Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime
Cyberwarfare's Role in the Next National Defense StrategyChris Dougherty of CNAS on Defending Against Cyberthreats From Russia and China
Despite the overarching strategic priorities laid out by the Biden administration and initial indicators provided by the Department of Defense, it's unclear how the next national defense strategy will prioritize threats and what the primary role of the U.S. military will be. Chris Dougherty, a senior fellow at the Center for New American Security, has been working on this problem for quite some time.
Dougherty says "people at United States Cyber Command" say "they're at cyber war with the Chinese and Russians every day," and adds that "a lot of folks are ... wondering why we're not seeing more cyberwarfare in Ukraine. I think a lot of people thought ... Russia would launch so many effective cyberattacks on Ukraine, and especially its critical infrastructure." But instead, he says, Ukraine has mounted "a very effective cyber defense campaign, supported heavily by the United States, but also by some of our NATO allies."
In this episode of "Cybersecurity Unpluged," Dougherty discusses:
- The "very small and very blurry" gap "between warfare and day-to-day competition in cyberspace";
- How Russia leverages social media to exploit the points of friction in U.S. society;
- The need to "educate people about how to spot cyberthreats," avoid them, and build cyber resiliency.
Dougherty's primary areas of research include defense strategy, operational concepts and force planning, which he combines in his project to develop a new American way of war, comprised of military strategies, operational concepts and forced designs to deter and defeat whomever our adversaries are when necessary. Prior to joining CNAS, Dougherty served as a senior adviser to the deputy assistant director of defense at the Department of Defense, where he led the development and writing of major sections of the 2018 National Defense Strategy. Prior to that, he wrote the 2018 Defense Analytic Guidance, which revamped the previous force planning and construct and mapped out major reforms to DOD's analytics and enterprise. Dougherty served as an airborne infantry member in the late 1990s.
Steve King: [00:13] Good day, this is Steve King, managing director at CyberTheory, inviting you folks to the latest version of our podcast where Chris Dougherty and I will be talking about cyber warfare and what's going on in the middle of the war that we're involved in and Ukraine and Russia. Chris is a senior fellow for the defense program at the Center for New American Security, His primary areas of research include defense strategy, operational concepts, and force planning. He combines these research priorities and in his project, which is called A New American Way of War, that's comprised of military strategies, operational concepts, and forced designs to deter and, if necessary, defeat whoever our adversaries are. I haven't read that yet. I would presume that's going to be Chinese or Russian aggression, but maybe it's all adversaries. Prior to joining the senator, Dougherty served as a senior adviser to the Deputy Assistant Director of defense at DOD, where he led the department at the development and writing of major sections of the 2018 National Defense Strategy (NDS), the war gaming and analytical inputs to the NDS. Prior to that, he wrote the 2018 Defense Analytic Guidance, which revamped their previous force planning, construct and mapped out major reforms to DOD's analytic and enterprise. Dougherty served as an Airborne Infantry member, the second battalion 75th Ranger Regiment in Fort Lewis, Washington in the late 90s. He holds a master's degree with distinction in International Studies from Johns Hopkins University School of Advanced International Studies, and a bachelor's degree summa cum laude and International Studies from the Henry M. Jackson School of International Studies at the University of Washington. So welcome, Chris. Thanks for joining us.
Chris Dougherty: [02:35] Thank you for having me, Steve. It's been a very nice introduction.
King: [02:38] You're welcome. My first question is, despite the overarching strategic priorities laid out by the Biden administration and initial indicators provided by DOD, it's not clear to me how the next national defense strategy will prioritize these threats, and what the primary role of the U.S. military might turn out to be. You've worked on this problem for a while now. Of the strategic options, which I think are high-end deterrence, day-to-day competition, which you guys call full spectrum competition, which makes the most sense and what role will cybersecurity play?
