DISTRIBUTION
A:
Approved for public release; distribution is unlimited.
Document created: 1 March 2007
Air & Space Power Journal
- Spring 2007
|
|
PIREPs |
| Editor’s Note: PIREP is aviation shorthand for pilot report. It’s a means for one pilot to pass on current, potentially useful information to other pilots. In the same fashion, we use this department to let readers know about items of interest. |
| The mission of the United States Air Force is to deliver sovereign options for the defense of the United States of America and its global interests—to fly and fight in Air, Space, and Cyberspace. |
|
—USAF Mission Statement |
In late 2005, the Air Force altered its mission statement. As before, the service flies and fights in air and space, but now it also flies and fights in cyberspace. We have long recognized that information serves as a center of gravity for the military. Although military operations may involve aircraft, guns, tanks, ships, and people, information is the “glue” that tells each aircraft what sortie to fly, each tank where to go, and each ship where to sail. The revised mission statement represents a bold move if for no other reason than the fact that its explicit mention of cyberspace brings to the forefront the role played by information and information technology in the modern Air Force. Indeed, the statement elevates the notion of cyberspace and its attendant infrastructure to the level of importance occupied by air and space. Whereas, formerly, the Air Force perceived itself as carrying out kinetic operations, the latest version of its mission statement places the service squarely in the nonkinetic arena as well.
We have an intuitive sense of how the Air Force operates in air and space since both are physical in nature. Less clear is the relationship between the Air Force and cyberspace. What is cyberspace? Why is it important? What are the rules under which it operates?
In the early 1980s, writer William Gibson coined the term cyberspace to describe a fictionalized computer network containing vast amounts of information that could be tapped for wealth and power.1 In his cyberspace, the physical world and the digital world become blurred to the point that human users perceive computer-generated experiences that have no real existence, and sentient digital beings affect the physical world. Although Gibson’s depictions of computer-simulated reality, cybernetically enhanced humans, and artificially intelligent entities remain in the realm of science fiction, the concepts of “exploring” vast amounts of data and “visiting” remote computers do not. Moreover, the premise that computer networks contain information that people can exploit—for good and ill—is very real.
We need a physical infrastructure of computers and communication lines to implement cyberspace. In other words, cyberspace runs “on” computers. However, what resides “inside” computers provides the greatest leverage: we measure the true value of cyberspace in terms of the information contained within that infrastructure. The crucial characteristics of cyberspace include the fact that (1) information exists in electronic format, and (2) computers can manipulate (store, search, index, process, etc.) that information.
Cyberspace has thus become a metaphor for the digital society made possible through computers and computer networks. When referred to abstractly, it connotes the sum total of information available electronically, the exchange of that information, and the communities which emerge from the use of that information. When used in reference to a particular military operation, it signifies the information available to a specific audience.
Cyberspace need not be publicly accessible although the public does have access to the predominant implementation of cyberspace—the Internet. Military units can operate private networks that constitute their own limited versions of cyberspace. In fact, many disconnected “cyberspaces” can exist simultaneously, each servicing its own community of users.
Marshall McLuhan’s aphorism “the medium is the message” characterizes our expectations of cyberspace. He points out that “societies have always been shaped more by the nature of the media by which humans communicate than by the content of the communication.”2 Since computers and electronic communication networks encourage the rapid and widespread exchange of information, it naturally follows that they would also influence military operations.
It is interesting to observe the evolution of the medium-is-the-message effect on the Air Force’s perception of cyberspace. Initially, government policies equated cyberspace with the communication hardware comprising computer networks, concentrating on hardening to protect against infiltration. Later policies envisioned cyberspace not only as networks but also as the data transmitted across them, which led to a focus on data integrity. The change in the Air Force’s mission statement to include cyberspace implies that we now perceive it as content—something more than hardware and data.
The electronic encoding of information in cyberspace, rather than on physical media, permits wider interchange of those data. This is the foundation of an information-driven society proposed over the last 30 years by so-called new-age pundits such as McLuan, John Naisbitt, Alvin Toffler, and Don Tapscott, to name a few.3 The premise of the information society is that information itself has economic value, with a corollary which holds that information has operational value to the military. The more efficiently and effectively we manage information, the more benefit we derive from it.
The military has recognized this idea by declaring “information superiority” as one of its core values.4 It has moved to organize and equip itself so as to improve the management of information. The specific organizational approaches have various names—net-centric, knowledge management, battlespace, infosphere, and so forth—but the general concept remains the same: create a rich cyberspace (with tools, sensor-provided data, quality of information, etc.) in which to make decisions.5
Ideally, two primary benefits become evident from operating in such an information-driven environment. First, the organization can be decentralized as much as is feasible within a military context. Everyone operates within cyberspace and has access to the appropriate information needed to make decisions. We no longer have to make decisions at the point in the organization determined by the nexus of suitable information, but at the point most affected by the decision. Second, the organization can function as a coalition of semi-independent agents whose environment drives their operations.
