{"id":24644,"date":"2014-07-12T19:47:09","date_gmt":"2014-07-12T19:47:09","guid":{"rendered":"http:\/\/berndpulch.org\/?p=24644"},"modified":"2021-07-15T20:13:20","modified_gmt":"2021-07-15T19:13:20","slug":"the-vocabulary-of-cyber-war-by-u-s-strategic-command","status":"publish","type":"post","link":"https:\/\/berndpulch.org\/de\/2014\/07\/12\/the-vocabulary-of-cyber-war-by-u-s-strategic-command\/","title":{"rendered":"The Vocabulary of Cyber War by U.S. Strategic Command"},"content":{"rendered":"\n

Become a Patron!<\/a>
True Information is the most valuable resource and we ask you to give back.<\/p>\n\n\n\n

\"\"<\/a><\/figure><\/div>\n\n\n
\"https:\/\/publicintelligence.net\/wp-content\/uploads\/2014\/04\/dod-network-admin1.jpg\"A restricted document from U.S. Strategic Command provides insight into the underlying philosophy of military efforts to wage cyber warfare.<\/em><\/div>\n

At the 39th Joint Doctrine Planning Conference, a semiannual meeting on topics related to military doctrine and planning held in May 2007, a contractor for Booz Allan Hamilton named Paul Schuh gave a short presentation discussing doctrinal issues related to \u201ccyberspace\u201d and the military\u2019s increasing effort to define its operations involving computer networks.  Schuh, who would later become chief of the Doctrine Branch at U.S. Cyber Command<\/a>, argued that military terminology related to cyberspace operations<\/em> was inadequate and failed to address the expansive nature of cyberspace<\/em>.  According to Schuh, the existing definition of cyberspace as \u201cthe notional environment in which digitized information is communicated over computer networks\u201d was imprecise.  Instead, he proposed that cyberspace be defined as \u201ca domain characterized by the use of electronics and the electromagnetic spectrum to store, modify, and exchange data via networked systems and associated physical infrastructures.\u201d<\/p>\n

Amid the disagreements about \u201cnotional environments\u201d and \u201coperational domains,\u201d Schuh informed the conference that \u201cexperience gleaned from recent cyberspace operations\u201d had revealed \u201cthe necessity for development of a lexicon to accommodate cyberspace operations, cyber warfare and various related terms\u201d such as \u201cweapons consequence\u201d or \u201ctarget vulnerability.\u201d  The lexicon needed to explain how the \u201c\u2018four D\u2019s (deny, degrade, disrupt, destroy)\u201d and other core terms in military terminology could be applied to cyber weapons.  The document that would later be produced to fill this void is The Cyber Warfare Lexicon<\/a>, a relatively short compendium designed to \u201cconsolidate the core terminology of cyberspace operations.\u201d  Produced by the U.S. Strategic Command\u2019s Joint Functional Command Component \u2013 Network Warfare, a predecessor to the current U.S. Cyber Command, the lexicon documents early attempts by the U.S. military to define its own cyber operations and place them within the larger context of traditional warfighting.  A version of the lexicon from January 2009 obtained by Public Intelligence includes a complete listing of terms related to the process of creating, classifying and analyzing the effects of cyber weapons.  An attachment to the lexicon includes a series of discussions on the evolution of military commanders\u2019 conceptual understanding of cyber warfare and its accompanying terminology, attempting to align the actions of software with the outcomes of traditional weaponry.<\/p>\n

Defining Cyber Warfare<\/strong><\/p>\n

One of the primary reasons for creating a lexicon devoted to cyber warfare is that there are \u201csignificant underlying differences\u201d between traditional military operations and so-called \u201cnon-traditional weapons\u201d such as those employed in cyber warfare.  The lexicon was intended to reduce these differences by integrating and standardizing the \u201cuse of these non-traditional weapons\u201d while providing \u201cdevelopers, testers, planners, targeteers, decision-makers, and battlefield operators . . . a comprehensive but flexible cyber lexicon that accounts for the unique aspects of cyber warfare while minimizing the requirement to learn new terms for each new technology of the future.\u201d  Described as a Language to Support the Development, Testing, Planning, and Employment of Cyber Weapons and Other Modern Warfare Capabilities<\/em>, the lexicon is designed to facilitate the construction and employment of cyber weapons:<\/p>\n