Dougherty: [03:22] When you're looking at a strategy, you're not going to do just one thing. The United States doesn't have the benefit of being able to just solve one problem; we've got to solve multiple problems across multiple timeframes. It's not, "are we going to do one of these things and not the other two," it's about the weight of emphasis that you're putting on different aspects of your strategy, because there will of course, be client deterrence, there will be day-to-day competition, and there will probably be some full spectrum activities. But what matters is how you balance between those knots or push one completely off to the side. With that being said, within that framework, I think this national defense strategy is trying to focus more on deterring, high-end deterrence, which is to say, deterring China from potentially invading Taiwan laterally, before that Ukraine war, deterring Russia from invading NATO or otherwise conducting course of acts against NATO, I still think that's important. But the Russian situation has evolved over the last eight months. I think that's where the focus is. That's where the focus of the previous strategy was. But then there's also a discussion in the 2018 strategy of what we call the "competition," and what the new strategy I think is increasingly referring to is "campaigning." That is, these day-to-day activities that might have their own security outcomes. They may be their own issue, their own sui generis operation, but in other cases, they might not be setting conditions, either for deterrence or for what we might need to do in a long term conflict. I'll use an example of that. I know this is a very amorphous concept, it's hard to wrap your head around. If you look at what China has done over the last decade, in the South China Sea, I think it's a good example of the interaction between day-to-day competition and high-end deterrence. What China has done through its island reclamation and turning these reclaimed islands into increasingly a string of military bases, is they've stretched out their ability to use land-based systems. This is like surface to air missiles and anti-ship cruise missiles that are based on land, as well as they've put some airfields and some ports on these islands. They've turned them into little military bastions, out in the South China Sea. By themselves, these things are not a huge headache for the U.S. Joint Force in the event of a war, but they're not nothing, they're certainly more than just a speed bump. They're not a preclusive defense. But nevertheless, they're a problem that joint U.S. military planners have to deal with; our allies and partners have to deal with these things. They happened in the rubric of competition, but they've changed the map, they change the board of the game, if we would get into a conflict. That's a good example of how these things start to interact and you get bullied disentangle high-end deterrence from day to day competition. The problem with that is from functional perspectives, you can write whatever you want in strategy. The 2018 National Defense Strategy that I worked on was very clear, we were going to prioritize warfighting, or combat preparation over day-to-day competition, we said that explicitly, it's clear. The problem is, once the ink is dry on a strategy, and you hand it over to the people who are going to implement it, they have their own ideas about what that means. Oftentimes, the friction here is between the combatant commanders of people like the commander of the United States in the Indo-Pacific Command, with the commander of the United States Central Command. They have their own ideas about what competition means and how that relates to deterrence. They tend to focus very much on what's happening today. What activity am I seeing from China, if I'm the Indo-Pacific commander, or what activities am I seeing from Russia, if I'm the European commander, for example. They tend to want a lot of resources to reduce risk in the near term in that competition phase, because they think that they compete effectively and they shape the environment, they shape adversary perceptions, they won't have to fight a war on their watch, or there'll be better prepared for it if it does happen. But there's a flip side of that. In a world of finite resources, I can't both do a bunch of stuff today, and do a bunch of stuff tomorrow. I've got to pick and choose where I'm going to spend my dollars. A couple years ago, the Chief of Staff of the Air Force and the Commandant of the Marine Corps jointly put out a couple of OpEds; they were talking about what they called future readiness, and how the Department of Defense needs to invest in future readiness, because we're spending too much on current day readiness to resource day-to-day competition. Their argument was it's great to do all these things, in competition on a day-to-day basis out in the Pacific Ocean, or in the Atlantic, or in Europe, all of these things have some utility, but they're coming at the cost of their services ability to fight wars in the future if it came to that. They felt like the balance had been shifted in the wrong direction, which in my mind is somebody who wrote a lot of the National Defense Strategy 2018 was ironic, because we told the department to not do that exact thing. I guess what my point here is that I think this strategy will probably focus more on high-end deterrence than it does on what they're calling campaigning. But despite that, what happens when you implement this strategy is going to be a whole other matter. You can see that just today, right now, with the original focus of the strategy was going to be on China, and then maybe a little bit of Russia, and some other stuff. As we're seeing the world had other plans, and they were probably focused more on a long-term strategy is you can see this in their budgets. They've invested a lot in research and development, they were interested in more of a long-term strategy. The problem is, the world events intervened, and now they find themselves essentially supplying a little bit of a proxy conflict in Ukraine. We can write one thing and a strategy, and what gets implemented can end up being something else entirely.
King: [09:46] Is that a function of multiplicity of advanced technologies more like compared to Vietnam, more than World War II or Korea, or has that ever changed?
Dougherty: [09:58] I think it's a constant of strategy. Every state have a sufficient size, and there haven't been a ton of them. But every state that has a security outlook that is more than defending their own borders, has to think about multiple challenges in multiple areas. For the United States as a global power, we're thinking about global challenges. Essentially, the whole world is an operating environment that we're concerned about. Within that, we can prioritize some threats are more acute than others, some threats are more dangerous to U.S. national security or national interests. So we focus on those areas. The National Defense Strategy 2018 focused on Indo-Pacific and on Europe, and then the Middle East was in third place, but everything else is "we'll deal with it as it happens." I think this 22 National Defense Strategy originally wanted to focus on the Indo-Pacific and deprioritize Europe a little bit. I think they had to go back to the drawing board once Russia invaded Ukraine, but that prioritization between theaters is not uncommon today. It's been a constant theme and U.S. defense strategy. Since prior to World War II, the whole "Europe First" aspect of World War II, which, if we look at where our resources went, in the beginning of World War II, we didn't do "Europe First." We did the "Pacific First," and then ramped up in Europe, and then ramped back to the Pacific in late 1945. But nevertheless, the British dealt with this, the Romans dealt with this, all the way going back to the Roman Empire. Managing multiple threats and multiple theories is just a fact of life of the United States.
