Cyber War Cannot and Will Not Happen…Or Will It?
Introduction
Whilst there are many critics of the concept of cyber war (see Gartzke, 2013; Liff, 2012; Valeriano and Maness, 2015), foremost among them is Thomas Rid. Therefore, this essay focuses on the arguments articulated in his book Cyber War Will Not Take Place (Rid, 2013), which closely parallels the above title statement. This essay argues: 1) the concept of cyber war is compatible with a Clausewitzian understanding of war. Rid insists on violence where Clausewitz emphasised only physical force. Moreover, cyber can be both instrumental and political. The Stuxnet virus meets all three criteria and demonstrates that cyber war not only can happen, but has already happened; 2) an act of war is a subjective determination. Rid rejects the notion of cyber war based on his interpretation of Clausewitz. However, defining war solely in terms of Clausewitz is ultimately a choice. This choice overlooks broader conceptual approaches which increasingly inform non-Western strategic cultures. In practice, an act of war is not any single theoretical abstraction. An act becomes an act of war if states perceive it as such; 3) the threat of cyber war is real, and potentially nuclear. Rid dismisses the catastrophic potential of cyber-attacks as mere hypotheticals, whose destructive power would be only ‘indirect’. This latter point is accurate, but wholly irrelevant. Meanwhile, the vulnerabilities in the cyber security of weapon systems demonstrate that a cyber-induced nuclear attack, whilst seemingly improbable, is possible.
In short, cyber war is not only possible, but has already happened. Narrow conceptualisations of war, which exclude cyber threats, constrain understandings of war and overlook its subjective nature. Finally, whilst a nuclear cyber-attack may seem improbable, it remains a distinct possibility.
Clausewitz and Cyber War
Rid argues that no cyber-attack can independently constitute an act of war. Adopting a Clausewitzian framework, he argues that any act of war must be: 1) violent; 2) political; and 3) instrumental (Rid, 2013: 1–2).
In this first point, Rid quotes Clausewitz’s dictum that war is ‘an act of force’ and thus asserts: ‘All war, pretty simply, is violent’ (Rid, 2013: 1). However, force and violence are not synonymous. For example, during siege warfare, the physical use of force may be somewhat passive, seeking only to deny the enemy vital supplies. In fact, siege warfare is specifically calculated to avoid a violent, physical engagement of kinetic force. As Stone (2013: 103) observes, Rid conflates force, violence, and lethality as one, when in reality they represent three distinct phenomena.
The Stuxnet virus used against Iran’s nuclear programme represents a watershed moment in cyberwarfare. For the first time, a cyber-attack resulted in direct physical damage (Sanger, 2012). For Rid (2013: 57), however, this merely represents an act of sabotage, since ‘things are the prime targets, not humans [original emphasis]’. However, by this standard the Allied bombing campaigns of the Second World War would be downgraded to mere acts of sabotage. People were not the targets of such raids; the human casualties were incidental to the objective of damaging Germany’s industrial capacity. Irrespective of human casualties, Germany’s Minister of Armaments and War Production, Albert Speer, observed that the Schweinfurt raids, if continued, would have proven ‘fatal’ to Germany’s war effort (Stone, 2013: 104–105). Thus, an act of war need not be violent, and by no means lethal, to qualify as an act of war.
The remaining of Rid’s criteria hinge on the issue of attribution. An act of war must be instrumental, with a ‘means and an end’ and the latter is always a political purpose to ‘force the enemy to accept the offender’s will’. Thus, an act of war necessitates ‘eventual attribution’ (Rid, 2013: 2). However, in the case of Stuxnet, ‘eventual attribution’ did indeed follow the attack. Yet more importantly, irrespective of attribution, Stuxnet had already been both instrumental and political. Through the instrumental means of a cyber-attack, the US and Israel successfully imposed their political will on Tehran: a delayed Iranian nuclear programme. Thus, the absence of attribution does not disqualify an attack from constituting an act of war.