For every benefit, however, a host of side effects exists. Technology that relies on information encoded in electronic format remains central to supporting information superiority. That technology does not exist in any integrated fashion today. We carry out information-related functions with a patchwork collection of software and hardware tools. We also struggle with a number of questions: How do we manage massive amounts of information? How do we prevent the mining of large amounts of unclassified data for classified information? How do we “compartmentalize” cyberspace so that the right information gets to the right decision makers? What information can we transmit over unclassified civilian networks versus tightly controlled, classified military networks? How do we integrate information coming through official military networks with information coming from “back-channel” sources? How computer savvy do users of cyberspace have to be? What mechanisms are in place to detect information tampering?
The Air Force’s announcement of its revised mission statement prompted a considerable amount of discussion regarding the precise definition of cyberspace and the way it relates to air and space. In the midst of this discussion were debates about what constitutes the bounds of cyberspace, whether it can function as a medium for weapon delivery, how the Air Force flies through cyberspace, and the like. That this discussion arose demonstrates that the concept of cyberspace is very much open to debate. As with the proverbial blind men giving their interpretations of the elephant, we have a number of ways of looking at cyberspace, depending on our perspective. Regardless of how we ultimately view cyberspace, though, we must recognize that it operates under some very fundamental principles.
Since cyberspace deals with information, the latter naturally determines the “economy” of the particular cyberspace in which it resides. In other words, we can think of information as having “value,” which depends on its inherent usefulness as a stand-alone piece of information as well as the way it relates to other information, both within cyberspace and without. Changes in the availability or usefulness of the information alter its value.
For example, content on an intranet page may gain in value if it leads to other information of equal or greater value. Similarly, it may lose value if it is duplicated or contradicted somewhere else. In the absence of relationships with other information, the value of information in cyberspace generally decreases over time because it has a greater chance of having been put to some use.
We need not restrict the notion of value to factual information. There is no guarantee regarding the accuracy or truthfulness of information in cyberspace. Consequently, disinformation intended to disguise the worth of legitimate information has value.
We may not explicitly know the value of a particular piece of information in cyberspace. Certainly, if it has a security classification, we understand the inherent risk if that information is compromised. We thus attach an arbitrarily high value to such information. However, it is computationally infeasible to compare one piece of information to all other combinations of pieces of information within cyberspace in order to determine value. We cannot know, a priori, when we can combine a particular piece of information, classified or not, with another piece of information to form intelligence higher in value than the individual pieces separately. To complicate things further, hardware and software appliances that “sniff” networks and intercept data transmissions often prevent us from determining if someone has obtained a piece of information illicitly, thereby unknowingly altering its value. Encryption and other information-assurance measures mitigate such occurrences to a great extent but don’t prevent them.
Paradoxically—at least in terms of economic theory—the ever-increasing supply of information available within cyberspace does not decrease the value of information. Instead, its value increases due to the scarcity of time and resources required to find useful information from the overall supply. This phenomenon has given rise to “technopower,” the concept that power and control are in the hands of people able to use cyberspace technology effectively to obtain high-value information.6
Although information itself defines value in cyberspace, access to that information determines power and, consequently, shapes authority. Economists portray information as falling into one of three categories: free, commercial, and strategic.7 Free information is available to whoever seeks it; commercial information to people willing to pay for it; and strategic information only to those specially entrusted to have it. Outside the context of cyberspace, strategic information has the greatest persuasive value because its restricted availability can serve as a source of influence and power over those who don’t have it. Holders of strategic information serve as gatekeepers, doling it out as necessary for their own purposes.
The emergence of cyberspace has altered this balance of power, providing a mechanism for disseminating information widely and freely. Previously, we funneled and filtered valuable information through gatekeepers; now, however, we can bypass them altogether, thus permitting peer-to-peer communication of information. Given this model, strategic information will undergo almost instantaneous devaluation if we put it into cyberspace without providing some sort of protection because it becomes available to all users of that cyberspace. Further, making information freely available means it becomes more accessible and has the potential to reach a larger audience.
This scenario has had societal effects, the most profound of which are virtual communities. Whether implemented as a private network supporting military operations or as a public Internet, cyberspace connects people. Users of a military cyberspace are fairly homogeneous; their goals address a specific military operation. As the user base of cyberspace becomes larger and more public, not only do user goals diversify, but also communities form within cyberspace.
