Defining the role of intelligence in cyber: a hybrid push and pull

Abstract

Information is the lifeblood of modern states. Intelligence is increasingly facilitating information superiority through an understanding of the cyber domain. The US Department of Defense Joint Vision 2020 establishes the goal of information superiority on the battlefield.2 This information superiority enables decision superiority and favorably tilts the strategic and tactical balance.3 Information superiority is built on cyber power, scale and complexity of attacks, robustness of defense, policy positions, systemic vulnerabilities and dependencies, and actor anonymity and attribution issues. Intelligence plays a mission-critical role in assessing these characteristics. This chapter examines the role of intelligence in identifying these characteristics within the cyber domain and examines how it influences the decision-making of policy-makers. Specifically, this chapter focuses on how intelligence increases the effectiveness of identifying potential attackers within the cyber domain and informs the decision-making of policymakers when engaging in covert cyber action directed against a potential adversary. This chapter is designed to serve as a strategic framework in which to understand the role of intelligence within the cyber domain. Is it really necessary to treat the role of intelligence within the cyber domain as contextually different from its role in a conventional domain? The short answer is yes. Cyber necessitates independent examination because it is characteristically different, and yet at the same time it is a pervasive feature affecting outcomes within other domains. What differentiates cyber from land, sea, air, and space, are three fundamental attributes relevant to intelligence practitioners. First, the cyber domain is a man-made domain. Second, military capabilities across the other domains are managed through the cyber domain. Third, military and civilian aspects of the cyber domain are often intertwined and difficult to differentiate. These attributes pose unique opportunities and problems for intelligence officials. The man-made nature of the cyber domain makes it a largely virtual domain with its value corresponding to the speed and volume of information containedwithin it. However, the cyber domain is not entirely virtual and has numerous real-world connection points to everything from industrial control systems of power and water management facilities to the weapon systems of drones flying above distant battlefields. Cyberspace is not tangible in the same way as more conventional domains and therefore necessitates a new form of dynamic intelligence evolving from allsource collection of conventional and novel intelligence sources. A recent National Research Council report states that intelligence in the cyber domain is useful for both strategic and tactical purposes.4 The strategic and tactical importance of intelligence’s role in influencing the cyber domain falls within the concept of all-source intelligence. Loch Johnson defines all-source intelligence as one of the fundamental propositions of a theory of strategic intelligence.5 More importantly, for the purposes of understanding the operational and political environments within which offensive and defensive actions in cyberspace can occur, it is necessary to understand what intelligence is within, and how intelligence influences, decisions regarding the cyber domain.