The Lawless Trons of Cyberspace

 By LT Travis Nicks, USN

Introduction

Open borders are here. You likely crossed the Rio Grande before breakfast this morning and you’ll sneak into China before you sleep tonight. Trons travel through cyberspace ignoring all manners of political boundaries. Technology doesn’t care where Ukraine ends and Russia begins, or about an air gap between China and Taiwan. The policy of cyber does; it shouldn’t.

Conceptualizing Cyber Borders

 The national policy for cyber borders has been similar to conceptions of airspace: a vertical extension of geopolitical borders into the sky, or in the case of cyber, into the flowing infrastructure of the internet. If a plane is going to travel through the airspace of another country, that country has to agree to it or the flight has to go around. A long-range bomber aircraft might fly over a few countries for a raid on the other side. Packets or “trons” can travel continents’ worth of countries in a path of least resistance taking seconds. Furthermore, while borders stay the same, digital routes are totally dynamic. In order to prevent the unintended escalation of cyber operations, we must divorce the routes trons take from the effects they cause.

A Path Forward

Fortunately, an existing policy framework already exists for an effects-based policy in a new frontier. We need to rise above the airspace mentality, and draw inspiration from satellites. Satellites travel freely over countries and cross borders with impunity. The international community agreed to a borderless framework in space in the Outer Space Treaty of 1967.1 The orbit a satellite is on and its position relative to political borders are irrelevant when it takes an action that causes an effect. The effect is all that matters. The group at the effect’s end may protest or retaliate, but the country under the satellite at the time of the action will have no issue. If, for example, China shot down a Russian satellite while the satellite was over Mexico, Russia would have no issue with Mexico for having allowed the attack above them, because they don’t own that space. Instead, China would be responsible for causing the malign effect.

The Department of Defense (DoD) has addressed this attribution issue. The DoD Law of War Manual specifically addresses “cyber operations that use communications infrastructure in neutral states.”2 This policy allows trons to be routed through neutral nations so long as the cyber infrastructure in that country allows innocuous information to be routed through it as well, if they route trons for the common World Wide Web. It also specifically acknowledges that it is unreasonable to expect other nations to review all cyber traffic for its content. These principles are fundamental to the spirit and design of the internet. Acknowledging those fundamentals will prevent future conflicts that will otherwise arise from misattribution during analysis of tron routes. Imagine Canada sends cyber attack trons to Russia via France, Thailand, and China. It is easy to see Russia determining that China may not have ownership of the trons that attacked them, but—unless we agree otherwise—they were complicit in the attack. A scenario where clumsy confusion leads to aggressive accusation, the likes of which we have not seen since the eve of WW1, is not far-fetched given the cyber domain’s peculiarities.

Many international cyber agreements are being written. One, the International Code of Conduct for Information Security, has already been signed by major players Russia and China. That agreement addresses the intent of cyber warfare and end effects, but leaves a grey area in between. A 2013 NATO report addressed this point indirectly, saying “demilitarized zones are not feasible in the context of cyberspace, due to its global scope.”3 NATO failed to separate the infrastructure itself from the use of the infrastructure. A United Nations report from 2015 (aware of NATO’s 2013 report)  further departs in the wrong direction and declares “states of jurisdiction over the ICT (information and communications technologies) infrastructure located within their territory.”4 This policy direction simply does not pragmatically address the technology involved. The transnational spirit of the internet and the technology itself does not respect borders as the UN does. A failure to acknowledge this fact is dangerous. The focus on infrastructure and not on the transmissions and effects of the technology leaves a dangerous grey area.

The solution is an agreement among the international community to ignore cyber routes. The DoD’s cyber components must press this issue into international agreements. The Department is uniquely equipped to lead this effort. It is the center of our nation’s cyber warfare universe. The NSA, CIA, DIA, and others with less notoriety are led or staffed largely by military officers and enlisted, retired versions of the same, or DoD civilians. No other organization is as integrated into every aspect of offensive and defensive cyber operations. DoD’s outsized operational involvement gives us an equally outsized cyber policy voice, and we should use it to ensure a discussion on cyber routes.

The discussion should acknowledge, first, that attribution is the foundation of cyber warfare. Second, acknowledge that routing technologies use the communications equipment of neutral states to obscure  the origin of cyber-attacks. After establishing those truths, the policy must focus on ensuring the analysis of digital forensic evidence acknowledges the inherent deceptiveness of cyber route analysis and delegitimizes the evidence as international policy. The international community must agree to focus on the information and effects of the trons and not attempt to hold accountable the infrastructure used for transmission. Absolve the owners of the infrastructure and the land on which it sits from responsibility for the trons it transmits, and inversely remove the standing they might have if they dislike the trons.