King: [11:46] We've now invested more than $40 billion into this conflict at this point. While at any point in time, I guess, can we imagine a future where any of our adversaries are prepared to launch a conventional warfare attack like Russia has on Ukraine? Or is it all going to be stepped up to either nuclear cyber?
Dougherty: [12:13] I think conventional warfare is possible. I wouldn't use the word probable, but I definitely think it's possible. I hate to say this, because the war is a massive tragedy for the people of Ukraine and even if they win, it's going to be a pretty bloody victory for them. But one of the salutary effects U.S. national security and global national security has woken people up to the idea that major interstate conflict is still a possibility. I think that during the Cold War, it was seen as a possibility. But it was always under this very intense nuclear overhang, which ultimately, I think, successfully deterred both sides from taking that step. But there was a belief, I think, in the post-cold war era that was just not a thing that states did anymore. That was a combination of economic interconnectedness, and nuclear deterrence, and U.S. hyper power, as it was increasingly rendering the world free from interstate conflict at that scale. I don't think that was realistic, I think it was anomalous. If you look through human history, that's just not a thing that has been a consistent theme of human history. The opposite is the consistent theme, the interstate conflict is the norm. I think we just lived through a 30 to 40 year period, where there's just an anomalous one in global history. Now we're, unfortunately coming out of that period. Now, to your point, how much does this war or a putative war between United States and China or the United States and Russia look like what we're seeing in Ukraine and/or how much would it look like cyber warfare or nuclear warfare? You talk to people at United States Cyber Command, and they'll tell you they're at cyber war with the Chinese and Russians every day, the gap between warfare and day-to-day competition in cyberspace is very small and very blurry. On the nuclear side, that's something that defense analysts are starting to wrap our heads around, for the first time in decades, because for the first time in decades, the United States is facing a nuclear armed conventional opponents that have significant nuclear capabilities, but also present this this pretty cute, conventional warfare threat. Say what we will about the North Koreans, they have a nuclear weapons capability. No, it's not what we would call a full nuclear capability on the order of the Russians or even the Chinese. But nevertheless, that's like a fundamentally different order of threat than what we see from China. Russia, in terms of the ability of all to escalate to real, no kidding nuclear exchanges, that could potentially kill tens of millions or even hundreds of millions of people. I do think that the nuclear aspect of this is important. But as we're seeing in Ukraine, we could see if there were ever a war with the United States and China, it would not immediately go nuclear. Even if it did result in some limited nuclear exchanges, that doesn't necessarily mean the war would end. I think that's one of the flawed beliefs that a lot of folks have is that somebody detonates a nuclear weapon, and all of a sudden everything stops. I just don't think that that's a realistic assumption to make.
King: [15:42] It doesn't seem reasonable to me, either. Certainly not in this day and age. If you look at the obvious adversaries, - China, Russia, Iran and North Korea - they have very four distinctive objectives, agendas that each of them are trying to fulfill, and none of them look the same as the other among those, which is the most significant threat on your mind.
Dougherty: [16:09] Absolutely. We can debate; there's some folks who want to call China, a challenge and Russia, a threat or trying to make the distinction that Russia is this acute near-term problem. China is a longer term problem. I don't know that. I think maybe five to eight years ago, I would have probably bought into that theme a little bit more. But unfortunately, China has accelerated a lot of its military development. We have not, I would argue, kept pace in certain areas, although there's some success stories in there. But I think what we're increasingly seeing is that we should no longer think about China as some far off future problem. I'm not of the opinion that 2027 is this magical date for the People's Liberation Army, where all of a sudden, they're going to have the ability to invade Taiwan and one day Xi Jinping will wake up and snaps fingers, and it'll happen. I don't think that's necessarily the case. I think 2027 is a marker on a long path of military development for the People's Liberation Army. It's a point at which they think they will transition in the various periods of development that they're trying to achieve. But I do think we need to start thinking about China as a problem today. Not just something it's often the future. I would say, China, number one and Russia, number two, but the Russia situation is kind of different now, given what's happening in Ukraine. I would argue, in terms of day-to-day risk, there's more day-to-day friction. I would argue with the Iranians, simply because we are in Iraq, we're still conducting some operations, I believe, in Syria, although it'll be quite limited. We're still operating on a day-to-day basis in the Persian Gulf. There's just that source of constant friction between ourselves and Iranians. But with that being said, the Iranians are fully aware of their conventional weakness, they don't have a nuclear deterrent. The Iranians are a lot of friction, but it's low-level friction. The North Koreans, I'd argue there's less friction, but if there were to be real friction despite the fact that DPRK armed forces are not what they once were, they're still significant. They still have a lot of artillery that can range the greater Seoul metropolitan area. They have nuclear weapons and increasingly means to deliver them at longer ranges. A Korean peninsula contingency would be a very bad day. The good thing about the Korean Peninsula is that, as you mentioned, they all everybody all these regimes have different security goals. I think the major goal of the Kim regime is the survival of the Kim regime. For that, they mostly just wanted to deter other people from getting into their business. I don't see them. I think most analysts do not see them as an aggressive military power. They do things that look aggressive, because they're trying to get people to negotiate with them and pay attention to them. Not because they want to start a war because they know that war does not go well for them.
