Myth #10: Cyberwar is coming.
Myth: Cyber wars are inevitable. Modern economies are highly dependent on computers, which are vulnerable to hacking. A strategic cyber attack against a critical infrastructure, a power grid for example, thus could cripple an entire economy and could lead to mass-casualties. It is not a matter of if, but when such a scenario will occur.
Busted: In 1991 the threat of a digital pearl harbor, a surprise cyber attack targeting the strategic functions of a nation-state and thus crippling an entire economy, was conceived of for the first time. Since then we have heard that “cyberwar is coming!”, because the transnational nature of the digital battlefield allows an attacker to strike from anywhere, anytime. It is not a matter of if, but when such a crippling cyber-attack would occur (Arquilla and Ronfeldt 1993). This cyber-doomsday scenario has been evoked repeatedly and features prominently in cyber strategies worldwide. (#13)
Although millions of different types of ‘cyber attacks’ happen in any given year, only a handful of them have ever produced a kinetic effect (CFR Cyber Operations Tracker 2019). To this day, no one ever died as a direct result of a cyber attack. Stuxnet, the sabotage of Iranian nuclear enrichment centrifuges in 2010, still is the most extreme case. The two publicly known examples of a power-grid shut down in Ukraine 2016/2017 only lasted a couple of hours. Cyber attackers against power-plants usually do not disrupt operations, but rather install backdoors that can be utilized in a future conflict.
The strategic cyber war myth is based on a misunderstanding of the function of war and cyber capabilities. As von Clausewitz wrote, “war is […] an act of violence intended to compel our opponent to fulfill our will”. Most cyber attacks do not fit into the category of war, since they are not violent and often driven by financial, not political motives. Cyber espionage happens frequently, but lacks the motive of coercion (Rid 2013). We also confuse the possibility of a strategic cyber attack with its probability: such a scenario is possible, but improbable. The reason is that not much can be politically gained by such an attack out of the blue, unless its effects are made permanent with the use of physical force. Most cyber-attacks have temporary-disruptive, rather than permanent-destructive effects. This means that they cannot be used effectively to subdue or coerce an enemy in the same way as physical forces can: by occupying territory and permanently degrading enemy forces (Gartzke 2013). This explains why cyber-capabilities are mostly used as an adjunct to traditional, physical conflicts and not as a standalone feature. Only in these contexts something can be gained politically by using cyber-attacks – which is a core function of war as the continuation of politics by other means.
Truth: Many cyber strategies warn against the threat of a digital Pearl Harbor, a strategic cyber attack that could knock out the power grid and shut down an entire industrial economy. Although it is possible to shut down a power-grid from afar, not much can be gained politically by that, unless such a cyber-attack occurs within the context of a traditional, physical conflict, where the effect of such an attack can be made permanent. Cyber capabilities are used as tools in physical conflicts, but a standalone, digital-only strategic cyber war will not take place.
Source: Thomas Rid, Cyber war will not take place (London: Hurst, 2013); Brandon Valeriano and Ryan C. Maness, Cyber War versus Cyber Realities (Oxford: OUP, 2015)