Conclusion

The publicly available cyber discussions in the international community have so far focused on intent, effects, and physical infrastructure while they ignore any agreement on cyber routes. To avoid a massive international misunderstanding in the fog of attribution we must internationally agree to ignore cyber routes. We have a framework for this. In space we own the object, not the orbit. In cyber we will own the information, not the route.

Travis Nicks is a nuclear submarine officer serving at the Pentagon. He is focused on finding precise fixes to complex problems. LT Nicks is interested in cyber policy and personnel performance issues. The views herein are his alone and do not represent the views of the Department of Defense, the Department of the Navy, or any other organization.

References

1. Outer Space Treaty, 1967, Article II

2. Department of Defense, Law of War Manual, 2016, Section 16.4.1

3. Dr. Katharina Ziolkowski, NATO Cooperative Cyber Defense Centre of Excellence, Confidence Building Measures for Cyberspace – Legal Implications, 2013, Section 3.2

4. Group of Government Experts, United Nations General Assembly, report on Developments in the Field of Information and Telecommunications in the Context of International Security, 2015, Section VI.28.a.

Featured Image: U.S. Navy Petty Officer 1st Class Joel Melendez, Naval Network Warfare Command information systems analysis, U.S. Air Force Staff Sgt. Rogerick Montgomery, U.S. Cyber Command network analysis, and U.S. Army Staff Sgt. Jacob Harding, 780th Military Intelligence Brigade cyber systems analysis, analyze an exercise scenario during Cyber Flag 13-1, Nov. 8, 2012, at Nellis Air Force Base, Nev. (U.S. Air Force photo by Senior Airman Matthew Lancaster)

What Does the New Administration Need to Know About the U.S. Navy?

By Dmitry Filipoff

Week Dates: Jan. 16 – Jan. 20.
Responses Due: Jan. 15
Response Length: 400 Words or Less

As various bureaucracies orient themselves around the incoming administration, they must transmit a clear message describing their purpose in serving the nation, the challenges they face, and how new leadership offers opportunity for change. Please respond below to share your thoughts on how the U.S. Navy may answer these key questions in 400 words or less. Respondents can opt to reply anonymously if so desired. We ask that submissions be objective and nonpartisan. CIMSEC will publish top responses as a topic week beginning Jan. 16 in the days leading up to the presidential inauguration. If the online form does not work for you please direct your responses to Nextwar@cimsec.org.

Dmitry Filipoff is CIMSEC’s Director of Online Content. Contact him at Nextwar@cimsec.org.

Featured Image: NAVAL STATION ROTA, Spain (July 10, 2016) – Gunner’s Mate 2nd Class Garrett Nelson speaks with President Barack Obama during his visit to USS Ross (DDG 71) July 10. (U.S. Navy photo by Mass Communication Specialist 1st Class Brian Dietrick/Released)

A Discussion on Grand Strategy and International Order with Barry Posen

By Mina Pollmann

Barry Posen is Ford International Professor of Political Science at MIT, Director of the MIT Security Studies Program, and serves on the Executive Committee of Seminar XXI. Currently on leave, he is presently serving as the Henry A. Kissinger Chair in Foreign Policy and International Relations at the Library of Congress John W. Kluge Center for the 2016-2017 term. In his most recent book, Restraint: A New Foundation for U.S. Grand Strategy (2015), Dr. Posen critiques Liberal Hegemony, the intellectual foundation of current U.S. grand strategy. He presents a bold new vision, a Grand Strategy of Restraint, as an alternative to Liberal Hegemony, and argues that the U.S. ought to focus on pursuing its security through an emphasis on command of the commons, a strategy with a considerable maritime component. CIMSEC spoke with Dr. Posen to get his take on how his arguments can be applied to the world’s emerging strategic defense dilemmas.

Q: Many have suggested that the U.S. is lacking a coherent strategy, including incoming Secretary of Defense James Mattis, who has testified that the U.S. is suffering from “strategic atrophy.” To what extent do you agree with such statements? Is it that the U.S. lacks strategic vision, or that the chaotic nature of the world makes the pursuit of any set strategic goals a fruitless exercise?

A: The United States has had the same strategy since the end of the Cold War. That strategy is Liberal Hegemony. It has two purposes: preserve to the extent possible the immediate post Cold War U.S. power and influence advantage relative to other nation states (dubbed the “unipolar moment”) and promote the spread of democratic forms of governance, market economies, and the rule of law—both within societies and at the level of the international system. This is a revolutionary strategy: it is meant to ensure U.S. security by transforming international politics.