King: [19:16] Alright. China can reasonably have an objective of world/global domination, whereas it's hard to imagine North Korea sharing that objective.
Dougherty: [19:28] Referee doesn't even dominate its own Peninsula. Dominations probably off the table.
King: [19:36] Russia, I don't know invented or used to be masters in the influence operations business. It appears that China has sort of taken the lead and then in the disinformation or misinformation space, can you share your view on what we can expect in there going forward? Because ever since 2000, arguably 12 I guess, at least from my note visibility point of view, we have seen a dramatic shift in the outcomes and effect of fake news and misinformation here. At least that's what I attribute to our current societal divide to? It seems like it gets worse every month.
Dougherty: [20:22] This is an interesting question. It's one that people in my field are grappling with now. That is, to what degree were the Russians, very skilled before? Were they the masters of this stuff before? What extent were we just so oblivious to what was happening, that it was effective, because we were just utterly clueless. They did a good job of it. One thing I do think the Russians have been pretty good at. Not great, always, but pretty good over the course history, is understanding that the points of friction in U.S. society, and the ways in which they can exploit those, and sometimes they just take if you look at what they did it pretty early in 2016, and leading up to it, and then afterward, a lot of what they would do is shotgun style attacks, where they would try out a bunch of lines online. That's, I think one of the things that social media has been great for them to do is social media allows them to test a bunch of approaches and a bunch of phrases and a bunch of methods, and then figure out which one works, because it got a governor's response, and then just keep drilling down on that. That's something I think they did pretty well. Now, you look at their info operations now in Ukraine, and they look a heck of a lot less effective. How much of their success was like the stopped clock prints like, it's never going to be right twice a day? Or was it that they were good at it, and they got less good? Or were they just okay at it. We were so bad, because we're so unaware of what was happening, but they stole a march on us. We kind have figured it out and responded, there are different theories all over the place there. I'm not sure which one I subscribe, I guess, if you had to ask me, I think it was that we were so ignorant of what was happening. We had taken our eye off of Russia, as a potential threat and competitor in the information space, so much that they got inside the wire before we were even aware that they were there. Once we woke up to it, it was too late. I don't know that they were that effective. I just think we were just that we were caught that unawares. They have this whole approach that they call three warfare: political, psychological, and/or public opinion psychological and law fair, or legal warfare, what they call it is their kind of broader approach to thinking about operations in the information environment. I would argue, they're a mixed bag, they have successes in some places. You'll see a lot of is that virtually no place refers to Taiwan as Taiwan anymore. If you fly in an airplane, and they've got a map showing you where you are in the world, if you fly over Taiwan, it's not listed as Taiwan, it will be listed as like Chinese Taipei, or they'll just list the cities in it, but they're not going to call it Taiwan. That's been part of China's information operation is convincing the world through all these little agglomerations of bits and bobs of data, that Taiwan is not a country, it's not an independent entity, it is part of China and convincing them to stay out of their business. Now, I think that has had some success in that area, but there's a backlash to that right. I don't know if your listeners have heard of the idea of wolf warrior diplomacy. Wolf warrior is a Chinese military action film that came out about six or seven years ago now to paint with a very broad brush it's like Rambo two or Rambo three for China. This is very muscular aggressive, militaristic number one, which was an anti-war film, if you've ever seen it, but the later ones that got a little bit more, you know, chest thumping, patriotic, but nevertheless, they've taken on this sort of aggressive public persona in diplomacy and information that I think has blown back on them in ways that they're not either not aware of or not capable of fixing. They have these successes here and there, but with every success, they end up shooting themselves in the foot. There's almost like a cultural arrogance that comes with believing that you are the number one kingdom under heaven, and I think that there's an aspect of that imperialistic behavior to the Chinese Communist Party and Chinese leaders more generally in the way that they deal with, especially countries around them in Asia, who they still see as fundamentally subordinate, and junior to China. That attitude comes out in these diplomatic interactions in a lot of their information operations. They have some successes here and there, but because of the way they act and the way they behave, and their tone deafness to a lot of the rest of the world, they ended up creating a lot of enemies at the same time.
