Abstract: This essay discusses cyberspace as a strategic lever of power, focusing on its impact on the relationship between states and other actors. It argues that cyber’s inception has set about a tectonic shift of power relations, forcing democratic states to acknowledge and concede its influence. Firstly, cyber reliance is discussed; secondly, the relevant features of the strategic environment in relation to cyber are reviewed; thirdly, cyber deterrence; lastly, two empirical cases illustrating the strategic character of cyber for state and non-state actors are presented.
Bottom-line-up-front: The strategic power of cyber unfolds in two main scopes: the unprecedented ability to multiply force by articulating instruments and tools, and the capacity to diffuse power amongst a plethora of incoming non-state actors.
Problem statement: How to better understand cyberspace based on the agency exerted by diverse actors? Should cyberspace be used as a sole-domain or a multi-domain platform?
So what?: Strategists and policymakers could better understand Cyberspace as an ever-evolving multi-domain platform whose power threshold has yet to be fully seen, demanding a flexible approach to operate within it, and to mitigate the multiple threats that impact online and offline structures.
Source: shutterstock.com/metamorworks
Cyber-Reliance and Interconnectivity
The ‘volatile and man-made’[1] domain, as Joseph Nye calls cyberspace, drives a continual transformation where liberal democratic actors struggle to cope.[2] Kinetically, cyber consists of the transmission of digital fragments over the electromagnetic spectrum, which – while ubiquitous[3] – still requires infrastructure such as routers, antennas, satellites, computers, and other devices.[4] Compared to other technologies, cyber dramatically reduces both the costs of communications and accessibility, making the information exchange limitless,[5] and fostering an ever-growing proliferation of actors. Citizens ‘live’ as both virtual and kinetic personas, connected in one living macrostructure alongside information, public and private networks, and collective spaces, where disruptive and enduring social processes come to fruition.[6] Optic fibers knit social tissue.
Compared to other technologies, cyber dramatically reduces both the costs of communications and accessibility, making the information exchange limitless, and fostering an ever-growing proliferation of actors.
Arguably, society’s increasing reliance on cyber tools and the proliferation of actors, which Covid-19 lockdowns boosted when work and study continued from home, triggered greater security risks online; as actors increase, vulnerabilities rise. However, limiting the number of actors or precluding their activity undermines the societal vertebration that cyberspace has brought to states, for example, collective learning. Interconnectivity leads to a new level of collective interoperability, benefiting social, informational, political, economic, military, and diplomatic state instruments.[7] Nevertheless, as these strategic instruments operate and interconnect online, they are vulnerable to cyber-attacks, ergo needing cyber-defence protocols too.
Strategy and Power
Strategy, “the bridge that purposefully should connect means with ends,”[8] manifests itself in cyber as “the creation and manipulation of social relations … towards a common goal.”[9] Strategy is said to serve policy, presumably serving statecraft. By extension, it should serve the interests of citizens. In the strategic environment, on the one hand, cyber has fundamentally changed the rapport between non-state actors, and how they relate to the state.[10] In democracies, social transactions of all sorts happen under limited control of the state, for example e-commerce, social media.[11] States can not provide cyber-security; this is developed and offered by private companies. Neither can they fully regulate private companies profiting from the cyber-security business;[12] hindering states’ relevance in citizens’ lives.[13] On the other hand, cyber has made the irregular character ofconflict official.[14] Belligerence now alternates between kinetic and cyber modalities, and intra-state social processes have become trans-state ones.[15] Foreign policy narratives reconceptualise threats from afar, detaching these from domestic taxpayers who fund them.[16] Boundaries between peace and war blur as private actors operate under the war threshold. Persistent issues – attribution, deterrence – complicate states’ display of power while favouring non-state actors. This reveals the convenience of recruiting surrogates to conduct cyber-attacks, ultimately exacerbating ambiguity.
Boundaries between peace and war blur as private actors operate under the war threshold. Persistent issues – attribution, deterrence – complicate states’ display of power while favouring non-state actors.
Then, what is power? Nye defines power as “the ability to affect other people to get the outcomes one wants.”[17] Commensurably, Robert Dahl remarks that one actor has power over another to the extent of making this another do something he or she would not otherwise do.[18] Power emerges as relational and is watermarked by the behavioural outcome in another’s action, fostered by the one. Cyber power transfers that concept:[19] by effectively using cyber means to achieve strategic ends, i.e., Stuxnet code programmed into malware. Noteworthy, the skills to produce and use cyber become a source of strategic power too, and is easier for states to fund and conduct than traditional sources of power. These power resources are shared horizontally and vertically across the borderless cyberspace, unintentionally contributing to diffuse cyber power. Such diffusion de-polarises the world order, according to Nye.[20]
Cyber power requires a new and comprehensive application. While it can function as a stand-alone domain, planning strategy upheld to a ‘cyber-to-cyber’ regular warfare model is naïve considering the state’s power in the strategic environment when factoring almighty interconnectivity. States would do a disservice to themselves by not exploiting the vertebration of resources, which enables a synergistic impact for both power projection and responses, making cyber, simultaneously, a tool on its own and the sinews of all others.
