Evaluating the Fungibility of Information Power

Over the weekend, I had a Twitter conversation with the always stimulating infosec blogger Krypt3ia on the subject of hard and soft power. Krypt3ia has a new post on his site that grew out of the conversation. While I would encourage you to read the whole entry (there are shades of some of Timothy L. Thomas's recent work on China, Russia, and information warfare), I would like to build off of one of the more interesting parts of the post:

Finally, I would also put it to you all that the battle space is much
different today than it has been in the past. Not only do we have the
digital landscape, but said same digital landscape, that makes it easier
to steal, also makes everything more interconnected. By interconnected,
I mean that it is far easier to effect large changes to companies by
the automation that we all have in place today to speed up our
transactions. Today it is far easier to quickly make instant trades, and
effect the bottom line of a company for the better or worse as well as
steal data in minutes that in the past, would have taken days, weeks, or
months to ex-filtrate from a company via conventional HUMINT means. In the scenarios run on trades on the markets, you can see how one
alleged “fat finger” incident can have a large scale and rippling effect
on the whole economies of states, never mind businesses individually.
So, once again, the battle space has changed greatly because of
the interconnected-ness of things. It seems that the matters of state
now more than before, can be changed through the soft power of the
digital attack or manipulation. This is what I mean by “soft power” or
perhaps the term I mentioned above “Covert Soft Power”, attacks that we
are seeing now, and are having trouble truly attributing to
nation-state, corporate, or individual actors are having larger and
larger effects on our economy, our policies, and our long term viability
as nations, companies, or groups.

One of the classics of the neorealist literature on force is Robert Art's article "The Fungibility of Force." Art argues that force, expressed roughly as a state's power for physical coercion, has ripple effects on other issues. The United States has historically benefited economically from its ability to protect the Persian Gulf, and the core of the deal made with Saudi Arabia has been one of economic benefit for the physical protection of the regime. This, in part, is what helps a single family dominate a country that Middle East watchers have perpetually predicted would be ripe for revolt. Barry Posen has also argued that military control of "commons"--air and sea lanes of commerce--underpins the US' current strategy of primacy. Force is also "fungible"--it can be utilized in a variety of ways and be exchanged for a multitude of political "goods." But despite being fungible, force is often tremendously costly to actually employ. Hence we should not confuse the shaping power of force structurally for force necessarily equaling an ability to create certain political effects in domestic political systems. The US, for example, can use force to shape the Persian Gulf security architecture in an attempt to thwart Iranian ambitions. This requires military investments in naval warfare systems, basing architecture, and military deployments. But the bluntness of force in use is infamous. You cannot guarantee, say, that an OPLAN for an invasion and occupation of iran or even devastating standoff strikes would result in Iran changing its system of government to American liking or giving up its nuclear program.

Hence states often search for indirect routes to benefit from military force or substitute it for other forms of decision.  Indirect forms of coercion seek to shape national-level outcomes as opposed to regional or systemic outcomes. These can take form of compellence and coercive diplomacy.  Compellence can involve discrete force but coercive diplomacy involves the threat of force integrated with economic pressure and psychological operations directed against enemy leadership targets. But coercive diplomacy itself has something of a mixed track record in recent years, and economic statecraft, while undoubtedly the root of all power--political and military--also is not necessarily a very efficient means of coercion. Let's not mince words--economic coercion can completely destroy a state's basic standards of living, as the Iraq sanctions did. But without positive sanctions (a suitable carrot), strictly negative measures often fail to convince states to change their behavior. The Iraqi sanctions were forged in a political climate that desired the removal of Saddam Hussein from power. Limited uses of force or coercion cannot hope to succeed if tied to total outcomes. And even if we perceive our aims to be limited, they may not be limited to those we hope to coerce. The Iranians see a "surge" capacity for nuclear mobilization as intimately tied not only to their means of power projection but also to their basic survival as a political entity.

Covert power is a "grey area" of statecraft not really well-covered in policy literature. As I noted in a previous entry, low-intensity warfare and covert operations can look alike at the lowest tactical margin. One interesting question that Kryp3ia raises in his discussion of Chinese and Russian (as well as non-state) cyber power and digital espionage is whether covert power is similarly "fungible" in the way Art argues that conventional military power is. For example, can states leverage proxy power, subversion, espionage and long-range cyber-reconassiance, the use of information warfare, or private force to shape outcomes in the way that an overflight of TU Backfire Bombers might? Plenty of decisionmakers seem to think so.Queen Elizabeth I saw subversion and divided loyalties as a mortal threat to the defense of the realm, and created a domestic intelligence apparatus to root it out. Robert Kaplan has written about Iran's use of covert power as a force multiplier in the Middle East. In the 1950s, many saw Communist psychological operations as a mortal threat against open societies, discussing them in terms similar to how some talk about cyber warfare today. Carl Schmitt attributes fear of Communist subversion as an explicit motivator for coup plotters against De Gaulle. Covert operations also have demonstrated the ability to change a domestic set of political relations. Political warfare altered the political composition of the Guatemalan and Iranian governments and augmented a conventional NATO strategy for the defense of Europe through the construction of stay-behind networks and a means of secretly intervening in domestic politics.

