Calls for aCyber ‘No‐Fly Zone’ Are Reckless and Unrealistic
pa href=https://www.cato.org/people/brandon-valeriano hreflang=undBrandon Valeriano/a
/p
div class=fs-sm
pPresident Volodymyr Zelenskyy’snbsp;a href=https://www.cnn.com/videos/world/2022/03/16/volodymyr-zelensky-congress-speech-ukraine-video-newsroom-vpx.cnn target=_blankimpassioned/anbsp;address to Congress added pressure on the United States to provide morenbsp;a href=https://nationalinterest.org/blog/buzz/zelenskyy-calls-no-fly-zone-speech-congress-201253 target=_blanksupport/anbsp;for Ukraine. While President Joe Biden might be able to resist calls for anbsp;no‐fly zone bynbsp;a href=https://www.washingtonpost.com/politics/2022/03/15/zelensky-joint-session-congress-biden/ target=_blankremarking/anbsp;that doing so is “called World War Three,” pundits will continue to push the West to provide more direct military support to Ukraine during this devastating war./p
/div
,
div class=fs-sm
pProviding material support to Ukraine might be entirely within thenbsp;a href=https://www.justsecurity.org/80661/supplying-arms-to-ukraine-is-not-an-act-of-war/ target=_blankbounds/anbsp;of historical and legal precedent. However, taking the idea to its logical extreme by suggesting the United States let loose the cyber “a href=https://warontherocks.com/2022/03/why-cyber-dogs-have-mostly-failed-to-bark/ target=_blankdogs of war/a” is anbsp;dangerous move that will likely drag the United States intonbsp;a href=https://nationalinterest.org/feature/raging-toward-abyss-russia-201144 target=_blankdirect conflict/anbsp;with Russia. Offensive cyber operations conducted by the U.S. military would be grounds for the expansion of the war and would make U.S. facilities legitimate targets during ongoing warfare./p
pstrongCyber Options During the War/strong/p
pThree weeks into anbsp;war withnbsp;a href=https://nationalinterest.org/blog/techland-when-great-power-competition-meets-digital-world/what-ukraine-shows-about-cyber target=_blankseemingly little/anbsp;cyber activity, the idea that the United States can launch offensive cyber operations against Russia to stop aggression withoutnbsp;a href=https://warontherocks.com/2022/03/preventing-cyber-escalation-in-ukraine-and-after/ target=_blanktriggering escalation/anbsp;is starting to take hold. The keynbsp;a href=https://www.washingtonpost.com/politics/2022/03/07/putins-invasion-ukraine-didnt-rely-cyber-warfare-heres-why/ target=_blankreason/anbsp;why cyber operations have not been utilized during the war is that they have limitednbsp;a href=https://oxford.universitypressscholarship.com/view/10.1093/oso/9780190618094.001.0001/oso-9780190618094 target=_blankcoercive/anbsp;andnbsp;a href=https://journals.sagepub.com/doi/abs/10.1177/0022002717737138 target=_blankbattlefield/anbsp;impacts, which suggests that they can do little to augment the already escalating violence in Ukraine./p
pCybersecurity isnbsp;a href=https://www.nytimes.com/2022/03/11/opinion/russia-ukraine-cyberattacks.html target=_blanknot magic/a, yet some seem to talk as if it is capable of achieving dramatic and disparate effects from the distance and relative safety ofnbsp;a href=https://www.greaterbaltimore.org/news/blog/fort-meade-cyber-star-central-maryland target=_blankFort Meade/a. Thenbsp;a href=https://nationalinterest.org/blog/techland-when-great-power-competition-meets-digital-world/what-ukraine-shows-about-cyber target=_blankdefense/anbsp;and skill of the attacker play massive roles in the equation of cyberwar./p
/div
,
aside class=aside--right aside--large aside
div class=pullquote p-mb-last-child-0
pThe war in Ukraine is far beyond the point where cyber operations can shape the conflict in anbsp;manner capable of limiting violence. /p
/div
/aside
,
div class=fs-sm
pIn a quest for some magical cyber capabilities, Fox News White House correspondent Jacqui Heinrich a href=https://twitter.com/JacquiHeinrich/status/1500961829509636099 target=_blanknoted/a that ldquo;some members of Congress are beginning to advocate for a non-kinetic no-fly zonemdash;something to the effect of using electromagnetic pulse, sonar, and cyber to keep Russian jets on the ground so they can never take off.rdquo; Just as there is no such thing as a a href=https://nationalinterest.org/feature/enforcing-no-fly-zone-ukraine-would-be-catastrophic-201073 target=_blanklimited/a no-fly zone, there is a href=https://www.vox.com/policy-and-politics/22967674/russia-ukraine-no-fly-zone-limited-nuclear-war target=_blankno such thing/a as a non-kinetic no-fly zone enabled through cyber weaponry./p
pIn another example, when asked on CNN about options if Russia escalates the war further, Gen. Mark Kimmitt (ret.) a href=https://www.youtube.com/watch?v=le2O8V28R2Y target=_blanksaid/a, ldquo;I know a href=https://www.penguinrandomhouse.com/books/547683/the-perfect-weapon-by-david-e-sanger/ target=_blankDavid Sanger/a is going to disagree with me, but this may be the opportunity for a cyber-attack, one limited in scope but one that clearly sends a message that there will be a penalty if [Russia] use[s] a href=https://nationalinterest.org/blog/buzz/russia-accuses-ukraine-planning-chemical-weapons-attack-201120 target=_blankchemical weapons/a.rdquo; Even after saying that he knows ldquo;there are no magic bullets,rdquo; Kimmitt offered a fantastical solution to the war in Ukraine./p
pstrongThe Risk of Cyber Escalation/strong/p
pWhile there is a low risk of cyber escalation a href=https://www.atlanticcouncil.org/wp-content/uploads/2019/11/What_do_we_know_about_cyber_escalation_.pdf target=_blankhistorically/a and a href=https://www.airuniversity.af.edu/Portals/10/SSQ/documents/Volume-13_Issue-3/Borghard.pdf target=_blanklogically/a, this does not mean that launching a cyber offensive comes without the massive risk of horizontal escalation spreading the war to other parties or proxies. When cyber scholars speak of limited escalation risks in cybersecurity, they typically refer to vertical escalation in severity and damage, not the risk of dragging third parties into the conflict, a key danger of using cyber options in support of Ukraine./p
