Cyber Changes Everything, Cyber Changes Nothing: On Admiral Rogers' Vision and Guidance for Cyber Command

In June, US Cyber Command issued Beyond the Build. It presents Admiral Michael Rogers’ vision and guidance for the command and its subordinate units. With little fanfare, the document was publically released in September by the Department of Defense. It has yet to receive much attention. Here’s why everyone should read it.

Arguments about the effects of cyberspace on military operations and strategy often resemble a Rorschach test — more telling in regard to the professional background and personality of the author, than the ramifications of cyber technologies on warfare.

Nonetheless, past arguments have provided insights into cyber’s potential ramifications upon conflict. They have spurred thinking about how cyber may change the outbreak and conduct of war. Generally, past works fall into one of two camps (each of which are well known to Lawfare readers).

One camp, personified by Paul Rosenzweig, argues cyber changes everything. Members of this camp contend that cyber transforms warfare and generates strategic effects. Their conclusion is predicated on the ability of cyber weapons to generate physical damage, render harm without being detected, and obfuscate attribution (thus undermining deterrence). They posit the idea that cyber warfare is destabilizing because it redefines and redistributes strategic military power. At this moment in time, they claim, the ambiguity that surrounds cyber’s effects on military operations and strategy is itself unsettling the status quo.

The other camp, personified by Erik Gartzke, argues that cyber changes nothing. Members of this camp contend that cyber generates no unique effects. Their conclusion is predicated on the belief that the need for surprise (in order to prevent the target from establishing an effective defense) inherently limits the coercive potential of cyber technologies; the moment a threat is leveled, it can be countered. Their position is also based on the belief that any damage caused by cyber weapons would be temporary, thus reducing the utility or benefit of such an attack. They claim that cyber weapons add options to the arsenal of the strong, reinforcing the status quo.

Both camps are right. Both camps are wrong.

Admiral Rogers’ vision, delivered as practical guide rather than esoteric theorizing, cracks open an important truism — cyber changes everything, cyber changes nothing. More than that, however, it provides an opportunity to reconsider how cyber technologies affect conflicts (and the political objectives that motivate them). It does this by highlighting how cyberspace alters three foundational elements of war: (1) how militaries fight and defend, (2) how and when militaries come into contact with one another, and (3) how military force is generated and sustained.

Central to the commander’s vision is the notion that cyber technologies alter the application of military force, they change how militaries fight. Beginning with the opening sentence — “As cyberspace has grown and become more pervasive, military art has changed” — and continuing throughout the document, is an argument that cyber must be integrated into the full spectrum of military operations (from peacetime preparation, through war, and into recovery operations). Rogers contends that cyber must be part of planning, training, and execution. Furthermore, rather than being held as something distinct, Rogers argues that cyber technologies must be folded into the traditional terminology, operational concepts, tactics, techniques, and procedures of existing military mission sets.

The commander’s vision recognizes cyber as a domain unto itself, one that permeates and extends beyond the physical domains. It captures an important reality: the sinews of our national economy, our political and social systems, our governments’ communication conduits, and our military’s command and control systems now reside in the cyber domain. This creates new vulnerabilities for the United States. As Rogers’ statement makes clear, we are not unique in this: “All nations have vulnerabilities that can be exploited in and through cyberspace,…” In short, the defense of our political values, physical security, and economic health — as well as the maintenance of our military readiness — is no longer confined to the physical world. This condition expands how and when militaries come into contact with one another. National militaries now deploy to, reconnoiter, and fight upon locations defined by IP-address, in addition to locations identified by grid coordinates. Unlike their physical counter-parts, digital operations are constant. Adversarial militaries are simultaneously and constantly in contact with one another.

Changes in how militaries fight and how and when they come into contact with one another necessitate changes in how military force is generated and sustained. It is this area to which the commander devotes the most attention. Admiral Rogers argues that to build and sustain a military capable of meeting the demands of the modern world, “The nation needs a motivated, fully-trained, and well-led cyber workforce that understands evolving technologies and adversary TTPs. The workforce — military (both active and reserve), civilian, and contractor — is the Command’s greatest resource.” In addition, he argues that procurement processes must be made more agile and efficient so that we can properly equip our forces. As the Admiral makes clear, both of these tasks require commitment to an operational mindset whereby our cyber capabilities are led, not administered.

Admiral Rogers’ vision statement for Cyber Command deserves more attention. Cyber technologies change how force is used, where and when it is used, and how it is sustained. We agree. It moves beyond the “either/or” straw man positions of past debates and places cyber technologies alongside traditional instruments of military power. From Rogers’ point of view, cyber alone is neither strategically decisive nor strategically immaterial. A balanced approach is needed, one that sees the potential of cyber and the realities of its limits. In his foreword, Rogers makes this point: “We must train and exercise to operate with degraded systems, because digital connectivity should never be taken for granted.” A profound statement from the Commander of Cyber Command, his tenant has significant implications for the civilian realm of both the public and private sectors.

The substance of Rogers’ vision statement is important. Equally important, however, Cyber Command’s Beyond the Build provides a path for the next generation of thinking about cyber’s effects upon warfare. The debates should now move beyond whether or not there are important effects. In fact, the task before academics and policymakers is the same as the one with which Admiral Rogers charged Cyber Command: it is “…to make this domain understood by other warfighter and integrated into broader military and governmental operational while providing decision makers and operational commanders with a wider range of options while resources are constrained and threats are growing.”