­­­­­What if warfare—the kind we see in World War II movies—never occurs again? The two great wars of Europe were total, unambiguous, and definitive. There was a beginning (a declaration), a prosecution of conflict, and a clear and declared end, including a postwar occupation and recovery. Histories of such conflict have made great books, and no end to them is in sight.

Warfare today, however, seems almost always ambiguous, murky, confusing, ongoing, and politically complicated—especially for the very legalistic United States. Warfare today is a combination of low-intensity (military) conflict and a fight over information via cyberspace—especially over “narratives” that sway public opinion.¹ And usually this warfare does not involve much violence, certainly not compared to the wholesale slaughters of the 20^th century.²

This isn’t exactly new—warfare has always consisted of competing narratives and had periods of low intensity. What is new is that our adversaries now specifically stay in the early stage of cyberspace operations, information operations, and very limited or no kinetic conflict, careful never to escalate to state-on-state conventional war.³ In short, our adversaries and competitors have embraced cyber warfare precisely to avoid kinetic hostilities with the United States, but in so doing they can at least from time to time still achieve their political objectives.⁴

Traditionally, the United States sees itself as either at peace or at war. Today, this divide is at best blurred and perhaps forever outdated. Today, we seem always in some sort of confrontation. “Steady state” operations imply a status quo—when little needs to be done, and relationships are static. This may be an unhelpful legacy of the great wars in Europe and the Pacific. (It may also have to do with our habit of Manichaean thinking, an artifact of religion.)

It is precisely because the United States enjoys dominance in many military domains that its adversaries plan and struggle against U.S. interests short of declared mass kinetic warfare, especially in the cyberspace domain. Russia, China, North Korea, Iran, and the Islamic State/al-Qaeda maneuver forces, conduct cyberspace operations, influence media, and pay for information all to shape a new environment without resorting to direct kinetic conflict with the world’s sole superpower. U.S. adversaries today see the world in a constant state of conflict and competition; the U.S. political elite sees the world in a state of peace, with “war” a deviation to be quickly corrected.

Cyber warfare is the delivery of effects via cyberspace and can be as un-invasive as collecting intelligence or delivering propaganda, or as invasive as disrupting government websites or stopping a civilian Supervisory Control and Data Acquisition (SCADA) system at a dam, an electrical power plant, or an air traffic control facility.⁵ A cyber “attack” is any hostile act using a computer or network system intended to disrupt or destroy an adversary’s critical cyber systems, assets, or functions.

Cyberspace is a unique military domain in which the United States and adversary forces meet and compete every day. The United States is engaged in almost continuous contact with adversaries in cyberspace, with often-ambiguous legal implications that frequently hamstring our ability to respond. The media has occasionally called it “virtual warfare,” but a better term for the situation may be “cyberspace confrontation,” or “warfare during peacetime.” Although since World War II we have had a succession of limited wars (a sine wave of conflict), cyberspace may have invited, in Army Chief of Staff George Casey’s phrase, an “era of persistent confrontation.”⁶

Russia, China, North Korea, Iran, and the Islamic State/al-Qaeda use cyberspace to pursue a variety of goals, including operations that emplace cyber weapons on our critical infrastructure (both public and private), steal intellectual property, attack U.S. industry, and enable terrorist acts. More recently, Russia has used such methods to influence a presidential election—a new threshold of audacity and danger. Our adversaries’ strategies usually combine traditional military forces and information operations to maneuver, influence, and manipulate information in cyberspace.

As a result, the United States is often hesitant to act politically and militarily during these periods of ostensible peacetime, even though its adversaries are not. (U.S. adversaries are well aware of how and why we find ourselves frozen.) We must recognize that there is a category of conflict that may not be easily recognized as “war” by most, but which involves the violation of U.S. sovereignty and interests, as well as the theft of resources and treasure.