This does not spare states from the delicate balance of risks they face regarding ambiguity. Although the odds of identifying attackers improves as skills and technologies grow,[21] attribution will hardly disappear. It got reloaded with new avenues to exercise (plausible) deniability and deception, limiting visibility, blurring boundaries, and concealing authorship for both state intelligence and military operations from one side, and criminals and mercenaries from the other. This means that, unless attribution is undoubtable, culprits will escape exposure and prosecution – a huge barrier to accountability.
Cyber Deterrence
Deterrence strategies, as well, cannot be transferred without adaptation. Nye posits that power and interdependence go together,[22] enabling deterrence by entanglement: the development of mutually beneficial bonds to deflate attack interest. However, a deterring state’s capabilities and intent must be credibly communicated to foster the expected behaviour. This process is constrained by the burden of the consequences that the deterrent’s decisions could prompt, such as the reputational risk of a non-proportional response if response in-kind would trigger escalations or conventional warfare, ultimate socio-political outcomes of responding. The more powerful the state, the higher its risks and stakes.
A deterring state’s capabilities and intent must be credibly communicated to foster the expected behaviour. This process is constrained by the burden of the consequences that the deterrent’s decisions could prompt ultimate socio-political outcomes of responding.
Perhaps the most significant shift that cyber’s inception has mobilised is the easiness to conduct disruptive attacks, a strategically profitable enterprise even for smaller actors taking advantage of asymmetry. Both Betz and Nye reflect on the excessive costs a disruptive attack could have either when targeting the critical infrastructure of services, or the social fabric of interactions and sociopolitical formations upholding society’s interoperability. States’, corporations’, and citizens’ daily lives can be seriously harmed without a drop of blood or a bullet being fired. Two cases illustrate the strategic use of cyberspace to disrupt societies: a foreign state-sponsored subversive attack on democratic elections, and a domestic citizen-led disruption of the financial system.
Donald Trump’s Presidential Campaign
During the 2016 USA electoral campaign, Russia strategically instrumentalised cyberspace in a subversive interference aimed at manipulating voters in favour of Donald Trump. The DNC’s servers were hacked, resulting in the theft and public exposure of confidential information. Simultaneously, a disinformation campaign, consisting of believers, impersonating trolls, and bots, propagated false anti-Clinton content over Facebook, Twitter, and news outlets, microtargeting undecided voters.[23] Although Russia’s cyber activities’ influence on the result eludes metrics, some consider this an invasion of the USA’s “political system,” and “psychological warfare at [a] grand-scale” equivalent to deploying military forces,[24] more so when considering that tactics applied – reframing content, priming the diffusion, hack-and-steal privileged information – facilitated effects to endure. At a fraction of the cost of conventional warfare and avoiding accountability, this operation led Russia to win an undeclared war by capitalising on the difficulty of detecting cyber-threats, anonymity, and (plausible) deniability.[25] However, the largest strategic effect of this cyber-attack, continuing today, was not its debatable impact on elections’ results, but the agitation it sparked within the nation’s social tissue, proving cyber’s power as a strategic lever.
At a fraction of the cost of conventional warfare and avoiding accountability, this operation led Russia to win an undeclared war by capitalising on the difficulty of detecting cyber-threats, anonymity, and (plausible) deniability.
Selecting the USA as a target had a strategic reading too. Democracies are as alive as the individuals navigating them. Drawing on Hannah Arendt, Pablo Quintanilla contends that the worst that can happen to democracy is the ‘banalisation of nonsense,’ which leads to intransigence when a society is not acquainted with debating arguments, cannot recognise them, or – even worse – has lost trust in these.[26] The assault on the Capitol on January 6, 2021, highlights how Russian cyber subversion eroded the resilience of democracy in the United States. Certainly, the intervention influenced affected voters to pursue a specific outcome, as per Nye’s concept of power.
The GameStop Saga
A case of non-state actors strategically using cyberspace in a less complex fashion is that of the GameStop Saga. In January 2021, a group of young adults known as Millennials (born between 1981-1996) and Gen Zs (born between 1997-2012) called Wireless Investors disrupted the Wall Street stock market causing losses of twenty billion dollars to their target, Wall Street hedge funds that had plans for GameStop’s shares,[27] in what isdescribed as generational warfare by some analysts due to starking demographic and cultural differences between both groups. One are wealthy baby-boomers, gamblers; the other are under-45, wage-dependent, gamers.[28] The Wireless Investors’ strategic intent was discussed during the fall of 2020 in WallStreetBets, an online venue in Reddit. Following, Robinhood – a financial application designed for retail transactions – was weaponised to achieve the objectives of the Wireless Investors. A massive number of these Investors individually purchased small amounts of GameStop’s shares, causing a reduction in their purchase costs and triggering share prices to skyrocket, which reversed Wall Street’s expectations to devalue GameStop’s shares for a convenient re-purchase. Small stockholders automatically turned into a guild of empowered stakeholders, configuring themselves as an agenda-pushing force which, according to its actors, aimed to shift the decision making of governing boards by advancing corporate responsibility towards environmental, social, and governance matters.[29]
A massive number of these Investors individually purchased small amounts of GameStop’s shares, causing a reduction in their purchase costs and triggering share prices to skyrocket, which reversed Wall Street’s expectations to devalue GameStop’s shares for a convenient re-purchase.