There are some advantages to the use of covert or paramilitary power as a means of power projection. The United States has, through the fine-tuning of the joint special operations community since the debacle of DESERT ONE, created an apparatus that compresses integrated logistics, advanced technology, and raw human strength into paramilitary war machine. It is useful for "reaching out and touching" J.D. Salinger-like reclusives holed up in air-gapped compounds in the suburbs of Abbotabad. These kinds of operations also create a dilemma for the target state. They take place in a murky realm populated by spies, criminals, and arms smugglers, proving that difficulty of attribution is not just a cyber problem. Moreover, even in the case of attribution it is hard to see what recourse is often open to target states. It was obvious to any intelligent observer that the United States, facilitated by Pakistan and a host of other partners, was funneling arms and money into Afghanistan during the 1980s. But what could the Soviets really do about it? The problem, however, comes when states expect covert ops, espionage, or discrete force to work as a standalone effort without being tied to a sound policy.

This brings us to the intersection of information and covert power. The postwar science of cybernetics is the backbone for our understanding of information power. Cybernetics--the science of communication and control---is about information as a feedback mechanism. Claude Shannon's idea of information theory is based on the idea that information is a signal, or a "difference that makes a difference" as Gregory Bateson artfully puts it. Whereas first-wave cybernetics looked at closed systems that adjust their internal states to preserve a set value (like a thermostat that adjusts a room's temperature) based on negative feedback from the environment, second-order cybernetics and complexity theory have looked at how information causes systems to shift to new frames of reference.

Thus, information warfare pioneers like Dorothy Denning and Martin Libicki have looked at information warfare in ways that draw from Shannon's mathematical theory and cybernetics. To Denning, information warfare involves operations that target or exploit information resources. Information resources consist of containers
(information media that contain forms of data), transporters (objects and
communication systems that transport information from one location to another),
sensors (humans and machines that extract information objects and the
environment), recorders (objects that place information in containers), and
processors (people and objects that manipulate information). In Denning's theory, you gain advantage by increasing the value of your own information resources while degrading the other side's ability to use theirs. Martin Libicki has a taxonomy of information warfare targets and methods that also are useful for thinking about the subject: the physical (hardware), syntactic (machine operating software) and semantic (the content of the information exchanged). You can drop a bomb on a command or control node and physically destroy it, certainly. You might also compromise a system through various cybernetic means, or you could, through military deception, attempt to prevent your opponent from utilizing information available to him.

While it may seeem like physical and syntactic information methods are particularly powerful, the power of strategic deception should be not be underrated. In 1944 and 1945, the Soviet Union utilitzed maskirovka on a massive scale to carry out Operations BAGRATION and AUGUST STORM, completely destroying the German and Japanese armies in Belorussia and Manchuria. The former laid bare the German heartland to the ravages of the Red war machine, and the latter may have--in conjunction with the atomic bomb--knocked Japan out of the war. It certainly also posed a direct Soviet threat to the Japanese heartland due to the threat of potential Soviet control over China. Strategic deception also protects intentions and capabilities in peacetime, such as crucial weapons projects or crucial geopolitical designs. Deception can also make a state seem more powerful than it actually may be. Hitler's Germany integrated numerous deception operations to play on the psychological weakness of Allied decisionmakers in the 1930s, convincing them that his military forces were ready for protracted war in spite of their actual material deficits.

Getting to the root of infomation power requires engagement with the fact that we live, largely, in the world Claude Shannon made. Information--as message rather than content--is key to many massively complex and integrated systems that underpin our day-to-day existence, from the stock exchange to military command and control systems. Thus information warfare and information power might broadly be understood, again,  as the plain use of information resources in order to improve our own information resources and degrade, exploit, or otherwise co-opt those of our adversaries. This process is not necessarily entirely technological. From a systems perspective, the British Double-Cross System or the Soviet Trust operation were analog-era attempts to manipulate organizational systems by sending distorting feedback through information channels. In a world increasingly governed by the way information interacts with organizational, technical, and social systems, information power becomes more important. Digitization and the delegation of authority to more and more automated systems in everyday life is creating a "second economy" well-known in the information technology community. There are certainly political and military implications in such a technological shift, as especially when paired with emerging informatized architectures and ecological systems.

