Cyber Warfare is the Future of Global Conflict

The future of war is digital. The importance of cyber defense can’t be overstated. We need insights on the evolving landscape of cybersecurity and innovative strategies to shape the future of protection and national security in a world of cyber warfare.

See Cyber Warfare with Dr. Chase Cunningham for a complete transcript of the Easy Prey podcast episode.

Dr. Chase Cunningham has over twenty years of experience in cyber forensics, analytics, and offensive-defensive cyber operations. After a career as a Navy chief where he worked in cryptology, he spent a number of years working at the NSA and other three-letter agencies. Now, he does a lot of consulting and helping people where he can, including regularly consulting with Capitol Hill.

Chase didn’t set out to become a cyber warfare expert. He was interested in computers, but when he joined the Navy and was given the job sheet, he passed over the cryptologist option and, since he also liked working on engines, chose to be a diesel engineer. Diesel engineering turned out to be mostly working on air conditioning and piping, and he hated it. But he did enjoy messing around with the computer systems and doing things he shouldn’t have been doing. Someone figured out that it was him, and instead of sending him to military prison, they let him transition to cryptologist instead. He got lucky – but it was the start of a great career.

Defining Cyber Warfare

Cyber warfare is just the next natural evolution of conflict. It takes conflict from physical space into digital space. Carl von Clausewitz said that war is just politics by other means; cyber warfare is just politics by digital means. It’s the bridge between espionage and kinetic activity. And it can be more on one side or the other depending on the need.

Cyber warfare is just the natural evolution of conflict in the digital space.

Dr. Chase Cunningham

It’s also the ultimate level playing field. It’s the only space where a country like North Korea, which can’t even feed its own people, can build a nuclear program. They’ve funded it on stolen cryptocurrency assets.

The conflict between Russia and Ukraine is the first time we’re really seeing it play out in real time. We’re seeing multi-billion-dollar tanks taken out with $600 and a piece of old Chinese artillery. It’s incredible to see what Ukraine has done with cheap homemade drones – enough to hold back a former world superpower. If you picture warfare in 2050, take the Russia/Ukraine conflict and make it a little more science fiction-ish, and that’s what it will look like. Chase thinks we’ll lose a lot less human life, which is good. Autonomous drones don’t need people, and dominating battlefields or airspace with cheap drones won’t have any humans involved. We’ll still need bomber pilots to fly long-range stuff, sure, but we probably won’t need fighter pilots in the near future.

I think what we’re seeing in Ukraine right now is honestly the future state of warfare.

Dr. Chase Cunningham

Non-Government Players

It’s not just governments getting into cyber warfare, either. There are also actors who aren’t specific to any governments. These are often criminals who live in areas without extradition treaties. There are also digital mercenary factions popping up. They make themselves available, do an operation for whatever government is willing to pay, make their money, and then disappear and find someone else. They have no allegiance to anyone.

These groups are majors players in the digital space. And they all seem to focus on different areas, which is interesting. Some break into systems, others are good at doing stuff once inside, still others are good at exfiltrating things to groups who can use it. And they resell what they get to each other, creating a cesspool of malicious activity.

These groups’ primary targets really depend on the group and who’s paying the bill. A lot of attacks out of Russia and Europe is focused on cyber disruption to kinetic systems – hospitals, healthcare, financial systems, critical infrastructure. Coming out of the Asia-Pacific region, they’re often strategic players looking at long-term infrastructure, logistics, oil and gas, and those kinds of things. It all depends on who’s running the operation and their motivations.

Cyber Warfare and Critical Infrastructure

“Critical infrastructure” is a very broad term. If you put a bunch of people from Capitol Hill in a room and asked them what critical infrastructure is, you’d probably get a weird answer. Typically, things like oil, gas, water, piping, and healthcare are considered critical infrastructure. Chase would argue that school systems also count.

It’s not well-defined, and this is actually a problem in cyber warfare. Because we don’t have a definition of it, we don’t have legislation on what should happen if it gets targeted. If a water filtration system goes down, was it an act of war, espionage, a kid goofing around, or did the code just break? It’s hard to tell, and we don’t have a process to decide what to do.

Last year, 140 hospitals were hit with ransomware and sixty Americans died because their care was interrupted or delayed by these attacks. If a bunch of terrorists parachuted into a city, took a hospital hostage, and killed sixty people, we would be going to war. But because it’s cyber, there’s often an attitude that the nerds will handle it. That’s a problem. Identifying the bad guys can also be a problem, too. We can identify terrorists who parachuted in. But 140 hospitals could be attacked by 140 different entities, all hiding their real location. It can be hard to figure out even where they’re coming from, let alone their motivations. And even if we could figure it out, people are still going to be unsure if we should react.

The U.S. Isn’t Ready for Cyber Warfare

There are a lot of good people doing good work to figure out how to operate in the context of a digital war. But if you were to ask Chase if we’re ready today to defend ourselves adequately and keep our current way of life functional, he would say not today – and that’s a problem.