Rid’s conceptualisation of an act of war requires potentially lethal violence and political attribution. As detailed above, acts of war, from a Clausewitzian perspective, depend only on the use of force, not violence. Moreover, an act of war can be both instrumental and politically purposeful without attribution. Thus, cyber war, as demonstrated by Stuxnet, is compatible with Clausewitzian strategic theory.
Acts of War Are Subjective
For Rid, war is always violent, always instrumental, and always political (Rid, 2013: 1–2). This insistence likely derives from an interpretation of On War as discerning between the ‘changeable character’ and the ‘immutable nature’ of war (Sjøgren, 2023: 56). Rid concludes that cyber is irreconcilable with these principles, which supposedly represent the unalterable nature of war. Thus, conceiving of cyber as ‘war’ requires a rejection of these principles, and by extension, threatens the inconceivable: to change the unchanging nature of war. In other words, as war’s nature does not change, anything which threatens to change its nature, cannot be considered war. However, it is debatable whether Clausewitz made such a sharp distinction (Sjøgren, 2023: 55–61). Clausewitz himself wrote that ‘the nature of war is complex and changeable [emphasis added]’ (Clausewitz, 1832/1976: 90). Furthermore, although English translations of On War read: ‘War…adapts its characteristics’, the original German refers to ‘its nature’ or ‘seine Natur’ (Clausewitz, 1832/1976: 89; Simpson, 2018: 7).
Regardless, Rid’s choice to define war in terms of Clausewitzian theory is ultimately just that: a choice. It is a deliberate decision based on a subjective judgement on the utility of Clausewitz as a means of understanding war. However, any strategic theory’s failure to adequately accommodate the cyber threat demonstrates its own limitations more than it does the impossibility of cyber war. Despite the immense influence of Clausewitz on Western strategic thought, On War merely represents one theoretical approach of many. Yet Rid dismisses Sun Tzu’s The Art of War, likening it to little more than ‘a choppy Twitter-feed from 500 BC’ (Rid, 2013: 1). In reality, it continues to inform Chinese military doctrine, as embodied in the ‘Three Warfares’, which aim to pursue strategic objectives whilst circumventing armed conflict (Livermore, 2018). Meanwhile, Jonsson (2019: 5) argues that Russian understandings of the nature of war have broadened to encompass far more than armed conflict.
In the age of cyber, states can pursue ‘strategic, tactical and operational objectives that were once only achievable through physical means’ (Brantly, 2017: 76). Consequently, states can pursue war’s political goals whilst bypassing its conventional means, thereby waging war in a manner unrecognisable as ‘war’ within Western strategic paradigms. As Warren (2020: 88) observes, ‘the absence of war as Western audiences define it is not the absence of war as [non-Western] adversaries define it [original emphasis]’. An over-reliance on Clausewitz for a theoretical understanding of war leads policy-makers, military strategists and academics to overlook the emergent cyber threat, which does not intuitively fall within a Clausewitzian paradigm, with its emphasis on physical, kinetic force (Greggs, 2024: 74–77).
In practice, what constitutes an act of war is determined by states. The US Department of Defense recognises cyberspace as a distinct operational domain of war, ‘as relevant…as the naturally occurring domains of land, sea, air, and space’ (DoD, 2010: 37). NATO also recognises the cyber domain and would consider invoking Article 5 in response to a major cyber-attack (Stoltenberg, 2016; 2019). Meanwhile, the US acknowledges that a full-scale cyber-attack would have an ‘existential impact’ comparable to that of a nuclear strike, and reserves the right to consider ‘a nuclear response in the most extreme case’ (DoD, 2013: 6, 32).
If states, particularly a consensus of states, come to view cyber-attacks as acts of war, then they fundamentally are acts of war. Just as anarchy is ‘what states make of it’ (Wendt, 1992), the same holds true for war.
The Nuclear Cyber Threat
The threat of cyber war is real, and potentially nuclear. However, Rid dismisses such catastrophic cyber scenarios, largely on the basis that they have not yet happened: ‘they remain fiction, not to say science fiction’ (Rid, 2013: 3–4). In this respect, Rid suffers from the same ‘failure of imagination’ which preceded 9/11 (Kean et al., 2004: 10). Whilst a cyber-induced nuclear attack may seem improbable, it is by no means impossible.
