Bringing Clausewitzian clarity to cyberspace

Cyberwar is the new buzzword in the media, in the military, among politicians and in academia.

This working paper contributes to the theory-scarce debate on cyberwar and returns to Carl von Clausewitz’s On War (1832) to examine cyberattacks as a new form of attack in future wars.

In doing so, the working paper not only targets the misunderstandings and exaggerations prevalent in the cyber-literature, but also demonstrates that Clausewitz’s On War, albeit two centuries old, is a key work in understanding the relationship between cyberattacks and war.

The argument is present in four parts:

• First, On War is revisited through a critical engagement with the few scholars, who have tried to apply Clausewitzian insights to cyberwar. Here the working paper argues that On War works as a prism through which one can look at war, and not as a checklist for testing what counts as war or how to control war.

• Second, the working paper reexamines three oft-cited cyber-events in Estonia, Syria and Iran through Clausewitzian lenses, and shows how the cyberattacks experienced so far have proven capable of causing physical damage, and have been used as tactical purposes instrumental towards reaching a political objective. On this basis it remains impossible – as Thomas Rid does – to deny the possibility of a future cyberwar.
• The third part, however, argues that cyberwar – when understood as war fought primarily in cyberspace – is not coming. When viewed through Clausewitz’s idea of war as reciprocal interactions, it makes little sense to talk about cyberwar. The stronger state, if attacked through cyberspace, is always more likely to retaliate using conventional weapons, due to cyberattacks’ inferior ability to cause physical damage.
• And last, the working paper examines the opportunities and challenges of using cyberattacks in conventional wars. Inspired by Clausewitz’s trinity, it is argued that cyberattacks provide possibilities for the creative army to find and exploit vulnerabilities in a potential enemy’s IT-infrastructure, but that cyberattacks remain useful only in the initial phase of war. States, like the United States, which are dependent on insufficiently protected IT-infrastructure, are further vulnerable to friction as well as the passionate people that take up cheap and easy cyber-arms.