(Joint Publication 3-0, United States Joint Chiefs of Staff, August 11, 2011, p. V-6)

The cyber domain did not usher in a new, definitive form of warfare, as some originally feared—just the opposite. Warfare did not change with the addition of the air or space domain, and cyber, too, is merely a new vector. It does not so much transform warfare as shift it “to the left”: There is more “Phase 0-1” competition—including cyber attacks—during peacetime and fewer “Phase 3” kinetic violence. Nowadays adversaries escalate confrontation with the United States within Phase 0, but rarely past Phase 1. And since cyberspace is pervasive and part of everyone’s environment, it is an especially seductive military domain for adversaries to exploit, especially authoritarian states.

Because U.S. adversaries know we see ourselves as either in peacetime or in wartime, they maneuver as aggressively as they can in Phase 0. Cyberspace is the one military domain where clear boundaries and red lines have not been established. Action in this phase is far easier for authoritarian states to conduct than liberal, consensus-building democracies. Thus, the United States often finds itself reacting late, insufficiently, or not at all to more nimble authoritarian states.

Yet the United States needs to shape this new international environment or our adversaries will do it for us. Cyberspace is sometimes referred to as the “Wild West” precisely because it has not been tamed by the United States and its allies. Norms are created through international law, and states put them into practice. Such norms became the basis of the Law of the Sea, conduct in space, the treatment of POWs, and rules for warships at sea. Thus, cyberspace intrusions by U.S. adversaries that are left unregulated by international law will begin to enjoy a level of international acceptance, no matter how many norms are advocated diplomatically. The effective shaping of cyberspace requires a combination of international norms promulgated on paper in international forums and clear, well-signaled responses to unacceptable activities.

Since World War II, the Department of Defense has concentrated far more on preventing wars through strength than on shaping environments to advance U.S. interests during periods of calm. Likewise, the U.S. military views risk in terms of the possibility of losing a kinetic conflict, but fails to recognize how we can “lose” during peacetime through a gradual and methodical “salami slicing” of U.S. interests (for example, incremental violations of sovereignty; theft of U.S. technology, proprietary information, and wealth; the use of social media to advance conspiracy to commit murder and terrorist planning). Being good at high-end warfare does not ensure success in nonviolent confrontations. The United States needs to introduce the concepts of dominating and winning into Phase 0—that is, to start thinking about “winning in peacetime.” Traditional warfare drives our intellectual, organizational, and strategic principles, but the era of persistent nonviolent confrontation is the new normal.

How U.S. Adversaries “Fight” in Peacetime

U.S. adversaries include most revisionist states in the international arena today, which is natural since the United States benefits most from the institutional status quo it had a major hand in shaping. But not all revisionist adversaries are the same, nor do they tend to work in tandem or explicitly share tactics. Let us now look at three cases: Russia, China, and the Islamic State. North Korea and Iran are certainly among our revisionist adversaries, but their efforts are not as serious a challenge yet as those of the other three.

Russia’s Hybrid Warfare Strategy

Russia today achieves its military objectives through a socially savvy, subtle, and ambiguous form of warfare (with antecedents in the Soviet period): hybrid warfare, with its principal weapon being the control of information. There are three broad elements to its strategy.

Information confrontation (Soviet “active measures”) include disinformation and planted information. Soviet-like themes of anti-Nazism, the threat to Russian civilization, and the struggle against Western “informational aggression” and “destabilization strategy” are delivered today via television, newspapers, movies, social networks, internet trolls, “experts,” and select political cronies.⁷

Information confrontation is followed by clandestine political (physical) destabilizing operations that focus on small sectors of a targeted country’s political apparatus by seizing certain public media and state communications, attacking certain facilities and smearing them as oppressive agents of an illegitimate state, and supplying weapons to separatists, the allegedly suppressed Russian minority of the targeted state (see Estonia in 2007, Georgia in 2008, and Ukraine in 2014).

Finally, Russian conventional forces posture along the border to intimidate the targeted country’s military, supply the separatists, and occasionally intervene directly inside its borders. Once the targeted country sees what it is facing, it agrees to a compromise that sacrifices elements of its sovereignty. Russia then pockets the political victory and repeats the process.

