INFORMATION and National Security

1. INFORMATIONand National Security Dr. Dan Kuehl National Defense University (NDU) Information Resources Management College (IRMC) My Opinions: not the USG, DOD, or NDU

2. The Three Stages of Mankind’s Evolution Homo Erectus: Mankind standing up and staring at movie props “2001 A Space Odyssey” 1968 Homo Sapiens: Mankind’s Superior Intellect Monty Python’s “The Holy Grail” Homo Connectus:Mankind as Overly-Connected Cyborg “Beetle Bailey”

3. Outline • Information and National Power • Cyberspace and Info Space • Information in National Security Strategy • Infrastructure Protection/Information Assurance • Strategic Communication • Information-Cyber Operations • Joint, Service, Global • New Developments • Measuring Power • An Information Strategy

4. Information as Power: DIME • Distinct from yet employed across/integrated with all other elements of power • Political/Diplomatic • From Radio Free Europe to “War of Ideas” to Strategic Communication • Military • Military Technical Revolution to Revolution in Military Affairs to “Transformation” to ?? • Economic • Synergy of Information Communication Technologies and national economies • Infrastructures

5. Information Power (1) • The Information Component of Power: • “Combination of information content and technology used as a strategic instrument to shape fundamental political, economic, military and cultural forces on a long-term basis to affect the global behavior of governments, supra- and non governmental organizations, and societies to support national security strategies & objectives” • Dan Kuehl, Strategic Forum #115, “Defining Info Power”,(1997) • President Ronald Reagan: National Security Strategy (1987) • Used by every nation state and strategic political entity, regardless of technological development

6. Information Environment • Physical/Electronic Connectivity: “Ether”/Cyberspace/”eSpace” • Infrastructures, wires, networks, etc: a means of delivery • Cyberspace as a unique physical domain (land, sea, air, space) • Includes human (non-technical) connectivity • Information Content: • Words, images, databases, 11010111000s • Deeds/Actions are content • Context: identical content may be understood differently • Cognitive: “influence/perception” • Meaning and the Mind: “most important” • Example: Serbian TV vs NATO cohesion 1999 • Losing the battle here may negate winning kinetically • Al Q’aida using kinetic ops to create cognitive effects

7. Information Power (2) • “The relative ability to operate in and exploit the information environment • the aggregated and synergistic combination of CONNECTIVITY, CONTENT, & COGNITION. It is an indispensable underpinning for all other forms of power, yet it is unique in its own right. It is employed across all other forms of human activity—economics, war, diplomacy—and across all levels of conflict, from peace to war. Its elements can be described, and their impact measured, albeit not necessarily to the exactness as other components of power.” • Analogous to air-sea-space power • Dan Kuehl, “The Information Revolution & the Transformation of Warfare” (2007)

8. Cyberspace is…..?? • “Cyberspace is a global domain within the information environment whose distinctive and unique character is framed by the use of electronics and the electromagnetic spectrum to create, store, modify, exchange and exploit information via interdependent and interconnected networks using information-communications technologies (ICT)” • Dan Kuehl, “Cyberspace & Cyberpower: Defining the Problem”, Cyberpower & National Security, 2009 • “A global domain within the information environment consisting of the interdependent networks of information technology infrastructures, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers.” (“until further notice”) J-5 Cyber Directorate (DepSecDef memo of 12 May 2008) DOD DTK

9. Cyberspace is…. Man-made technologies are necessary to exploit ALL of our operational domains and the natural phenomena from which they derive their characteristics: Chariots on land, Airplanes in the air, Ships at sea, Satellites in space PC PC Tim Harrell, Booz-Allen-Hamilton

10. Cyber operations are… • “the employment of cyber capabilities where the primary purpose is to achieve military objectives or effects in or through cyberspace. Such operations include computer network operations and activities to operate and defend the Global Information Grid” • Is the GIG our “base” in cyberspace? • A foundation for Organize, Train & Equip • What is excluded: “operations that may cause effects in cyberspace—EW, Psyop—[but] that do not employ cyber capabilities.” • VCJCS Memo 25 September 2008 • (Do you agree?)