Rid would nonetheless object that violence from such an attack would be ‘indirect’. Code, having no independent physical force, relies on weaponising an existing system, and is therefore ‘parasitic on the target [original emphasis]’ (Rid, 2013: 13). Whilst this is true, it is also utterly irrelevant. If a missile strike produced an explosion equivalent to 200kg of TNT, whilst a cyber-induced attack triggered an explosion equivalent to 5 kilotons, there is little doubt as to which is the more consequential act of war. The physical effects matter far more than the physical means.
Elsewhere, Rid and McBurney (2012: 11–12) argue that cyber-attacks against secured targets would ‘probably require the resources or the support of a state’. However, cyber has a disconcertingly low barrier to entry. In 2018, a US government report concluded that any software-dependent weapon subsystem is vulnerable to cyber-attacks. In one instance, a two-person test team infiltrated a weapon system in just one hour, gaining full control of the system after a single day. One test, using a ‘basic technique’ requiring ‘little knowledge or expertise’ was halted mid-test due to safety concerns. Alarmingly, default software passwords were often left unchanged, with one test team guessing an administrator password in just nine seconds (GAO, 2018: 1, 22–23). A DoD cyber task force acknowledged that it is ‘impossible to completely defend against the most sophisticated cyber attacks’. Moreover, the task force advised that nuclear deterrence would remain viable not due to cyber security but ‘only because…[full-spectrum state adversaries] have much to hold at risk’ (DoD, 2013: iii, 7). Considering these vulnerabilities, it is especially disconcerting that in 2010, the US Air Force lost contact with fifty Minuteman ICBMs for nearly an hour. During this time, the missile crews would have been unable to detect or abort any unauthorised launch resulting from a cyber-attack (Perry and Collina, 2020: 74).
The nuclear cyber threat may seem improbable. Such attacks will hopefully remain hypothetical. Yet they are far more probable than Rid admits, and a far cry further from impossible.
Conclusion
Though Rid rejects the concept of cyber-attacks as independent acts of war, this essay has argued that they are compatible with a Clausewitzian conceptualisation of war. Cyber-attacks are capable of effecting physical force, in an instrumental manner, and in pursuit of a political purpose. The Stuxnet virus, having met all three of these criteria, demonstrates that acts of cyber war are not a question of if and when, but here and now.
Ultimately, however, acts of war are determined by subjective perceptions. Based on his interpretation of a single, though highly influential, strategic theory, Rid rejects the very concept of cyber war. In doing so, alternative conceptual approaches to war are overlooked, even as non-Western adversaries increasingly diverge from traditional Western understandings of war. In reality, if states perceive cyber-attacks as acts of war, then they fundamentally are acts of war. In this sense, war is in the eye of the beholder.
Get James Sanders’s stories in your inbox
Join Medium for free to get updates from this writer.
Finally, the threat of cyber war is real, and raises the spectre of nuclear war. Whilst such a scenario remains hypothetical, it is by no means impossible. Arguing that the effects of such attacks would be causally indirect in no way diminishes their destructive potential. Even the most advanced cyber security cannot guarantee that weapon systems will not be compromised. Therefore, though seemingly implausible, the threat of a cyber-induced nuclear attack remains an ominous possibility.
In sum, cyber war is no longer a future possibility; it is a present-day reality. Narrow conceptual approaches which fail to acknowledge cyber as war overlook the subjective nature of acts of war. Finally, whilst nuclear cyber threats remain improbable, they are nonetheless possible. Complacency is no antidote to the emergent threat of cyber war.
References
Brantly, A. F. (2017). The Violence of Hacking: State Violence and Cyberspace. The Cyber Defense Review, 2(1), 73–92.
Clausewitz, C. von. (1832/1976). On War. Edited and translated from the German by Howard, M. and Paret, P. Princeton: Princeton University Press.