The cyber warfare community needs a precise language that both meets their unique requirements and allows them to interoperate in a world historically dominated by kinetic warfare. Mission planners must be able to discuss cyber weapons with their commanders, the intelligence analysts, the targeteers, and the operators, using terms that will be understood not just because they have been defined somewhere in doctrine, but also because they make sense. Giving the weapons planners a well-founded lexicon enables them to have far-reaching discussions about all manner of weapons and make important decisions with a significantly reduced likelihood of misunderstanding and operational error.<\/p><\/blockquote>\n

To understand what exactly constitutes a cyber weapon<\/em> and what makes it so different from the kind of weapons employed in traditional warfare, it is important to understand the objectives of cyber warfare<\/em>.  Cyber warfare is defined in the lexicon as the creation of \u201ceffects in and through cyberspace in support of a combatant commander\u2019s military objectives, to ensure friendly forces freedom of action in cyberspace while denying adversaries these same freedoms.\u201d  This can be accomplished through cyber attacks<\/em>, cyber defense<\/em> as well as cyber exploitation<\/em>, with each option providing its own unique set of associated capabilities and potential outcomes.  Cyber attacks bare the greatest resemblance to popular notions of cyber war, incorporating actions to \u201cdeny or manipulate information and\/or infrastructure in cyberspace\u201d through methods like a computer network attack (CNA) that are intended to \u201cdisrupt, deny, degrade, or destroy the information within computers and computer networks and\/or the computers\/networks themselves.\u201d  Cyber defense is primarily focused on defending U.S. military networks from similar attacks conducted by other nations or non-state actors and protecting the integrity of the Department of Defense\u2019s Global Information Grid (GIG) which carries military communications worldwide.  Cyber exploitation is focused primarily on the collection of intelligence and other useful data from targeted computer systems to enable improved \u201cthreat recognition\u201d that can contribute to future operations in cyberspace.<\/p>\n

These components of cyber warfare rely on capabilities<\/em> that are used to construct cyber weapon systems<\/em>.  A cyber warfare capability<\/em> is a \u201cdevice, computer program or technique\u201d that includes any combination of \u201csoftware, firmware, and hardware\u201d that is \u201cdesigned to create an effect in cyberspace, but has not been weaponized.\u201d  Weaponization is a process that takes these capabilities and implements \u201ccontrol methods, test and evaluation, safeguards, security classification guidance, interface\/delivery method\u201d and other tactical considerations to ensure that the capability can be properly employed to produce the intended effect.  A completed cyber weapon system<\/em> is a combination of one or more of these capabilities that have been weaponized and are ready for deployment.  These weapons can then be categorized based upon specific uses and issues related to their employment, such as who is authorized to use them.  One suggested schema in the lexicon provides three categories: the first for weapons that require approval from the combatant commander, a second for weapons that are pre-approved for specific uses and a third that requires the approval of the President or Secretary of Defense before the weapon can be utilized.<\/p>\n

\"Brig.<\/a><\/p>\n

One of the \u201cDiscussions on Cyberspace Operations\u201d contained in the lexicon follows the military\u2019s historical apprehension toward describing software programs and other cyber capabilities as weapons.  Throughout the early 1990s, the term \u201ctool\u201d was widely favored in the initial phases of the military\u2019s cyber warfare mission.  One reason for this reluctance was military commanders\u2019 concerns about the lack of authority under Title 10 for conducting cyber operations.  However, given that there are six \u201cJoint functions\u201d recognized in military doctrine \u201cC2 [command and control], Intel, Fires, Maneuver, Protection and Sustainment,\u201d the use of any offensive cyber capabilities \u201cunquestionably\u201d is a form of fires, making the cyber capability itself a kind of weapon.  The idea that software and computer hardware could be considered a weapon is further complicated by the fact that many offensive cyber capabilities consist of nothing more than \u201ccyber techniques\u201d that involve \u201ckeystrokes, but where no hardware or software is introduced into the target system.\u201d  When \u201clast minute changes in the target render the approved weapon inert, an operator might need to use cyber techniques to complete an assigned mission, particularly one that has been approved for effect or objective,\u201d making the certification process and training of the \u201coperator\u201d critical to considering cyber capabilities as a \u201cweapon system.\u201d  There must be control methods, testing and evaluation, safeguards, certified personnel, mission logs, a concept of operations as well as tactics, techniques and procedures on how to employ the weapon system.  This is similar to the situation with conventional weapons as \u201cthe very first M-16 rifle ever made, while a \u2018weapon\u2019 in the dictionary sense of the word, was not deployed until it was operationally tested, had a training program, spare parts inventory, etc.\u201d  It was only after this process that \u201ceach new M-16 was part of a \u2018weapon system\u2019 and could be crated and shipped to the front lines directly from the assembly line.\u201d<\/p>\n

Cyber Weapons and Their Effects<\/strong><\/p>\n

A fundamental distinction discussed in the lexicon, one which separates cyber weapons from those used in conventional warfare, is the distinction between kinetic and non-kinetic weaponry.  Kinetic weapons are those that \u201cuse forces of dynamic motion and\/or energy upon material bodies\u201d whereas non-kinetic weapons are those that \u201ccreate their effects based upon the laws of logic or principles other than the laws of physics.\u201d  Within each of these broad categories, there are further distinctions based upon the lethality of the weapon being described.  For example, a Mark-84 bomb is an example of a lethal kinetic weapon capable of inflicting physical damage to material entities based upon the use of motion and force.  The Active Denial System, a directed-energy weapon which uses millimeter waves to create a sensation of heat on the skin of human targets, is an example of a non-lethal kinetic weapon.  As a non-kinetic weapon creates its effect through the use of logic or other principles, the category necessarily encompasses a much wider array of weapon systems from diverse fields like information warfare and psychological operations.  Biological and chemical weapons are examples of lethal non-kinetic weapons that rely upon biological factors rather than physical force to create their effect.  Computer network attack (CNA) software, on the other hand, is an example of a non-lethal non-kinetic weapon, creating an effect based solely on the logical operations it performs on a targeted computer system.<\/p>\n

While cyber weapons are considered to be non-lethal in their effects, this doesn\u2019t mean that non-lethal weapons are \u201crequired to have zero probability of causing fatalities, permanent injuries, or destruction.\u201d  To better understand the effects that non-lethal non-kinetic weapons can have, the lexicon attempts to align cyber weapons with the traditional terminology of the \u201cFour D\u2019s\u201d used throughout the information operations community: deny, destroy, degrade and disrupt.  One discussion in the lexicon introduces a construct to understand these effects in terms of a scope, level and time of \u201cdenial\u201d in a targeted system, causing \u201creduction, restriction, or refusal of target operations.\u201d  Using this framework, \u201cdegrade, disrupt, and destroy\u201d would all be considered different forms of denial that have varying scopes.  Disrupt introduces a \u201ctime aspect of denial\u201d and degrade adds an \u201camount or level of denial.\u201d  The final term \u201cdestroy\u201d is saved for the \u201cspecial case that includes the maximum time and maximum amount of denial.\u201d  The lexicon even proposes a function for calculating denial:<\/p>\n

Quantitatively, denial (D) can be expressed as a function of scope (s), level (l), and time (t), i.e. D(s,l,t). Defining effects in this manner makes it clear to the planning staff that each of the parameters of the function must be considered and specified as necessary as indicated by, or derived from, commander\u2019s objective. As the level (l) or amount approaches 100% and time (t) approaches infinity, destruction is achieved.<\/p><\/blockquote>\n

The true effects of a cyber weapon often differ significantly from simply denying or even destroying an enemy system.  Every weapon \u201ctakes an action\u201d when it is triggered and this action is \u201cintended to have an effect.\u201d  For a traditional bomb, that action is a \u201ckinetic explosion and the effect is normally target damage,\u201d whereas a cyber weapon may result in \u201cthe execution of some software and the effects, some form of denial or manipulation.\u201d  However, weapons also have \u201coutcomes that are not expected and are not required to achieve the objective.\u201d  The lexicon describes these as indirect effects that can result in consequences for unintended targets.  When these consequences affect unlawful targets or cause \u201cdamage to persons or objects that would not be lawful military targets,\u201d they are considered \u201ccollateral effects\u201d that are similar to the traditional notion of collateral damage.<\/p>\n

\"unintended-consequences\"<\/a>Vulnerabilities and Target States<\/strong><\/p>\n

Past worries about collateral damage from cyber weapons have proven to be well founded.  In the summer of 2010, copies of an unknown computer worm began replicating throughout the internet<\/a> using a vulnerability in Microsoft Windows to find its way into the control systems of major corporations like Chevron<\/a>.  However, the malicious program was not the work of Chinese hackers or sophisticated cyber criminals, it was a cyber weapon called Stuxnet created as part of a joint U.S. and Israeli intelligence operation targeting Iran\u2019s nuclear program that was codenamed \u201cOlympic Games.\u201d<\/a>  Stuxnet would later claim other unintended targets, including a Russian nuclear power plant<\/a>.  Unintended effects associated with cyber weapons are dangerous for a number of reasons, including the risk that an adversary might be able to use the weapon, once discovered, against the originator of the attack.  According to the lexicon, these vulnerabilities<\/em> of cyber weapons can be separated into six distinct categories:<\/p>\n

\n