Thought Leadership Papers

The World Economic Forum (WEF) has acknowledged the increasing frequency and severity of cyber-attacks on critical infrastructure as a “cyber pandemic,” with an increase of 300% in the U.S. itself, particularly in the wake of the COVID-19 pandemic. Targets of these attacks include Operational Technology (OT) which connects Industrial Control Systems (ICS) and critical systems that are interlinked and connected widely. These attacks on ICS can potentially disrupt essential services, causing chaos and financial losses for individuals and organizations. The susceptibility of vital infrastructure to cyber incursions, including power grids, presents a formidable threat to the stability and security of nations. Nevertheless, many countries, among them Pakistan, have yet to fully comprehend and tackle the potential ramifications of a cyber-attack on their power grids.

This article aims to dissect and analyze why Pakistan faces tremendous insecurity in cyberspace. The primary driver of the problem is a lack of appreciation of the strategic nature of cyberspace and a lack of comprehension of the distinct structure of cyberspace. Additionally, there seems to be a lack of commitment to pursuing effective solutions that can have a transformative and holistic impact on the state of cybersecurity in Pakistan. The article describes how it may be concluded that Pakistan has a weak cybersecurity posture while admitting that determining the true extent of the damage is not possible in current settings. We discuss some of the fundamental components required for an effective national cybersecurity arrangement before finally describing a national initiative that could have steered Pakistan in the right direction by addressing the need for these components.

For the most part, the cybersecurity environment has always been viewed as a technical problem with attempts to solve it on a deterrence-centric framework. However, we have failed to realize that cybersecurity is a political, economic, social, organizational, and behavioral challenge in a technically fluid environment. In fact, strategic advantages are being sought and cumulatively gained in, through, and from the cyberspace environment (Nakasone, 2019). The question, then, becomes how do we explain what we are observing when traditional modeling of this phenomenon, as either coercive reflected in the “Coercion Theory” or as an active deterrent highlighted in the “Deterrence Theory,” seems inapplicable. Neither of these strategic security frameworks is of any assistance when developing a logical sense of what we observe in the operational space (Jakobsen, 2011; Morgan, 2017).

This is a time of enormous technological change. However, we often focus so much on technology for technology’s sake that we forget to analyze what this change implies — where it can lead.
It would be wise to remember that a military-technical revolution unfolds ever so often and is marked by a period of sharp, discontinuous change. This change always renders the very definition of warfare, which is in practice at that moment, obsolete. This change then leads to a profound and destabilizing effect on battlefields. It may be seen in the form of a new tactic, such as the ‘Blitzkrieg’ in World War II or, it may be seen as the emergence of a new strategic era, such as that brought about by Nuclear weapons. Sometimes, these revolutions occur hand in hand with changing political agendas such as the Napoleonic revolution or the nuclear arms race.

Darkness. Extended periods of darkness, longer and more profound than ever experienced by the Pakistani nation. On Saturday, 10th of January 21, at 1841 GMT, what the NTDC declared as an “engineering fault” in one of the National grid sections led to ‘cascading failure’ throughout the country. A nation of more than 210 million people plunged into total and utter darkness. Still, despite the media attention, cyber events are now such commonplace that we have absorbed them into the catalog of daily outrages that we observe, briefly register, lay off a few people from their jobs, and ultimately ignore.

The military sector has always been home to significant innovation. World War -II events set out a prime example of how innovations such as radars, jet engines, blood plasma transfusion, cameras, and electronic computers, were born purely out of the necessity to survive. Private corporations are commonly known as "Prophets of War". Such as Lockheed Martin, Northrop Grumman, Raytheon, Amazon Web Services, and Huawei have served as drivers of innovation, economic growth, and national power for developed nations. Although the development and employment of offensive cyber capabilities and operations fall in the military domain, private corporations and defence contractors have played a pivotal role for developed states. The corporate sector is a critical driving force behind the development of modern cyber security products and tools, with lines blurring between the private, public, and military sectors.

Before we speak of the structure of cyberspace and the nature of competition in cyberspace, we want to answer a fundamental question: What is a core characteristic of the cyber domain that makes it unique compared to the physical domain? We want our audience to be grounded on the fact that the cyber domain is global and interconnected – constant contact, dynamic in nature but distinct from other structures such as hierarchy and anarchy. Cyber is often misidentified and wrongly classified as a military domain. It is, in fact, an interconnected domain where the military has to operate alongside a multitude of stakeholders.

In the previous article, “Cyberspace: The Environment of Continuous Strategic Competition,” we explained how cyber offensive operations executed below the threshold of armed conflict call for new strategic thinking in cyberspace. States predominantly leveraged the cyber domain to compete in an Intelligence Contest. Most cyber operations executed by great powers were about collecting or protecting information. Blindsiding even the perpetrating ‘hawks’ of the time, one particular event in cyberspace transformed the intelligence contest into a Strategic Competition of unmanageable convolution and ferocity. The inevitable adoption of technology will propel every state into this continuous competition – whether they like it or not.