King: [25:38] The global perception has shifted a little bit than now. China's not seeing so much as the benign trading partner, but rather aggressive, pissed off adversary.
Dougherty: [25:54] It's also easier to not be afraid of China when they weren't as strong. Even if they weren't always a great partner or reliable interlocutor, it's different when they were a regional power and one that was limited regional power. Now, they're the major power in East Asia, and I think countries are changing their attitude toward China accordingly.
King: [26:23] From a technology point of view or a cybersecurity point of view, there's no question but that we are far behind China in terms of advanced technology development, to the extent that I think the quote from the joint Chiefs of Staff, General, who usually runs WarGames, and has been doing this for 20 years; we were shutting down this exercise, because every time we run it, the Chinese hand SRS in 15 minutes. We need to do something different, which is shocking, in a way. We talked about that in deterrence and leading with diplomacy and yet at the same time, Biden's made policy statements. Unwittingly, I think that he said that he's had to walk back later how realistic to expect that by next year, we can continue to lead with diplomacy, where you get these people that we're dealing with that have no pretense about their intentions.
Dougherty: [27:28] This is my belief; I'm not basing this on any information I have from folks inside the White House at the Pentagon, I don't think that what Biden is saying is a mistake. His statements on Taiwan are clear. He said it now. The old saying, "once it's an accident twice as a coincidence, and three times as enemy action," it's now at least three times, I think it might be four, where he's clearly stated if China aggressively tries to change the status quo, without a provocation from Taiwan, we will come to Taiwan's defense, if you put all those caveats in there. Maybe that's just me adding it, but that's what I hear in my head.
King: [28:10] But what exactly would we do to defend Taiwan?
Dougherty: [28:14] There's a lot we could do. First and foremost, we're seeing this today in Ukraine. A lot of it on our side of the intelligence provision, the Taiwanese have their intelligence capabilities. They have their own human intelligence networks in the People's Republic of China, they've got their own technical collection capabilities, but they don't have anything nearly what we do, especially in terms of technical collection, when it comes to things like space. Prior to a conflict, China wouldn't be willing, we assume anyway, to take actions against our space assets that would blind them. We're going to be able to start seeing indications and warnings of Chinese movements in all likelihood, long before the Taiwanese do. The idea would be that we start providing information so they can get themselves ready. If it does come to war, there's a couple of things that we can do that help. Number one is just our mere presence in the region causes China as a dilemma. If they think that we're going to intervene, they can choose to strike U.S. bases and forces in the Pacific. But that's going to bring us fully into the war. After that, there is a full war between the United States and China, you hit Guam, it's functionally the same as hitting Hawaii in 1941. In 1941, Hawaii was a U.S. possession, it wasn't a state, and Guam is sort of in the same boat. It's a U.S. possession filled with U.S. citizens. If you want to strike Guam as part of this opening salvo. For China, then you're in this world in which you've now started a war with United States or you can choose not to strike United States, but then you're just hoping that the United States doesn't intervene and doesn't get involved. Then there's a whole question of what do you do about U.S. bases in Japan? Because a huge amount of U.S. combat power in the Pacific is located in Japan. China probably doesn't want to fight the Japanese alongside U.S. and Taiwan, they probably want to keep Japan out of the fight. But the problem is, if you allow U.S. bases in Japan to keep operating, then you haven't achieved your effect just by hitting Guam. You're going to face all this U.S. airpower that comes up places like Dakota Misawa. Kadena, etc. The Chinese have that problem to solve. The difficulty is you can't strike U.S. bases in Japan, and not also hit Japan like there's no way that you can square that circle, you just hit the U.S. stuff in Japan, because most U.S. bases in Japan are co-located with Japanese self, the fourth Defense Force bases, and a lot of them are in like pretty built up urban areas, because Japan is a pretty densely occupied area. Unless you're like, incredibly precise, with every single one of your weapons, chances are some bombs or some missiles are going to fall with not supposed to, they're going to kill either Japanese military personnel or Japanese civilians. And now, you've brought Japan into the war. Now that you're starting to change the strategic content, in its treaty, contours of conflict that you thought was going to be a limited war over Taiwan is now a big regional war with the United States, and Japan, and then probably Australia as well, maybe the U.K. and France. You've kind of started World War III over Taiwan, which I don't think the Chinese Communist Party wants to do. I don't think that's where their head is. There are a lot of things we can do up to even before we've even started a war. Then once the war starts, we've got a lot of military capabilities that can make life extremely difficult for the Chinese, as they try to cross the Taiwan Strait and prosecute an invasion of Taiwan, the most obvious in my mind is our fleet of extremely quiet and extremely capable nuclear attack submarines, the Virginia class, increasingly, but also still, the older Los Angeles class submarines, both highly effective at delivering torpedoes and anti-ship cruise missiles against all targets: both surface vessels, but land targets as well, things like ports and landing