Pentagon's Move to Fast-Track Cyber Weapons Will Upset China and Russia

The Pentagon plans to fast-track cyber weapon development and acquisition through a process separate from that used for conventional weapons, according to a non-public report obtained by the Washington Post and reported on April 9. A Cyber Investment Management Board has been established within the Department of Defense to prevent abuse of the fast-track process, and is intended to also coordinate matters between relevant military and intelligence entitites. 

In about a year, you'll probably be reading about how the Board is a) still too slow, b) prejudiced toward certain defense interests, and/or c) responsible for massive waste of taxpayer dollars used to acquire weapons that were never used.

That's the good version of next year's story. There are plenty of versions you don't want to read.

The most obvious potential downside is a destabilizing effect on bilateral relations with China and Russia, countries suspected of sponsoring the most anti-U.S. cyberattacks and cyberexploitations. (Note: The vast majority of events called 'cyberattacks' are actually exploitations designed to obtain valuable insights into U.S.-based industries and intellecutal property.) Whether the U.S. is starting an arms race or catching up with one has long been a matter of debate; China's defense budget is dwarfed by the U.S.'s, but the PLA is considered a heavy investor in cyberwarfare capacity precisely because it needs an asymmetric advantage against the U.S.'s considerable conventional warfare strengths. 

The less obvious but more difficult question is what this development and acquisition fast-tracking signals for the future of U.S. policy. The framework outlined in the report describes two systems for cyber weapon development: rapid and deliberate. According to the Washington Post,

The rapid process will take advantage of existing or nearly completed hardware and software developed by industry and government laboratories. This approach could take several months in some cases, or a few days in others. The deliberate process is designed for weapons whose use carries greater risks. It would be for projects expected to take longer than nine months - still short compared with the years-long process to develop most Pentagon weapon systems.

That speed could present an intelligence advantage for the Pentagon as it seeks to acquire weapons without spending years signalling its intent and providing other intelligence services with due time to investigate those systems. But a weapon acquisition process whose timeframe is shortened to days seems clearly designed for the deployment of those weapons within days, and that kind of offensive intent needs to be matched with a clear diplomatic strategy. 

Predictability has been a core problem with cyber weapons in the past, and these structural approaches underline the precariousness of cyberwarfare. Speed potentially begets instability, and certainly heightens it in the short-term before a new set of defense and diplomacy norms are established. The effect of a cyber weapon also often lacks predictability; one of DoD's biggest goals in developing these weapons is that they project a more finely targeted, highly predictable impact. Yet, determining impact often requires a long-standing, deep intelligence effort that understands every potential weakness of an opponent's sytems. Thus, developing smarter, better cyber weapons demands as much investment in intelligence efforts as it does in the weapons themselves; the intelligence and the development go hand-in-code. Watching cuts in intelligence spending will therefore be as important as watching the increases in the cyber budget.

Fortunately, the rapid vs. deliberate structure outlined by the Pentagon report signals clear intent toward stabilizing the use of cyber weapons, precisely because it designates those with 'greater risks' to a more rigorous oversight process. Investing in weapons with more precise targeting capacity also improves the actual strategic implications of their use. 

Whether that stabilizing intent will be felt in the short-term remains unclear. The only sure bet is that Russia and China will feel the pressure to increase their own offensive capacities to match a U.S. surge.