forget Sun Tzu

Forget Sun Tzu: The Art of Modern War Can Be Found In A Chinese Strategy Book From 1999

Cyber defense experts have seen their job as complementing conventional warfare for too long. They need to think bigger — much bigger. Cyber warfare covers every aspect of modern life.

“If it’s even possible to start a war in a computer room or a stock exchange that will send an enemy country to its doom, then is there non-battlespace anywhere?”
Qiao Liang & Wang Xiangsui
Unrestricted Warfare, PLA Publishing House, Beijing, 1999
The 1990s were a heady time for the internet. As the number of websites, services and applications exploded, humanity entered a lather about the infinite possibilities of the world wide web. Untethered from politics and government interference, society would manifest its destiny in cyberspace; peaceful, cooperative, equal and free. These concepts were so strong, and so appealing, that they dominated our thinking about the internet for nearly two decades.
At the end of the nineties, Wang Xiangsui and Qiao Liang, two relatively unknown Chinese military scientists wrote a book that would ultimately bring that dream to an abrupt end. In 1999 they published “超限战” or “Unrestricted Warfare.” Written in a provocative tone, the authors state definitely that technology is extending the contemporary battlefield to a degree that is virtually infinite. From submarines to missiles, the electromagnetic spectrum, the domains are limitless… “even the inner world of the human heart cannot avoid the attacks of psychological warfare” they state. War, conflict and power would never be the same.
All arenas of society were legitimate targets for both military and non-military techniques; the media, the stock markets, pharmaceutical research, civilian aviation and others. The book outlined how an inferior power (such as China) could leverage these new dimensions to create advantage over the sole superpower (the United States). Wang and Qiao realized China could never win a direct, metal-on-metal confrontation with the US, but if China created and dominated the new spaces of warfare, it could overcome the physical might of its superpower rival.
To do this, a country like China must urgently begin experimenting, by mixing ‘cocktails’ of different military and nonmilitary capabilities for strategic effect. For example, the authors advocate combining cyber-attacks with physical protests, assassinations or planting fake stories in the news media. Power, they argue, is knowing how to apply these cocktails, at what time, and at what strength.
Learning from their Chinese counterparts, Russia studied and updated the strategy in what became known as the Gerasimov Doctrine, named after the Russian general who is widely credited with introducing hybrid warfare into Russian strategy. Ukraine became (and still is) a laboratory for the concepts of Unrestricted Warfare, but it was Russia’s 2016 application of a cocktail of information warfare capabilities against the United States that demonstrated the power of Wang and Qiao’s ideas.
It is in the information sphere, and psychological warfare, where Unrestricted Warfare’s success is most apparent: hacking electoral ballots, planting fake news, using bots to alter the news cycle. Individually these tactics are little more than an annoyance to a country like the United States. But used in a coordinated and strategic way, they can be very powerful. The question policymakers must ask themselves is clear: Our adversaries are radically innovating in the information space, how do we radically challenge our preconceptions of war — and power — today?
The answer lies in altering our mental understanding of information. Today, most public and private organizations have separate teams dedicated to guarding, creating, analysing and publishing information. Many of these teams are labelled “Communications,” “Analytics,” “Public Relations,” “Cyber Security,” and others. Each process occurs separately from each other and on most organizational diagrams, the teams can be found at opposite ends of the charts.
In reality, most of these organizations are ignoring the difficult truth: information wants to be free (through hacking, leaks, disclosures, or quantum computing). If we accept this, then it is the resilience of information that matters most, not security. If published — will it be questioned? Will it stand up to scrutiny? Can it be used by others for personal gain, leverage or profit? Does it embarrass its authors?
Terms like cyber security are unhelpful. The old phrase ‘Information Security’ is slightly better, but the United States and its allies would be better served by building a culture around the concept of information resilience. Russia’s Unrestricted Warfare campaign was a nascent example of this type of warfare. It will increase in intensity and effectiveness. Making our information resilient is a better form of defense than attempting to make it secure, and failing.
A good example of information resilience can be found in France. The Macron campaign knew Russia would be using cyber-attacks to obtain and leak information, and pre-empted this by planting false information and deliberately forging documents ahead of the inevitable Wikileaks publication. It became impossible to know which documents were real and which were fake: Macron Campaign’s information became resilient because its owners deliberately discredited their own documents beforehand.
For many years, medieval mindsets — firewalls, trolls, and trojans — dominated the thinking of the information security world. Unsurprisingly, Sun Tzu’s “The Art of War” remains on the bookshelves of most boardrooms and in the bestseller lists. Few would argue against the teachings of Chinese philosophy, but with the benefit of hindsight, we have perhaps all been reading the wrong book.