber is an offence-dominated domain.
“Canadian military's nascent cyber capability is restricted from going on the offensive to protect itself.” – Richard Fadden, Former National Security Advisor says Canada should have its own cyberwarriors, CBC, 22 Jun 2016
Decisive Engagement
A modern military needs the capability to close with and engage adversaries at a distance proactively[6] and preemptively rather than remaining in garrison and reacting to perimeter breaches.
“The history of strategic surprise has been filled with the failure to predict future discrete events and, more importantly, a failure to detect the nature of emerging threats.”[7]
Just like counter-battery, "if we are going to allow that we're going to have Canadian Forces abroad and they are facing cyberattacks, either communications or other, I think it's totally reasonable to think seriously about whether or not we should give them the capacity to reach out and suppress before they are used against them." - Former Director CSIS on CBC Radio's The Current 22 Jun 2016
Rich Narrative
If one wishes to enter the proactive defence[8] or offensive game, they should understand that it has a rich narrative.[9] A national capability for cyber defence is decades behind, yet weeks away. Neither technology nor costs have been the principal impediments to capability development.[10] In some cases defences have been deployed but never turned on[11] for lack of markets or mandates.
Markets, Management and Mandates
Public mandate is one of the few remaining impediments for the public sector to operationalizing an effective national cyber strategy. Industry has been waiting for market demand or investment before implementing clean-pipe strategy[12]. Meanwhile, Canadian experts have been waiting in the wings doing mission critical work for allies. Cyber does not have to be expensive.
“Almost any group or state that wants to launch an attack can do so at an affordable cost.” - Global Commission on Internet Governance 2016
CyberISR
Cyber Intelligence Surveillance Reconnaissance (CyberISR) offers new vision to defence with a powerful new lens with a wide-aperture into the Internet-of-Everything. The capability can provide strategic listening, enhanced situational understanding, precision and mission-confidence though a keen awareness of both adversary dynamics and the nation’s attack surface, thus facilitating anticipatory threat reduction, accelerated evidence-based decision support, contextualization, targeting and the ability to mount pre-emptive proactive defence against the most aggressive and sophisticated threats, or conduct effective influence campaigns a world away at the speed-of-light.
Enhanced Situational Understanding
We require an enhanced situational understanding of the next-evolution of the cyberspace; with its risks, opportunities and moral hazards. An informed strategy can chart a path to manage a business, which nowadays, is principally described by data, and subject to global influence at the speed-of-light.
Strategic Deterrence
Current, cyber norms and Law of Armed Conflict makes provisions for acting in self-defence. Norms legitimize the use of cross-domain countermeasures and proactive defences including: coercive signaling, pre-emptive interdiction and disruption of attack networks. The ability to respond out-of-band enhances the deterrence effect. In this regard Cyberwar tends to looks a lot more like espionage and covert action than regular uniformed warfare. Deterrence and coercive signaling is predicated upon establishing standards of attribution. Nevertheless, deterministic rules do not work well in war - particularly information war.
The multi-stakeholder model in Cyberspace governance means that there are a lot more players, engaged in near-real-time deterrence, escalation, remediation and micro conflict. This continuous release of tensions may mitigate all-out cyber war. However, proxy conflicts in cyberspace unbalances the traditional deterrence equation given shared globalized infrastructure, supply chain, privatization, attribution and false flagging.
Cyber offers a response somewhere been a diplomatic note and a nuke strike. Cyber is far more useful as an offensive or persuasive weapon than is the nuclear option. A country may wish to reveal counter-force capabilities through signaling within clandestine services for reasons of deterrence. Notwithstanding, deterrence and diplomacy are required in the right dosage to dissuade purposeful interference with Canadian national critical cyber infrastructures by foreign states.
Strategic deterrence needs a credible offensive, proactive defence and information peacekeeping capability in which to project power and influence globally through Cyberspace in the defence of Canada.
KEY POINTS
The threat is sophisticated, multifaceted and dangerous.
Canada is subject to continuous cyber exploitation and attack.
Information warfare is real.
The damage is measureable and substantial.
There is an over-emphasis on resiliency, emergency management and disaster recovery in this country, thus establishing a policy of failure as the starting point to a strategy on cyber and critical infrastructure protection.
The state has legitimacy in armed conflict.
A military may opt for a counterforce of:
Pre-emptive proactive cyber defence;
Information peacekeeping;
Strategic Deterrence based upon a credible offensive capability in which to project power and influence globally through Cyberspace in the defence of Canada; and
Deterrence and diplomacy in the right dosage to dissuade purposeful interference with Canadian national critical cyber infrastructures by foreign states.
ENDNOTES
[1] State-of-Readiness (Cyber Security) of Canada’s Critical Infrastructures. Bell Canada and Rand Corp, Research Commissioned by Public Safety Canada, March 2007.
[2] Cyber Interdependencies of Canada’s Critical Infrastructures. Bell Canada and Rand Corp, Study for Public Safety Canada Mar 2007.
[3] Combating Robot Networks and their Controllers PSTP08-0107eSec.
[4] In 2008, the Industry provided a structured response to Public Safety Canada’s: Working Towards a National strategy and Action Plan for Critical Infrastructure.
[5] Understanding cyber operations in a Canadian Strategic Context: More that C4ISR more than CNO. Melanie Bernier and Joanne Theurniet, Defence Research and Development Canada, 2010
[6] Proactive cyber defence means acting in anticipation to oppose an attack against computers and networks.
[7] “Don’t Call Us” Governments, Cyber Security, and Implications for the Private Sector, Tom Quiggin, April 2012, Occasional Paper Series, Centre for International and Defence Policy, Queen's University. ISBN 978-1-55339-356-6
[8] National Proactive Cyber Defence Strategy. 2013.
[9] NATO Science for Peace and Security Advanced Research on the Best Practices in Computer Network Defense April 2014.
[10] A National Proactive Cyber Defence Strategy for Canada, Bell Canada, 2008
[11] Dark Space (APT0)– A comprehensive report on advanced cyber security tradecraft and issues affecting Canada, PSTP02-359ESEC (Mar 2015)
[12] Ibid. Dark Space