These goals are very ambitious, and confront many moving targets. First, the economic and technological bases for power are diffusing to other countries and to groups, making it inherently difficult to preserve U.S. power and influence relative to them. Second, other peoples may not wish to emulate our forms of governance and economic organization. Nationalism is a strong force, making societies resistant to external tutelage. In some places, there simply is no obvious path to a liberal future. The Middle East is perhaps the most obvious example. There is a strong tension between the preservation of U.S. interests, power, and the spread of democracy. Indeed, there is not even sufficient cause-effect understandings about how to construct democracies.

Q: The U.S. identifies its adversaries in a 4+1 construct: revisionist regional powers such as China and Russia, rogue states that make wild threats and are pursuing or have pursued weapons of mass destruction such as Iran and North Korea, and the condition of widespread extremism and insurgent conflict. Under a Grand Strategy of Restraint, what would be the priorities among these threats?

A: The U.S. needs to think about what are the main threats to its safety, sovereignty, territorial integrity, and to its ability to generate sufficient power to defend these.  If China or Russia were to establish hegemony in their regions, that would be a problem for the U.S. Russia is not powerful enough to do so in Europe. China may grow to be powerful enough to do so in Asia. So China is the main problem, though a full court press of containment seems premature.

“Rogue” states are not major problems for U.S. security; they may be problems for U.S. allies and if those allies lack the power to deal with them, then the U.S. can lend a hand. Extremism can be a problem, when it manifests itself in terrorist organizations with global ambitions. But this threat cannot be addressed as we have tried to address it, by reforming societies at the source. Instead the best the U.S. can do is keep pressure on such groups to divert their energies to their own defense, and to put defensive barriers between them and the U.S. This will not stop every problem, but efforts to go to the source, as attempted in Afghanistan and Iraq seem to create new terrorists as fast as the U.S. eliminates old ones.

Q: What is the force structure that a Strategy of Restraint recommends?

A: Restraint focuses U.S. security efforts on the most important threats to U.S. security. And it chooses military forces that are most appropriate to address those threats. Though ‘terrorists of global reach’ are a threat to U.S. safety, the chosen remedy of the last fifteen years—sending large numbers of ground forces to democratize and reform riven societies at gunpoint has proven wildly expensive and largely ineffective. Restraint cuts the ground forces that have been employed for this purpose. Restraint does oppose other great powers who might try to establish hegemony in Eurasia. To maintain the capability to act in Asia, the U.S. must retain command of the sea, and of course sufficient command of air and of space to be able to move forces across the ocean, should that become necessary.

At this time, the most survivable warship in the U.S. inventory is the nuclear attack submarine. When forward deployed, it makes a critical contribution to blocking other great powers access to the open oceans. The aircraft carrier provides a mobile, strategic reserve, to assist threatened allies, and to help sustain command of the air over the open oceans. That said, the carrier is increasingly vulnerable to a range of weapon systems deployed ashore. Thus, in wars with peer competitors, carrier forces must be used in strength and also with care. Except against much weaker states, they can no longer be viewed as airfields that can simply linger offshore for extended periods. U.S. strategic decision makers—civilian and military—must confront the strong possibility that in a serious conflict, some carriers will be lost. The U.S. began WW2 with six carriers; by the end of 1942 four were sunk; and two were badly damaged. Command of the sea does not come cheap.

Q: How important is it for the U.S. to assert itself in the South China Sea? What strategic interests and precedents are at stake? What is the value of freedom of navigation operations there and what other means can the U.S. employ to shape the environment?

A: The U.S. relies on the sea to access the rest of the world, not just for trade, but more importantly to ensure against the rise of a continental hegemon. Thus the U.S. should protect freedom of the seas. States are tempted to bootstrap historical claims and the fine print of the Convention on the Law of the Sea to assert control over quite a lot of sea space. The U.S. should ratify the Convention and continue to assert its right to sail in those waters where others’ claims seem beyond what the Convention allows.

Q: You severely criticize “buck-passing diplomacy” by U.S. allies in your book. Yet there are partners who have been working well with the U.S. (e.g. Singapore) or that the U.S. could be doing more with (e.g. Australia). How can the U.S. better leverage security relationships with such prospective partners? Are there any lessons the U.S. can learn from these relationships that can be applied to the U.S.’s relationships with less forthcoming partners?

