misleading cyber metaphors

Every now and then, I come across something that is mind-stretching and truly exciting to ponder. This week, that was my reaction to an article by RAND scholar Martin Libicki, "Cyberspace is Not a Warfighting Domain." I have long admired Libicki's intellectual creativity and used to have him speak to my class at the National War College on Military Innovation for Future Wars.

In this article, he warns against letting the metaphor of cyberspace as a "domain" like air, sea, land, and space limit and misdirect our thinking about cyber warfare. He notes, for example, that the U.S. military has rushed to create a cyber command but hasn't done the same for the radio-frequency spectrum. Isn't it just as important?

Calling cyberspace a "domain," he argues, leads the military to fall back on familiar concepts from the existing domains -- dominance, defense, retaliation, and so forth.

Thinking of cyberspace as a warfighting domain tends to convert the problems associated with operating in cyberspace—creating useful effects in your adversaries’ systems and preventing the same from being done to you—into a warfighting mold shaped by the four older domains. This shifts the focus of thought from the creation and prevention of specific effects to broader warfighting concepts, such as control, maneuver, and superiority. This approach emphasizes the normal attributes of military operations, such as mass, speed, synchronization, fires, command-and-control, and hierarchy, at the expense of other ways, such as engineering, as a way of creating or preventing effects. ...

More broadly, the emphasis on defending the domain puts the information assurance cart before the mission assurance horse. ...

In a sense, if defensive cyberwar is largely a question of engineering systems to make them resistant to attacks, then offensive cyberwar is reverse-engineering target systems to understand how they may be vulnerable to attacks. All this dynamism further argues against trying to force-fit cyber operations into any mold, not the least of which is domain dominance.

He is especially telling when contrasting the typical military organization with what we need for cyber operations.

 Finally, focusing on cyberspace as a domain suggests that cyber warriors be organized the same as warriors in other domains. Using/Implementing a division of authority in which the enlisted greatly outnumber officers (typically by more than four-to-one) implies converting cyber warfare into a set of operations in which most elements can be broken down into routines and taught to people who are well-trained but not extensively educated. The wiser alternative is to determine what skill mix the domain requires, then recruit and train appropriately without worrying too much about whether the resulting hierarchy characterizes what are understood to be warfare domains.

Think about these ideas.