areas. On top of that, we have a good size fleet, a bomber is not huge relative to what we had during the Cold War, but definitely still the world's largest fleet of long range strike bombers. Those can be armed with a variety of weapons, but the big one we'd probably be launching early on in the fight is a long-range anti-ship missiles. You've got all our fleets of destroyers and aircraft carriers, which would probably have to operate a greater range because of the threat from Chinese missiles. But nevertheless, they're still going to be able to bring some combat power to bear. It's not just as though China gets a free pass into Taiwan. You've talked a little bit about cyber, I do think it's important to note that a lot of folks are out there wondering why we're not seeing more cyber warfare in Ukraine. I think a lot of people thought there was like a cyber Armageddon in Ukraine, where all the lights would get turned off. We'd go back to the Stone Age, because Russia would launch so many effective cyberattacks on Ukraine, and it's especially its critical infrastructure. What we're seeing, and I think this surprise of some, but not everybody is just a very effective cyber defense campaign, supported heavily by the United States, but also by some of our NATO allies, that is helping keep the lights on in Ukraine. I think some folks might have overestimated the capability of cyber offensive and underestimated the capabilities of cyber defense. I think we're seeing that today in Ukraine. I'm basing that on open sources. I've got no secret insights into that. But the open sources do seem to be suggesting that's what happened. That's what's happening. You could see something similar in Taiwan, where China tries to turn off huge swathes of critical infrastructure in Taiwan, and the United States long as some of our allies helps keep the lights on in the cyber domain. That's before we even get sort of any kinetic action. There are a lot of things we can do. I think one of the things that's important to point out is China hasn't fought a war since 1979. That war they fought in 1979 was not exactly a successful one. They invaded Vietnam and had some naval skirmishes with them and mostly then just withdrew behind their border after it didn't go the way they wanted. Since then, they haven't had a single real combat operation. There's nobody in the People's Liberation Army who's been to war and fought in combat. They're going to do after not having been in combat for almost 50 years is undertake the most difficult, most complex operation there is to do, which is an amphibious invasion. I think a lot of military analysts, like myself are skeptical that they're going to have a whole lot of success, but that doesn't mean they can't do it, doesn't mean we shouldn't assume that they can. It just means it's going to be a lot harder for them than perhaps a lot of people understand.
King: [34:57] We're launching education/online learning platform. I'm curious as to your view on cybersecurity education. We have this democratic/republic organization here. We're not an oligarchy, we're not running an authoritarian regime. It's not easy to influence what people do with their educational goals, very dissimilar to China and Russia and North Korea. But we're way behind in terms of both level of understanding in cyber, and in advanced technology progress. How important do you think cybersecurity education is, not just to closing the skills gap but do you think it's too late to have any real impact on the next 10 years of international conflict?
Dougherty: [36:01] I think there's definitely space; anything we do that can improve our cybersecurity right now. My general focus is probably on military organizations in the government. But increasingly, it's going to matter across the whole of society, because they're not just going to target government systems, they're going to target critical infrastructure, civilian systems, oftentimes, because those are easier targets. A good example of that is, when we worry about targets against the U.S. government and against our military capabilities, one of the things we're most concerned about is China or Russia targeting the defense contractors and not necessarily the big prime ones, but Lockheed and Northrop Grummans and General Dynamics in the world, because those have significantly improved their cybersecurity practices over the last 10 years after the discovery of the Chinese advanced persistent threat that we've found to have been exfiltrating large amounts of data throughout the 2000s. Now, that's gotten a lot better when I'm thinking of our sort of the people who provide things like gas and sanitation. A lot of those people have to plug into defense networks is like the Defense Logistics Agency or United States transportation command. But their cybersecurity practices are just all over the map right there. Some of them are good. Some of them are terrible, the vast majority are probably somewhere in the middle. That is a potential backdoor for China or Russia to get into our systems and to wreak havoc. One of the things I think we need to do is we need to educate people about how to spot cyberthreats, how to avoid them, what to do when they discover that they've been become a victim, and how to how to build cyber resiliency, I don't think we're going to have a perfect cyber defense. But I think we do need to have an ability to raise the bar of entry, potential adversaries, and then limit the damage they can create once they're inside. To the extent that we can do that for the general public, but particularly for people who are involved in national security, it would be it would be excellent. There is a false deadline here. That's one of the things I would like to make point about - about the 2027 timeframe. Some people think that putting these deadlines out there for China's going to do X by Y date motivates people. But there's also a sense of defeatism that could come in from that, if they're going to do this by 2027, and we can't do anything about it by then anyway, then why should we bother trying