So, with this understanding of information, we can go back to the original issues of fungibility Krypt3ia brought up. What can information, taken through the lens of Denning and Libicki, do?

Strategic deception not only distorts the quality of information available to a decisionmaker but also can, when coupled with targeted psychological operations and counterintelligence, disrupt a decisionmaking system by eroding its ability to process and use information. The British did the latter by riddling the Irish Republican Army with informers.  The ability to exercise individualized information targeting, as demonstrated through Anonymous and the Chinese "human flesh search engine" opens up intriguing possiblities for both deception and psychological pressures and disruptions. 

The informatization of critical infrastructure poses opportunities for countervalue attacks on civilian targets. Though these threats often have been massively inflated, they do exist. They can cause everything from financial damage to injury and death. And air-gapping is not a panacea. This perhaps may be most useful not necessarily as a tool of "cyber-doom" but more as a tool of escalation dominance at the lowest rung. 
Industrial espionage can create economic gain. China and Russia, after all, are following a longstanding French practice of using spying to bolster state-suppotted industries. French intelligence, in fact, used to bug first-class sections of Air France jets to record commerical conversations.
The knowledge that crucial systems may be vulnerable could create a deterrent effect, but it is important to note that these threats are of an operational rather than predominately strategic nature. 

That being said, there are very many drawbacks. Strategic deception can certainly help realize a given policy objective, but also can significantly backfire. Saddam Hussein  attempted to simulate and dissumulate, presentating an ambiguous image of unconventional power to Iran and internal regime audiences while simultaneously trying to hide evidence of the truth from the outside world. The United States eventually decided that it was better to remove him from power than deal with the constant ambiguity his deception efforts created. The German deception efforts from the end of World War I to the late 1930s at first hid re-armament and then exaggerated German strength. But they would not have worked if the Allies had the political will to enforce the terms of the Versailles Treaty. It is hard to see what the Soviet Union gained in the long term beyond immediately tactical and operational gains from its strategic deception efforts.

Individualized information targeting depends on a dauntingly granular degree of information about an individual's worldview, habits, and psychology, paired with an accurate model of how he or she plays a role in the overall ecology of a regime's decisionmaking structure. Playing havoc with an organizational system may also result in undesired side effects. Targed disruption of individual links within the Syrian regime hierarchy should only be attempted if the targeteer is OK with such actions potentially resulting in intensified strife that may result in substantial civilian casualties. James Angleton's mental decline into the "wilderness of mirrors" is also an apt demonstration of what happens when counterintelligence begins to devour the bonds of trust within an organization intead of its adversary's organizational functioning. 

It is also true that critical infrastructure can present a countervalue target, but Sean Lawson's review of disaster response research and the historical record of the Air Force's "industrial web" strategy against German critical infrastructure and moral resilience in World War II suggests that disruption may only be temporary. Frederick Kagan has also observed that while command and control links can be reconstituted at a relatively low cost, the destruction of an army itself through annihilation requires an immense amount of resources to rectify.

Finally, as a part of the larger "grey area" of covert and paramilitary power, information power suffers from some of the same defects as special operations direct action or black propaganda. It is dependent on a host of pre-existing factors that may be difficult to be conjured out of thin air. Operation AJAX was only possible because powerful forces within the Iranian political ecosystem were receptive to covert power. American contractor support ended the Bosnian War, but only by utilizing the pre-existing Croatian Army as a hammer for a punishing ground offensive against Serbian forces. Operation BAGRATION may have been enabled by deception but was carried out by a preponderence of Soviet military force. And a determined countersubversion architecture safeguarded the English throne from the threat of subversion in the Elizabethan era. Iranian covert power projection allows it to punch above its weight but still does not make it a hegemon regionally due to the political, material, and military weight of the Gulf states and their external protector in Washington. The specific characteristics of information power also pose some quandries. One can, say, monitor, disrupt, or deny the electromagnetic spectrum but not control it in the way that the "man on the scene with a gun" can when he attacks land targets.

So we have ultimately a mixed picture of the fungiblity of information power. Krypt3ia and others writing on the subject have demonstrated that it should be regarded, like financial power, as a force to be reckoned with in world politics. But it lacks the ability, seen in military force, to be tied to other important issues or exercise ripple effects. To return to the example of Saudi Arabia, American military backing for the Saudi regime enabled beneficial economic effects. It's true that information power can bolster military and financial power, but its impact may be ultimately much more limited than military force in creating linkages. Information power can bolster other forms of power significantly and will certainly transform the nature of "grey area" force in the international aren. Krypt3ia is right that it should not be disregarded, and states should pay heed to how they construct their own information strategies.