The cyber domain is undergoing extraordinary changes that present both exceptional opportunities to and major challenges for users of cyberspace. The challenges arise from the malevolent actors who use cyberspace and the many security vulnerabilities that plague this sphere. Exploiting opportunities and overcoming challenges will require a balanced body of knowledge on the cyber domain. Cyberpower and National Security assembles a group of experts and discusses pertinent issues in five areas.
The first section provides a broad foundation and overview of the subject by identifying key policy issues, establishing a common vocabulary, and proposing an initial version of a theory of cyberpower. The second section identifies and explores possible changes in cyberspace over the next fifteen years by assessing cyber infrastructure and security challenges. The third section analyzes the potential impact of changes in cyberspace on the military and informational levers of power. The fourth section addresses the extent to which changes in cyberspace serve to empower key entities such as transnational criminals, terrorists, and nation-states. The final section examines key institutional factors, which include issues concerning governance, legal dimensions, critical infrastructure protection, and organization.
Cyberpower and National Security frames the key issues concerned and identifies the important questions involved in building the human capacity to address cyber issues, balancing civil liberties with national security considerations, and developing the international partnerships needed to address cyber challenges. With more than two dozen contributors, Cyberpower and National Security covers it all.
My thoughts on this book are necessarily preliminary. I've not read the entire thing, but that which I have read is frustratingly dry and unimaginative. While the exploration of definitions of cyberspace, cyberpower and cyber warfare are admittedly useful, they lack depth. The book was co-published by National Defense University and it reads that way. Too heavy on doctrinal language with not enough doctrinal content. I'm okay with discussing doctriny type of stuff, but I'd prefer to go a little deeper than top level definitions. Chapter 3, for example, though admittedly focused on an important area of study, the search for a theory of cyberpower, suffers from a dearth of "countries must do better at..." and "further study is needed in this area." Though we must start somewhere, many of the calls for action seem overtly obvious and perhaps could have been at least nominally addressed. The title of the chapter, "Toward a Preliminary Theory of Cyberpower," aptly describes the content of the chapter, which consists mostly of calling on people to shift their gaze in the general direction of a preliminary theory regarding cyberpower. In today's environment, such advocacy seems unnecessary. The pages could have been better spent actually tossing some ideas onto the table.
Additionally, the book suffers in areas from a challenge inherent in any writing about cyber operations or cyber power: the veracity of much information, especially regarding doctrine and organizational architecture, rapidly degrades. Given the relatively "newness" of the environment, organizations, ideas, operating concepts, and predictions tend to have a very short half-life. As such, entire concepts addressed risk either having fundamentally changed or overcome by events. Chapter 12, the Military Service Overview, is especially susceptible to this challenge.
My most valuable takeaway (so far) was a concept from Libicki's examination of Military Cyberpower. In Chapter 11, he makes the case that cyberpower still has not proven to definitively been of substantial benefit in warfighting. Although it seems obvious that increased connectivity is useful, his point is that the nature of what exactly about that connectivity is helpful has yet to be positively identified. In other words, is knowledge, which could be provided via broadcast means similar to blue force tracker or other non-collaborative communication, the dependent variable, or is collaboration? To the extent that one can identify which is the key capability, systems integration and design could be more clearly focused and tailored to provide one versus the other.
A collection of 24 chapters (from different authors) covering cyberpower in a very broad sense. There are some aspects that are a bit dated (this is obviously before wikileaks, Stuxnet, and Snowden!), but overall the breadth of the coverage is a worthwhile read still. The first few chapters had a weird focus on IPv6 -- I think this was an outcome of a workshop and there must have been someone with a strong personality there that convinced people that IPv6 was "the big thing" coming. There is good discussion of many aspects of cyber. I think the overview in Chapter 8 "The Future of the Internet and Cyberpower" seemed to be the most insightful and well-informed. Chapter 13 on cyberdeterrence struck me as under-developed, but perhaps this is because I read a full book on cyberdeterrence. It would be fun to update this book and also to use it for a seminar/discussion/class setting.
To look at Cyberpower and National Security as source material would be unfair as most books dealing with "Cyber Scope"--it is outdated before it hits the shelf. This book provides a high level overview for decision makers to understand the complexities involved and dilemmas posed and details the thought process. It is a good read for those in Homeland Security (Key Asset and Critical Infrastructure Protection) or decision makers.