to do anything at all? I think that's just as pernicious as complacency. You have to find this balance of getting people to believe that not only is a problem, but it's a solvable problem. If all we do is we make the Chinese out to be 10 feet tall, and they're going to invade Taiwan tomorrow, and there's nothing we can do about it, then that's how it will behave, as though this is going to happen inevitably, and there's nothing we can do about it. That is absolutely the wrong answer. They are not 10 feet tall, there is something we can do about it, they are not necessarily going to invade tomorrow, and we absolutely can deter them from taking this action. I would say yes, please do educate people about cybersecurity. There's a good example here, from the Chinese side, and a little bit from the Russian side, but pretty much from the Chinese side. If you read cybersecurity analyses of China, about 10 years ago, maybe a little bit longer, they were a mess, that the Chinese were in large part because they were using huge, just insane numbers of pirated software and pirated operating systems, mostly Microsoft Windows, but because they were using pirated versions, they weren't getting any of the security updates. They were using computers that just had like known zero day vulnerabilities throughout them. This wasn't just like random citizens; this was businesses, sometimes government entities. They're just rife with these vulnerabilities and eventually we're trying to realize was that their pirating IP theft at scale was a problem that they had to deal with it. They couldn't keep operating in this way, because it was opening up this massive cybersecurity vulnerability. They basically cracked down on it. As you mentioned, it's something that authoritarian system could do, it's a little bit more difficult for us. But, collective action is possible. We still have an ability to act collectively as a nation, despite all our divisions. I still believe that there's a world in which we can get there. It's just we have to stop fixating on our differences and disagreements and fixate on what are the things that we can all agree that we want to do. I think one of the things, hopefully, that we can almost all agree on, is we don't want to live in a world that is dominated where the rules are written in Beijing, by a bunch of authoritarian, techno autocrats. I don't want to live in that world. I don't think you do. I don't think most Americans do. Where we want to go from there. I think that's up to us. But we do, I fundamentally think most Americans can agree, we want our decisions about who we are as a nation, and what we do as a nation to be made here in the United States and not somewhere else.
King: [41:20] But the distinction between progressive liberal thought and more expression of communism is blurring. I think there is a perception among Gen Z, that another form of government might work out better than the free market capitalism that we try to try to manage here. God willing, we are able to retain a world that encourages private ownership and competition. I think we've talked about the prioritization of threats and your view of the NDS in the future and prioritizing China. The rest of that question, though, and going forward, I think if deterrence fails, how do we prepare the fighting sources to get ready for serious semi-conventional adversarial thrust? If China decides, for example, that they don't like the way we're showing the world, our relationship with Taipei, what's their next move? How do we deal with that?
Dougherty: [42:29] If you're looking at a potential war with China, usually from a U.S. perspective, not usually always, for U.S. perspectives, we do not plan to start the war with China. When we're thinking about conflict with China, it's going to be "a conflict of China's starts" and the upside of that, from U.S. perspective is that we're not the aggressors, we're not the ones out there violating international law. Then there's strategic advantages that come to that right. Generally speaking, it's easier to rally a coalition to your side, the downside to these means we're handing we're handing China the initiative in this conflict. They get to take the first punch. And so the first thing we have to do, as a country and as an armed force, and starts department defense is to make sure that we can withstand that first punch. When I talk about war with China, or even with Russia, I say the first thing you have to do is not lose the war. We're not going to win the war in the first opening days or opening weeks of the war, that's not likely. I think one of the things I hope that Ukraine has taught people is that war between two major powers is probably not likely to be all that short. Anybody who's out there telling you, "oh, this war is only going to last X number of days," unless that number is like in the hundreds or potentially thousands. You probably shouldn't listen to them, because the worst, it is likely to go on for at least a month, if not potentially, into the years. That's point one, though, is in order to get to that point, you got to not lose so badly, that you don't have a credible position. Once it's all said and done, the first thing that Chinese are going to do in that because they write about this pretty extensively and things like the science of military strategy is they're going to attack us in space, cyberspace, the electromagnetic spectrum. What the exact phasing of that is, it is dependent, probably very contingent on how the scenario unfolds. But that's where they see the immediate, acute attacks to be happening. During the war, you're going to see that three warfare is approach to set the information environment to their advantage, to set world opinion to their advantage. The other aspect is underappreciated aspect of three warfare is at least outside of the China community is it's not just externally focused. One of my former colleagues, Peter Mattis, who's now at the special competitive studies project, has written extensively on how important three warfare is to ensuring internal