This case emphasizes Dahl’s concept, where the younger cohort behaving as one-actor changed the older cohort’s expected course of behavioral action with strategic use of cyber platforms. The case also highlights the ability of individual non-state actors that, outside cyberspace, lacked the power they could wield when swarming into an online articulated force.
Conclusions
The center of gravity of power has experienced a tectonic shift. Increasing cyber reliance is driven by the proliferation of users to the point of prompting an unforeseen diffusion of power. States and intrastate actors used to be the largest stakeholders; currently, non-state actors’ influence blooms in at least two directions: private corporations with advanced skills in one, and citizens – individual and collectives – levering their voices through political borders in the other.
The center of gravity of power has experienced a tectonic shift. Increasing cyber reliance is driven by the proliferation of users to the point of prompting an unforeseen diffusion of power.
The cases analyzed in this article show that both actors, state and non-state, can make strategic use of cyberspace with relative ease despite asymmetries, supporting Nye’s argument of depolarising the world order. The enduring impact of this could produce unforeseen outcomes able to change the pattern of socio-economical formations and, in some cases, damage the social fabric, highlighting that cyber reliance raises risks and vulnerabilities multidimensionally.
While cyber is considered a domain for military operations, it would be better understood as the sinews that strategically backbones multiple domains such as military, diplomatic, informational, and critical infrastructure. In conclusion, based on their use of power and cyber power, states face higher risks than non-state actors, especially liberal democracies whose foundational values of freedom and agency challenges their governments’ abilities to exert control.
Julia M. Hodgins. Her research interests are gender security, cyber security, strategy, social equality, and decolonization; researched and co-authored the chapter “El Perú a Través de Nuestros Ojos” in forthcoming book Más allá del Bicentenario: Tareas Pendientes (Ed. Mariela Noles); producer of Docu-podcast “Indigenous languages in music”; sociologist concentrated in social research, candidate to the MA in International Affairs. The views contained in this article are the author’s alone.
[1] Joseph Nye, Cyber Power (Cambridge: Harvard Kennedy School) 2010, 1.
[2] Daniel Kuehl, “From Cyberspace to Cyberpower,” in Cyberpower and National Security (2009), 28.
[3] Nye, CyberPower, 11.
[4] Ibid., 7.
[5] Joseph Nye, The Future of Power (New York: PublicAffairs, 2011), 113.
[6] David Betz, “Cyberpower in Strategic Affairs: Neither Unthinkable nor Blessed,” Journal of Strategic Studies, 35:5, DOI:10.1080/01402390.2012.706970, 703.
[7] Robert Mandel, The Meaning of Military Victory (Boulder: Lynne Rienner Publishers, 2006), 16.
[8] Colin Gray, The Strategy Bridge, (Oxford: Oxford Scholarship Online, 2010) 43.
[9] Betz, Cyberspace, 29-30.
[10] Betz, “Cyberpower,” 697.
[11] Nye, Future, 113.
[12] Andreas Krieg and Jean-Marc Rickli, Surrogate Warfare (Georgetown: University Press, 2019), 40-49.
[13] Nye, Future, 114.
[14] Krieg-Rickli, Surrogate, 40-49.
[15] Colin Gray, Another Bloody Century (London: Phoenix, 2006), 217.
[16] Hew Strachan, ‘The Changing Character of War’, Europaeum Lecture delivered at the Graduate Institute of International Relations, Geneva (9 Nov. 2006), 2.
[17] Nye, Cyberpower, 2.
[18] Robert Dahl, “The Concept of Power,” Behavioral Science 2, no. 3 (1957), 202-203.
[19] Betz, Cyberspace, 31.
[20] Nye, Future, 113.
[21] Joseph Nye, “Deterrence and Dissuasion in Cyberspace,” International Security 41-3 (2017), doi-org.libproxy.kcl.ac.uk/10.1162/ISEC_a_00266, 51.
[22] Ibid., 44.
[23] Kathleen Jamieson, Cyberwar (Oxford: Oxford University Press, 2020), 42.
[24] Richard Clarke, “Warnings,” interview by Bill Maher, Real Time with Bill Maher, HBO, June 30, 2017, video, 2:49-3:00, https://www.youtube.com/watch?v=OCBJSmWY6nE&t=177s
[25] Jamieson, Cyberwar, 37-39.
[26] Pablo Quintanilla, “El Dialogo Publico y la Fuerza de las Razones,” in 2021, ed. Martin Tanaka (Lima: PUCP Fondo Editorial, 2021), 231
[27] Sergio Gramitto and Christina Sautter, “Corporate Governance Gaming,” https://ssrn.com/abstract=3815088, 5-9.
[28] Ibid., 15-20.
[29] Ibid., 33.
