The debate about the efficacy of cyber power must necessarily involve analysing both offensive and defensive cyber capabilities.
While defensive cyber operations are necessary to protect a network, Offensive Cyber Operations (OCOs) are equally necessary for effectively prosecuting kinetic operations in contemporary and future warfare.
A cyber-attack can be carried out in conjunction with other instruments such as Electronic Warfare (EW) and space capabilities, as well as kinetic means in the form of air, naval, and land power.
Offensive cyber operations (OCOs):
Offensive Cyber-attacks can be divided into two types: attacks that disrupt the effective operation of a weapons system, and another set that destroy or inflict damage on weapons systems.
OCOs are fundamentally an evolutionary aspect of intangible warfare, which covers EW and operations across the EMS.
OCOs are domain-specific or confined exclusively to the cyber domain may have limitations about escalation and the degree to which they damage a target.
When evaluating OCOs, consider: event-based and presence-based operations. The latter encompass primarily strategic capabilities that involve protracted network intrusions of the adversary and end with an offensive or attack.
The former cover tactical tools which are deployed in the course of ongoing operations on the field to generate localised impact.
Uses of OCOs:
“hacking” to destroy propaganda by terrorist groups or disinformation
“adversarial infrastructure destruction” against a hostile cyber group located in another country;
“counter-influencing” missions planting unhelpful information or “digital harassment”.
“kinetic” offensive operations that cause damage and disruption in the adversary country.
a comprehensive attack against the adversary’s digital networks amidst a conflict.
can serve as key force multiplier during conventional operations and more limited tactical action and contingencies.
imposing countervailing costs against an opponent in the middle of a war or to pre-empt an opponent. For instance, India might want to take out the command network of the Western Theatre Command (WTC) of China’s People’s Liberation Army (PLA) in the midst of active hostilities.
Challenges:
Cyber power should not be used offensively because it is ineffective as cyber operations have limited psychological and coercive effect against adversaries.
Further, cyber weapons such as viruses could infect the attacker’s systems as much as it would the enemy’s.
Given the collateral damage cyber-attacks could cause, their deterrent value is at best modest. NotPetya, for instance, was a cyber-attack against Ukraine which affected not only the primary target but inadvertently, third parties, too.
Defensive cyber security is more demanding than developing offensive cyber capabilities such as malware. This is because defence is harder than offence in the cyber domain.
Cyber power intersects with space technology such as counterspace missions to disrupt the performance of orbiting spacecraft.
There are three specific elements in a space network that are vulnerable to a cyber-attack: uplink, downlink, and satellite-to-satellite attacks.
Cyber-attacks can disrupt uplink communications between their ground control segments and in-orbit satellites; in downlink, communications between satellite-derived internet service.
Russia, for example, has combined electronic and cyber warfare to target the North Atlantic Treaty Organisation’s (NATO) satellite capabilities.
Penetration of communication and C2 networks using malware can disrupt the effective operation of logistics nodes.
The attack could be executed in the form a Radio Frequency (RF), which is primarily an electronic action merging cyber and electronic warfare operations
The US, for instance, has used exclusively cyber means to disable Iranian rocket and missile systems, which was executed by the US Cyber Command (USCYBERCOM) in 2019.
Indian context:
There is generally a strong focus on cyber defence than offence in India.
At present, India’s offensive cyber capabilities are weak, especially relative to China.
India requires more robust cyber warfare capabilities geared for offensive action to deal with Pakistan and China, which could engage in cyber collusion against India.
Pakistan is likely to serve as a key Chinese proxy for cyber-attacks against India.
Pursuit of the “cult of the defensive” can be an answer.
India needs the combined application of cyber and air power (such as Balakot air strike) for offensive action to be lethally effective, rather than a purely or dichotomous “air/cyber power” application.
Tibetan Autonomous Region (TAR) create target-rich opportunities for the conduct of OCOs by India.
Suggestions:
Develop traffic or network analysis capabilities by which develop the service’s traffic analysis capabilities and its crucial develop the service’s traffic analysis capabilities.
Well-trained personnel for the conduct of OCOs such as civilian hackers who have technical proficiency and provides cover in terms of deniability and anonymity.
Organisational Integration of Technical Agencies such as National Technical Reconnaissance Organisation (NTRO), Defence Cyber Agency (DCA), which is a tri-service organisation, Defence Intelligence Agency (DIA).
Leveraging India’s IT and Software Ecosystem which are generally weak vis-à-vis China, and at best moderately strong against Pakistan and including private sector.
India may have to develop a large reserve of OCO capabilities.
Way forward
While defensive cyber security is important, offensive cyber capabilities cannot be ignored.
However, the Indian armed services, especially the Air Force and the Army, will need to recognise the limits of offensive action when reacting to crises.
Well-planned cyber-attacks in conjunction with electronic attack and kinetic attack, as Israel and America have demonstrated against enemy air defences, require attention and focused investment.
Given the growing fusion between electronic, cyber and space technology that are applicable to military operations, investment in these capabilities will need high priority.
Thus, developing capabilities as part of a strategy where cyber power plays a central role whether against Pakistan or China is well worth pursuing.
