My concern is not so much that countries like China can compete with the United States on the conventional battlefield. My concern is that China could fight a war against the United States without deploying a single military asset. I fear our current force posture is not adequately prepared to handle new cyber threats.
The United States can protect itself the tangible threat of terrorism. But how is the United States’ current military posture prepared to handle a sophisticated cyber attack on Wall Street, that manages to shut down the stock market for a few weeks? This is not an indictment on the United States military but rather an observation of a major challenge that lies ahead. The United States needs to understand that Chinese cyber warfare capabilities could reduce the impact of our combined military output. Regardless of how advanced its ships, tanks, and aircraft might be, their uses can be nullified with a series of keystrokes from thousands of miles away. If anything, cyber warfare capabilities gives China the ability to wield a unique tool of deterrence just as powerful as a nuclear arsenal. It also prevents them from having to engage the United States military in a conventional fight it would otherwise lose. They do not even need to direct cyber warfare against our military assets. All they have to do is attack civilian infrastructure.
The truly terrifying aspect of cyber warfare is its characteristics of anonymity and remoteness. While the United States might have the capability to readily identify the Chinese as the likely culprit in any cyber attack on the United States, proving it definitively might be a challenge. Unlike using photographs–collectively known as imagery–to prove the Russians were hiding missiles in Cuba, using intelligence to point the proverbial finger at China for a cyber attack is not an exact science. At best, the United States’ intelligence community might be able to state that an attack originated from somewhere in China, which might or might not implicate a government, a rogue group such as Anonymous, or a lone wolf who simply wants to cause trouble. Attributing the attack to a personable identity is comparable to finding a needle in a haystack. Being able to identify an IP address for instance does not translate into finding the name and exact address of an attack’s perpetrator. Thus the anonymity of cyber attacks moots the use of a calculated military response since military responses are usually justified as reciprocity for an attack on one’s sovereignty.
Since it is relatively difficult to put a face to a cyber attacker or attribute a cyber attack to an entire government, a group, or individual, what might be interpreted as a violation of one’s sovereignty cannot be readily proven. As such, the United States, perceiving a cyber attack originating from China, might have a hard time justifying the destruction of Chinese military assets as a reciprocal response to a cyber attack. American allies might be skeptical that the cyber attack was even sanctioned by the Chinese government, due much in part to the lack of precision when identifying the attack’s perpetrator. Furthermore, China could plead ignorance of the attack and successfully posit the United States as an opportunist aggressor attacking China without due cause. This would risk putting American credibility into question and leave the United States by itself in something that could well turn into all out war.
But even if the United States was able to prove China was involved in a cyber attack and had the support of the global community regarding a reciprocal military response for a violation of sovereignty, the United States would have to ask if the response is even worth it. China and the United States, for all intents and purposes, are mutually symbiotic, at least from an economic perspective. Recognizing this, there is a distinct possibility that the United States and even China would be jeopardizing their economic vitality. War between the two countries would create global economic havoc and leave both the United States and China in a state of damaging economic depression. Any military response can lead to misunderstandings, which in turn can lead to escalation that could dramatically drive up the cost of war in terms of lives and money. Therefore, the United States should really think about how it would respond to a Chinese cyber attack and whether or not it should resort to offensive or diplomatic means of castigation.
Yet another question is what circumstances would cause China to use cyber warfare against the United States. The most recent apparent Chinese sanctioned cyber attacks against the United States have been relatively benign and have mostly involved the private sector. These attacks have not damaged our civilian or military infrastructure making these attacks relatively harmless. China, if it is in fact behind these attacks, does not seem interested in engaging in any belligerent attacks. More than anything, the term cyber attack might be a little too strong of a description for China’s current digital machinations. Cyber espionage and cyber theft might be better terms as they more readily capture the intents of Chinese cyber strategy. More than anything, China wants to remain ahead of the curve in an economic sense. As such, it might seek to steal secrets on American companies, exploiting those secrets to anticipate how corporate rivals might react to certain conditions. This would undoubtedly give Chinese companies a significant advantage over American competitors. After all, the Chinese government if not completely endorsing, is at least tolerating cyber piracy, which is robbing the global entertainment industry of billions in capital. The Chinese seem to be doing just enough to secure its position as a growing economic and military powerhouse.
Regarding cyber espionage, the Chinese are likely probing our infrastructure, military and civilian, for any weakness, which could be exploited in times of war. But I seriously doubt China would initiate a cyber attack against the United States. The Chinese would more than likely engage in a large-scale cyber attack against the United States if it is already at war with the United States. In other words, China would not use a cyber attack to open the war so to speak, but would rather use it as effective weapon to drive up the material cost of American military action. For instance, if the Chinese and the United States were engaged in a conventional conflict in the South China Sea, China could launch a debilitating cyber attack on Wall Street that leaves it unable to engage in an important economic activity. Say this attack shuts down Wall Street for an entire month. The United States might be forced to abandon military operations for fear that prolonged conflict will only leave it economically bankrupt. In this capacity, Chinese cyber warfare capabilities would be as effective a deterrent as a nuclear weapon. It could negate the superiority of American military force without even dropping a single bomb.
In all likelihood, Chinese cyber actions will never escalate to the level of belligerency just described. The possibility is very remote in my opinion and will likely remain more of a nuisance than a serious national security threat. These opinions are by no means definitive as more research needs to be done on the subject. But implying that China, who has too much to lose by engaging in massive cyber attacks, is out to destroy our civilian and military infrastructure is very premature. China might well be considering the deterrent application of cyber warfare for future hypothetical engagements. But in the interim, it merely seems content to steal valuable economic information from rival companies, meaning that cyber theft for instance might become the standard norm of Chinese cyber activities directed towards the United States.