War is changing, and the U.S. military can now use cyber weapons as digital combat power.

When and how that’s done is the subject of a new book, Bytes, Bombs and Spies: The Strategic Dimensions of Offensive Cyber Capabilities, edited by Herb Lin and Amy Zegart at the Center for International Security and Cooperation and the Hoover Institution.

US military doctrine defines offensive cyber operations as operations intended to project power by the application of force in and through cyberspace. This is defined as actions that disrupt or destroy intended targets.

At a time when US cyber policy is taking a new direction, Bytes, Bombs and Spies is one of the first books to examine strategic dimensions of using offensive cyber operations. With chapters by leading scholars, topics include US cyber policy, deterrence and escalation dynamics, among other issues. Many of the experts conclude that research, scholarship, and more open discussion needs to take place on the topics and concerns involved.

Lin and Zegart are senior research scholar and senior fellow, respectively, at Stanford’s Center for International Security and Cooperation. Max Smeets, a CISAC cybersecurity postdoctoral fellow, is also a contributor to the book.

Offensive cyber rising

Examples in recent years of offensive cyber usage include the Stuxnet computer virus that destroyed centrifuges in Iran and slowed that country’s attempt to build a nuclear weapon; cyber weapons employed against ISIS and its network-based command and control systems; and reported cyber incursions against North Korea’s ballistic missiles system that caused launch failures.

“If recent history is any guide, the interest in using offensive cyber operations is likely to grow,” wrote Lin and Zegart.

One key issue is how to best respond to cyberattacks from abroad, such as the 2015 theft of millions of records from the Office of Personnel Management, the 2016 U.S. election hacking, and the 2017 WannaCry ransomware attack that affected computers worldwide, to name but a few. Those incidents have “provided strong signals to policymakers that offensive cyber operations are powerful instruments of statecraft for adversaries as well as for the United States,” Zegart and Lin wrote.

In September 2018, the White House reportedly issued a directive taking a more aggressive posture toward cyber deterrence. This measure allows the military to engage, without a lengthy approval process, in actions that fall below the “use of force” or a level that would cause death, destruction or significant economic effects. Also, US Cyber Command was elevated to an independent unified command, giving it more independence in conducting offensive cyber operations.

These new policy directions make it all the more imperative that offensive cyber weapons be researched, analyzed and better understood, wrote Lin and Zegart.

Conceptual thinking lags

The 438-page Bytes, Bombs and Spies includes 16 chapters by different authors. Topics include the role and nature of military intelligence, surveillance, and reconnaissance in cyberspace; how should the United States respond if an adversary employs cyberattacks to damage the U.S. homeland or weaken its military capabilities; a strategic assessment of the U.S. Cyber Command vision; and operational considerations for strategic offensive cyber planning; among others.

“Conceptual thinking,” Lin and Zegart noted, lags behind the technical development of cyber weapons. Some issues examined include:

• How might offensive cyber operations be used in coercion or conflict?

• What strategic considerations should guide their development and use?

 • What intelligence capabilities are required for cyber weapons to be effective?

• How do escalation dynamics and deterrence work in cyberspace?

• What role does the private sector play?

Scholars at universities and think tanks need to conduct research on such topics, Zegart said. “Independent perspectives contribute to the overall body of useful knowledge on which policymakers can draw.”

In the chapter Lin wrote on “hacking a nation’s missile development program,” he noted that cyber sabotage relies on electronic access to various points in the life cycle of a missile, from its construction to ultimate use.

“For some points, access is really hard to obtain; in other points, it is easier.  Access can be technical (what might be obtained by hacking into a network) or human (what might be obtained by bribing or blackmailing a technician into inserting a USB thumb drive),” he said. 

One key, Lin said, is the availability of intelligence on the missile and the required infrastructure needed to fabricate, assemble, and launch the missile. 

“Precisely targeted offensive cyber operations generally require a great deal of detailed technical information, and such information is usually hard to obtain, especially if the missile program is operated by a closed authoritarian government that does not make available much information on anything,” he said.

Origins in cyber workshop

The idea for Bytes, Bombs and Spies originated from a 2016 research workshop led by Lin and Zegart through the Stanford Cyber Policy Program. That event brought together researchers from academia and think tanks as well as current and former policymakers in the Department of Defense (DoD) and U.S. Cyber Command.

“We organized the workshop for two reasons,” wrote Lin and Zegart. “First, it was already evident then—and is even more so now—that offensive cyber operations were becoming increasingly prominent in U.S. policy and international security more broadly. Second, despite the rising importance of offensive cyber operations, academics and analysts were paying much greater attention to cyber defense than to cyber offense.”

Herb Lin is the Hank J. Holland Fellow in Cyber Policy and Security at the Hoover Institution and senior research scholar for cyber policy and security at the Center for International Security and Cooperation, a center of the Freeman Spogli Institute for International Studies.