Take the Internet, for example. With an estimated audience of 1.8 billion users across 225 countries, it has transformed the globe into a virtual village.8 People can communicate with each other regardless of physical location. In so doing, they are able to form and join social networks consisting of individuals with similar interests. The popularity of Web-based social networking tools such as Facebook (7 million users), Xanga (40 million), MySpace (108 million), and Hi5 (40 million) demonstrates the potential of cyberspace to bring people together.9
This ability is not lost on nonstate actors, who use the Internet as a meeting place, recruiting tool, and conduit for propaganda. For example, Hezbollah has leveraged cyberspace technology quite effectively, sponsoring a number of Arabic and English Web sites that describe world events from a Hezbollah perspective. Its graphic pictures, video clips, and news articles of the Israel-Lebanon conflict in July 2006 are clearly designed to portray Israel as a terrorist puppet of the United States.10 Realizing that many Israelis visit these sites, Hezbollah uses them to demoralize this Israeli audience while simultaneously boasting of its victories to the Arab audience.11
The juxtaposition of cyberspace with air and space in the Air Force’s mission statement almost depicts cyberspace as a physical means for conducting operations. True, it is useful at some level of abstraction to conceptualize cyberspace as a medium. After all, cyberspace works through the medium of computers and networks. However, drawing too close an analogy between a physical entity (air and space) and a logical one (cyberspace) can be dangerous. Cyberspace operates on entirely different laws of physics than does physical space. For example, information doesn’t weigh anything. It has no physical mass. It can instantaneously pop into—and out of—existence. It can be replicated without cost, accumulated without human intervention, and divorced from its physical location. Information does not, in itself, kill. It does so only when we use it to influence physical players in air and space. Because of the nonphysical nature of information, placing it in cyberspace gives it instant, global availability to all users of that cyberspace. We often cannot determine whether information we obtain from a source in cyberspace is original or has been copied from somewhere else within cyberspace.
Cyberspace—particularly the Internet—is a global phenomenon. Information that the United States does not wish to reveal may be available through sources located in countries outside its purview. We cannot necessarily control all information, nor can we necessarily remove a piece of information. We can only regulate information within our own span of control.
Census and survey data indicate that 54 million households in the United States have at least one personal computer and that roughly two-thirds of Americans actively use the Internet in some fashion.12 Fifty-seven million employed Americans—62 percent of the workforce—report using a computer at work, 98 percent of whom have access to electronic mail.13 Of those, the majority reports trusting the content of electronic mail when it contains at least one item of personal information other than first name. We can reasonably assume that these statistics generally represent the Air Force workforce, given the 15 million personal computers in the Department of Defense’s inventory, combined with the leadership’s vision of a net-centric force.14
We can access public cyberspace literally from within our own homes or places of employment. For the first time in history, we have a vast amount of information at our fingertips. Also for the first time, we have the front line of a battle at our front door. Prior to cyberspace’s rise in popularity, the main participants in military operations were soldiers physically engaged in conflict. News reports that portrayed the results of military action to civilians at home dealt with events happening outside the country’s borders. With cyberspace within easy reach of ordinary citizens, those who wish to use it for ill gain have direct entrée into the home. This situation is particularly poignant since empirical studies have shown that computers, at home or otherwise, are probed for security vulnerabilities during the first 20 minutes of their connection to a public network.15
Contrary to the prevailing picture painted by the media, “war” in cyberspace will not likely manifest itself as an electronic Pearl Harbor, causing massive destruction. More probably, cyberwar will take the form of influence rather than lethality. Cyber warriors will not destroy infrastructure because that would be self-defeating, particularly within the United States. Instead, they will more likely obtain information they can use to manipulate happenings in the physical world to their advantage.
Those who choose to operate in cyberspace have a number of asymmetrical advantages. First, the “battlefield” is large and easy to hide in. Second, the effects of attacks are disproportionate to their costs. Using cyberspace is neither material- or capital-intensive. Individuals can access it with inexpensive computers, free software, and consumer-ready communication equipment. They can launch attacks from across the globe almost with impunity because of the difficulty of determining the exact origin of the attack or the identity of the attacker. Third, the one-sided nature of cyber attacks forces potential victims into assuming a defensive posture. The victim curtails his computer and communication services to within what his governance structure deems “acceptable,” based on its perceptions of the prevailing dangers—real or not. In case of an attack, the victim probably will not launch an in-kind offensive action since, even if he can identify the attacker, he probably lacks the computer infrastructure to make a counterattack worthwhile.
