Be the Windscreen, Not the Bug

Cyber – An Air Commander’s Responsibility

By Lieutenant Colonel

By Lt Col

 Dave

 Sexstone

, CA

 AF

Joint Air Power Competence Centre (2012-2016)

Published:
 September 2014
 in 
Warfare Domains: Cyberspace Operations
Subject Areas: Cyberspace Operations

Introduction

What is Cyber? More importantly, why should you as a military professional, commander and airman even care to understand? Frankly, what Cyber is defined as precisely and whether it be anointed as its own ­domain is irrelevant. Your general awareness of Cyber, its risks and associated consequences from an oper­ational planning and continuity of operations perspective is what is important. Leadership is what is required to act; i.e. having gained awareness of Cyber risks and implications, execute a consequence management plan to remain effective. Take the time to recognize your dependency on Cyber to operate.

Cyber in Practical Terms

A loose description of Cyber is provided here to frame understanding. Cyber is a system of any and all electronic technologies networked or linked together to allow their sum coordinated effect, function or mission. Cyber is a medium or a tool to enable. From an Air Power perspective Cyber includes, but is not limited to, the interconnectivity of aircraft, ISR platforms, fusion centres, and Air Command and Control (C2) elements.

Dependency on Cyber

The consequences to Air Power of a Cyber action is argu­ably potentially more harmful than to the other services due to its more centralized and Cyber depen­d­ent approach to C2 and synchronized execution. Furthermore, as Air Power is prin­cipally a supporting arm to other services in a joint or combined campaign, the required collaboration with other services / components and higher headquarters to support is also a factor. What is important is recognition of your dependency on Cyber, an understanding of the associated vulner­ability and a determination of associated actions neces­sary to reduce the consequences of this dependency. The degree of interconnectivity Cyber offers has en­abled the potential for commanders to receive and exchange an unprecedented amount of data and ­information, and thus an expectation of situational awareness that supports expedited decision-making. Commanders and their staffs need to ask themselves, are we ready for the inevitable; the moment when ­access to critical information is slowed or prevented? Or even worse, the trustworthiness of that information becomes suspect?

Cyber Ownership: Adapt to and Exploit It

It is fair to say that most airmen today inaccurately view Cyber as a simple ‘wire and router’ or a desktop computer network, and hence mitigation of their dependency is transposed to the CIS / A6 staff to manage. The reality facing airmen today regarding Cyber requires an approach where Commanders and oper­ational plan­ners’ take ownership of the problem and con­duct the necessary assessments to determine courses of action to maintain effective operational function should elements of that Cyber be rendered inoper­able or degraded for any reason. Much the same as an airman is eager and compelled to understand Electronic Warfare to be able to both exploit and survive in the air, he must begin the journey to understand and survive within the broader Cyber world.

The incredible level of interconnectivity achieved by information technology burdened Air C2 systems, platforms, sensors, power plants and grids, civil works, etc. have combined to introduce both threats and opportunities for the conduct of a campaign.

While NATO is of common mind about the need for Cyber Defence, it is divided over the collective development and conduct of active defensive and offensive Cyber operations. It is clear that globally a number of nations as well as non-state actors are active poking and prodding via Cyber seeking to exploit military and civilian elements. The major global powers all are known to have the ability to exploit Cyber and would not hesitate to do so to gain advantage in a military or other conflict. The same can be said for a number of smaller nations. A simple search and review of open sources alone highlights the players and the successes.

Stated in another way, the concern regarding Cyber perhaps is best summarized in a covering memorandum enclosed in the published report2 from the Task Force on Resilient Military Systems and the Advanced Cyber Threat. Therein it states, ‘There is no silver bullet that will eliminate the threats inherent to leveraging Cyber as a force multiplier, and it is impossible to completely defend against the most sophisticated Cyber attacks.’ The Task Force goes on to recommend a risk reduction strategy which includes: improved Cyber Defence; refocused intelligence capability; and a segmentation of critical mission capabilities to retain some level of function and response in face of a catastrophic attack. While the strategy reduces Cyber risk it does not eliminate it. The message to commanders remains unchanged; plan and be prepared for reduced capability.

Cyber: A Principles of War Perspective

The importance of understanding Cyber may be ­stated from another standpoint; a back to the basics principled perspective, i.e. long recognized Principles of War (PoW). Representative PoW of a few nations and the NATO Principles of Operations3 (PoO) are ­listed in Table 1 below. While western nation states and NATO have slightly different PoW / PoO, stark ­similarities highlight sound considerations in the con­duct of warfighting or campaign conduct. The PoW are of course not dogma, but it does not take too much of an imagination to understand how Cyber could both empower and undermine a commander’s campaign. Cyber directly supports or enables vir­tually every PoW. Stated another way, the PoW or their application have dependencies in one way or another to Cyber.

I do not intend to dissect every PoW against Cyber, just a few to provide some thought for further con­sideration and thereby seek to re-enforce the importance of Command understanding and leadership engagement re Cyber as part of an air warfighting mindset.

Offensive Action. This principle is about taking or seizing and exploiting the initiative, thereby imposing on the opponent a compelling need to react or defend. The ultimate aim is to get inside the opponent’s decision-making and disrupt his ability to execute his plan or to command his force effectively. Offensive action in NATO’s comprehensive approach environment lends itself to and is more inclusive of means leading to the required effect / objective. Certainly being able to suppress an opponent’s air defence, anti-aircraft net­works or associated command and control elements temporarily via Cyber attack with virtually no notice would allow the application of this principle in the right circumstances. The debilitation of command and control, disruption or severing of sustainment lines of communications or critical supporting infrastructure each offer an opportunity for offensive action in cooperation with traditional conventional methods.

Surprise. Sun-tzu is said to have proclaimed, ‘to subdue the enemy without fighting is the acme of skill’4 and that knowing the adversary and proceeding with speed and stealth offers opportunity for surprise. Through understanding of adversary, the weaknesses or vulnerabilities are mapped and exploits identified. This principle and underlying approach was perhaps best demonstrated with the debated debilitation or set-back of the Iranian nuclear program, exercised through malicious code insertion.5

Security. The principle is about protecting one’s own force while maintaining the freedom to act against an opponent. Physical and other measures are employed to protect the force; this clearly must include the protection of information systems and Cyber as a whole. Measures within NATO are ongoing to improve the defence of specific elements of Cyber enabled capabilities; certain networks. Defending or securing elements of Cyber enabled capabilities is a laudable goal, but as already indicated in the above-noted Task Force study, not believed to be assured. Recent expositions to the vulnerability of Cyber6 have been laid bare by the so-called Snowden Affair, as well as the revelation of a serious flaw within arguably a more commonly used internet security encryption protocol7. Issues of Cyber complexity, human error, blind understanding, and a keen desire to know your adversary all play out to affect this security principle. Certain governments are known to actively feed on and exploit security measures to acquire industrial or diplomatic benefit. Refer back to Sun-tzu, and ask yourself whether such governments limit their efforts. Some nations possess professional Cyber warriors. How secure are you in the belief that your capabilities and information are protected from infiltration? Importantly, how confident are you that you have contingent or branch plans in place to counter-act or work through such an infiltration which might include an element of information corruption or a power grid failure?

Flexibility. The immaturity of Cyber law and the relative leeway afforded Cyber events compared to kinetic or lethal force offers opportunity or alternate avenues to achieve effect. Flexibility calls for creativity of mind and adaptability to changing circumstance, giving consideration to alternate means to achieve the end or effect. In a more modern yet still traditional sense, this has meant the ability to dynamically redirect conventional forces to target. While Cyber related action tends to be more deliberate, certainly awareness and consideration of such tools and capabilities and their potential for application also speaks to the principle of flexibility. A flexible mindset starts and flourishes with education and exercise. Commanders must light the fire within their staffs and subordinate commanders to pursue understanding of Cyber and to apply it in oper­ational planning and campaign development.

