Why Australia needs ‘shock and awe’ tactics for new age of cyber attacks

Just more than 20 years ago the US launched more than 500 cruise missiles into Iraq in what became known as the “shock and awe” campaign aimed at eliminating Saddam Hussein and his regime.

But if such an assault were to be conducted today the opening salvos would not be missiles, rockets and cordite but bits, bots and bytes.

The objective would be to incap­acitate a nation’s critical infrastructure and war-fighting systems, most of which are connected via a complex web of cyber networks, all of which are vulnerable to cyber attack. The conflict in Ukraine has given us a window into what this type of hybrid war-fighting will look like. There, Kyiv’s networks have come under sustained Russian attack, including crippling assaults on its satellite and telecommunication networks.

A company linked to the chief of Russian mercenary group, Wagner,

Similarly, most war-game scenarios involving an invasion of Taiwan depict China initiating the attack with a shock and awe campaign consisting of a maritime blockade coupled with a pulverising cyber campaign.

Australia has shown an admirable willingness to upgrade its traditional war-fighting capabilities – its submarines, its surface fleet, its air force and its long-range strike capacity. But in an age of networked warfare our cyber assets are not fit for purpose. Responsibility for cyber remains spread across too many agencies, denying Australia the advantage of scale. Policy and operational functions are split between departments.

What is needed is the creation of a cyber corp. The creation of a dedicated cyber capability would allow one entity in government to focus on the needs of Australia’s cyber workforce – its recruitment, its retention, its training, its concepts, its platforms and its tools – thus allowing its forces to integrate and support the Australian Defence Force, the Australian Signals Directorate or Home Affairs. A cyber corp also would achieve one of the recommendations in the Defence Strategic Review.

Cyber Security Minister Clare O’Neil

The ADF is the obvious location for such a service, although there are compelling arguments to place it in Home Affairs or ASD.

It would provide actual cost savings across a myriad of government portfolios, which would leave the Australian taxpayer shocked and awed by the efficiencies.

But these are details.

What matters is that Australia’s policy makers recognise the scale of the challenge in front of them and act accordingly.

The creation of a new service or corps would be a shock and awe undertaking. The good news is we’ve done this before. In 1921 a similar undertaking occurred with the creation of the Royal Australian Air Force.

The advent of the aeroplane at the beginning of the 20th century changed war by weaponising the air domain. Across the world nations realised the need for a separate service – an air force. The quantum leaps that have occurred in offensive cyber capabilities may not whiz across the sky the way the old Spitfires did but their effect on war-fighting has been no less profound.

Digital and drone platforms now serve as the primary attack means. The DSR’s recommendation for “a centralised cyber domain capability … that builds and sustains a cyber force” echoes the pragmatism that led to the creation of the RAAF in 1921.

A commemorative service for the RAAF's 88th birthday in Sydney.

No doubt the army, navy, air force, ASD and others will vehemently object to the notion of creating a cyber corps. It will cost them resources, control and a measure of power. They will argue the recruiting, training, resourcing and technology development are already in place and no change is needed.

These were the same arguments the Australian Army and the Royal Australian Navy used in 1921 when the debate about creating the RAAF was occurring.

The reality is that cyber is the only domain of conflict without an aligned service or corps in Australia. This represents an unnecessary risk. Australia is at a crossroad. We can create a corps, as advised in the DSR, that is trained, maintained and equipped to defend and counter-attack against adversarial cyber activities, thus ensuring our citizens digital sovereignty whilst projecting shock and awe. Or we can continue to cede Australia’s digital freedoms to forces that do not share our values or our interests and be the ones who are shocked and awed.

John Powers served as the US senior defence intelligence officer in the Australian embassy, 2013-17. He resides permanently in Australia.