Cyberwarfare Management: Battlespace Made Up of Bits and Bytes

Cyberwarfare refers to a massively coordinated digital assault on a government by another government, or by large groups of people. It is the action by a state actor to penetrate another nation’s computers and networks for the purpose of causing damage or disruption.

Cyberwarfare has become one of the most unavoidable topics in any discussion of global security today. Many nations are found to be involved in covertly executing cyber operations such as reconnaissance, cyber espionage, and penetrating other nations' CNI; furthermore, establishing offensive cyberwarfare capabilities, developing NCSS, and participating in cyber-attacks repetitively. The term cyber warfare may also be used to describe attacks between corporations, form terrorist organizations, or simply attacks by individuals called hackers, who are perceived as being warlike in their intent.

One of the main challenges every state face at present is the hybrid challenges of disinformation campaigns and malicious cyber activities. Russia is said to be challenging Euro-Atlantic security and stability through hybrid actions, including the threat and the use of force to attain its political goals, attempted meddling in the election processes, and the sovereignty of NATO allies. Widespread disinformation campaigns and malicious cyber activities were conducted in Montenegro recently.

Another recent example was a cyber-attack against Ukrainian provincial electrical energy supply companies in 2015, which resulted in an unplanned power outage in Ukraine and a population of 225,000 people was impacted. The US independent analysts iSight Partners have linked the spear-phishing attack to a Russian hacking group but Russia has blamed pro-Ukrainian saboteurs for the outages. The incident was also thought to be the first known successful cyber-attack aimed at CNI.

In July 2016, During Warsaw Summit, NATO pledged to strengthen and develop its allies’ own cyber defense capability in order to be prepared to defend its network and operations against the evolving sophisticated cyber attacks and threats. Additionally, NATO formally accepted cyberspace as the 5th domain of warfare and has confirmed that international law applies in cyberspace. Existing international customary law separates the usage of cyber warfare into 3 categories; under the law governing the resort to force between states (jus ad Bellum), under the law of neutrality, and under the law of armed conflict (jus in bello). Likewise, Article 5 NATO Collective Defence Clause can be invoked should a cyber-attack meet the international legal definition of an ‘act of war’. However, the biggest quest in cyberspace remains that the current international law has not explicitly described what actions or severity of impacts or threshold form a cyber-attack that is equivalent to an armed attack in the real world. The UK MoD Cyber Primer argues that a cyber operation may constitute an armed attack if its method, gravity, and intensity of force are such that its effects are the same to those achieved by a kinetic attack which would reach the level of an armed attack. However, deciding on what constitutes an ‘act of war’ has been more a politically driven decision than a legal or military one.

As an international effort, in Sep 2011, China, the Russian Federation, Tajikistan, and Uzbekistan proposed an International Code of Conduct for Information Security under UN’s framework with basic principles for maintaining information and network security. Under the proposed code, each subscribing state would pledge “Not to use the information and communication technologies, including networks, to carry out hostile events or acts of aggression, and pose threats to international peace and security or to proliferate information weapons and related technologies”. However, it is not yet a legally binding document and it’s unclear how many other nations have ratified it and cooperating with this framework.

One of the big issues in cyberwarfare is that unlike in conventional warfare, the use of force is less clear in a new complicated battlespace made up of bits and bytes, where the borders between countries blur, the weapons are much more difficult to detect, and the combatants can easily be disguised as non-combatants. Crowell warned that in the future, belligerents will very likely use cyberspace to deny all elements of power: diplomatic, informational, military, and economic (DIME) use of machines and the EMS necessary for daily life.