Perhaps the greatest lesson we can derive from the Air Force’s revised mission statement is that it warns all Airmen of the reality of cyberspace. The statement requires us to understand the implications of an information-reliant military. It also challenges us to look for ways to best use cyberspace and to understand that we can attain “throw weight” by finding new ways to make the best use of cyberspace technology.
B. H. Liddell Hart’s admonition that a “strategist should think in terms of paralyzing, not killing” remains as relevant today as it ever was.16 Although Liddell Hart spoke of paralyzing armies of people and the economies of states, his words nevertheless apply to the individual Airman. Never in history have so many people found themselves intimately tied to a weapon system—cyberspace—that is limited only by the human imagination.
*Lieutenant Colonel Umphress is an individual mobilization augmentee at the College of Aerospace Doctrine, Research and Education, Maxwell AFB, Alabama, and an associate professor in the Department of Computer Science and Software Engineering at Auburn University.
[ Feedback? Email the Editor ]
Notes
1. William Gibson, Neuromancer (New York: Ace Books, 1984).
2. Marshall McLuhan and Quentin Fiore, The Medium Is the Message (New York: Random House, 1967).
3. Ibid.; John Naisbitt, Megatrends: Ten New Directions Transforming Our Lives (New York: Warner Books, 1982); Alvin Toffler, The Third Wave (New York: Morrow, 1980); and Don Tapscott, The Digital Economy: Promise and Peril in the Age of Networked Intelligence (New York: McGraw-Hill, 1996), 6.
4. Joint Vision 2010 (Washington, DC: Joint Chiefs of Staff, 1996), 18.
5. John G. Grimes, “From the DoD CIO: The Net-Centric Information Enterprise,” CrossTalk: The Journal of Defense Software Engineering 19, no. 7 (July 2006): 4; Managing Knowledge @ Work: An Overview of Knowledge Management (Washington, DC: Chief Information Officers Council, 2001), 7; Dr. David S. Alberts, Defensive Information Warfare (Washington, DC: National Defense University Press, August 1996), http://www.ndu.edu/inss/books/books%20 -%201996/Defense%20Information%20Warfare%20 -%20Aug%2096/index.html; and Michael Vlahos, “Entering the Infosphere,” Journal of International Affairs 51, no. 2 (1998): 497–525.
6. Tim Jordan, “Cyberpower: The Culture and Politics of Cyberspace,” Internet Society, http://www.isoc.org/inet99/proceedings/3i/3i_1.htm.
7. Robert O. Keohane and Joseph S. Nye Jr., “Power and Interdependence in the Information Age,” Foreign Affairs 77, no. 5 (September/October 1998): 89–92.
8. “Web Worldwide,” ClickZ Stats, http://www.clickz .com/showPage.html?page=stats/web_worldwide.
9. Wikipedia: The Free Encyclopedia, s.v. “List of Social Networking Websites,” http://en.wikipedia.org/wiki/List _of_social_networking_ websites.
10. “Israeli Aggression on Lebanon,” Moqawama.org, http://www.moqawama.org/aggression/eindex.php.
11. Maura Conway, “Cybercortical Warfare: The Case of Hizbollah.org” (paper prepared for presentation at the European Consortium for Political Research [ECPR] Joint Sessions of Workshops, Edinburgh, United Kingdom, 23 March–2 April 2003), http://www2.scedu.unibo.it/roversi/ SocioNet/Conway.pdf.
12. Home Computers and Internet Use in the United States: August 2002 (Washington, DC: US Department of Commerce, US Census Bureau, September 2001), http://www .census.gov/prod/2001pubs/p23-207.pdf; and “U.S. Internet Adoption to Slow,” ClickZ Stats, http://www.clickz.com/showPage.html?page=3587496#table1.
13. “Email at Work,” Pew Internet and American Life Project, 8 December 2002, http://www.pewinternet.org/reports/toc.asp?Report=79.
14. Army Field Manual 100-6, Information Operations, 27 August 1996, 14.
15. Lorraine Weaver, “They’re Out to Get Us! The Cyber Threat to the Telecommuter, Small Office / Home Office (SOHO), and Home User” (presentation to the 14th Annual Systems and Software Technology Conference, Salt Lake City, UT, 1 May 2002), http://www.sstc-online .org/Proceedings/2002/SpkrPDFS/WedTracs/p1371.pdf.
16. B. H. Liddell Hart, Paris: Or the Future of War (New York: Garland Publishing, 1975), 40–41.
Disclaimer
The conclusions and opinions expressed in this document are those of the author cultivated in the freedom of expression, academic environment of Air University. They do not reflect the official position of the U.S. Government, Department of Defense, the United States Air Force or the Air University
[ Home Page | Feedback? Email the Editor ]