Hoisted by Which Petard, Exactly? Cyber Warfare, Collisions at Sea, and Threat Inflation
With the latest tragedy befalling the USS John S. McCain, some have sought to blame China or cyberwarfare more generally. So far, these accusations rest primarily upon “expert opinion,” skepticism about coincidence, and downright speculation. It is therefore worth keeping in mind that threat inflation, by definition, occurs in the absence of evidence. If we consider known facts, skepticism that a cyberattack is responsible for the recent tragedies in the Pacific is warranted. Even in the unlikely event a cyberattack is responsible for these or future disasters, properly accounting for this case can help us develop a better strategic response.
Much of the “evidence” that cybersecurity is the culprit for the collisions in the Pacific assumes the commanders could not have made mistakes leading to these collisions, or that so many failures must arise from a witting, malicious actor. Jeff Stutzman, a former information warfare specialist said:
When you are going through the Strait of Malacca, you can’t tell me that a Navy destroyer doesn’t have a full navigation team going with full lookouts on every wing and extra people on radar.
Pointing to four recent incidents of collision, Todd Humphreys a professor of engineering at the University of Texas said, “Statistically, it looks very suspicious, doesn’t it?”
Unfortunately, there is ample evidence that clustered leadership failures do occur, and we can expect them now. The U.S. military has been on a war footing for 16 years, and it has taken a toll. The services have been plagued with a series of scandals where officers acted inappropriately. The same dynamics that have produced rafts of nuclear officers unable to pass tests without cheating might also produce multiple naval commanders incapable of navigating their ships without collision. Indeed, there is mounting evidence of systemic problems that would explain these collisions.
There is no obvious motive for China, or any other actor, to hack Navy vessels in such a fashion. Cyber capabilities are extremely perishable, and if an actor has the ability to interfere with a destroyer’s operations, doing so during a time of relative peace is costly. While damaging a couple of destroyers might impose costs on the United States in the short term, it is no where near sufficient to offset the risk of losing or exposing a capability that could be priceless in a war. Nor could this be an attempt to coerce or deter the United States, since we are not only guessing at the potential causes, but guessing even more wildly at the motivations. If China wants change American behavior by threatening cyberattacks, it needs to actually threaten the attacks, and tell the United States what behavior its wants it to change.
Cybersecurity has taken on the role previously held by demons or aliens: a convenient ex machina that we can blame. Computing technology makes for a convenient boogie man because everyone uses computers and the internet, but few understand them. Consequently, it is easy — and in some cases plausible — to believe computers could cause nearly any outcome.
There are also powerful reasons for people to want to believe hackers and computers are to blame. People have died, careers have ended, and more will soon end. It is hard to accept that such tremendous loss resulted from seemingly trivial causes like inattentiveness. This search for meaning in loss can also push us to impute a pattern when one does not exist. It is also terrifying to think that we may have entrusted some of the most expensive and powerful weapons systems in the world to people who cannot manage them. And cynically but truthfully, cyberwar sells in a way that accidents, however disastrous, do not.
It is important that we not exaggerate the threats from cyberattacks whatever the motivation, because there is a real threat. But if the best that cyberattacks can do now is replicate the damage that our own incompetence can handle just fine, we must calibrate our response accordingly. If we falsely attribute power to a tactic that does not currently work, we risk expending scarce resources to counter a threat that currently does not exist. Inflating low-level threats now can cause us to underestimate greater threats in the future, or ignore warnings that the threat is increasing. If the day comes that cyber threats really threaten command of the sea, air, or land, we will be better off if we habitually consider the evidence before use, rather than leaping to conclusions through conjecture.
David Benson (@davidcbenson) is a Professor of Strategy and Security Studies at the School of Advanced Air and Space Studies (SAASS), part of Air University in Montgomery, AL. His area of focus includes online politics and international relations.
