Strategic Warfare in Cyberspace

Strategic Warfare in Cyberspace, by Gregory J. Rattray. MIT Press, 2001, 517 pp. 

Developing the appropriate strategic understanding to win our nation's first cyberspace war will be at least as important as airpower strategy development was during World War II. Gregory J. Rattray presents this very comparison in Strategic Warfare in Cyberspace by illustrating potential strategic cyberspace conflict considerations before examining historical analogies between airpower and information warfare theory. The 2001 work is obviously slightly dated regarding recent notable cyberspace actions, including the National Strategy to Secure Cyberspace in 2003 and the Comprehensive National Cybersecurity Initiative in 2009, although the broader analysis still carries significant value. The volume carefully examines what would now be called cyberwarfare's associated concepts and terminology, develops a clear thesis, and presents a historical comparative study. This excellent work provides a clear starting point for anyone looking for historical cyberspace background as well as graduate level discussions for the professional strategist.

The author's thesis suggests five factors critical to generating and then assessing organizational technological capacity: a supportive institutional environment, demand-pull motivation, managerial initiative, technological expertise, and learning ability. Each factor presents a different facet necessary to create strategic power and organizational success. First, policies, legal restrictions, and cultural influences drive institutional ability to adapt to environmental, technological changes. Demand-pull refers to the emphasis organizations place on change; demand-pulls can occur from customer desires, threats, or fluctuating government regulation by altering the agencies strategic direction. Managerial initiative speaks to leadership's ability to articulate their vision while technological expertise creates the right blend of people and skills at the right time and in the right place. Finally, learning ability reflects an organization's capability to adapt through upsetting conventional wisdom, encouraging experimentation, and empowering individuals. Rattray uses this framework to successfully compare early strategic airpower development (1920–1947) with early strategic information warfare (SIW) development (1990–2002). Although the examined information period is shorter regarding information warfare, the framework still provides a clear guide to important events.

The work's clear strengths are the first three chapters. Here, Rattray carefully explains guiding concepts, articulates how strategic information warfare may be conducted, and then advances the unique aspects about his thesis. Two key definitions emerge within the introductory chapter; first, SIW is the means for state and nonstate actors to achieve objectives through digital attacks against adversary centers of gravity, and second, digital warfare represents microforce occasions where effects are disproportionate to the energy used. The next chapter carefully blends those definitions into a strategic vision within information warfare. This vision reviews offensive and defensive techniques as well as previous warfare strategies before concluding that SIW requires offensive advantage, targets to attack, minimal opportunity for the adversary to retaliate, and a possibility to assess one's effects. At this point, the book's thesis appears and carefully examines how organizational capacity affects offensive and defensive opportunities within cyberspace.

Unfortunately, after this point, the book shifts toward historical application rather than future vision. Chapters four and five do an excellent job of laying out early strategic airpower and some of the ideas associated with SIW development. Every Airman should read about early strategic airpower, B-17 development, and Air War Plans Division–Plan 1 (AWPD-1) influences. The historical approach excellently uses Rattray's thesis, but I am not convinced this section adds significant value to the overall work. In the same manner, the chapter on information warfare during the 1990s is interesting, but many of the ideas and functions have been superseded since the book's 2001 publication. At the time of publication, the information was likely the only available source for this data. Since then, many other authors have recreated early cyberspace history. Factors like Stuxnet, smartphones, and the Department of Homeland Security's Critical Infrastructure program simply did not exist when the work first reached print.

An excellent example here when critiquing the work as slightly dated is simply the United States Cyber Command (USCYBERCOM). Launched in 2010 from a combination of Joint Force Component Command–Network Warfare and Joint Task Force–Global Network Operations, this organization emerged at the National Security Agency's Fort Meade headquarters to form the premier Department of Defense organization for cyberwarfare. Although unit operations are spread across the United States and the globe, the center for digital SIW likely resides at Fort Meade. This lack is not the author's fault; as mentioned, these organizations did not exist at publication, but their current influence on the field is significant. One other small critique, more pictures would have been helpful. Line drawings were included of various organizational structures, but no easy reference guide was included to all included diagrams.

From an US Air Force officer's perspective, this work is outstanding and should be read as a core professional development piece by every operational leader whose career touches cyberspace. Rattray's own experience as a USAF information operations squadron commander shines through his work with both his in-the-weeds understanding and strategic vision. The careful comparison between airpower and cyberspace development illuminates the analytical thinking and planning success required at the strategic level. Rattray's thesis identifies areas necessary for organizational success, and his historical examples provide the proper perspective. The thesis can likely be used up and down the operational chain to measure organizational capacity. An interesting case study would be to apply this model against either USCYBERCOM or a service cyber component. As demonstrated, only through correct integration of managerial initiative, technological expertise, and learning adaption within our own organizations can we ensure success in any forthcoming digital conflict—large or small. This work demonstrates a comprehensive understanding of how our Air Force should proceed to be just as successful at "Fly, Fight, and Win" in cyberspace as we have been in air and space.