This unique form of warfare is designed never to develop into a full-scale conventional war with the targeted country, and certainly not with NATO. Russia’s hybrid warfare begins and ends in the early phases of warfare without reaching kinetic conflict with powerful adversaries.

By creating a new status quo, Russia successfully breaks international norms, creates indistinct (and new) borders, and lowers international expectations about its behavior. By making the conflict politically ambiguous, claiming no direct involvement, and keeping hostilities small and protracted, Russia keeps outside players like NATO and the United States weak, off-balance, and confused. Russia fuses psychological with kinetic operations to cloud its adversaries’ and Western perceptions of the conflict. This strategy complicates the arrangement of an appropriate and timely response from the international community.

Cyberspace operations are integrated into all aspects of Russian military operations and involve three categories: 1) psychological effects: employing diplomats, “experts,” and academic elites to influence opinions and perceptions; 2) information operations: controlling the message; and 3) technical effects: offensive cyber operations against computer and communications systems. Information is not used to persuade but to confuse, paralyze, and subvert. Russia maintains its power not by persuasion, but by making it clear that it can manipulate what it considers to be the truth.⁸

Russia today is at the very least a dangerous peer of the United States in cyberspace; it is undoubtedly the most sophisticated and dangerous cyberspace adversary of the nations it wishes to destabilize. Russia recognizes the importance of cyber operations in all conflict today and invests in their development. It does not hesitate to use cyberspace to conduct its warfare.

China’s Salami-Slicing Strategy

The Chinese Government believes in internet freedom—that is, freedom from Western online influence. That means YouTube, Facebook, Fox News, the BBC, and Voice of America are as toxic to the Chinese Government as an ISIS beheading video is to Americans. Internet “security,” meanwhile, is the defense against any online activity that threatens Party rule. (So when these Chinese call for internet “security,” we ought not to mislead ourselves—they mean something other than we do.) China views U.S. manufacturing not as a competitor to Chinese industry but a resource to mine for proprietary and business information through cyberspace to advance China’s economy and modernize its industry and military.⁹ The internet is a tool to protect the Party, advance economic growth, exert control over political competitors and Western influence, and aid the Chinese military in future conflicts.

The Chinese government considers private Western websites to be weapons that deliver the dangerous toxin of Western influence; it doesn’t care that the delivery vehicle is a private entity or that competing speech can easily be found or added online. It thinks our acceptance of speech we don’t like (even on private websites) is a sign of weakness and leads not to a stronger state but to a decadent populace. Internet “sovereignty,” to the government of China, is the control of information within its borders.

The Chinese conduct three types of state-sponsored cyber activity: national security espionage (which all nations conduct); economic espionage to aid Chinese industry (an illegal activity, and adamantly opposed by the United States); and internal information operations designed to control and manipulate what the Chinese people can view and say online (anathema to the United States and other democracies).

National security espionage (authorized state acquisition of information via clandestine means) is an activity undertaken by almost all states and recognized as such. Chinese espionage includes stealing U.S. government secrets, information regarding members of the U.S. intelligence community, the blueprints of U.S. weapon systems, and the details of U.S. national security strategy.

Economic espionage consists of the theft of intellectual property and sensitive business information to aid Chinese industry and trade negotiations. This illegal activity is what China is especially well known for, and rightly so. Chinese economic espionage is likely greater than the economic espionage conducted by all other states against the United States combined. A 2013 McAfee study puts the annual high-end estimated loss to the United States from cybercrime and espionage at $100 billion (perhaps as much as 1 percent of U.S. national income) and as many as 508,000 U.S. jobs; China accounts for most of this loss.¹⁰ The former Commander of U.S. Cyber Command, General Keith Alexander, described cybercrime as the “greatest transfer of wealth in modern history.”¹¹ Worse, the Chinese cyber presence throughout U.S. public and civilian computer networks poses the risk that such access could someday be used to attack our networks and infrastructure during or prior to a conflict.

