Cyber as a Domain: Concept and Capabilities

During the North Atlantic Council in Warsaw 8-9 July 2016, NATO declared that its essential mission is unchanged.[1] It was also stated that NATO has the full range of capabilities necessary to deter and defend against potential adversaries and the full spectrum of threats that could confront the Alliance from any direction.

Cyber-attacks present a clear challenge to the security of the Alliance and could be as harmful to modern societies as a conventional attack. For that reason, the Member States agreed in Warsaw that cyber defense is part of NATO’s core task of collective defense and NATO’s defensive mandate, and that cyberspace is recognized as a separate domain of operations in which NATO must defend itself as effectively as it does in the air, on land, and at sea. Furthermore, it will ensure more effective organization of NATO’s cyber defense and better management of resources, skills, and capabilities.[2]

The research in this report focused on both the concept of Cyber as a Domain for NATO and on the question whether the existing NATO Strategic Command’s cyberspace capabilities cover the whole spectrum of possible cyberspace capabilities that might be required for NATO Strategic Commands to fulfil its ambitions in this new domain. To answer this question, we applied an analytical input-effect framework. Initial analyses showed that the current NATO framework does not fully cover Cyber as a Domain and that gaps exist.

The research concluded that:

1. Current cyber capability requirements and approaches do no take the full scope and depth of Cyber as a Domain in consideration. Future focus by NATO Strategic Commands could be considerably broadened. The scope and depth of NATO’s current cyber capability framework should reflect this broader scope.
2. Possible broadening of the current cyberspace analytical framework can be found in emphasizing its deterrence capabilities and strengthening the notion that as a result of considering Cyber as a Domain it contains operational capabilities in their own right.
3. The alignment of thinking and clarity of roles and responsibilities between the NATO Strategic Commands and the Member States, and between the different domains need further attention.
4. There are options to further strengthen NATO cyber capabilities by involving more Non-state actors.

The proposed extended framework could create more awareness, thus deepening and operationalizing capability development.

About this study:

This study is aimed at exploring and developing the concept of Cyber as a Domain for the NATO Communications and Information Agency (NCIA) at the request of NATO Allied Command Transformation (ACT).

HCSS was asked to address the concept of cyber as a domain and analyze and develop the scoping of the concept by addressing the question whether the existing NATO cyber capabilities covered the whole spectrum of possible cyber capabilities that might by required for NATO Strategic Commands to fulfil its ambitions declaring cyber its fourth domain of operations. For that latter part, an analytical framework was applied.

To answer these questions HCSS used both top down and bottom-up approaches:

1. A top down approach to look at Cyber as a Domain in a purely conceptual manner. We analyzed elements of the cyber domain that are unchangeable and intrinsic to the cyber domain alone and compared this to similar or comparable elements in the other domains.

Subsequently, as a second step, we examined how these elements in other domains are addressed in terms of strategy, doctrine, requirements, and the like. Important was to examine how one can dissect the domain in a variety of ways and how to make connections with other domains. This approach was conducted by examining the academic literature on Cyber as a Domain to tap into the most recent thinking on this subject.

The third step in this approach was to examine the role of NATO within the cyber domain. Here, we made a distinction between NATO as an enterprise and NATO as an alliance.

• Our second approach was more bottom-up and incorporated ongoing developments with respect to the identification and formulation of cyber capabilities. NCIA is developing a framework to identify and distinguish cyber capabilities which will allow assessment of currently existing capabilities and their level of maturity and compare this to capabilities that are required or desired in the future. Taking this framework as a starting point, we have include current activities conducted by HCSS regarding the development of a framework for cyber capabilities to further refine and add to the NCIA framework, including the formulations of the dimensions to distinguish the groups of capabilities as well as of the capability groups themselves. We did this by organizing analyses sessions between NCIA and HCSS staff to combine experiences and resources.

Finally, we compared the results of both approaches to see whether and how the outcomes could show differences and gaps.

^[1] Warsaw Summit Communiqué, Issued by the Heads of State and Government participating in the meeting of the North Atlantic Council in Warsaw 8-9 July 2016.

^[2] Ibid