A: Most U.S. allies invest much smaller shares of GDP in defense than does the U.S.  This arises from their confidence that the U.S. will defend them, and perhaps also their true doubts about the imminence of security threats. They may complain about those threats, but they may not be as concerned as they pretend to be. Australia is one of the allies that under-invests. To the extent that some allies do more than others, this arises from either their proximity to threats, or their history of having been abandoned, or nearly abandoned by past protectors. 

There are three lessons for the U.S. First, when your allies tell you they are frightened, ask them what they intend to do about it before offering to solve the problem for them.  If the answer is not much, then do not rush to address the problem. Second, make burden sharing a central issue of alliance diplomacy. Third, remind allies that the U.S. is inherently a very secure country. And the U.S. retains command of the sea. We have more options than they do. They need to earn our support.

Q: Donald Trump, on the campaign trail, suggested that the U.S. provide less security to allies unless they paid more, and hinted that Japan, South Korea, and other countries, should acquire nuclear weapons. If Donald Trump sustains pressure on U.S. allies to increase burden sharing, how may these alliances evolve?

A: Eliciting a more equitable sharing of defense burdens requires a strategy. If the President simply sends an irate tweet every now and then, he will accomplish very little.

There are two ways this can go. First, the President can complain and at the same time unilaterally reduce U.S. military contributions to the alliance. If the U.S. simply disengages, my prediction is that U.S. allies, who are quite rich, will learn to defend themselves. But the process could be rocky. This could include getting nuclear weapons. We may wish for prudential reasons to attempt serious reform first. Or, the U.S. can make burden sharing a central issue in the alliances, hinting that our contributions depend on theirs.

The President and U.S. cabinet officials and diplomats must communicate regularly and publicly with allies on this issue. The alliances must set actual concrete military goals. Many of these should be public. The performance of allies must be assessed in public. The Congress must hold hearings on the matter. The press needs to be induced to cover the issue. The allies need to be made to believe that this is very, very serious. If they value U.S. help, they must show that they care about their own defense. They must be made to believe that without evidence to this effect, the alliances will fray, and they will find themselves on their own. Few people remember that this is what the U.S. did with NATO in the late 1970s and early 1980s. It did not work perfectly, but it worked better than anything attempted in recent years.

Q: In the conclusion of your book, you remark that change can happen through one of three ways. The Strategy of Restraint could be adopted through astute politicians listening to proponents of the Strategy of Restraint and having a “eureka” moment; through crisis; or through incremental changes. Is Trump’s election more like a “eureka” moment, or just the first step in a longer process of redirecting U.S. security policy?

A: It is very difficult to read the actual foreign policy orientation of the Trump administration. It does not look to me as if this is a ‘eureka’ moment for the “Restraint” strategy. Instead, this looks a bit like hegemony without liberalism. President-elect Trump has promised to increase U.S. military spending. This is not consistent with Restraint. His appointees seem to be people who wish to militarily confront those states and groups who challenge the U.S. in any way. China and Iran seem to be at the head of the list. Some of his appointees seem hostile to Russia as well. The President-elect seems to wish to do something more aggressive vis-a-vis Al Qaeda and ISIL than the outgoing administration. It is hard to see how this many military confrontations would be consistent with Restraint. With this many under-thought confrontations underway, it is likely that one or more will go awry. The costs will mount, and future administrations will find they have even less public support for a forward grand strategy. This is how I imagine the U.S. could ultimately shift to a more restrained grand strategy.

Barry Posen is Ford International Professor of Political Science at MIT, Director of the MIT Security Studies Program, and serves on the Executive Committee of Seminar XXI. He is presently serving as the Henry A. Kissinger Chair in Foreign Policy and International Relations at the Library of Congress John W. Kluge Center.

Mina Pollmann is CIMSEC’s Director of External Relations.

Featured Image: CAMP FUJI, Japan (Nov. 4, 2016) MV-22B Osprey tiltrotor aircraft return after a long-range raid from Combined Arms Training Center, Camp Fuji, Japan to Marine Corps Air Station Futenma, Okinawa as part of Blue Chromite 2017, Nov. 4, 2016. (U.S. Marine Corps photo by Sergeant Major Michael Cato/released)

Sea Control 126 – End of the Year Episode 2016

By Matthew Merighi

It’s the end of the year, so the CIMSEC team gets together to talk about the events of 2016 and does its best to look into the crystal ball to see what is on the horizon in 2017.

Happy New Year from the entire CIMSEC team!

Matthew Merighi is the Senior Producer for Sea Control and the Host of Sea Control: North America. He works as Assistant Director of Maritime Studies at the Fletcher School of Law and Diplomacy.

Fostering the Discussion on Securing the Seas.