If NATO cyberspace policy violates many of the principles of war – What hope is there for cyber influence?

The November 16, 2018 on-line edition of Breaking Defense ran an article “NATO To ‘Integrate’ Offensive Cyber By Members (see: http://bit.ly/2rebnZo, which is also the photo source).

NATO established a Cyber Operations Center (CYOC) on August 31, 2019 to serve as a focal point for the Alliance’s cyber efforts and to insure that the Alliance had situational awareness concerning the cyber efforts of its members. According German MG Wolfgang Renner, head of the CYOC, “NATO is clear that we will not perform offensive cyberspace operations ….. However, we will integrate sovereign cyberspace effects from the allies who are willing to volunteer.”

To say that such a cyber policy is nascent would be kind. The policy is far from official even though NATO members engage in cyberspace operations everyday. It’s a military, legal and technical quagmire that appears to be in danger of violating many of the longstanding principles of warfare.

Serving on a NATO staff requires not only the skill and knowledge required of your rank and your specialty, but a certain kind of finesse that allows you to work well with international colleagues who will often out rank you. You also will need to know when your country’s national influence needs to be in play and when to work for the good of the alliance.

We know that cyberspace operations are fast moving and we also know that they don’t respect borders. If several of the 29 member states’ interests are attacked simultaneously it is only natural to assume that the military of that country will give the highest priority to their own self-defense.

 

This sort of ad hoc approach would seem to violate the principle of Unity Command right off the top.

Given that each member state will have different priorities, this would also seem to violate the principles of Objective and Mass. Each member state will pursue different objectives and the total mass of the cyber force (and its resources) will be diluted.

Which leads me to yet another principle that appears to be in jeopardy – Simplicity. The “Fog of War” is nothing compared to the fog of cyberspace operations. The variables at play and the speed of the interaction is unlike the traditional domains.

Knowing that even the best plan often doesn’t survive contact, it would seem that MG Renner and his staff have their work cut out for them. Of course, the focus on cyberspace operations here are things like Distributed Denial of Service, Malware, etc., I’m willing to be they haven’t considered or are woefully understaffed to address the impact of Cyberspace operations as a PSYACT or optimizing the diverse influence of the Alliance members while minimizing second and third order effects.