War by Other Means

How cyberattacks can stymie the US efforts to defend Taiwan against Chinese aggression. An extract

To illustrate how a cyberattack may implicate larger warfighting issues, consider a scenario that starts by Taiwan moving toward independence. China decides it is time to take the island but concedes that the United States will intervene on Taiwan’s side—so it tries to complicate and hence delay the transit of U.S forces over the Pacific. It hopes that by the time the United States does arrive, the war will be over, or at least the Chinese will have a secure lodgment on the island. To do this, the Chinese carry out a full-fledged operational cyberattack on U.S military information systems with the hopes of turning the data they contain into gibberish. Even before 2000, James Mulvenon, an authority on Chinese cyberwar, argued that the Chinese might corrupt the time-phased force deployment data accessible through DoD’s unclassified Internet.

To the extent that the United States might use force—which the Chinese, in this scenario, already assume is inevitable—a cyberattack on such a force (before it has started to fight) is an understandable use of military power. Because it is entirely possible that such a cyberattack never hits the news (at least not until after the lessons-learned analyses take place), it would not automatically evoke a narrative of attack and defense (as an opening Chinese attack on U.S critical infrastructure might). The workings of U.S military logistics may not be secret, but they are often esoteric. If such a cyberattack were to take place after Chinese forces had begun irrevocable moves toward Taiwan, and if the fact of U.S intervention was already determined, then the U.S. military would have little choice but to work around the disruption or corruption of its databases.

To make matters more complex, imagine further that the Chinese are holding back on using kinetic force while waiting to see how badly U.S forces have been delayed by the cyberattack. The Chinese may be looking for indications that are visible, but they may also be collecting from listening posts already emplaced within unclassified DoD networks. If these indicators reveal that the hoped-for effect has taken place, then the PLA may conclude that it has achieved a favorable correlation for forces and start fighting. If, however, the hoped-for effects fail to materialize, then perhaps the correlation of forces is not so good, and they may stand down and deal with the fallout from the cyberattack later, perhaps by denying everything.

Would a cyberattack on U.S. forces actually degrade mission effectiveness? If the military knew the specific vulnerabilities that such an attack would exploit, then presumably these would have been fixed already. But determining whether such a cyberattack would work may be secondary to whether the Chinese think that they can alter the correlation of forces by so doing. If the answer is yes and they find themselves debating whether to go to war, their confidence may impel them toward going ahead with both a cyberattack and a kinetic attack (incidentally, a similar argument can be made for outer space). In such a case, if they carry out a cyberattack and it turns out that the United States can fight its way through it with little effect, then although U.S. forces will be in a better position to fight, war will have begun anyhow.

Therein lies a challenge