Global Security Studies, Spring 2014, Volume 5, Issue 2
Don’t Forget the Humans: Toward a 21st Century Offensive Cyber Strategy
Mr. Josh M. Cartin
U.S. Army War College, DDE Class of 2014
U.S. Department of State
4170 AIT Taipei Place
Dulles, VA 20189
+886-933-192-451
josh@desertdragon.com
Abstract
As military competitors and allies alike explore military applications of cyberspace of increasing
scope and complexity, a debate rages in national security circles about cyber war: what might it
look like, whether one is imminent, and whether such a phenomenon is even possible, have
become topics of debate given characteristics that distinguish cyberspace from other warfighting
domains. This paper proposes two types of offensive cyber operation, instrumental and strategic,
and argues that strategic offensive cyber operations are a form of information warfare that aim
primarily to act upon adversary perceptions, which are fundamental to warfare as viewed as a
contest of wills. A close examination of recent cyber campaigns attributed to China yields a
nuanced understanding of from whence cyber operations derive their strategic potential. Such an
understanding will be critical if the United States is to leverage its current technological
advantage and imagine offensive cyber operations to maintain the initiative against able
adversaries whose own strategic traditions condition them for warfare that transcends the
physical into the information domain.
Key Terms: Information Operations, Warfare, China, Technology, Deterrence, Deception
Introduction
Recent public allegations of Chinese government sponsorship of intrusions into U.S.-
based government, military, and commercial information systems have prompted a flurry of
commentary, diplomatic activity, Congressional hearings, and at least one Presidential Executive
Order. (Obama, 2013) Discussion has settled on the realization that hostile actors have the
capability and motivation to erode U.S. military and commercial advantages by exploiting
American society’s ubiquitous reliance on cyberspace. The conclusion is that all segments of
society need to work together to reduce the vulnerabilities that make hostile exploitation
possible. (Wallace, 2013) With few exceptions, commentary has focused on defense and
resilience of information systems, necessary and worthy investments whether the malicious
actors are hostile states, criminal networks, “hacktivists,” or bored teenagers in a basement. The
concept of offensive cyber operations has been absent from most public discussion, with the
notable exception of presumed United States involvement in the 2009-10 Stuxnet worm attack
on Iran’s nuclear program. (Gross, 2011)
That the main perpetrator in recently revealed cyber attacks is China, the only perceptible
potential spoiler of U.S. global dominance, has however revived a debate that has been
simmering in national security circles for over a decade regarding the concept of “cyber war”:
