Cyber and Cognitive Warfare:  Dreaming of Winning Wars Sans Violence?

(Published in Indian Defence Review January-March 2024)

“The purpose of warfare is not to fight; it is to achieve a political objective. If you can achieve this objective without kinetic conflict, so much the better.”

Prof Nora Bensahel[1]

Background

The world has seldom been a harmonious place. Countries are forever competing to enhance their relative security, power, and well-being. Conflicts are, therefore, inevitable and at times tend to turn into violent wars.  Greater social awareness amongst people is leading to the abhorrence of violence and human suffering associated with wars. These social perceptions have resulted in new concepts being proposed to transform warfare by attempting to avoid bloodshed. Tools like cyber, space, cognitive, and economic sanctions are becoming integral to any discussion on warfare. New terms such as hybrid, generational (going up to seventh generation), network-centric, grey zone, and contactless warfare are becoming common. The melee of terms is so confusing that the line between war from peace is being erased. It seems that the world is in a state of continuous war, with nations seeking alternatives to achieve their political objectives without resorting to the use of force. These newer approaches view cyber and cognitive warfare as a panacea for violent wars.  

Domains of Warfare

Wars were traditionally fought in three domains: land, sea, and air. The space domain was added when assets in outer space started facilitating military operations, also due to the looming possibility of space-based weapons. Then cyber was added as the fifth domain and recently cognitive warfare has also been viewed as the sixth domain. Cognitive warfare aims to affect attitudes and behavior by influencing or disrupting individual and group cognition[2]. Cognitive warfare encompasses psychological and information operations using the internet, social media, and even cyberattacks. These tools were generally used to supplement diplomacy and politics. However, today the language of warfare is being applied to cyber and cognitive operations viewing them as alternatives to the use of force. In this paper, Cyber and Cognitive warfare are being covered separately since cyberattacks are employed even for espionage and disruption of command & communication, besides aiding psychological warfare.

Cyber and cognitive warfare strike deep into the hinterland affecting civilian populations as much as the military and can be waged without a formal declaration of war. This gives rise to the idea of continuous wars and the erasure of the line between war and peace. Such changes are not unusual as even Clausewitz had acknowledged that every age has its own kind of war, its own limiting conditions, and its own peculiar preconceptions[3]. It is, therefore, not surprising that new concepts employing latest technologies propose how wars can avoid violence and a bloody battlefield.

Whither Cyber and Cognitive Warfare?

These new concepts raise certain doubts and questions. The idea of wars without violence or armed force challenges our traditional understanding of war and the realities of geopolitics. The traditional or Clausewitz’s trinitarian concept of war involves the use of violence, to compel the opponent to fulfill one’s will, thereby achieving political objectives[4].  War is thus inherently human and technology or computing power cannot change its essence of violence and uncertainty. The very concept of war is questioned if violence is removed from the equation. In any rivalry or confrontation, force remains the ultimate arbiter.

The other question that arises is: Do the domains of cognitive and cyber warfare possess the potential to achieve the decisiveness of an armed conflict? Are they efficacious enough to force an adversary to fulfill one’s will? Only then can the dream of a bloodless war come true.

A peep into the employment of these tools in the recent past would help understand their efficacy. Let’s first discuss cyber warfare. It is known to disrupt or cause failures of critical systems and can also impose military effects. Some well-publicized cyberwarfare operations bring out its potential as well, as limitations.

Cyber Warfare

 Stuxnet. In the first decade of this century, Iran was known to be pursuing a nuclear weapon program despite UN sanctions. This led to the U.S. and Israeli government’s decision to derail and obstruct the Iranian program. US and Israeli intelligence developed STUXNET, a powerful computer worm, which after infecting the computers at the Iranian nuclear facility at Natanz, destroyed the centrifuges used for enriching Uranium to weapon-grade.  STUXNET may well be labeled as the first cyber weapon which destroyed machinery. The use of this cyber weapon avoided the requirement to physically destroy the nuclear facilities of Iran as done by Israel at Osirak in Iraq in 1981 and 2007 against the Syrian nuclear facility. In this regard, the use of STUXNET, the cyber weapon did avoid the use of force to derail Iran’s nuclear program.  Evidence suggests that STUXNET required at least five years of development and substantial financial outlay[5]. But did STUXNET result in the destruction of the facility and Iran complying with the demand to abandon its nuclear weapons program? Not really. After a gap of a couple of years, Iran uses the same facilities and continues its clandestine nuclear weapon program despite sanctions and impediments. [6]

Defanging Iran’s Defences. Iran was once again a target of cyberwarfare when in the late 2000s, the USA undertook detailed planning for cyberattacks on Iran’s air defences, power grids, and communication systems under project Nitro Zeus. It was a precautionary plan to employ non-lethal means to neutralize Iran’s military assets in case of an escalation if negotiations fail. It was a detailed plan and since it was not implemented, its efficacy remains uncertain. [7]

Russia’s Cyberattacks

Russia has been repeatedly blamed for cyberattacks across the West and NATO countries which has been denied by Russia. Some of the publicized cyberattacks by Russia include 2007 denial of service attacks on Estonia over the decision to move a World War II grave marker. Just a year later in 2008, Russian cyberattacks disabled government portals and communications just before invading Georgia. Once again in 2014, cyberattacks disrupted Ukrainian government portals and military command and communications during the occupation of Crimea. [8]

The infamous 2017 NotPetya cyberattacks which impacted businesses across 65 countries was sponsored by Russia to dissuade businesses from investing in Ukraine. However, the sponsor lost control over the spread and impacted Russia as well.

Ukraine has been a pet target with its howitzers malfunctioning due to malware in 2014-15. Similarly, cyberattacks preceded the Russian invasion of Ukraine in 2022, attempting to disrupt military and government communications and command centers. The disruptions were temporary and Ukrainian networks proved resilient. [9]

Russian cyber operations involved phishing attempts, distributed denial-of-service campaigns, random hacking attempts, espionage, and single network intrusions. The attacks interfered with normal functioning but their impact was limited. As would also be obvious, most of these cyberattacks were not in isolation but combined with other operations.

India as a Target. India is among the top three targets of cyberattacks, attracting over 13% of the total attacks in the Asia-Pacific region. Chinese cyber warriors disrupted power supply on three occasions in Ladakh and also in Mumbai recently. AIMS was a target of cyberattacks leading to the theft of personal health records of patients and disruption of services. Defacing and hacking on government portals is a regular affair. These attacks, however, remained at the level of irritants[10].

Non-Attributability and Retaliation. The originators of cyberattacks are generally difficult to trace. Retaliation is, therefore, rare. In some cases when attributability was established, retaliations have occurred such as Israel destroying a building in Gaza after a Hamas-backed hacking group targeted Israel’s infrastructure. Similarly, the US has also retaliated against Russian cyberattacks by targeting Russian power grids with crippling malware.  But violent response to cyberattacks is rare, particularly among peers. [11]

The details discussed above indicate that there is little evidence to suggest that cyber warfare can force or coerce adversaries to accept the demands of the attackers. It can at best disrupt some functions causing inconvenience to the public but not powerful enough to fulfill one’s will.  The evidence in support of the efficacy of cognitive warfare is even less compelling.

Cognitive Warfare

Cognitive warfare gained importance when counter-insurgency/counter-terrorism operations became the norm. Winning the hearts and minds of the affected population is normally the objective in such wars. Convincing the population and the world at large about the appropriateness of one’s narrative became essential. As Joseph Nye pointed out, “In today’s wars, it is not whose army wins, but whose narrative wins.” Winning the war of narratives is best achieved through psychological and information operations. This resulted in cognitive operations gaining high visibility. Cognitive warfare targets an opponent’s domestic vulnerabilities which may be historical or due to poor governance or oversight. Such vulnerabilities create opportunities for interference.

Crimea 2014. The efficacy of cognitive warfare gained grudging acceptance after the Russian occupation of Crimea in 2014. This event was hailed as an illustration of hybrid warfare and in that, the effectiveness of information or cognitive warfare.  Russia’s information campaign was somewhat central to its occupation of Crimea. Crimea was a test case of the new form of warfare based on ideas developed by General Valery Gerasimov of involving uniformed personnel, covert operatives, deception & disinformation, psychological pressure, armed civilians, and cyber warfare alongside the use of highly trained Special Operations Forces (SOF)[12].   Information operations were aimed at convincing the Russian-origin population of Crimea that it was always a part of Russia, Russians and Ukrainians are one nation which the decadent West was trying to divide, socio-economic hardships under the current regime, people of Crimea and East Ukraine being dominated and treated as second class citizens. Many false stories were spread. One such story was about a pregnant Crimean woman being denied aid and another of a Russian doctor being stopped from providing aid to victims of a fire due to his origin. The telephone conversation between the Ambassador of USA and the Assistant Secretary Victoria Nuland obtained through hacking was made public and revealed the perfidious motives of the USA and the West to destabilize the Ukrainian government and align it with NATO.  Russian regular troops acting as civilians (green men) incited protests and restricted Ukrainian troops in their garrisons. The SOF cleverly disrupted services and provided arms to civilians. A skillful mix of armed forces and information warfare enabled the Russians to occupy Crimea without bloodshed. Even though this operation is touted as a success of cognitive warfare. Some features however, make this one of its kind operation. Firstly, Crimea had a very large percentage of the Russian origin population which supported merger with Russia. Secondly, cognitive and cyber operations were combined with SOF and militiamen who armed and guided the civilians in public protests and opposition of Ukrainian forces. Such unique features are unlikely to be present in other situations and extrapolating the lessons from Crimea to other contexts may not be quite appropriate[13].

Reflexive Control. There are many avatars of cognitive warfare. One of them is Reflexive Control. Reflexive control was made famous by Russians who made it a part of their doctrine. Reflexive control is an indirect means of maintaining control over an opponent’s decision-making process. By feeding false information or diverting attention away from main issues, an opponent may be unknowingly induced to opt for a course of action that favours the entity employing reflexive control. One current illustration often cited is that of the USA’s approach to China’s A2/AD strategy. The USA views it as a threat and being predisposed to solving technological problems, focuses on countering this Chinese strategy through innovative means. However, China’s main weakness lies in what President Hu Jintao called the “Malacca Problem”. Nearly 80% of China’s imported oil is shipped through the Malacca Straits: a choke point. China has attempted through various means to overcome this problem by using Gwadar port as also viewing Myanmar as an alternative route. By inducing the USA to focus on countering its A2/AD strategy, China manages to divert attention away from its main weakness.[14]

US Presidential Elections 2016. One highly publicized instance of cognitive warfare was the Russian interference in US presidential elections of 2016. Divisive content was spread on social media platforms such as Twitter, Facebook, and Instagram. The server of the Democratic National Committee was hacked and incriminating emails were leaked to damage Hillary Clinton’s campaign. While this may not have impacted the outcome, the very idea of outsiders influencing elections in a democracy is frightening. But these attempts are irritants and not consequential enough to coerce the target to submit to the will of the attacker. 

Brexit. During Brexit, Moscow-based information operations are stated to have influenced the voting. Russian broadcasters such as Sputnik and RT along with social media, supported influential persons in the UK to spread their views. A miniscule number of Twitter accounts accounted for over 30% of the tweets on the subject. Many feel that these actions may have influenced the voters. The Russian aim was to weaken the EU. [15]

China’s Taiwan Focus. China is a known exponent of cognitive warfare and has developed a fair degree of expertise in this field. It’s focus on Taiwan for decades has been to create a mindset among Taiwanese to accept reunion with the mainland. Taiwan on average is flooded with as many as 2400 pieces of disinformation daily from the mainland. Most of these attempts aim to induce people to elect a leadership that is favorable towards reuniting with the mainland. This decades-long cognitive warfare is still to yield any noticeable results in terms of Taiwanese people favouring a reunion with mainland China. China has also tried to promote the idea that the option of independence implies a war with China. As per surveys, in 2017 about 41% believed that China would attack Taiwan if it declared independence. By 2020 the percentage of people believing this increased to 61%. This indicates the extent to which Chinese cognitive warfare has influenced the Taiwanese. The bottom line remains that despite decades of effort, Taiwan is still unwilling to be coerced into accepting China’s demands and appears to be preparing to counter a possible Chinese invasion. [16]

India as a Target

India has also been at the receiving end of attempts to tarnish its image through news items, books, and articles written by authors supported by Pakistan and Turkey. These authors and journalists cite each other’s work in trying to validate false information on India’s Human Rights record. The aim is to tarnish India’s image abroad.[17]

Chinese disinformation campaign regularly targets India. Its attempts during the pandemic were aimed at questioning the efficacy of India-made vaccines and to obfuscate the origins of the pandemic. By discrediting Indian vaccines China attempted to showcase the efficacy of the Chinese variety. These attempts, however, had little impact in influencing Indian opinion[18].

Analysis of Discussions

All the above illustrations and discussions showcase numerous attempts by nations to employ cyber and cognitive warfare to influence and coerce opponents. Some conclusions that emerge are:

·       Cyber and cognitive warfare are akin to subversion, a non-military tool which aims to bring down the opponent by weakening and undermining institutions and society. This is done without going to war.

·       Subversion is a very slow process which requires connivance from within the target country. Its ability to produce the desired outcomes depends on the target country’s leadership and the society’s cohesion. Like subversion, the effectiveness of cyber and cognitive warfare is debatable.

·       Cyber and cognitive warfare cannot coerce an opponent like physical means. These domains cannot be expected to produce the finality and decisiveness associated with real wars.

·       Cyber and cognitive warfare yield best results when employed in conjunction with other domains. Recent instances also reveal that these domains will not be used in isolation but in conjunction with other tools.

·       Current expectations grossly overestimate the impact of cyber and cognitive warfare.

·       Discussing cyber and cognitive warfare using the language of war is a theory with limited practical significance.

·       Cyberwarfare exploits the opponent’s oversights in data and network security. Its impact is dependent on the resilience and recovery capabilities of the IT infrastructure.

·       Similarly, cognitive warfare targets the opponent’s vulnerabilities and seeks to induce behavioral changes. Its efficacy is dependent on the target nation’s ability to counter disinformation and fake narratives.

·       Cyber and cognitive warfare offers countries a quiet and obscure option to exert power alongside diplomacy and other means.

·       Democracies are most vulnerable to cognitive warfare since diverse views and narratives coexist providing openings to exploit societal divisions.  Autocratic governments possess the wherewithal to curb opponents’ cognitive warfare by hard options such as internet shutdown, barring social media platforms and own propaganda.

·       In most of the cases of cognitive and cyber warfare the impact on outcomes is unclear and cannot be depended upon with any degree of certainty.

Discussions of Findings

Political Warfare. The idea of undermining an adversary without using force is not new. It was articulated during the Cold War period in a different context by George F Kennan, the American diplomat famous for his,” Long Telegram”.  He called it political warfare and defined it as applying Clausewitz’s doctrine in times of peace. Political warfare as per him was the employment of all means at a nation’s command short of war, to achieve national objectives. [19] The central point that bears repetition is that all these tools are “short of war” and do not replace the use of armed force. Cyber and cognitive operations require to be discussed in the language of political warfare instead of the context of violent wars. They are primarily tools of political warfare when employed in isolation.

Inconvenience vs Destruction. Force is the ultimate arbiter and countries and entities capitulate when faced with death and destruction. If the lifestyle and normal living of people is inconvenienced, countries are unlikely to yield to unpalatable demands. This in essence is the problem with cyber and cognitive warfare. These tools only inconvenience people and countries. They are too weak, slow and the effects indefinite, to tilt the balance of power or coerce an opponent.

Multi-Domain Operations. Wars today demand integrated employment of all domains: land, air, sea, space, cyber and cognitive. As revealed in the earlier discussions, cyber and cognitive operations are most effective when employed in conjunction with other domains. Synchronized employment of all domains is necessary for achieving the desired outcomes. Cognitive and cyber operations can be employed before the commencement of military operations to dent enemy capability through covert and subversive means. After the declaration of war, all domains can be integrated to formulate strategies to overwhelm the enemy. This is the way forward in a complex world in which wars are becoming distasteful.

Conclusion

Cyber and cognitive warfare in theory and on paper appear formidable but experience suggests that they do not lead to decisive outcomes. Classifying and sensationalizing these as effective tools of warfare to rule out violence is, therefore, a gross exaggeration. Such exaggeration would be harmless were it not for the fact that it relates to the serious business of war and a country’s survival. These tools are best suited for political warfare: employing Clausewitz’s doctrine in peacetime. Any overestimation of the efficacy of a particular tool may distort the overall strategy during wartime, jeopardizing the chances of victory. In peacetime, such thinking may lead to the allocation of resources to bolster capabilities for cyber and cognitive operations, reducing those for kinetic warfare. The results can prove disastrous when expectations are belied. Prudence and perspicacity demand the proven capability of cognitive and cyber warfare to force opponents to submit to one’s will before accepting the idea of a war bereft of violence. Till then it is best to keep in mind Hannah Ardent’s advice that, “The chief reason warfare is still with us is ………….. the simple fact that no substitute for this final arbiter in international affairs has yet appeared on the political scene.” [20]

End Notes

[1] Cybèle C. Greenberg, Could Cyberwar Make the World Safer? New York Times, Aug. 22, 2021

https://www.nytimes.com/2021/08/22/opinion/cyberwar-world-safety.html

[2] Cognitive Warfare: Strengthening and Defending the Mind, April 5, 2023

https://www.act.nato.int/article/cognitive-warfare-strengthening-and-defending-the-mind/

[3] Carl von Clausewitz, On War, Edited by Michael Howard and Peter Paret, Princeton, NJ: Princeton University Press, 1989, p 593.

