ARGUMENT: DIGITAL SUPRISEWhat to Expect with Cyber Surprise

The cyber domain has three critical characteristics which differentiate it from the kinetic domain: it is connected across the globe; it is pervasive in the economic life-blood of the world; and it is asymmetric in its ability to enable power projection.

Paul Rosenzweig writes in Lawfare that “Never before has the world faced a kinetic war with that background of baseline vulnerability.”

What, then, can we expect from a strategic surprise which we expect Russia to launch as part of its campaign in Ukraine? Rosenzweig notes that the degree of surprise often varies. Some surprises, like the attack on Pearl Harbor, are deep strategic surprises. The 9/11 attacks were similarly disorienting. But other surprises, like the Bengals victory over the Chiefs in the Super Bowl, or (for those who follow soccer), Leicester winning the English Premier League in 2016, were surprising, but not so completely unanticipated that they are deeply disruptive.

He writes

Governments and the private sector will, of course, expect the normal level of surprise. There will be denial of service attacks and the surprise will only be where and when. Likewise, we can expect disinformation campaigns, false flag operations, and even disruptions to Ukrainian critical infrastructure.  

As Jason Healy has put it, the possibilities of surprise in cyberspace are almost limitless. But if the defenders have done their jobs well, their responses will be as good as they can, in practice, be. That may or may not be sufficient to the task—but the surprise factor will be only a small component of the overall success or failure.

What then, of the bigger strategic surprise? Here of some of them:

What if Ukraine’s weapons don’t work? It’s possible that many of the more sophisticated weapons rely on computer systems that can be disabled.

Will deep fakes play a role in the upcoming conflict?  What, for example, might happen if a video of Ukrainian President Zelenskyy surfaced in which he abdicated his office?

What if Russia decides to expand the cyber battlefield?  What is the Western response if, say, Putin decides to punish Lithuania for providing support to Ukraine?

What if Russia decides to hold at risk critical international initiatives? In this time of pandemic response, for example, the supply chain for vaccine production and distribution is both extremely important and extremely fragile.

But the unique characteristics of the cyber domain make it impossible to predict, with any degree of certainty, what a digital surprise will look like. “We are about to see what war in the cyber era really looks like and, truthfully, nobody can tell you what will happen next,” Rosenzweig concludes.