11. “First Battles’” Thesis • Traditional Warfare: first defeats-even disasters- did not always equal final defeat; strategic “space” allowed for recovery • Geographic and Temporal (“land/distance & time”) • Russia, 1941-44; Pacific, 1941-44 • Battles for operational/technological superiority: • Radar, Airspace, Battle of Atlantic • Cyberwarfare: defeat in the first cyberbattle may be the defining condition for victory • “Victory” in Clausewitzian terms, ie./ political objectives, not solely/narrowly military

12. President Reagan, 1987/1988 Political and Informational Power federal agencies & private sector counter “public deception & propaganda” “full range of US informational programs” to “reach peoples of denied areas” “electronic media, written materials, increased contact & exchange” Technology strategic advantage “free flow of information” facilitates creation & exploitation of advanced technology economic health and military capability computer technology and software Info support to diplomatic power “fight the war of ideas” President Clinton, 1999/2000 3 Key pillars Info Assurance/Critical Infrastructure Protection (IA/CIP) Vital national interest, use unilateral force to defend; “Partnership” Information Warfare/Ops (IW/IO) MTR/RMA to Network Centric Ops to Transformation: Desert Storm to Kosovo to Afghanistan and Iraq Public Diplomacy/International Public Information (PD/IPI) ”Softpower” (Joe Nye); (Strategic Communication) “increasingly vital….transmit [our] message to people around the world” to “counter misinformation & incitement…mitigate conflict” “Softpower & Smartpower” (Joe Nye and SecDef Gates, 2008) US National Security Strategy(Past)

13. Obama Admin • Three Suggestions • Do not treat cyberspace in isolation from information environment (See DepSecDef Memo of May 07) • Need comprehensive Cyberstrategy as a segment of an even more comprehensive National Info Strategy • “Comprehensive National Cybersecurity Initiative” (CNCI) is vital but not enough by itself • Grow the Partnership • Public Sector: Interagency/Government (all levels), Military, Congress, Intel, Agencies, etc • Private Sector: Industry/Business, Academia, Society • International partners and organizations • Develop an Information Strategy • Build the “3Cs” (later)

14. Information Assurance Critical Infrastructure Protection • Dependency/Interconnections create Vulnerability • National Infrastructure controls • complex, interconnected, centralized, autonomous: SCADA • energy, transportation, communications, finance, etc • US Government actions 1990s – 200Xs • Australia, Norway, Sweden, Canada… • Just as valid for Europe, Asia as US: A global trend • NATO, EU • Partnership of Public-Private sectors • Lessons from Estonia & Georgia? • “Smaller is Better” • Strategic/economic impact/threat • “Strategic Fragility” • Mobilization = German railroad system 1914? • Cybersecurity Report (Melissa Hathaway’s effort)

15. The New National/Global Security Environment • “Global Asymmetric Engagement/Asymmetric Counterforce’ • Cyberwar vs information & networks; operating in a contested global commons • (see Flournoy/Brimley in USNI July 2009) • Asymmetric warfare & the “revolution in military affairs” = others are looking for OUR weaknesses • Information-dependent military operations • Critical infrastructure-dependent national societies • Inter-connected global economies • Have we the organizations, doctrines, personnel needed to survive and win the First Battle in Cyberspace?

16. Potential Cyber Attack Objectives • Disrupt enemy infrastructure, logistics and supply chains • Distract, confuse, and disable enemy C4ISR • OODA-Loop effects • Impair the movement of military forces • Deny similar capabilities to the enemy • Create opportunities for strategic attacks on enemy infrastructures • Weaken, distract and disorient social cohesion and political will of both military forces and civil populace • Shape global perceptions of the conflict • Time-Gap: potentially NANOSECONDS! Bob Miller & Irv Lachow, “Strategic Fragility”, http://www.ndu.edu/CTNSP/defense_horizons/DH59.pdf

17. Strategic InfluenceStrategic Communication • “Strategic Influence” is a strategic instrument…and always has been • Assyrian palace at Nimrud 700BC • TV is everywhere (“Softwar”) • “This weapon of television could be useful”; Edward R. Murrow 1951 • Vietnam to “Tear Down This Wall” to Al Firdos bunker to “Live from the WTC” • New mediums: Internet, cell phone cameras (London 2005), Twitter • Cyberspace & Terrorism = cyberterrorism? • Info battle of Iraq: winning? • Global influence: succeeding? • MUST see through THEIR lens • Al Jazeera - Al Hurra, Radio Sawa • Recent congressional engagement • Needed for resources, support

18. Strategic CommunicationSymphony Orchestra or Jazz Ensemble? Cdr Steve Tatham, RN “Strategic Communication: a Primer”

19. War of Ideas…or Images?Narratives and Pictures

20. Influence “Campaigning” Sensing- Receiving • Elements of an Information “Campaign” • WHAT is the desired EFFECT? • WHO is the audience? • Cultural awareness • Are we listening or just talking? • WHAT is the message? • Content analysis • Perceptions = Reality • DEEDS = messages! • HOW to deliver it? • Which Media and Spokesman: Shortwave to Arab street, or Imam in Mosque? • WAS it successful? • Metrics & measurement • Measure impact, not effort Behaving Cognitive Dissonance Confirmation or Contradiction Goal: Desired Action Cultural Mismatch Faith and/or Reason Perceiving- Internalizing Believing

