As a follow up to my post regarding China’s growing cyber warfare capability, I have decided to ask whether the threat associated with this burgeoning capability is being exaggerated. In saying this, I do not mean we should trivialize the matter. Instead, I seek to bring a sense of equilibrium to the debate surrounding China’s cyber warfare capability. I am not discounting the obvious national security challenges that an increased Chinese cyber warfare capability poses to the United States. Recent instances of cyber attacks attributed to China might lead many of us to believe China is developing an offensive series of unconventional weapons. But I am particularly interested in exploring the other side of this debate, which posits Chinese cyber warfare platforms as being purely defensive. There is certainly legitimacy to both sides of the debate and I hope that by exploring both we might begin to form a clearer understanding of China’s intentions regarding it’s cyber warfare capability.
I think it is pertinent to cite an excellent article speaking about the purportedly inflated threat of Chinese cyber attacks. Thomas Rid, in an article written for Foreign Policy, highlights several myths and misconceptions regarding Chinese cyber warfare capability. Relatively early in his piece, he takes issue with Leon Panetta’s premise that we are in danger of experiencing an imminent cyber Pearl Harbor. The analogy, according to Rid, is misrepresentative. Pearl Harbor, he explains, actually resulted in casualties, whereas there has been no documented death attributed to what we would call a cyber attack. He is not trying to belittle our rightful concerns regarding China’s supposed cyber arsenal. More than anything, he is simply trying to dial down the concern regarding something that may not be as malign as it initially seems.
Rid continues his piece by highlighting the rather inconclusive and inconsistent intelligence that designates the Chinese government as sanctioning cyber attacks against the United States. A private cybersecurity firm, Mandiant, has supposedly identified the source of Chinese cyber attacks to a building housing what appears to be a specialized force of purported cyber warriors, conspicuously identified as Unit 61398. In a report, Mandiant outlines its reasoning and assessment that identifies the People’s Liberation Army as a prime culprit in cyber attacks against the United States. But Rid is quick to note some confounding factors regarding Mandiant’s assessment. He refers to a concept in the intelligence community known as words of estimative probability. Rid is very uncomfortable with the assertiveness of Mandiant’s claims. Even if they prove correct, the lack of estimate language in the Mandiant report, such as possibly, supposedly, maybe, and other neutral words of attribution leaves the report open to criticism if not outright dismissal.
Mandiant is making an assessment on the best available evidence, which is often what professional intelligence agencies rely on when making their assessments. The Mandiant report even acknowledges this. But there is an issue of causality at play here, where the Chinese could easily say it was probably a deviant group or individual that carried out the attack. In the report’s executive summary, Mandiant admits that it cannot determine the extent of Chinese government involvement. The report simply states that the Chinese government is aware of these attacks. But it does not specifically identify the Chinese government as a perpetrator.
Rid is not shy of commending Mandiant for its willingness to publicize their report. He also acknowledges their success in proving that numerous attacks have actually originated from China. But he points out that the headquarters of Unit 61398 is located near a large Chinese neighborhood. In my opinion, this implies there could have been any number of individually motivated groups or Chinese citizens who could have launched a cyber attack against the United States. While I for one believe Mandiant’s assessment, it might not be enough to convince the court of global opinion. For it is not really a matter of whether the Chinese government is officially engaging in cyber attacks. For if the United States wants to justify a proportional response to Chinese cyber attacks it needs damning evidence that the Chinese government is directly involved. Without such evidence, the United States risks positing itself as an irresponsible actor on the global stage.
But the United States seems to be taking a more aggressive posture with regards to defending against cyber attacks. The Director of National Intelligence, General James Clapper has actually tried to tone down the concern regarding China’s cyber warfare capability. Yet even so, General Keith Alexander, head of United States Cyber Command, has outlined a plan of response to Chinese cyber attacks. He specifically noted the creation of cyberteams that will become our frontline defense against cyber attacks directed against the United States. These teams will be offensive in nature and serve as a deterrent against Chinese cyber attacks.