There are many factors affecting this. Cyber warfare is an interesting evolution of the combat space. Things haven’t changed this dramatically in war since the invention of gunpowder. If you see an army coming over a hill, you know what to defend and where you can run. If you’re in the interior of the U.S. and your water filtration isn’t working, it’s not clear where the attack came from, where you can go, or what to do next.

Other than the invention of gunpowder, things have not changed this dynamically in the entire human history.

Dr. Chase Cunningham

The Cyber Warfare Playbook

Two Chinese PLA colonels wrote a book called Unrestricted Warfare that set the future state of digital conflict. It basically plotted out what would happen over the last ten years. The book says the war god’s face will become undefined – meaning that the goal is the person you’re attacking doesn’t even know who they’re engaged with or why. The goal is just to cause enough chaos so the enemy falls in on themselves.

It’s an interesting perspective because the U.S. is a country built around processes, requirements, legal issues, and regulations. If you throw enough wrenches into that, it gets crazy fast. War is no longer about conquering a particular piece of land. It’s about not wanting someone to be a player in world affairs and generating enough chaos that they can’t anymore. It’s like avoiding calling the big kid to the parking lot by driving him so crazy inside that he won’t bother coming out.

The techniques don’t even have to be perfect, just good enough to cause death by a thousand cuts. The Chinese and CCP have been playing this game for a while. They built three aircraft carriers and only put two out to sea. The third they called a research vessel and keep trying new things on it. They don’t intend to ever put it out to sea. Its entire goal is to keep us invested in figuring out what they’re doing. Unrestricted Warfare also talks about how these tactics are what we did to the Russians in Afghanistan. We caused the fall of the Soviet Union, and now China is using it on us. In the U.S., our time as a global superpower is limited for lots of reasons, not least because cyber warfare makes the playing field very level.

Protect Yourself from Cyber Warfare

There are things you can do to protect yourself and reduce your risk in these incidents, even as a civilian. Whether you’re a business owner or a home user, follow best practices. Don’t be lazy with your setup and configurations. Change the defaults that you get from the manufacturers. Turn on multi-factor authentication. Consider switching to Chromebooks for your devices – ransomware won’t run on a Chromebook because they don’t have an operating system.

Especially be cautious with smart devices and internet-connected tools. Thermostats and baby monitors with default passwords, a smart fridge with an outdated operating system that can’t be upgraded, all of these are big risks. Chase recently saw someone with a wifi-enabled bidet – which is just entirely unnecessary. Every internet-connected device you have is another potential attack vector.

None of this stuff as far as being a harder target is rocket science, but it does require a little bit of strategic thinking and maybe some investment.

Dr. Chase Cunningham

Being safer and becoming a more challenging target isn’t rocket science. But it does require you to pay attention, think strategically, and potentially invest a little bit in your security. Just doing the simple, basic stuff can go a long way towards keeping you safer.

How Governments are Advancing Cyber Defense

The U.S. government put out a policy a few years ago called Defend Forward. The idea is that if there are indications of things being problematic or there’s a trend towards attack, they can start moving to defend that front line. Some of the new leadership currently on Capitol Hill are suited to actually change the legal requirements. There are a lot of conversations going on about the definition of negligence in cybersecurity, which is good. The government is aware of the threats. A lot of working groups, like Mitre, NIST, and others, have guidance for it. But it’s a big battleship trying to turn with a wooden tiller. It’s going to take time.

The Russia-Ukraine war has also let us see what happens and figuring out how to adapt our militaries. It’s the most televised and recorded war in human history. Military strategists can learn what works, what does, where changes are needed, and where things can be applied practically in real time. It’s a good time to be a U.S. military strategist because you have practically a live feed of this war.

Israel is probably the world leader in effective cyber operations – in large part because they have to be. They’re surrounded by their enemies and have to counter cyber warfare all the time. They have been directed from t heir higher-ups to do whatever they need to do to defend Israel. Some other countries are catching up. But if you want a good example of what cyber defense looks like for a government, look at Israel.

What’s Next for Cyber Warfare

A lot of valuable capabilities are developed in the context of war. Whether or not people want to admit it, war is good for innovation. On the drone side, battlefield medicine has seen some huge advances because it’s much easier to get a drone in with a kit before you can get an injured person on a plane or helicopter. When Chase was in the military, conversations were all about how fast they could get wounded people back to surgery. Now there are videos where people in Ukraine were shot, a drone flies a kit out, and someone gives instructions to use it over the phone. It saves lives.

There’s also a lot of potential for collaboration. We’re learning what conflict will look like in the future, which is very needed. We’re also seeing some innovation around identity and identification, with more ways to track and respond in real time. Just like anything, there’s risk and reward. War can cause a lot of damage, but there’s good coming out of cyber warfare with innovation and collaboration. Times of transition are always messy. At some point, things will be stable, but for the immediate future, we’re just ice skating uphill.

Chase Cunningham’s books, gAbrIel and the sequel vArIable are available wherever books are sold. You can also connect with Chase on LinkedIn. He is a fan of DMs and chatting with people there.