The US will win the cyber war with China in 2017

In 2015, the Rand Corporation published a courageous assessment of the war-fighting potential of China and the United States. It assessed that the Americans would have a clear advantage in cyber war scenarios involving Taiwan or the Spratly Islands in 2017.

The authors’ confidence was buttressed by their conclusion that out of another 16 sets of conventional military capability comparisons (such as naval and air), the United States forces enjoyed at least parity in eight and a clear advantage in another six. In other words, China loses in almost all scenarios of military confrontation.

This report is one of the best ever net assessments of US and Chinese military capabilities that is available in the public domain.

The report flies in the face of the defeatism and pessimism endemic in US political discourse about threats from a rising China. The report received surprisingly little serious media coverage in the United States, and has fared only modestly in subsequent coverage by US scholars.

Of some note, the report’s overall assessment goes very close to how I would read Chinese assessments of their weaknesses relative to the United States.

That said, a case can be made that the authors understated or under-estimated the degree of US military superiority. There are many ways in which this might be argued, but one stands out above all others to me. The factor that has not been accorded sufficient weight by the authors in assessing kinetic forms of military capability, such as naval or air combat, is the impact of cyber strategies and attacks on that capability.

The report follows the Rand orthodoxy that “cyber operations are primarily support operations,” mere add-ons instead of potentially transformational tools in naval and air force combat operations. The shortcomings of this position are reinforced by two questionable statements.

The first is that the “direct effects of cyber operations can be reversed relatively quickly.” This is only true if one confines one’s view to the damage done to the particular IT system. But in war, the intent of almost all cyber attacks will be to create a military or political effect beyond the IT system. For example, in a Taiwan-related scenario, the United States would aim cyber attacks against the forward-deployed combat platforms and the headquarters to slow down the rate of delivery of attack sorties by Chinese forces.

The military and political impact of retarding the intensity of enemy attacks even for 24 hours cannot be reversed by software repairs to the IT system. In fact, a high success rate by the United States in slowing down the intensity of Chinese air attacks in a Taiwan war scenario may be the difference between victory and defeat for China. Sure the specialist may fix the IT system but the war has been lost almost in the same time it takes them to repair the software.

And the software of Chinese weapons systems, command and control, and intelligence systems is only one possible vector of attack on cyber systems. There are seven others: the hardware, the payload, the networks, the power supply, the personnel, the policy chain, and the information ecosystem. In all eight vectors of attack, the United States would not stake everything on a single cyber assault and sit back while Chinese IT specialists found one piece of malware.

The United States would plan sustained multi-phase and multi-vector cyber attacks, supported by a variety of non-cyber information operations, which would prevent the relatively weak Chinese cyber defenses from having the luxury of quickly reversing those particular attacks they were able to identify in a timely fashion.

The second questionable statement in the Rand study is that “cyber operations almost never involve force-on-force confrontations.” In the US military strategy, most cyber attacks are reserved exclusively for force-on-force confrontations. Thomas Rid’s book Cyber War Will Not Take Place points us very firmly away from acceptance of this statement by the Rand authors.

The 2015 Vision Statement by the Commander of US Cyber Command, Admiral Mike Rogers, titled “Beyond the Build,” talks of the aim of providing cyber options for all phases of operations, meaning all force-on-force confrontations.

In fact, the authors appear to recognize this later in the conclusion of the relevant chapter when they say that “Cyber warfare matters only to the extent that it affects the outcome of other military operations.” The authors also recognize this in their very strong analysis of possible cyber attacks on the logistics capability of an enemy.

The authors analyze “strategic cyber warfare” (a dubious concept anyway) and “operational cyber warfare” but they focus the latter topic narrowly around logistics. Their treatment of attacks on command and control or deployed weapons systems is more in the realm of “may or may not” have decisive effect.

The authors also note correctly that attacks on Chinese air defense and intelligence and surveillance assets “are most likely to be successful early in a conflict.” This, in fact, is the very reason why the United States would seek to maximize disabling cyber attacks against any military cyber systems if such attacks could degrade China’s ability to achieve its war aims.

The analytical shortcoming is compounded in the report’s analysis of classic kinetic modes of warfare such as naval and air combat. It assumes for the most part that extant capability and platforms in the navies and air forces can all make it to the front line and that none of their preparedness has been in any way degraded by cyber attacks on the platforms themselves, the command and control systems guiding them, or real time intelligence feeds on which their combat effectiveness may depend.

It is now time to focus more on the ways in which cyber military capability can transform military power in wartime. As China’s Military Strategy published in 2015 says: “Outer space and cyber space have become new commanding heights in strategic competition among all parties.”