While our nation certainly needs to be prepared for cyber attacks, I believe an offensive posture is not the way to go. While the United States cannot let Chinese cyber attacks go unanswered it needs to recognize that the open admission of offensive cyberteams might be interpreted as unwarranted aggression by the Chinese.The fact that these cyberteams are being described as deterrents implies the use of eye-for-an-eye style military strategies that runs the risk of escalating conflict to intolerable levels. Instead of fielding offensive style cyberteams it would suit the United States better to pursue a strategy that prevents and mitigates cyber attacks. The rationale behind American cyber defense strategy should actually embrace the concept of defense. Merely building your defense on a good offense ignores the need to concentrate on preventative measures. The United States should instead concentrate on training cyber warriors to identify, prevent, and mitigate attacks before they cause significant damage.
But why would the Chinese even want a cyber warfare capability? The Chinese recognize the futility of fighting the United States on a conventional battlefield. China understands just how far it lags behind the United States military in terms of technology, training, strength, and ability. A war with the United States would be costly in terms of lives and money. China has no interest in going to war with the United States. But China does have its share of territorial ambitions and seeks to exercise them.
One of the notable areas where China wishes to expand its presence is the South China Sea and the Senkaku Islands. China believes it has the right to exercise territoriality in its proverbial backyard and these geographic areas are considered prime, strategic real estate. The South China Sea offers China the ability to exploit natural resources such as oil and opens up a valuable maritime route that it would certainly benefit from economically. The Senkaku Islands on the the other had offers China a militarily valuable strategic location. But several Asian nations in addition to the United States are not fond of such ambitions. They share a desire to curtail if not halt Chinese hopes of expansion. This invariably brings China into conflict with the United States, which perceives itself as a de-facto guarantor of security in East Asia.
The United States can easily project massive firepower to dissuade Chinese territorial ambitions. It can deploy troop and fighter aircraft from Japan and is further bolstered by a powerful fleet of submarines armed with cruise missiles and at least two aircraft carriers with a full complement of combat aircraft. China can only hope to defend against such a force with a barrage of land-based missile systems. Even though such systems will wreak significant havoc against American military assets it will only delay an inevitable Chinese defeat. With relatively few options in terms of withstanding an American attack the Chinese have sought cyber warfare as the next best thing.
What China lacks in conventional military hardware it makes up for in unconventional platforms. Cyber warfare is one such platform and gives China a unique deterrence capability on par with nuclear weapons. Cyber weapons might not be able to sink a heavily defended aircraft carrier or outsmart a cruise missile launched from a submarine. But they can cause significant economic damage by shutting down the stock mark. They can potentially harm valuable infrastructure such as water treatment plants. And they can also severely disrupt the daily activities of banks and private business that keep our economy afloat. These are scenarios that would make life terribly difficult in the United States.
China might not resort to such measures in an offensive capacity. But in the event of a shooting war in the South China Sea for instance, it is very possible that China will use its cyber weapons to force the United States to cease military operations. Cyber attacks might not stop a defeat. But they could potentially drive up the costs of victory for the United States by creating economic chaos back at home. China will most certainly be defeated in any military contest with the United States. But an American victory in a war with China will be a pyrrhic one at best.
The United States certainly needs to develop ways of mitigating and preventing such attacks before they start. This needs to be a priority if the United States wishes to effectively curb Chinese territorial ambitions while minimizing the cost of doing so. Instead of creating offensive cyberteams to reciprocate Chinese cyber attacks it needs to develop teams that are trained to defend against such attacks. The concept of offensive cyberteams seems to be inherently rooted in the Cold War axiom of mutually assured destruction. But such tit-for-tat warfare only leads to further escalation and leaves the United States in a much more vulnerable position. If the United States wishes to protect its citizens and its economic standing it should prepare itself to stop cyber attacks in their tracks as opposed to deploying cyber weapons against Chinese targets. By creating a defensive cyber strategy the United States robs China of a major deterrent capacity. This allows our military to operate without fear of costly reprisal and keeps Chinese territorial ambitions contained. That being said, it is my hope that our military leaders are taking such thoughts into consideration.