Amy Zegart is the Davies Family Senior Fellow at the Hoover Institution, where she directs the Robert and Marion Oster National Security Affairs Fellows program. She is founder and co-director of the Stanford Cyber Policy Program, and senior fellow at the Center for International Security and Cooperation, a center of the Freeman Spogli Institute for International Studies.

Media Contacts

Clifton B. Parker, Hoover Institution: 650-498-5205, cbparker@stanford.edu

Closing the gap between technology leaders and policy makers will require a radically different approach from the defense establishment.

A silent divide is weakening America’s national security, and it has nothing to do with President Donald Trump or party polarization. It’s the growing gulf between the tech community in Silicon Valley and the policy-making community in Washington.

Beyond all the acrimonious headlines, Democrats and Republicans share a growing alarm over the return of great-power conflict. China and Russia are challenging American interests, alliances, and values—through territorial aggression; strong-arm tactics and unfair practices in global trade; cyber theft and information warfare; and massive military buildups in new weapons systems such as Russia’s “Satan 2” nuclear long-range missile, China’s autonomous weapons, and satellite-killing capabilities to destroy our communications and imagery systems in space. Since Trump took office, huge bipartisan majorities in Congress have passed tough sanctions against Russia, sweeping reforms to scrutinize and block Chinese investments in sensitive American technology industries, and record defense-budget increases. You know something’s big when senators like the liberal Ron Wyden and the

In Washington, alarm bells are ringing. Here in Silicon Valley, not so much. “Ask people to finish the sentence, ‘China is a ____ of the United States,’” said the former National Economic Council chairman Keith Hennessey. “Policy makers from both parties are likely to answer with ‘competitor,’ ‘strategic rival,’ or even ‘adversary,’ while Silicon Valley leaders will probably tell you China is a ‘supplier,’ ‘investor,’ and especially ‘potential market.’”

Read the rest at The Atlantic.

This piece originally appeared at Lawfare.

"The election interference tactics originally deployed by Russia against the United States and Europe are now global. Hackers across the democratic world have exploited weaknesses in campaign email servers; probed electronic voting machines for vulnerabilities; set up troll farms to spread highly-partisan narratives; and employed armies of bots to distort the truth online. Tech experts in countries such as Iran and Venezuela have borrowed these tactics and joined efforts toward the same goals: to erode confidence in electoral processes and in democratic governance itself," writes Eileen Donahoe. Read here.

Midterm elections pose an opportunity for hackers interested in disrupting the democratic process

Voter registration systems provide an additional target for hackers intending to disrupt the US midterm elections; if voting machines themselves are too disperse or too obvious a target, removing voters from the rolls could have a similar effect. in Esquire, Jack Holmes explains that election security experts consider this one of many nightmare scenarios facing the American voting public—and thus, American democracy itself—on the eve of the 2018 midterm elections. (Allison Berke, Executive Director of the Stanford Cyber Initiative, quoted.)

Max Smeets is a cybersecurity fellow at Stanford University’s Center for International Security and Cooperation (CISAC), a Research Associate at the Centre for Technology & Global Affairs, University of Oxford, and a non-resident cybersecurity policy fellow at New America. In 2018, he was awarded the Journal of Strategic Studies’ prestigious Amos Perlmutter Prize for the most outstanding publication by a junior faculty member.

This interview originally appeared on Global Policy: Next Generation-- a new annual issue from the journal Global Policy. 

First, can you briefly describe your work and your interest in the field of cybersecurity?

I am currently finishing up my book manuscript on the dynamics of cyber proliferation. For at least a decade, policymakers and analysts have made explicit statements about the spread of what some call ‘cyberweapons’. Some senior officials argue that well over 30 nation-states are capable of launching cyber attacks; others are less conservative in their estimates. But, like much of the early nuclear thinking, no explicit basis for these estimates and forecasts is provided. Indeed, variations of the ‘domino effect’ logic -- when one goes cyber, all go cyber -- seem to implicitly dominate thinking. 

There is a lack of attentiveness to the theoretical assumptions behind why governments are setting up these military units to conduct offensive cyber operations, and there is a need for more social science scholarship on this topic. The main argument of my book is that the world is not at the brink of ‘mass cyber proliferation’.

How much do existing theories of international security contribute to understandings of the dynamics of cyber proliferation? Are other proliferation theories still useful for understanding this new space? 

They contribute a lot. Scott Sagan’s classic study identifies three ‘models’ (international security, domestic politics, and identity politics/symbolism), in the informal sense of the term, to explain states’ willingness to go for the nuclear option. I also use these ‘models’ to better understand the motivations of states to go cyber. But we have to be very careful here. The fundamental dynamics of cyber proliferation are different in a number of ways. For example, non-state actors play a much bigger role in enabling states to develop these capabilities. The Russian government, perhaps most prominently, is known to rely on cyber criminals and other patriotic hackers to conduct cyber operations. For a good overview, see this piece in Meduza.