21. “Integrated use of OPSEC, military deception, PSYOP, EW, and physical destruction, mutually supported by intelligence, to deny information to, influence, degrade or destroy adversary C2 capabilities, while protecting friendly capabilities against such actions.” JCS, Command and Control Warfare” 1993 “Integrated employment of the core capabilities of EW, Computer Network Operations, Psyop, Military Deception, and Opsec, in concert with specified supporting and related capabilities, to influence, disrupt, corrupt or usurp adversarial human and automated decision making while protecting our own” Info Ops Roadmap 2003 C2W to Info Ops Roadmap

22. Doctrine Pub 3-13, 2006“the Thesis” • Highlights/Key Points • Retains Roadmap definition of Info Ops • Part of “Transformation” • “IW” no longer used; (irregular warfare) • Three interrelated dimensions • Physical, Informational, Cognitive • Strategic Command • Coord IO across AORs and functional boundaries • Importance of Strategic Communication • Important role of allied/coalition Info Ops

23. An Info Ops Map Services Air Force Army • EW, Influence, Networks • AFDD-1, 2-5 • Realm to control • Cyberspace Command? • 24th AF – 67th NW Wg • Digital battlefield • FM 3-0 & 3-13 • Info Superiority • 1st IOpsCmd – 4th POG • FAs 29, 30 & 39 JOINT Info Ops Navy USMC • Maritime Dominance • Fleet Operations • Net Centric Ops • NETWAR Command • Cyber Forces Cmd? • Info Warriors • Human factors & Tech • MCWP 3-40.5 • Command Dominance • OODA loop • MCIOC at Quantico • IOps career field RMAs require Operational and Organizational change/”Transformation”

24. A DOD Map USD(I) SERVICES Info Operations Mil Dec, CNO, Opsec Organize/Train/Equip ASD/NII Networks & Info Integration IA/CIP Combat Cmds Plan-Exercise Execution SOCOM-Psyop JCS JOINT Info Ops JROC Process J2 Threats/TGTS J39 (DDGO) Offensive J5 Cyber Division J6 Networks/Cyberspace J7 Doctrine/Education NSA Threat Analysis E-space Analysis JFCC-NW DIA DISA INTEL Focal Point Indications & Warning Human Factors Analysis JIOWCntr Defensive IW JTF-GNO Indications & Warning NCS/NSTAC Support to CoComs Stratcom – Global Strike Nodal Analysis JWAC STRATCOM USD(P) Nodal analysis Mission/Advocate Support to CoComs Plan/Execute New Cyber Command Policy Roadmap Psyop-DSPD

25. UK Joint Warfare Pub 3-80 “Co-ordinated actions undertaken to influence an adversary or potential adversary in support of political and military objectives by undermining his will, cohesion and decision-making ability, through affecting his information, information-based processes and systems while protecting one’s own decision-makers and decision-making processes.” EU Military Info Ops EU Mil Committee 2/2008 “Military function that provides advice and coordination of military activities affecting information and information systems in order to create desired effects in support of the mission specific Crisis Information Strategy and of the political and military objectives of the EU” What is a “crisis info strat”? Allies’ Info Ops

26. NATO • Info Ops comprises three interrelated activities • Changing, influencing or reinforcing perceptions and attitudes or adversaries, potential adversaries, others • Preserve and protect Alliance freedom of maneuver in the information environment by defending the data and information [of] decision makers/processes • Countering command, functions, and capabilities by affecting data/info of adversaries’ C2, intelligence, surveillance, target acquisition and weapons systems • an integrating function focused on the info environment, not a capability in its own right • Military Policy on IO MC 422/3 9 March 07 (agreed July 2008) • Allied Joint Pub 3-10 (pending official publication)

27. Russia “Information Security Doctrine of the Russian Federation” 9 Sept 2000 Protect “national interests…in the information sphere” Protect the IT industry Send: reliable info on the RF Protect: spiritual life of the RF Russian Info Ops Two, not five, core areas Info Technical, Psychological Tim Thomas, FMSO at Ft Leavenworth China Overlays IW with ideology “New People’s War”--“Overcome superior with inferior” Focus on non-technological Unconventional warfare Not a battlefield force enabler/multiplier “Anti-Info-Strategy Technology” Info campaign precludes the need for military action!---a preemption weapon Jim Mulvenon, “PLA in Info Age”, RAND Others’ IO

28. Discussion • Is Cyberspace a warfighting domain? • Define “domain” (Definitions DO matter!) • Did the USAF try to “grab the cyberturf”? • How much of Cyberspace does AF/DOD “own”?...civilian infrastructure is 90%+ of DOD use • Are we making the right changes in… • Organizations, doctrines, technology • What are coalition partners/allies doing? • Who will be the “Billy Mitchell” of Cyberspace? (do we need/want one?)