Concluding Comment

In summary, the intent of this journal article was to highlight the need for Commanders as military profes­sionals and airmen to understand Cyber and its implications to the conduct of operations and campaigns; both opportunity and vulnerability. Ultimately, Commanders’ leadership is essential to indoctrinate a mindset of awareness and consideration for Cyber opportunities and vulnerabilities in operational planning, consequence management and courses of ­action. The insertion of Cyber into exercise execution and concepts is a starting point.

Command and control of air capabilities which has increasingly become integrated by and dependent on Cyber must be studied and understood from a warfighting perspective. Much the same as the aircraft after its introduction at the dawn of the 20th century changed the battlefield and considerations, Cyber, as a pivotal enabler to Air Power, must now be dissected for implications to the art of warfighting.

Variation of expression; see http://www.phrases.org.uk/bulletin_board/46/messages/327.html.
US Department of Defense: DEFENSE SCIENCE BOARD Task Force Report: Resilient Military Systems and the Advanced Cyber Threat dated Jan. 2013.
AJP-01(D), Allied Joint Doctrine December 2010. A twelfth PoO, Multinationality, omitted intentionally.
www.goodreads.com re quotes attributed to Sun tzu in his Art of War.
http://investigations.nbcnews.com/_news/2013/06/27/19175276-the-worm-that-turned-how-stuxnet-helped-heat-up-cyberarms-race?lite.
http://www.bbc.com/news/technology-25832341.
http://heartbleed.com/.
Content Navigation
Author
Lieutenant Colonel
 Dave
 Sexstone
Joint Air Power Competence Centre (2012-2016)

Lieutenant Colonel Dave Sexstone is assigned to the C4ISR and Space Branch at the Joint Air Power Competence Centre in Kalkar, Germany. Responsible for the Deployed Communications and Information Systems (CIS) and Cyber portfolio, Lieutenant Colonel Sexstone is a Communications Electronics Officer with 31 years’ service to the Royal Canadian Air Force. Lieutenant Colonel Sexstone has served at the operational level principally at 1 Canadian Air Division Headquarters in various capacities including as the A6, and more recently with the Canadian Operational Support Command coordinating planning for and execution of Deployed CIS to all Canadian international operations.

Information provided is current as of September 2014

Other Articles in this Journal

Leadership Perspective

Interview with General Gorenc

Interview with Commander US Air Forces in Europe, US Air Forces Africa, Allied Air Command and Director Joint Air Power Competence Centre

Transformation & Capabilities

First Collective AAR Clearance Trial

An Outstanding Best Practice for Truly Collective Development

Air and Space Power in NATO – Future Vector Project

Europe’s Strategic Airlift Gap

Quantifying the Capability Gap and Measuring Solutions

Capacity Language Building in NATO

Language Skill as a Crucial Tool for Interoperability at All Levels

How is Close Air Support Changing?

Viewpoints

Future Considerations of BMC2

BMC2 Must Be Both Horizontally and Vertically Integrated to Maximize Information Exchange and Fusion

Intellectual Interoperability and Higher Education

Professional Training and Partnership Development with Academia

Communication as a Service

100 Years of German Naval Aviation

A Continuous Change from the Beginning

Where are the Carriers?

Affirming and Preserving NATO Air Power from the Sea

Developing Future Force Protection Capability

Part 2

Unmanned Cargo Aircraft!

A Paradigm Shift for Theatre and Tactical Level Logistics in Asymmetric Conflicts?

Out of the Box

The $50.00 Cognitive Swiss Army Knife

Manual Simulation Systems – Versatility Trumps All

Contact Us

Contact Information

Joint Air Power Competence Centre
Römerstrasse 140
47546 Kalkar
Germany

+49 (0) 2824 90 2201

Please leave us a message