political cohesion in the face of an external threat. And a lot of it is about rallying people behind the Chinese Communist Party. Chinese Communist Party calls political work to rally both their internal cadres but also people who are not inside the party itself to support political objectives of the CCP. A very important aspect of that as well. But it also has these external aspects of convincing regional audiences either to join on trying to side or at the very least stay out of it, and creating legal justifications for what they're doing. That seems that are in now they've kind of launched a space cyberspace and electromagnetic spectrum attack. These things are targeting stuff like our communication satellites, or intelligence satellites, or communications links. You know, one of the things there's a good Wall Street Journal explainer recently on how they might attack undersea cables to sever Taiwan's connections with the rest of the world because they're only connected to the rest world for a handful of undersea data cables. Those have landings, they slip cash on in the south, on Taipei in the north. China would go after those landing sites, potentially the cables themselves to cut Taiwan off from the global information environment. They would escalate to using things like precise ballistic missiles and cruise missiles to start attacking radar sites, early warning sites, surface air missile systems, airfields, ports, ships, and command and control centers. They probably try to take a shot to decapitate the Taiwanese government, although, generally speaking, we think the Taiwanese government would probably go into a bunker somewhere below kind of in the in the bowels below Taipei. That's the opening salvo now, the other big question, as I referred to earlier is, what do they do to take the shot at United States? Do they just go after our salaries, they just go after our networks? Or do they launch the Fire Strike campaign or overseas bases in Japan, particularly the base in Okinawa and Cadena and then go after things like the aircraft carriers and our ships using anti-ship ballistic and cruise missiles, and potentially even the future anti-ship hypersonic missiles or torpedoes launched from submarines. It's like multiplicities threat, both in kind of the non-kinetic domains like space cyberspace in the EM spectrum, but then also in the physical domain, using air and surface delivered missiles. The big question for United States is, can we withstand that opening barrage, it's going to be real intense, it's going to be chaotic, and you're crazy. But if we can come out the other side, with combat capability and tact, I think that puts a question mark, under China's approach. I think, if they don't believe that they can launch that opening salvo and if not knock us out, then knock us down pretty hard for a few days, maybe even a week. If they don't think they can do that. I don't think they launch this invasion. The reason why is there's a period of time from when they launched their invasion, to when they fully get across the Taiwan Strait, where they're just incredibly vulnerable. Even once they get ashore on Taiwan, those forces on Taiwan will be vulnerable. The ships and aircraft that are bringing them supplies, fuel, munitions, food, all of that is going to be incredibly vulnerable to interdiction from the air from the sea from the undersea. I think they have to be very concerned about the about their ability to sustain that force on Taiwan once they get. There's going to be this constant tension for the PLA, because the bigger force you get on Taiwan, the more combat power you have on Taiwan, because you want to you want to attain a localized force advantage over the Taiwanese defense forces. But the downside is, the bigger the force is, the more logistical support requires. That's what we saw. We've seen this repeatedly in Ukraine, I think we're going to see it even more going forward. As the Russians mobilize more forces, bigger army equals bigger logistical demands. And if you're limited in your ability to put stuff across the strait, whether by ships or by aircraft, if you're limited, especially if they can't get hold of a port, it's going to be hard for them to keep those forces that are on Taiwan, filled up with fuel, filled up with munitions, getting the medical supplies, they need evacuating, injured soldiers and all these kinds of down to the weeds, logistical details of military operations. They're getting hard fast. The United States learned this the hard way, multiple times throughout the course of World War II, just how difficult this is. Despite the decades we spent examining amphibious operations and the joint Marine Corps Navy team, Guadalcanal was a bit of a disaster. It took several iterations of amphibious assaults like that to take to figure out exactly how the Marine Corps Navy team was going to work. Then you look at the European Theater, Operation Torch-kind of a mess against opponents who are trying all that hard. The French weren't in the fight all that much. We went from Torch to Husky to Nichido, then to, Overlord. You didn't just go straight to Operation Overlord and the invasion of France. I think the concern if I were a PLA planner is you're going from zero to Overlord, all in one big swoop without ever having done anything intermediate. I got to say, if we cannot lose in that first week, I don't know that I can't guarantee we win, but I guarantee it's going to be a bad day for the People's Liberation Army.
King: [50:29] Thank you, Chris. That seems like a great spot to end this. Thank you for taking time out to do this. There's so much more here to unpack. I I hope we can do this again soon, because I'd like to explore a couple of these issues further. By March, I'm sure the landscape will look different than it looks today. If you don't mind, we'd love to have you back and we'll do it again.
Dougherty: [51:07] Absolutely. Steve, thank you for having me.
King: [51:09] Thank you to our listeners. I hope you enjoyed this. Until next time, I'm Steve King, your host, signing off.