Staring Down the Digital Fulda Gap Path Dependency as a Cyber Defense Vulnerability

TL;DR

This paper critically examines the assumption that critical infrastructure is the primary target in future cyber conflicts, arguing that adversaries will prioritize targets with strategic military and national security implications rather than infrastructure alone.

Contribution

It challenges the prevailing paradigm by analyzing the strategic limitations and priorities of adversaries in cyber warfare, emphasizing the importance of understanding attack motivations.

Findings

Critical infrastructure is not necessarily the primary target in cyber conflicts.

Adversaries have limited capabilities and will prioritize targets with strategic military value.

Attacks on infrastructure may strengthen national resolve rather than weaken it.

Abstract

Academia, homeland security, defense, and media have accepted the perception that critical infrastructure in a future cyber war cyber conflict is the main gateway for a massive cyber assault on the U.S. The question is not if the assumption is correct or not, the question is instead of how did we arrive at that assumption. The cyber paradigm considers critical infrastructure the primary attack vector for future cyber conflicts. The national vulnerability embedded in critical infrastructure is given a position in the cyber discourse as close to an unquestionable truth as a natural law. The American reaction to Sept. 11, and any attack on U.S. soil, hint to an adversary that attacking critical infrastructure to create hardship for the population could work contrary to the intended softening of the will to resist foreign influence. It is more likely that attacks that affect the general population instead strengthen the will to resist and fight, similar to the British reaction to the German bombing campaign Blitzen in 1940. We cannot rule out attacks that affect the general population, but there are not enough adversarial offensive capabilities to attack all 16 critical infrastructure sectors and gain strategic momentum. An adversary has limited cyberattack capabilities and needs to prioritize cyber targets that are aligned with the overall strategy. Logically, an adversary will focus their OCO on operations that has national security implications and support their military operations by denying, degrading, and confusing the U.S. information environment and U.S. cyber assets.