DoD. (2010). Quadrennial Defense Review Report. [online]. US Department of Defense. February 2010. Available at: https://dod.defense.gov/Portals/1/features/defenseReviews/QDR/QDR_as_of_29JAN10_1600.pdf [accessed 14th May 2024].
DoD. (2013). Task Force Report: Resilient Military Systems and the Advanced Cyber Threat. [online]. DTIC. January 2013. Available at: https://apps.dtic.mil/sti/pdfs/ADA569975.pdf [accessed 6th May 2024].
GAO. (2018). Weapon Systems Cybersecurity: DOD Just Beginning to Grapple with Scale of Vulnerabilities. [online]. Government Accountability Office. October 2018. Available at: https://www.gao.gov/assets/gao-19-128.pdf [accessed 8th May 2024].
Gartzke, E. (2013). The Myth of Cyberwar: Bringing War in Cyberspace Back Down to Earth. International Security, 38(2), 41–73.
Greggs, D. (2024). Violent Limitation: Cyber Effects Reveal Gaps in Clausewitzian Theory. The Cyber Defense Review, 9(1), 73–86.
Jonsson, O. (2019). The Russian Understanding of War: Blurring the Lines between War and Peace. Washington, DC: Georgetown University Press.
Kean, T. H. et al. (2004). The 9/11 Commission Report: Final Report of the National Commission on Terrorist Attacks Upon the United States. [online]. GovInfo. 22nd July 2004. Available at: https://www.govinfo.gov/content/pkg/GPO-911REPORT/pdf/GPO-911REPORT-24.pdf [accessed 9th May 2024].
Liff, A. P. (2012). Cyberwar: A New ‘Absolute Weapon’? The Proliferation of Cyberwarfare Capabilities and Interstate War. The Journal of Strategic Studies, 35(3), 401–428.
Livermore, D. (2018). China’s “Three Warfares” In Theory and Practice in the South China Sea. [online]. Georgetown Security Studies Review. 25th March 2018. Available at: https://georgetownsecuritystudiesreview.org/2018/03/25/chinas-three-warfares-in-theory-and-practice-in-the-south-china-sea/ [accessed 13th May 2024].
Perry, W. J. and Collina, T. Z. (2020). The Button: The New Nuclear Arms Race and Presidential Power from Truman to Trump. Dallas: BenBella Books.
Rid, T. and McBurney, P. (2012). Cyber-Weapons. The RUSI Journal, 157(1), 6–13.
Rid, T. (2013). Cyber War Will Not Take Place. New York: Oxford University Press.
Sanger, D. E. (2012). Obama Order Sped Up Wave of Cyberattacks Against Iran. [online]. The New York Times. 1st June 2012. Available at: https://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.html [accessed 11th May 2024].
Simpson, E. (2018). Clausewitz’s Theory of War and Victory in Contemporary Conflict. Parameters, 47(4), 7–18.
Sjøgren, S. (2023). The Last Refuge of the Unimaginative? Doctrine and Its Role in the Military Profession. Thesis (PhD). Roskilde University, Denmark.
Stoltenberg, J. (2016). Press conference. [online]. NATO. 14th June 2016. Available at: https://www.nato.int/cps/en/natohq/opinions_132349.htm?selectedLocale=en [accessed 14th May 2024].
Stoltenberg, J. (2019). NATO will defend itself. [online]. NATO. 27th August 2019. Available at: https://www.nato.int/cps/en/natohq/news_168435.htm [accessed 13th May 2024].
Stone, J. (2013). Cyber War Will Take Place! The Journal of Strategic Studies, 36(1), 101–108.
Valeriano, B. and Maness, R. C. (2015). Cyber War versus Cyber Realities: Cyber Conflict in the International System. New York: Oxford University Press.
Warren, J. (2020). Not All Wars Are Violent: Identifying Faulty Assumptions for the Information War. Air & Space Power Journal, 34(4), 75–90.
Wendt, A. (1992). Anarchy Is What States Make of It: The Social Construction of Power Politics. International Organization, 46(2), 391–425.