Information operations, as in Russia, are conducted continuously against China’s own people, led by the “Golden Shield Project” (a.k.a. the Great Chinese Firewall)—a massive censorship and surveillance system operated by the Ministry of Public Security. This government cyberspace tool is hyperactive: It attacks and blocks certain websites, poisons caches, conducts speech and face recognition, and sucks in closed-circuit television, smart cards, credit cards, and other surveillance technologies. It also indexes content around the world (in anticipation of filtering it when it heads to China), filters incoming content, and blocks pro-democracy groups and certain related content (such as anything to do with the Dalai Lama, Falun Gong, or Taiwan), along with any news stories that embarrass the government. In addition, it blocks Voice of America and many Western news sites, such as the Chinese edition of the BBC. Such an ambitious cyber mission makes the Chinese government extremely active on the web—the most active state in the world, by far.

The current Chinese President, Xi Jinping, puts the economy first, in the hopes that growth will lead to the modernization of the Chinese military, ease social discontent (that is, keep up with the rising expectations of an increasingly wealthy populace), and increase China’s stature internationally—but not move the state toward liberal democracy. Xi believes Chinese socialist propaganda is good stuff, important food for Chinese youth—and the internet and social media is its best delivery mechanism. The Chinese government uses the internet to conflate nationalism and Party rule and to justify the righteousness of the Party’s existence. It portrays the Great Chinese Firewall as a form of paternal protection from the prurient West. (To add insult to injury, our stolen technology is put to work suppressing democracy in China).

The current Chinese leadership believes the United States is ahead in cyberspace and overall military capabilities, and views the status quo in cyberspace as intolerable. It conducts a gradual “salami slicing” strategy: the continuous and aggressive Phase 0 activities of espionage, industrial theft, and preparation for warfare, but at a level that does not provoke a major, overt U.S. response.

Further, the Chinese believe that cyber warfare is “offense-dominated” and that as long as their vulnerability in cyberspace is low, they might be especially well served by acting preemptively in this domain during a confrontation (such as in a scenario involving the defense of Taiwan). Thus, the more passive the United States remains in the face of China’s cyber hyperactivity and salami-slicing strategy, the more likely actual, violent conflict becomes.

The Islamic State’s iTerrorism Strategy

The invention once thought a panacea for advancing free speech and liberal democracy is also the perfect tool for Islamists intent on intolerance and totalitarianism. The United States invented the very tool that was not just critical to but singularly instrumental in the Islamic State’s success. The internet affords ISIS a means of recruitment, organization, operational direction, ideological conformity, and pride. Its slick, online propaganda gives the Islamic State a sense of identity. It uses social media to coordinate operations and conduct attack planning and has built a sophisticated online strategy involving Facebook, Twitter, YouTube, and WhatsApp. Without the internet, no part of its success would have occurred.

The Islamic State, unlike its predecessor, al-Qaida, practices sophisticated cyber operational security. The State boasts numerous technically savvy operatives, who leverage networks worldwide to keep Islamic State communications redundant, secure, and of high quality. Operatives teach online security through online videos, change accounts periodically, use TOR (the free online software that hides IP addresses), encrypt communications, and develop indigenous communication applications to keep Islamic State communications largely dark, hard to track and take down, and capable of bouncing back after a disruption.

Such activity has made the Islamic State largely secure from traditional warfare techniques of jamming or interception. It has largely crowd-sourced its communications by uploading its propaganda videos on networks outside the Islamic State and then disseminating links via Twitter feeds. It created a new form of operational “Command and Control (C2)” in the form of a Twitter app, the “Dawn of Glad Tidings,” through which users granted the Islamic State permission to send them messages, images of military success, and videos, along with updates on unfolding Islamic State battles. (The app is no longer active, having reached many followers and served its purpose well.)