You have also published on other topics, including your prize-winning article in the Journal of Strategic Studies. The article argues that the “transitory” nature of cyberweapons is an underappreciated dimension of cybersecurity. What do you mean by this?

Formally, the transitory nature of cyberweapons (a term which I actually do not use in my forthcoming publications) refers to ‘the temporary ability to access a computer system or network to cause harm or damage to living and material entities’.

Less formally, we can draw an analogy with food and cooking. Food is perishable. And we have a pretty good sense of ‘best-before dates’ of different types of food. The perishability of food likely affects our decision-making: when you have a delicious piece of salmon in the fridge which goes off tomorrow, you’re more likely to eat it today. 

For cyber, when a new ‘exploit’ is developed for a certain vulnerability, we do not have a good sense of the practices which affect the exploit’s ‘best-before date’. Equally, there is little research which explains how these time dynamics affect the decision-making of offensive actors, and so my article in JSS sought to provide some insights.

In what ways might appreciating the transitory nature of cyber capabilities change policymakers’ approach to cyber policy?

Offensive cyber programs potentially require a different approach to budgeting, at least when compared with conventional weapon programs. For conventional weapon programs, (government) institutions can come up with a relatively good cost estimate as to what is required to maintain a certain capability; a typical budget proposal would say ‘in X years’ time, the following capability needs to be replaced/upgraded. Hence, we project to spend …’. Conventional weapons’ ageing is generally modeled as a gradual (log-linear) deterioration. 

This approach, however, does not hold up for cyber. Instead, governments only have the ability to use a certain ‘exploit’ or weapon for a certain period of time, and its usability rapidly declines when it is discovered. What this means is that more flexible budgets (and hiring procedures) are recommended to cope with potentially prompt fluctuations in overall capability.

Which books have proved influential for your work? 

I have been impressed by Ben Buchanan’s book The Cybersecurity Dilemma published last year. As the title suggests, the book argues that the security dilemma also holds great relevance in cybersecurity. More specifically, Buchanan’s argument is that states are incentivized to launch intrusions into others’ networks to enhance their own security, but in the process risk escalating tensions.

There are not many books in the field which combine IR theory with ‘cyber’, but this book is one of them and does it well. Also, it is pretty difficult to write a book on cyber conflict which stands the test of time, as the dynamics are changing so quickly and our understanding too. But I believe that Buchanan’s book - describing a fundamental dynamic of this ‘domain’ - will still be on course syllabi 10+ years from now.

What other disciplines should people in your subfield learn more about in order to better understand cybersecurity? Or what other disciplines do you find it valuable to draw on in your research? 

Some have argued that cyber studies can be split up into different wings, in which political scientists, computer scientists, legal scholars, etc. would each contribute their own share to understanding different aspects of the cyber issue. I, however, am a big believer in interdisciplinary research and think trying to split up the field would quickly lead to a similar situation as the attempt of the blind men to discover the nature of the elephant: the one who touches its leg calls it a tree, another who touches its tail calls it a rope, and so on.

I am currently reading a lot of organizational management literature. Scholars who set out to explain the conduct of cyber operations normally focus on argument related to the ‘nature’ or ‘meaning’ of cyberspace. Yet, we cannot fully understand the use of cyber capabilities without studying the organisational structure in which its use of these capabilities is embedded. For example, in previous work I have argued that organizational integration between intelligence and military activities can both enable and constrain the conduct of cyber operations.

What piece of advice have you found most helpful as an early career researcher?  

There is this great twitter account called “Lego Grad Student”. One of the tweets is a picture of 'Lego Grad Student' in a bathroom, and says: “Washing up for bed after accomplishing nothing that day, the grad student instinctively refuses to look at himself in the mirror.” 

What I believe should be avoided during the PhD is a perfect correlation between ‘happiness’ and ‘PhD progress’: e.g. when research goes well I’m happy; when research goes badly I’m not happy (and don’t want look at myself in the mirror). That’s dangerous - although, of course, some correlation is inevitable and cannot be avoided.

It is likely there will be (sometimes long) stretches of time that you are not happy with your research. It is hard to break the negative cycle if there is ‘perfect’ correlation. I think a key strategy to managing this issue is setting goals that have nothing to do with your research, for instance joining a sports team or becoming a Trivial Pursuit expert. The key is finding other opportunities to generate a sense of accomplishment that can tide you over during challenging periods in your research. 

What advice would you give to students just beginning their doctoral research?  

We all talk about finding the supervisor who is the perfect research fit. Supervisors are important. But I would say peers are more important. Who is sitting next to in your office/open desk space changes your day, week, and PhD-life completely. Having people with whom you can share your writing and your successes or failures is also critical.

Emma Lecavalier is the Deputy Editor of Global Policy: Next Generation.