The significance of drones and cyber weapons can be found not in their tactical results but in their long term strategic effects
For students of military affairs attuned to changes in warfare and the application of force in international relations, no topics command more eager attention at the moment than the use of drones and cyberspace by the US to strike its’ enemies. Fueling the contentious international debate about the use of these technologies is that drones and cyber-attacks are widely mistaken for policies in themselves instead of tools or weapons used to pursue a policy. This confusion unfortunately obscures the more important strategic implications that drones and cyber warfare together represent, at a time when they are still in their technological infancy. As the lumbering WWI tanks rolling slowly over trenches on the Western Front foreshadowed the next war’s Panzer blitzkrieg, the convergence of drones and cyber weapons may herald a darker future.
Of the two, drones have the older history, going back almost a century to the Great War where experiments in auto-piloted planes were financed by the US Navy, but for much of the twentieth century, military applications for drones (or “remotely piloted vehicles”) were sharply limited. The technological capabilities of drones always lagged far behind the advances in manned aircraft and they were extremely vulnerable to modern anti-aircraft systems, or in some cases, small arms fire. While drones had some marginal utility for battlefield surveillance or as decoys, during the Cold War they were never the primary collection tools for sensitive intelligence that the U-2 Blackbird, listening posts and spy satellites were.
Several factors in the twenty-first century have pushed drones to the forefront as a weapon of choice for the Pentagon and the militaries of major powers. First, has been the relative decline of the probability of major interstate war since the collapse of the Soviet Union and the corresponding rise of irregular warfare in the form of insurgency by terrorists, guerrillas and rebellious tribes. Generally, these low-tech combatants reside in poor and remote areas and lack the capacity to detect or defend against drones except by concealment. Secondly, drones offer a tremendous economic advantage and battlefield return on investment (ROI) per enemy killed over advanced fighter aircraft. A new F-22 costs $150 million to buy and $45,000 an hour just to fly with a pilot whose training costs the USAF $2.6 million; a reusable, propeller-driven Predator only costs slightly over $4 million. About the price of two and half Tomahawk cruise missiles.
Unlike a human pilot, a drone can operate around the clock, never requires heath care, will never claim retirement benefits and if shot down, cannot be held hostage or have any grieving next of kin. The operational and political risks for using drones in military strikes are so low that some, like Andrew Bacevich, have argued they create an irresistible temptation to use drones without strategic purpose or much legal accountability. This position on drones echoes similar arguments made against past advancements in military weapons from gunpowder to submarines to atomic bombs- and is likely to be equally unpersuasive.
Cyber warfare, until the recent debut of Stuxnet and Flame against Iran’s clandestine nuclear weapons program which high-level White House leaks have confirmed as a joint US-Israeli attack, has been a highly controversial concept in defence circles. Accurate attribution for cyber attacks on private and governmental computer networks has historically been difficult, making it hard to decipher if the intent of perpetrators is criminal, espionage, hacker vandalism or an act of war– and if the latter, who to hit back against? Theorists questioned if attacks in cyber space could qualify under international law as “sabotage” much less “armed conflict”. Only in 2009, did the United States military establish a “Cybercommand” (USCYBERCOM) and begin to enunciate a doctrine of “equivalence” evaluating cyber attacks in terms of a damage with those caused by traditional, “kinetic” weapons.
Previously, states with known offensive cyber capabilities (the US, UK, Russia, Israel, China and probably North Korea, Iran and Taiwan) have been at pains to preserve plausible deniability of involvement in major known cyber attacks like “Titan Rain” (China) and those against the governments of Estonia, Latvia and Georgia (Russia). With the prevalence of cyber criminals online and the significant public vendettas of hacktivist collectives like Anonymous and Lulzsec, the origin of major cyber attacks and the existence of “cyber war” were always in doubt. No longer.
The de facto admission of American origin of the Stuxnet and Flame attacks crosses a threshold in several ways: first, the two attacks represent an evolutionary jump to normalising self-replicating “fire and forget” weapons that penetrated an “air gapped” network system disconnected from the larger internet; secondly, confirming that a state could use cyber weapons in a way that could create physical damage in the real world. Cyber war is a reality, like an artillery duel or a bayonet charge and can no longer be ignored by the world’s governments.