The Islamic State uses Twitter to rouse “flash mobs” of fighters to attack a village or target—communicating to thousands so instantaneously that U.S. forces cannot come to the defense of the target before Islamic State murderers arrive. But in addition to official Islamic State accounts, thousands of followers and sympathizers will re-tweet Islamic State communications. These followers, of course, are followed by thousands of others, creating what are known as “Twitter Storms.” Such clever use of Western technology affords the State free, redundant, secure, instant, and largely anonymous communications.

Islamic State radicalization is a post-bin Laden phenomenon, involving young men who were teenagers (or younger) when al-Qaeda attacked the World Trade Center and the Pentagon. Such men are children of the internet and social media; bin Laden and his colleagues were children of the Soviet invasion of Afghanistan. The Islamic State provides would-be recruits with a sense of identity through a familiar social network (in their native language) more so than coherent religious instruction.

The social media strategy the Islamic State employs is specifically directed at young people worldwide. Tech-savvy cyber jihadists have used the web to attract frustrated, marginalized, and vulnerable young people to its ranks and convince them of its world vision. Thus, to defeat the Islamic State, we need somehow to supply an alternative identity to Muslim youth online or undermine the identity the Islamic State offers via cyberspace. That is a prerequisite for successful warfare today.

Thus, the problem is not only that the Islamic State practices good operational security (as al-Qaeda did not) and uses tools and apps the West created to reach those searching for identity. It is not only that the Islamic State encrypts communications and takes numerous and advanced steps to avoid being detected by Western surveillance. It is not only that Islamic State media posts numerous detailed and comprehensive do-it-yourself terrorism manuals online—inspiring violence remotely and often untraceably until it is too late. It is that mentoring—the psychological guidance that anyone searching for identity seeks—is now conducted not individually by a person in a small study group in the basement of the local mosque, but using secure social media on the internet.

The terrorist world—more than any other—is flat. The Islamic State now reaches into every Western country thanks to social media. Individuals are killed every month by lone wolves worldwide. (Is it better to call them “cyber wolves?”) The internet allows tens of thousands to stay on message, hear the same sermons, and marvel at the same beheading videos. The Islamic State has discovered that extremism generates publicity—and that is (nearly) all that matters. Savagery is official policy since it generates massive worldwide media buzz.

A new phenomenon has emerged through these high-quality Islamic State snuff videos: brutality that engenders pride and a sense of psychological inclusion, rather than revulsion. Whereas al-Qaeda used the web to advance its message with online content (web 1.0), the Islamic State uses social media to distribute images of savagery to project a sense of righteousness, immediacy, and, somehow, invitation (web 2.0+).

Al Qaeda’s Number Two man at the time, Dr. Ayman al-Zawahiri, had to write an online letter to al-Qaeda followers in 2005 to apologize for al-Qaeda-in-Iraq leader Abu Musab al-Zarqawi’s brutality. (He had been beheading people and putting the videos online.) Savagery was giving al-Qaeda a bad name. Today, Zarqawi’s successors—the butchers of the Islamic State—showcase their beheadings, drownings, live-burnings, and stonings all in 1080p video and make sure anyone in the world who wants to watch can see it. They could not be more proud of it. Even the Nazis tried to cover up their acts of torture and mass execution. We have little appreciation for this phenomenon—let alone a psychological counter to it. And we have nothing to counter it online.

The Islamic State has an “iTerrorism” strategy: Wear down the United States with constant threats, terror, images, and military success so that the West will freeze politically and strategically. The Islamic State believes the West is incapable of sustaining battle for a long time and will implode politically, owing to its own moral collapse, social inequities, selfishness, and prioritization of worldly pleasures.

How to Fight During Peacetime

To protect the United States from further attacks and the erosion of sovereignty during this period of persistent confrontation, the next President ought to have the means and the legal framework to confront adversaries in cyberspace. A U.S. response to such cyber activity should include elements of deterrence, capabilities that can de-escalate an international crisis, and the legal recognition that much of what the Islamic State publishes on the web is illegal speech.