[4] Carl von Clausewitz, On War, ed. and trans. Michael Howard and Peter Paret, Princeton University Press, 1976, p 75

[5] Lennart Maschmeyer,  Why Cyber War Is Subversive, And How That Limits Its Strategic Value, November 17, 2021, https://warontherocks.com/2021/11/why-cyber-war-is-subversive-and-how-that-limits-its-strategic-value/

[6] Mohan B. Gazula , Cyber Warfare Conflict Analysis and Case Studies, Working Paper CISL# 2017-10 May 2017, MIT Management, Sloan School, https://cams.mit.edu/wp-content/uploads/2017-10.pdf

[7] Cybèle C. Greenberg, Could Cyberwar Make the World Safer? New York Times, Aug. 22, 2021, https://www.nytimes.com/2021/08/22/opinion/cyberwar-world-safety.html

[8] Mueller Grace et al, Cyber Operations during the Russo-Ukraine War,  CSIS, Juky 2023, https://csis-website-prod.s3.amazonaws.com/s3fs-public/2023-07/230713_Mueller_CyberOps_RussiaUkraine.pdf?VersionId=BwNbsmkThLIPVpB0tctC59kwVpZ2aXeI

 "War in the fifth domain. Are the mouse and keyboard the new weapons of conflict?", The Economist. 1 July 2010.

[9] Adam Meyers, Danger Close: Fancy Bear Tracking of Ukrainian Field Artillery Units, December 22, 2016, https://www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/

[10] Recent Cyber Attacks With Alleged Chinese Involvement That Targeted India’s Critical Infrastructure, 17 October 2023, https://www.outlookindia.com/national/recent-cyber-attacks-with-alleged-chinese-involvement-that-targeted-india-s-critical-infrastructure-news-241897

[11] Abhijit Ahaskar, How cyberattacks are being used by states against each other, Livemint, 21 June 2019, https://www.livemint.com/technology/tech-news/how-cyberattacks-are-being-used-by-states-against-each-other-1561100711834.html

[12]  Valery Gerasimov, “The Value of Science Is in the Foresight: New Challenges Demand Rethinking the Forms and Methods of Carrying Out Combat Operations,” Military Review (January–February, 2016, https://www.armyupress.army.mil/Portals/7/military-review/Archives/English/MilitaryReview_20160228_art008.pdf

[13] Analysis Of Russia’s Information Campaign Against Ukraine, NATO StratCom Centre of Excellence, https://stratcomcoe.org/cuploads/pfiles/russian_information_campaign_public_12012016fin.pdf

[14] Stimpson RT, Cyberwarfare Will Not Replace Conventional Warfare, Canadian Forces College, https://www.cfc.forces.gc.ca/259/290/317/305/stimpson.pdf

[15]  Donatienne Ruy, Did Russia Influence Brexit? CSIS, July 21, 2020,

ttps://www.csis.org/blogs/brexit-bits-bobs-and-blogs/did-russia-influence-brexit

[16] Matthew Becerra, The Battle for Reality: Chinese Disinformation in Taiwan, August 24, 2022

https://www.geopoliticalmonitor.com/the-battle-for-reality-chinese-disinformation-in-taiwan/ and

Tzu-Chieh Hung and Tzu-Wei Hung, How China's Cognitive Warfare Works: A Frontline Perspective of Taiwan's Anti-Disinformation Wars, Journal of Global Security Studies,

https://academic.oup.com/jogss/article/7/4/ogac016/6647447?login=false

[17] Namita Barthwal, Information Warfare and India’s Level of Preparedness, CLAWS, February 11, 2022,

https://www.claws.in/information-warfare-and-indias-level-of-preparedness/

[18] Sarthak Ahuja and Samridhi Diwan, India’s Two-Front Information War, Observer Research Foundation, May 10 2023,

https://www.orfonline.org/expert-speak/indias-two-front-information-war/)

 [19]  George F. Kennan, 'The Inauguration of Organized Political Warfare', Wilson Centre Digital Archive, , April 30, 1948, https://digitalarchive.wilsoncenter.org/document/george-f-kennan-inauguration-organized-political-warfare

 [20] Hannah Ardent, On Violence, Harcourt and Brace, New York, 1970.

[i] Cybèle C. Greenberg, Could Cyberwar Make the World Safer? New York Times, Aug. 22, 2021

https://www.nytimes.com/2021/08/22/opinion/cyberwar-world-safety.html