The Cyber, Space and Future Conflict Programme represents a significant revamp and enhancement of the Cyber Security Programme that has been in existence in IISS since 2010. Its overarching purpose will be to examine how the future evolution of conflict, including armed conflict, will be affected by developments in Information and Communications Technologies (ICTs) and related technologies such as robotics, autonomous systems and artificial intelligence.
Information and Communications Technologies (ICTs) have had a transformational effect on the way most forms of human interaction are now conducted. The significant benefits that these technologies have conferred have also injected equally significant levels of new risk. This is particularly true in the fields of international security and armed conflict. While traditional security powers, such as the United States, have derived substantial first-mover advantage from developing ICTs for purposes of espionage, sabotage and the delivery of military effect, numerous other lesser actors have been empowered by these same technologies. The more networked societies have become, the more vulnerable they have become to potentially paralyzing cyber disruptions. The international community has been slow to respond to the militarization of the cyber domain, with many states refusing as a matter of policy to acknowledge that this phenomenon is taking place or that it requires the development of new concepts, norms of conduct and laws. The cyber domain is also characterised by political and ideological tensions that pit established cyber powers, such as the United States, against rapidly rising cyber powers, notably China, which have a very different perspective on global cyber governance and cyber security.
The aim of the IISS Cyber, Space and Future Conflict Programme is to study in detail the impact on future conflict of cyber capabilities and related technologies such as artificial intelligence (AI). The focus of this work will be on the role and capacities of the nation-state. However, it will also consider the role of non-state groups and major transnational actors such as technology companies and international organisations. The Programme will examine the cyber capabilities and doctrines of states and will attempt to form judgments about the relative capacities of individual states, whether acting independently or in partnership, to achieve effects and outcomes in the cyber domain, at both the level below the Law of Armed Conflict (including cyber espionage), and within the realm of laws governing armed conflict. The role of social media in conflict situations and in the use of cyber capabilities in information warfare will also be the subject of investigation. The Programme will analyse the different factors – technical, legal, economic and social – that condition the global cyber domain. It will consider how international diplomatic negotiations might shape and condition this domain, and in particular its impact on global cyber governance, discussion of norms of behaviour as well as laws relating to the cyber activities of states. Other factors that will be taken into account are the changing shape and structure of the Internet including the implications of Internet fragmentation and the potential for new Internet service providers from states such as China to exercise a normative effect on the global cyber environment.
The Programme will comprise a number of research strands, including the development of a methodology for determining the military cyber capabilities of states. It will also consider how concepts of deterrence and the application of international law can be developed to inject greater stability and predictability into what has become an unstable and unpredictable environment. An important component of the Programme will be para-diplomatic engagement with major non-western actors, including China and Russia, to ensure that policy-relevant research is developed which takes account of their interests and perceptions.
Since 2010, the cyber domain has witnessed substantial changes and developments with Information and Communications Technologies (ICT) playing an ever more central role in most facets of modern life. The evolution of the cyber domain is being driven by rapidly developing technologies which are overwhelmingly in the hands of large corporations. Though headquartered in the United States, these corporations are quasi-independent transnational actors controlling more resources and exercising greater power than many nation-states and are ever less beholden to any particular national jurisdiction. It is through networks and systems built, owned and maintained by these entities that national governments seek to exercise their responsibility to provide security for their citizens and to exercise and project national power.
The Internet evolved out of a small academic network linking individuals who knew and trusted each other. Security was never a consideration in the original design. But this approach has not scaled to a global level and the absence of security by design has created a global network that is chronically and irremediably prone to vulnerabilities that are being exploited by a growing range of malign actors: criminals, terrorists, non-state groups and hostile states. Attitudes towards security are beginning to change as awareness of vulnerabilities becomes more pervasive; the private sector are- slowly and unevenly- beginning to develop an appreciation of the digital value of their organisations and are investing more in systems and data security. But security is being retrofitted with all the implicit shortcomings of such an approach and is in any case unable to keep pace with the rate of technology change leading to a situation in which the critical national infrastructure of many states remains dependent on highly vulnerable legacy systems.
The evolution of ICT has had a significant empowering effect on state groups many of whom now possess signals intelligence and cyber espionage capabilities that until a decade ago had been the preserve of a few major cyber powers. States have begun to acquire both the capabilities and doctrines that would enable them to undertake offensive operations in the cyber domain with other states possessing the capacities but not yet the doctrines. And non-state and sub-state groups such as Hizballah and Islamic State have acquired substantial capabilities while presenting very little by way of attack surface against which to retaliate. There however remains a top tier of states whose capabilities remain orders of magnitude superior to those of other states and it is these actors – the USA and its Five-Eyes allies, China, and Russia- that are shaping a global strategic cyber environment that is characterised by deep ideological division and by a state of constant and unremitting cyber contestation occupying a space between peace and war and mostly taking place at a level below the point at which the Law of Armed Conflict could be invoked. These top-tier states are devoting significant diplomatic effort to shaping an international cyber environment in the fields of governance and security which favours their national strategic aims and preferences whilst simultaneously reconnoitering each other’s networks and engaging in widespread cyber espionage which in the Chinese case includes a significant state-sponsored industrial component.
The cyber component of hard power projection operates at two levels. The first is at a specifically military level and is about protecting dedicated military networks, developing capabilities that provide battlespace visibility such as C4ISR, and the use of cybered weapons systems. In this latter context the use of autonomous weapons systems is likely to becoming an increasing preoccupation and calculated to become controversial as evidenced by public responses to existing operations involving the use of armed UAVs. Most major weapons systems are now cyber-dependent and often involve a space component. The other level is the strategic use of cyber power to compel or constrain an adversary by degrading or destroying the networks and systems that support normal life- transport, banking and finance, supply chains. It is debatable whether such actions can in and of themselves constrain an adversary and are more likely to be a prelude to or concomitant of kinetic activity with all the escalatory potential that such behaviour would imply in particular in relation to states with space-based and nuclear weapons capabilities. Such activities are beyond the current capabilities of most militaries and would likely be conducted by a combination of signals intelligence agencies and contract employees or non-state proxies thus conferring advantage on those actors able to brigade all-of-nation capabilities in support of their cause. In such circumstances private sector networks would expect to be commandeered or nationalised.