The title of Brian Mazanec’s book is somewhat misleading, for this work does not explore the evolution of cyber war. Neither does it attempt to predict how cyber war will evolve. Instead, the study seeks to apply norms theory—a theoretical approach useful to both hard and soft sciences—to war, a not-at-all scientific historical phenomenon whose most common norm seems to be expediency. In war, regardless of treaties and conventions (and, yes, norms), the prevailing rule is that might makes right, and the victors write volume after volume of history proving such to be the case.
In an ideal academic setting, Mazanec might use lessons learned from the application of norms-development theory to earlier instances of norms development for various emerging weapons technologies to anticipate what cyber war norms might evolve into. However, he is a federal employee with senior-level experience as a defense analyst and prior publications in the area of cyber warfare. Despite his bona fides, given the difficulty of applying any academic theory to real-world actions that put actual lives at risk, Mazanec has taken on a challenge that may well be insurmountable. With that caution, let us move on to the content of this study of how we come to have norms regulating warfare of various types.
First, because they are the basis for this book, we need to understand exactly what norms are. As the author reminds us, they are the agreed-to means of dealing with whatever issue society seeks to civilize. They are standards of appropriate or inappropriate behavior, not defined by nature but by society. According to norm theory, norms do not arise spontaneously and arbitrarily but evolve through a sequence of stages, each characterized by a set of elements.
In the first stage, norm emergence, old norms become obsolete or inappropriate to new conditions. In the void of normative behavior, competing nascent norms coexist, and slowly a new potential norm rises above its rivals. It has no constituency, merely potential to become the new defining behavior for the new circumstance. Over time it develops a following and an advocacy group—and it grows.
After emergence is the norm cascade. When the norm reaches viability, it begins to become more and more accepted, with the increasing speed of acceptability creating a cascade effect that broadens and accelerates acceptance. During this stage, the river becomes a figurative rapids, a cataract, and finally a waterfall. The cascade can involve either masses of insignificant players or a handful of major movers.
Once the norm is widely acknowledged, comes the third stage—norm internalization. At this point, a norm can still die because it requires near-unanimous acceptance and compliance. The norm is not theoretical but integral to whichever condition it deals with. Internalization commonly does not occur unless it is to the real advantage of major powers.
Norm theory works for the sciences, soft and hard, but as Mazanec acknowledges, it requires significant refinement and narrowing to fit the evolution of weapons technology. In narrowing the theory to fit, the author discards the positive and voluntary aspects of the theory, throws out peaceful or positive norms, and focuses on the proscriptive ones that define power relationships in the creation of weapons use and development norms. Mazanec notes that he deals with restraints rather than permissions.
Among the norms he addresses is the set for cyber war, but the study takes a long time getting there. Before attempting to discuss cyber war norms, the author applies norm theory to other weapons technologies that arose in the previous 125 years or so. Examples of the development of norms for emerging weapons technology include gas, airpower, nuclear weapons, contemporary emerging technologies, and, finally, cyber warfare.
First, Mazanec recaptures the history of chemical and biological weapons development—the events leading to the international consensus that such weapons were unacceptable. He notes, among other things, that the weapons-ban norm arose from preexisting norms that outlawed some other sorts of behavior as barbaric and that for the most part, the norm has stood despite pressure for many decades, with only rogues violating the norm—the Iraqis under Saddam Hussein, for instance.
Mazanec also cites strategic bombing. In this case, the norm began developing even before such bombing became possible. It failed to become internalized because bombing became advantageous to one power rather than to all, and the advantage overwhelmed the potential barbarism of the technology. The author’s key argument is that a norm will not internalize if a power finds advantage in rejecting it or imposing it on others while remaining aloof.
Nuclear and emerging-technology weapons are the other scenarios, the former much more developed than the latter. And the final emerging technology, late in this work, is cyber warfare. At this point, Mazanec seemingly throws up his hands, noting that the major powers have no incentive, are active players against cyber foes, and probably could not do much other than what they do. He develops no scenario in which a norm for cyber warfare can become internalized. Even cascading is unlikely.
Norms must go through all of the stages if they are to mature and become internalized. Nothing in the theory says that a norm will do so, though, and the author does indicate that some norms stall out at one level or another because of factors that he describes—the most important being the disincentive for those in power to accept the norms and their restraints. Mazanec reads this disincentive as dooming the development of any effective norm for or against cyber war.
The Evolution of Cyber Warfare includes a list of abbreviations, notes, and a bibliography, as well as an appendix that expands on the events summarized or referenced in the short chapter on cyber warfare. For chemical/biological weapons, strategic bombing, and nuclear arms, the author incorporates this sort of material in the relevant chapter. Segregating it in an appendix for cyber war seems odd, given the tendency of the casual reader to ignore end matter generally, but the appendix is useful nevertheless.
The first impression after finishing the study is that the author spends too much time developing norm theory and too little applying it to cyber warfare. The imbalance is one negative, and another is the finding that norm theory does not allow significant prediction of how cyber warfare will develop.
The book is either irrelevant or premature if all it can offer is a recommendation to mobilize and prepare to withstand the onslaught—old stuff because norms will not develop to restrain bad actors from engaging in cyber warfare. In sum, Mazanec says to stay the course and throw out any prospect of norms arising to regulate cyber warfare. In short, although the author has developed an interesting study of norm theory as it pertains to what is acceptable and unacceptable in the development and use of weaponry, he fails to show that norm theory is all that useful in the specific area of concern—cyber war.
If the ultimate outcome of his study is that norm theory indicates that norms will not develop for cyber warfare, then what is the point? It is a provocative test of a social science theory, but the result of the experiment is failure in the applicable case. Readers looking for some sort of idea of where cyber warfare countermeasures might trend in the short or long term will find no guidance here. For the practical warrior, The Evolution of Cyber Warfare does nothing.
John H. Barnhill, PhD
Houston, Texas