What does it mean to 'win' a cyberwar?

Even as countries build up digital defense networks and train armies of hackers, the nature of cyberconflict remains little understood. There isn't even a firm grasp on what it means to fight – let alone win – a cyberwar. 

That was the consensus of a panel discussion at the Atlantic Council’s Cyber Statecraft Initiative Wednesday that focused on digital warfare. While the group of experts agreed that rules of engagement in cyberspace are still evolving, they said it's time to stop giving that realm secondary status to a physical conflict because it's less immediately tangible.

"[Military experts] walk the battlefield at Gettysburg because they think there's something that they can learn that will help them be a better military officer or duty official today," said Jason Healey, nonresident senior fellow at the Atlantic Council and senior research scholar at Columbia University. "But yet something that happened a couple years ago in cyberspace they say, "Eh, why bother learning that?'”

Passcode was the exclusive media partner for this event hosted by the Atlantic Council’s Cyber Statecraft Initiative on Wednesday focusing on the nature and origins of cyberconflict. Here are three things we learned from some of the country’s leading thinkers: 

1. Don’t forget about the human element

Despite the technical nature of cyberconflict, humans are the most important element, said Chris Inglis, distinguished visiting professor in cybersecurity studies at the US Naval Academy who was National Security Agency deputy director until last year. "The most vexing, the most opportunistic, the weakest component of that is the people” and those who are making decisions related to cyberconflict, he said. 

This is most apparent in instances where soft power, such as during negotiations with allies, have helped nations emerge from a cyberconflict on solid footing. Estonia, the panelists agreed, is a perfect example. While Estonia was seemingly beaten in the digital security realm by a Russian attack in 2007, the country came out strong because other nations learned about Russia’s capabilities – and Estonia was able to rebound to a stronger security position.

2. Cyberwar is the buzzword, but cyberpeace is the statistic

Despite the headlines made about cyberwar practices, said Brandon Valeriano, a senior lecturer at the University of Glasgow, the statistics show that "there’s been a remarkable amount of restraint" when it comes to digital conflicts. Cyberwarfare is manifesting differently than other kinds of war. Nations with the most sophisticated cyberweapons are not primarily using them in offensive operations, but rather in cases of covert espionage. This suggests there is more of an undercurrent of peace present than there is conflict. 

3. There’s no way to be completely secure

No matter how sophisticated the technology may be, panelists say there is “no such thing as total cybersecurity.” Mr. Valeriano suggested that instead of striving for an iron fortress of technology, countries should reframe their the way they think about digital protection.

“If you write it down, if you put it on your computer, you will be vulnerable,” he said. “We need to accept that.”

Two notable quotes:  

"While cyber is unique, it has unique characteristics, it doesn’t stand on its own. We bring other instruments of power to bear to achieve objectives in cyberspace. Cyberspace can be brought to bear as an instrument of power to achieve objectives in other domains. It’s connected. It’s always been true about other domains, and it’s no less true for cyberspace." – Chris Inglis, distinguished visiting professor in cybersecurity studies at the US Naval Academy.

"What if 20 years from now, we look back and said, 'Oh, the nation that won in cyberspace wasn’t the one that went out to seize the most digital hilltops, it was the one that won the hearts and minds of the digital natives around the world.' If that’s how we should be defining winning, if that’s what’s actually going to be the most successful nation that gets the best national security outcomes, we’re not necessarily going down the right path." – Jason Healey, nonresident senior fellow at the Atlantic Council and senior research scholar at Columbia University.

Notable tweet: