Jason Healey recently authored a provocative piece in which he raised the question – “Is Cyber Revolutionary or Barely Relevant in Modern Warfare?”  It’s something that needs to be seriously and objectively examined as the past decade or so has seen nation states amp up their offensive cyber capabilities, used them in extensive cyber espionage campaigns, infiltrated critical infrastructures, and yes, have used them in conjunction with kinetic warfare.  Now, no longer a hypothetical, one can look objectively at how cyber thinking has evolved from considering it the next nuclear weapon to what it has largely become – a magnificent medium to conduct espionage, infiltrate networks, and disrupt systems and operations.  But is it the revolutionary weapon that many have expected and predicted?  For the present, the answer would have to be a ‘no,” or at least, a “not yet.”
 
Like any modern weapon, there are certain advantages to using cyber attacks as a tactical\first strike weapon that could occur near tandemly with a kinetic assault, achieving surprise while inspiring uncertainty in both civilian and military audiences, providing critical momentum to the aggressor.  And this may very well still hold true for attacks against nations that are not cyber-capable, both in offense and defense.  For those that have a capability like Ukraine, and an understanding of their adversary, cyber attacks and where they were directed by the Russians were not unexpected, nor were their initial targets (e.g., critical infrastructure).  At this juncture, states are generally aware of the challenges that exist in cyberspace including but not limited to prolific cybercrime campaigns, cyber espionage, data privacy concerns, the emergence of advanced technology, cybersecurity, among others.  The fact that state and nonstate threat actors take advantage of cyberspace and use it to their benefit, a condition undoubtedly exacerbated by geopolitical environments, should come as no surprise.  Nor should the fact that states will use them in the steps leading up to a kinetic conflict, as well at the onset of an invasion, and throughout the conflict.  So, while the specific targets of an attack may be a surprise, the fact that cyber attacks are coming should not be.
 
In terms of military conflict, one expert suggests that cyber operations can provide an advantage over an adversary, in at least naval engagements.  Granted, this was a modeling scenario, but it provides a potential realistic scenario that could happen, especially as the threat of coercive Taiwan reunification would ostensibly bring naval powers to bear.  This is interesting given the increasing evidence of the vulnerabilities in maritime assets and reporting of cyber attacks “impacting” warships and support vessels, and some being compromised by ransomware attacks. Given the navy’s need for cyber resiliency, and its questionable ability for cyber readiness, this is a legitimate concern, especially as global maritime warfare – as in a possible China-United States confrontation – could be impactful on future state-on-state combat.  But again, that is hypothetical, requiring a real-world conflict scenario to provide better a better understanding into the extent with which cyber attacks would have in sea battle.  What might emerge is that an anti-ship weapon or other forms of sabotage might be more reliable in delaying a naval deployment than a disruptive cyber attack.
 
Cyber has provided limited strategic or even tactical advantage in land conflicts.  First seen in the 2008 Russia-Georgiaengagement, there was an expectation of what would happen.  Though those attacks fell short of impacting the brief clash, many ruminated on what could be.  Fast forward to today, the current Russia-Ukraine conflict has afforded us the opportunity to observe an extensive number of cyber attacks have been used by both state combatants, as well as their state allies, and nonstate proxies.  Attackers have targeted critical infrastructure, logistics, government and military organizations, and even disseminated soft-power disinformation and influence operations.  And despite these various state and nonstate elements conducting thousands of  cyber attacks of varying levels of magnitude, the war has remained largely a stalemate with cyber weaponry providing neither side a distinct advantage over the other. 
 
So, Healey’s question is a good one to ask especially at the policymaker level and in the context of a tenuous geopolitical environment where cyber-capable states can come to blows both in the digital and physical spaces.  A revolutionary cyber attack would be something to behold, but it would also have to succeed.  Stuxnet is still largely considered a revolutionary attack particularly for what it did and was supposed to do.  However, while successful, it fell short of its intended execution and impact.  It was powerful and frightening, but it wasn’t a game changer.  It certainly gave Iran the chance to dissect and study it, and in turn, increase their own understanding of different method a state can conduct a cyber attacks, and how the target can defend against future ones.
 
Even the Russian cyber attack against VIASAT can be considered a next-level attack, ambitious in scale and a consequence of impacting government and military organizations, as well as other key companies and civilian populations of several countries that relied VIASAT.  The general consensus was that the attack was a sophisticated one involving a combination of wiper malware and network-based attacks to disrupt the satellite’s Internet services to several European countries.  The attack was short lived, though it should be noted that there is little insight into whether it was supposed to be a temporary attack to support a tactical initiative or one intended  to have more long-lasting effects.  
 
So, observers have witnessed the evolution of cyber attacks as single strikes, used in conjunction with kinetic attacks, hunt forward operations partnering with another state, and the use of organized and unorganized proxies.  This indicates that cyber is still a work in progress, and while there may be a secret cyber weapon capable of rendering massive destruction, we simply have not seen it used yet.  And if the best cyber weapons have not been deployed in a conflict like Ukraine, it begs the question if there is a cyber weapon/attack that can yield a revolutionary effect.
 
Recently, the United States halted hunt forward operations against Russia, a move many critics have cried as giving in to Russia, rather than considering if it may be part of a strategy to put the fighting in Ukraine to rest.  Perhaps such a move was initiated to help sweeten the pot in order resolve a never-ending conflict.  And maybe, just maybe, this was put on the table because strikes were not achieving the type of decisive dividends as had been hoped.  After all, if they had shifted the balance of the war, there would be no need to stop them as long as they assisted in Russia’s capitulation.
 
Therefore, I’d say cyber weapons are not there yet.  But that does not mean they are not being developed to be just that.  When completed, what’s left will be how to deploy it in a way that matches the desired outcome.  And hopefully, just like a nuclear weapon, there will be sensible thought about when and if to use it, and under what circumstance.
 

About the Author

Emilio Iasiello

Emilio Iasiello has nearly 20 years’ experience as a strategic cyber intelligence analyst, supporting US government civilian and military intelligence organizations, as well as the private sector. He has delivered cyber threat presentations to domestic and international audiences and has published extensively in such peer-reviewed journals as Parameters, Journal of Strategic Security, the Georgetown Journal of International Affairs, and the Cyber Defense Review, among others. All comments and opinions expressed are solely his own.