As a country, we must adapt to this era of constant conflict and competition in cyberspace. We need synchronized interagency measures to bring all the power and authority of the U.S. government to bear on malicious cyber actors and prevent—rather than simply react to—adversary activities. Undoubtedly, the U.S. military must play a key role, including taking actions to signal U.S. capability and resolve in instances short of conflict, just as the Department of Defense does in the other domains. We must forge a consensus on when we can and should respond to cyber attackers and exploiters that clarifies the role of the military in a whole-of-nation approach. We need to test and deploy offensive cyberspace capabilities, at scale, and in ways that make it clear we can back up words with action, while reinforcing the ability of the U.S. government to exercise power and defend the nation consistently with international law and norms.

At present, our approach to the current period of continuous confrontation has been almost exclusively defensive, including the hardening of defenses of U.S. government and DoD networks. Good cyber deterrence policy, however, is a combination of international norms promulgated on paper, in public, and in practice along with clear, well-signaled responses to certain unacceptable activities.

Commanders must recognize that conditions today do not align clearly with any phase of warfare, especially given that the “Phases” construct was written to track the two great world wars of the previous century—a discernible form of conflict likely never to repeat itself. Commanders ought to be expected today to transition or maneuver quickly to meet any challenge. Understanding warfare today is a prerequisite to defeat the new challenges to our sovereignty.

The era of persistent confrontation is not limited to the United States and its particular adversaries. This warfare is occurring worldwide—a form of low-level, continual, gray, but global conflict via cyberspace. Thus, the United States must find like-minded allies and friends to wage this conflict in a coordinated fashion and build the kind of the international customs and norms that the West built in the other four domains. Further, although U.S. national security policy and confrontation via cyberspace involve the whole of government, they involve the private sector just as much. The U.S. approach to shaping norms of cyberspace, therefore, will need to involve the private sector if it is to be successful.

At first, many analysts thought cyber warfare would occur often and separately from traditional warfare, and be enormously influential. That doesn’t seem to be happening. It could be that cyber warfare will indeed be important, perhaps even decisive, but more likely it will serve as a complement to a state’s military power, part of larger political and military confrontations among states and non-state actors. That is, cyberspace operations may prove important but will likely be integrated into a state’s national and military strategy (that is, “warfare via cyberspace,” also known as “cross-domain warfare”)—not fenced off on its own. But more importantly, cyberspace will favor authoritarian states that violate sovereignty, law, and proposed norms all in peacetime as long as the United States does not successfully impose costs for such warfare.

The Department of Defense is involved in cyber warfare in order to project power through this domain and because cyber attacks and cyber effects activate the United States’ inherent right of self-defense. Other Departments, such as Justice, Homeland Security, Commerce, Energy, and the intelligence community at large, all have equities involved—and most have roles to play in cyber defense. But because states fight in cyberspace, the U.S. right to wage war must be retained for instances when defense or law enforcement are insufficient or inappropriate.

World War II began for the United States on December 8, 1941, when the United States declared war on Japan, and on December 11, 1941, when it declared war on Germany. Today, the United State may already be involved in warfare against certain adversaries without such declarations of war, and those conflicts might or might not escalate into larger kinetic violence. Adversaries conducted information operations in the past to complement their kinetic warfare and seizure of territory. Today, information operations in cyberspace are the means to manipulate new geo-political realities without having to occupy territory physically.

Cyberspace favors less-legalistic actors and those who like to conduct information operations, for cyberspace gives those actors a direct window to the individuals they wish to influence. The United States need not become expert at propaganda, Russian-style trolling, or Chinese industrial theft, but it does need to recognize how its adversaries have shifted warfare “left” and to figure out how to “win” in the new era of persistent confrontation.

All forms of confrontation and warfare today involve the fifth domain of war—cyberspace—whether we like it or not. And the future of warfare may involve even more peacetime maneuvering and information manipulation and less violence than we see today. The sooner we recognize how our adversaries “fight” in peacetime, and what is required of us to compete and win in this new Phase 0, the more successful we will be in defending our sovereignty and preventing conflicts from escalating to actual violence.