Daily Times

Planning and executing successful cyber-attacks need human and financial resources.

“War is an act of force to compel the enemy to do our will,” wrote Clausewitz, a military theorist and Prussian general, in his book, “On War.”

It is a formal fight between the two or a group of enemies at a larger scale that may incur extensive losses in terms of lives and assets. An act of war is considered a means to an end: Physical violence is the means and forcing the enemy to accept the offender’s will is the end. To achieve the results in war, the opponent has to be rendered defenceless.

An act of war is always political, which means the war is the continuation of politics by other means. One school of thought subscribes to Clausewitz’s criteria of war, which is: a war has to be lethal resulting in human casualties and physical destruction of critical infrastructure, including defence installations. Does the cyberwar meet these criteria? It’s a pertinent question today.

According to some strategists and defence experts, the aim of cyber-attacks can be sabotage, espionage and subversion.

However, all three seem to be criminal in nature. An act of sabotage could destroy critical and sensitive infrastructure, both civil and military. In espionage, the attackers would disrupt or steal sensitive and critical information. This action, on its own, is not likely to result in human casualties. Subversion would result in demolishing the legitimate government. This could also change the loyalties of a significant portion of the population. This act again may or may not cause human casualties. According to the above school of thought, planning and executing successful cyber-attacks is not all that simple and economical. It needs human and financial resources. For each category of the target, the cyber-attackers have to design specific malware or an appropriate cyber weapon. In the event of a failure, the criminal act could backfire.

Thomas Rid, in his book titled: Cyber War Will Not Take Place, argued that cyberwar had not happened in the past. It did not occur in the present, and it’s highly unlikely that it will disturb our future. He added,

“To fight and conquer in all our battles is not supreme excellence, supreme excellence consists in breaking the enemy resistance without fighting. The supreme art of war is to subdue the enemy without fighting. Know your enemy and know yourself and you can fight a hundred battles.”

“All past and present political cyber-attacks—in contrast to computer crime, are sophisticated versions of these activities that are as old as human conflict itself: sabotage, espionage and subversion—at the technical high-end, weaponized code and complex sabotage operations enable highly targeted attacks on the functioning of an adversary’s technical systems without directly physically harming the human operators — espionage makes it possible to infiltrate data without infiltrating humans first — subversion may be becoming less reliant on armed direct action: networked computers and smartphones make it possible to mobilize followers for a political cause peacefully. In certain conditions, undermining the collective trust and legitimacy of an established order requires less violence than in past.”

He concluded that cyber war will not take place. On the contrary, there was another school of thought, which subscribes to the military doctrine of Sun Tzu, the ancient Chinese general.

“To fight and conquer in all our battles is not supreme excellence, supreme excellence consists in breaking the enemy resistance without fighting. The supreme art of war is to subdue the enemy without fighting. Know your enemy and know yourself and you can fight a hundred battles.”

His doctrine, although five centuries old, is so flexible that it is applicable even in cyberwar. It revolves around gathering information and deception. Cyberwar builds on espionage, subversion and sabotage. An enemy who is weak in cybersecurity and whose computer systems are not hardened and resilient will be susceptible to cyber-attacks. An adversary determined to break its opponent’s will to fight can subdue him by attacking his command, control and communications (C3). The victim with weak cyber defences can be overwhelmed by attacking his financial resources, power grids, water supplies and communication systems. This is sufficient to completely demoralize the population.

Today, we talk with excessive pride about nuclear deterrence. What we should remember is that all critical infrastructure, command, control, and communications are dependent on electronic and computer systems. This is also true for nuclear weapons. We can isolate such facilities from the Internet, but physical penetration cannot be ruled out. A few years ago, a Syrian official’s laptop, which he left in his hotel room in a foreign country, was physically penetrated by two Israeli agents. This act of espionage enabled Israel to plan and bomb Syria’s nuclear reactor on September 6, 2007, by first disabling Syria’s missile launching system through a cyber-attack. A well-planned cyber-attack can destroy a nuclear facility by producing uncontrollable heat, cause air accidents and disable naval ships and submarines’ navigation system.

However, cyberwar or a massive cyber-attack is a game of the rich and powerful countries, because it requires talent, time and resources. The weak neither have the expertise nor the resources to move against the strong in cyberspace.

Pakistan has made impressive progress in nuclear and missile technology. What we need to concentrate on is a cyber defence to ensure that at the time of need, the critical infrastructure will remain operational. This would mean to build capacity to work under degraded conditions, build resilience to adapt to adverse conditions and to ensure that the systems will recover quickly in the event of a cyber- attack.

The next war will be a hybrid war which means, proxy, political and economic warfare. Cyberwar will be an essential element of hybrid warfare. The battles will be won without human and physical destructions. To conclude in the words of Sun Tzu, “Victorious warriors win first and then go to war, while defeated warriors go to war first and then seek to win.

The writer is a Senior Advisor at Sustainable Development Policy Institute, Islamabad