Military theorist John Robb described Stuxnet-Flame as the “opening of Pandora’s Box”:
“Why Pandora’s box? The technologies used in this system aren’t just available to big countries (like nuclear technology is). This is technology that anybody can use and configure in new ways. In some cases, like Stuxnet and Flame, the software itself is freely available, and is now being analysed and copied by people all across the world. The demonstration of these technologies in warfare takes them out of the realm of science fiction and makes them real. It also goads any country with even a modest budget to develop their own.”
As Robb indicated, the significance of drones and cyber weapons can be found not in their tactical results of breaking an Iranian centrifuge or killing Al Qaida’s number two leader, but in their long term strategic effects. Moreover, over time, these two technologies are on a path to convergence even as they evolve to become more versatile and effective weapons, shaping the strategic environment in the following ways:
Asymmetry: While leading great powers currently hold an advantage in cyber and drone technology, this lead will erode as competitors enter the field. Unlike nuclear weapons or the dreadnought race of the 19th century, drone and cyber does not require the resources of a great power. Small states, corporations and private groups can effectively employ either for significant tactical advantage. And while some estimates place a price tag of a half a billion dollars to create a strategic cyber weapon, this may be grossly exaggerated and will inevitably fall over time. There’s no reason why countries like Singapore, Belgium or the UAE could not become a major “cyber power”, while corporations like Google already are.
Autonomy: It is largely a matter of policy (and bureaucratic self-interest) rather than technological limitations to keep human drone pilots tightly “in the loop” in a fail-safe that was not done with earlier smart bombs or cruise missiles. The same psychological “creep factor” has inhibited development and deployment of ground-based “hunter-killer” vehicle drones that would echo Hollywood Terminator movies. This will inevitably change as drone technology advances because it is cheaper and efficient to reduce human involvement as much as possible, with the poorest actors having the greatest incentive to do so. Already, according to WIRED, the US military is seeking a “universal remote” to allow one operator to control large drone swarms that are interdependently autonomous ( a very dangerous idea); from there it is a small step to crossing the red line of a drone making kill decisions. Expect this barrier to be broken by a criminal or terrorist group with few scruples about indiscriminately killing large numbers of bystanders or police; once a “Robotic Mumbai” occurs though, all bets will be off.
Evolutionary Rapidity: Both drones and cyber weapons intrinsically lend themselves to continuous stigmergic improvement through the tinkering of millions of hackers, software engineers, DIY hobbyists and politically motivated activists. While amateurs and small groups will not be able to create something as elaborate as Flame (which cyber expert Richard Stiennon called “a frightening display of sophistication”) or a TQ-170 Sentinel, their ability to mash-up code or platforms should not be underestimated. A primitive quadrocopter (or a swarm working together) outfitted with an ordinary firearm, high explosives or a canister of anthrax and flown over a sports stadium during a game would not pack the punch of a Predator, but with the resultant panic, it would hardly need to do so. As malware becomes self-replicating and drones become fully autonomous, releasing such weapons by states and individuals will increasingly include unintended consequences.
Ubiquity: Drone use and malware are increasing at tremendous rates, with the potential to become dominant features of their respective environments. For example, from 2010 to 2012 alone the number of unique variants of malware discovered rose from 286 million to 403 million while a recent sample test of one million IP addresses by Telestra discovered 5.4 percent were infected by botnets (an alarming figure, but low compared to other major telecoms). According to journalist Spencer Ackerman, drones increased from 5 percent of all USAF aircraft in 2005 to 41 percent by January of 2012, a figure that does not include civilian and DIY hobbyist drones used domestically. Although far from perfected, surveillance drone prototypes have already been scaled down to insect-size and many of these small and micro- platforms can be weaponised with John Robb predicting tens of millions of unauthorised micro- and small drones in use by 2020. Such an eventuality will require changes in architecture, public security and counter-terrorism policies as well as extensive litigation in areas of property, privacy, aerial regulation and public safety laws.
Historically, it is occasionally possible for states to regulate the proliferation of particular weapons systems as has been done with nuclear arms control agreements, but generally there were incentives to do so. Poison gas, chemical and biological weapons were recognised as having limited military effectiveness while nuclear weapons and anti-ballistic missile systems were very expensive state investments with a point of diminishing strategic returns in an unrestricted arms race. None of this applies to drones or cyber weapons, nor can states reliably keep them out of private hands.
The future of warfare looks increasingly dystopian.