pCyber capabilities can serve as tools of conflict management by offering a href=https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3987259 target=_blankoff-ramps/a and sending signals to the opposition. Yet it is difficult to manage a conflict that has already become a war for national survival. The war in Ukraine is far beyond the point where cyber operations can shape the conflict in a manner capable of limiting violencemdash;Russia is already shelling maternity wards, a href=https://nationalinterest.org/blog/buzz/outcry-after-russian-forces-bomb-childrens-hospital-mariupol-201095 target=_blankhospitals/a, and playgrounds./p
pThe risks of providing direct offensive cyber support to Ukraine are not limited to escalation; they also include the problem of unintended consequences with cyber operations. a href=https://www.nature.com/articles/palcomms2016102 target=_blankCyber weapons/a are not precise, nor are they really weapons. The idea of targeted and pinpoint accurate cyber operations betrays the evidence that even the most targeted operations, such as the Russian operation against a href=https://www.business-standard.com/article/technology/notpetya-how-a-russian-malware-created-the-world-s-worst-cyberattack-ever-118082700261_1.html target=_blankUkrainian tax software/a, can spread to a massive extent. Even a href=https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/ target=_blankStuxnet/a, a precise operation targeting a non-networked facility in Iran, spread into the a href=https://www.bbc.com/news/technology-12465688 target=_blankwild/a./p
pOffering offensive cyber support can also activate proxy and criminal elements. The Conti ransomware group a href=https://twitter.com/micahflee/status/1503421330695213062 target=_blankstated/a that ldquo;as a response to Western warmongering and American threats to use cyber warfare against the citizens of Russian Federation, the Conti Team is officially announcing that we will use our full capacity to deliver retaliatory measures in case the Western warmongers attempt to target critical infrastructure in Russia or any Russian-speaking region of the world.rdquo; Even more dangerous is the threat that such operations could pose to American allies and partners, including those in private industry. The U.S. government has the resources and ability to a href=https://nationalinterest.org/blog/techland-when-great-power-competition-meets-digital-world/forget-cyberwar-we-need-cybersecurity target=_blankprotect its interests/a, but it is not clear that our allies are organized in a manner that can forestall digital disaster./p
pstrongWe Shouldnrsquo;t Find Out/strong/p
pIn Kim Zetterrsquo;s comprehensive a href=https://www.politico.com/news/2022/03/12/cyber-russia-hacking-security-00016598 target=_blankreview/a of U.S. cyber capabilities and their potential to impact Russian operations, a href=https://www.dragos.com/team/robert-m-lee/ target=_blankRobert Lee/a, CEO of the cybersecurity firm Dragos and former National Security Agency ldquo;hacker,rdquo; made a key statement on American restraint. ldquo;Now is not the time to go poking around. Unless you have a … good need to be there, donrsquo;t go doing something that could be perceived as escalatory.rdquo;/p
pldquo;Mess around and find outrdquo; has become a popular meme, and the sentiment directly applies to the war in Ukraine. Now is not the time to experiment and find out the limits of Russian aggression. In fact, it is likely there a href=https://www.cnn.com/2022/03/09/europe/russia-invasion-ukraine-evacuations-03-09-intl/index.html target=_blankare no limits/a. While the a href=https://www.airuniversity.af.edu/Portals/10/SSQ/documents/Volume-13_Issue-3/Borghard.pdf target=_blankrisks/a of a href=https://www.atlanticcouncil.org/wp-content/uploads/2019/11/What_do_we_know_about_cyber_escalation_.pdf target=_blankescalation/a after a href=https://academic.oup.com/cybersecurity/article/5/1/tyz007/5575971 target=_blankcyber action/a are limited, the context of the war and Russiarsquo;s belligerence suggest that it is a dangerous time to test the bounds of cyber a href=https://www.lawfareblog.com/managing-escalation-under-layered-cyber-deterrence target=_blankescalation theory/a./p
pCyber operations are difficult to leverage for effect; a href=https://global.oup.com/academic/product/cyber-strategy-9780197523780?cc=usamp;lang=enamp; target=_blankacademic/a research shows that they are ambiguous and weak signals. But empirical academic observations do not make for easy policy options. Discussions of how to employ cyber operations during a crisis need to advance to the point where there is a clear and realistic strategy for their impact that does not buy into the a href=https://oxford.universitypressscholarship.com/view/10.1093/acprof:oso/9780190204792.001.0001/acprof-9780190204792 target=_blankhype/a offered by cyber operations./p
pAbstract discussions of what can be done to help the Ukrainian people may transform into a moral imperative at some point. However, if that happens, it does not mean that technological tools can be leveraged to minimize violence. There is no sanitizing violence through cyber operations. Cyber operations do not offer a magical solution to the conflict, and anyone selling this bill of goods has clearly moved on from slinging a href=https://en-academic.com/dic.nsf/enwiki/8793098 target=_blankswampland/a in Florida. /p
/div