29. US Strategic Command New Subordinate Unified Cyber Command Director National Security Agency 4 stars, 2 hats JFCC-NW and JTF-GNO folded into it Missions, Roles, Responsibilities evolving Protect military—not civilian—networks Generating significant discussion/unease QDR Cyber Strategy Broad goals (draft) Freedom of Action in cyberspace Prevent/Deter conflict Cyber support to homeland defense Supports Secure Networks Cyber Ops External partners DOD & national efforts Cyber Changes

30. Information Operations • QDR sub-panel on Info Ops • Moving away from “5 core competencies”, and towards the “Information Environment” • DTK proposal (based on QDR proposals): • [M] = Military • Information Operations are [M] activities conducted in or via the information environment to affect and protect information itself as well as the connectivity necessary to exchange that information and create cognitive effects. Info Ops is thus the integrated and coordinated [M] use of the information environment in order to create desired [M] effects. This use of the [M] information environment spans the range of operations, and exists within and supports larger governmental and national uses of the information environment and information power in national security.

31. Measuring PIME • Traditional measure of power is control of resources • Land, iron/coal/oil, people • M and E: easily visible and quantifiable • Military: hardware, troops, training • Economic: GDP, trade, industry • P/D: may have some visible metrics • Stability, continuity, participation • Embassies, treaties, diplomats • I most difficult of all • What metrics can we use?

32. “Use of information content and technology as strategic instruments to…affect global behaviors” “The relative ability to operate in and exploit the information (cyber) environment…” Two Critical and measurable factors: CONNECTIVITY Exchange of information CONTENT What’s exchanged One somewhat less—but still-measurable factor COGNITIVE Influence/behavior Bottom Line: Impact and Effectiveness Information/Cyber Power

33. Information Power…Who’s in Charge? Economic and Information… Diffused and Shared Diplomatic and Military… Centralized and Hierarchical Which model is correct for Information?

34. What’s Lacking The “Long Telegram” • Who and Where do we go to shape and create Information Power? • National Information Council? • Public & Private Partners • What do need from them? • National Information Strategy • What are we lacking? Why don’t we have one? • We need a strategic and conceptual foundation for how we can employ Information Power to support national security • Needed: Information-age corollary to the “Long Telegram” • 861.00/2 - 2246: Telegram • The Charge in the Soviet Union (George • Kennan) to the Secretary of State • [was classified at the time…now declassified] • Moscow, February 22, 1946--9 p.m. [Received February 22--3: 52 p.m.] • 511. Answer to Dept's 284, Feb 3 [13] involves questions so intricate, so delicate, so strange to our form of thought, and so important to analysis of our international environment that I cannot compress answers into single brief message without yielding to what I feel would be dangerous degree of over-simplification. I hope, therefore, Dept will bear with me if I submit in answer to this question five parts, subjects of which will be roughly as follows: • (1) Basic features of post-war Soviet outlook. • (2) Background of this outlook • (3) Its projection in practical policy on official level. • (4) Its projection on unofficial level. • (5) Practical deductions from standpoint of US policy.

35. Information Strategy • Builds on “3Cs” • Build, enhance, support Connectivity • Physical: networks, infrastructures, Information-Communication Technology (ICT) • Human: one-one, one-many, many-many • Get the REAL experts (ie. Private Sector) • Build/Use institutions that create Content • Entertainment, News, Marketing, Education, more • Get the REAL experts (ie. Private Sector) • Measure Cognitive impact • Get the REAL experts (ie. Private Sector) • All Three require partnerships beyond government, military, and especially the private sector to include non-US, and they require a long-term view…this isn’t years, it’s decades • Taliban: “Americans have all the watches, we have all the time”

36. What’s Needed?“Wire the World!” • New strategy is not “Containment”…it’s CONNECTIVITY • See Hart-Rudman Commission’s 2nd Report, May 2000 • An (increasingly) Networked World • Free flows of information and exchange of CONTENT • Via both Human & Technological Interaction • Enhance economic growth and productivity, standards of living and health care, etc • Enhance strategiccommunication, which can enhance • Human rights, Democracy, Peace • Bridge the “Core-Gap” paradigm • …BUT: won’t be 100% successful

37. Critical IssuesQuestions for Discussion • How do we develop and protect “National Cyberspace? • What is it? Who? • Organizations, people, doctrines • How do we leverage Info Ops to fully support military operations/commanders? • Enabler? Multiplier? Partner? Supported/ing? • How do we communicate and influence? • Who? What? How? Did we Succeed? • Roles • Intel Community, Private Sector, Allies/Friends, NGOs • Where fit within NATO security strategy?

38. Cubicle-Centric WarfareAre we too busy fighting ourselves…and not paying sufficient attention to THEM?

39. Dr Dan Kuehlkuehld@ndu.edu 202-685 2257 Twittersphere: “Daninfowar” http://www.ndu.edu/irmc/programs/index.html Programs/Certifications for/in…Chief Information OfficersInformation AssuranceOrganizational Transformation… …and Information Strategists