Loading module…
Loading module…
Module 1 of 6
There is a persistent and dangerous misconception that cyberwarfare is simply hacking done by governments — the same techniques a criminal might use, applied at larger scale by state actors. This misconception fails to grasp what cyberwarfare actually is, and the failure has consequences, because a society that understands cyberwarfare as merely large-scale crime defends against it as it would defend against crime, and is defeated by the strategic dimension that the crime framing misses. Cyberwarfare is the projection of state power through the digital layer — the use of cyber capabilities to achieve the strategic objectives that states pursue through all their instruments of power, applied through the digital systems that now underpin every function of a modern society. It is warfare, conducted in and through the digital domain, and understanding it as warfare — with the strategic logic, the state actors, the geopolitical stakes, and the systemic effects that warfare involves — is the foundation of defending against it, which is the purpose of this course.
This course examines cyberwarfare from the perspective of understanding it in order to defend against it, attribute it, and build the national and organizational defenses that resist it. It is not a course in conducting cyber operations; it is a course in understanding cyberwarfare as a phenomenon — its strategic logic, its actors, its targets, its patterns, its legal frameworks, and its defenses — so that those responsible for defending against it, attributing it, and responding to it can do so from a genuine understanding of what they face. The defensive and analytical orientation is fundamental: everything in this course serves the purpose of understanding cyberwarfare well enough to defend against it and to build the resilient systems and effective defenses that resist it, because the defense of a society's digital systems against the projection of hostile state power is one of the central security challenges of the age, and it requires the understanding this course develops.
This first module establishes the systems framework for understanding cyberwarfare — the frame within which the specific topics of the following modules fit. Cyberwarfare is understood, like everything in the Academy, through systems thinking: the digital layer is a system, embedded in the larger systems of the society it serves, and cyberwarfare is the attack on and defense of this system, with effects that propagate through the systems the digital layer underpins. The systems framework reveals what cyberwarfare actually is — not isolated attacks on isolated targets but the contest over the digital layer of a society's systems, with strategic objectives and systemic effects — and it is the frame that makes the following modules' topics coherent: the state actors and attribution (Module 2), the critical infrastructure targets (Module 3), the campaign patterns (Module 4), the legal frameworks (Module 5), and the national defense architecture (Module 6) are all aspects of the cyberwarfare system that this module frames.
Begin with what distinguishes cyberwarfare from cybercrime, because the distinction is the foundation of understanding cyberwarfare as warfare rather than crime, and it turns on the actor, the objective, and the strategic logic. Cyberwarfare is the projection of state power, and understanding this is understanding why it is warfare and why it must be understood and defended against as warfare.
Cyberwarfare is conducted by states (or actors serving state objectives), which distinguishes it from cybercrime conducted by criminals for criminal gain. The actor matters because it determines the objective, the resources, the persistence, and the strategic logic of the activity. A criminal hacks for criminal gain — money, data to sell, resources to exploit — with the resources and persistence of a criminal enterprise and the logic of criminal profit. A state conducts cyber operations for strategic objectives — the objectives states pursue through all their instruments of power — with the resources of a state and the persistence of a strategic actor pursuing national objectives. The state actor is a fundamentally different adversary from the criminal: better resourced, more persistent, strategically motivated, and pursuing objectives that serve the state's power rather than criminal profit. Understanding cyberwarfare begins with understanding that the adversary is a state, projecting its power through the digital layer, which makes it warfare rather than crime and makes the adversary far more formidable than the criminal the crime framing imagines.
Cyberwarfare serves strategic objectives — the objectives of state power — which distinguishes it from the profit objectives of cybercrime and connects it to the strategic logic of warfare. States use cyber capabilities to achieve strategic objectives: espionage (gaining the intelligence that serves the state's strategic understanding and advantage), sabotage (degrading an adversary's capabilities, infrastructure, or functions), coercion (pressuring an adversary through the threat or demonstration of cyber effects), preparation (positioning for future conflict by penetrating adversary systems in advance), and influence (shaping perceptions and decisions through the Intelligence layer, which the following module on the information dimension develops). These are strategic objectives, serving the state's power and its pursuit of its interests in competition and conflict with other states, and they connect cyberwarfare to the strategic logic of warfare and statecraft — the pursuit of national objectives through the instruments of power, of which cyber is now one. Understanding cyberwarfare's objectives as strategic is understanding it as an instrument of statecraft and warfare, pursued for the reasons states pursue their strategic objectives, which is the strategic logic the crime framing entirely misses.
Cyberwarfare operates in the context of the strategic competition and conflict among states, which is the context that gives it its logic and its stakes. States compete and sometimes conflict, pursuing their interests against each other through all their instruments of power — diplomatic, informational, military, economic — and cyber is now an instrument in this competition and conflict, used by states against each other in the ongoing contest of statecraft. Cyberwarfare is thus embedded in the geopolitical competition and conflict among states, an instrument of the strategic contest, and understanding it requires understanding this context — the strategic competition and conflict that cyberwarfare serves, the geopolitical stakes that drive it, the state adversaries that conduct it in pursuit of their strategic interests. This connects cyberwarfare to the geopolitical and nation-state analysis of the broader Academy: cyberwarfare is an instrument of the statecraft those disciplines analyze, and understanding it requires understanding the strategic competition and conflict it serves, which is the geopolitical context of the cyber contest.
The distinctive characteristics of cyber as an instrument of state power shape how cyberwarfare is conducted and why it is attractive to states, and understanding them is understanding cyberwarfare's particular logic. Cyber capabilities have distinctive characteristics: they can be used covertly, with the possibility of denying involvement (the attribution problem the following module develops); they can achieve effects at a distance, without the physical presence military force requires; they can be relatively cheap compared to conventional capabilities, accessible even to less powerful states; they operate below the threshold of conventional armed conflict, allowing states to pursue objectives through cyber without triggering the responses that conventional attack would; and they exploit the digital layer that now underpins everything, giving them potential effects across a society's functions. These characteristics make cyber attractive to states — covert, deniable, cheap, distant, below the threshold, and pervasive in effect — and they shape how cyberwarfare is conducted, favoring the covert, deniable, persistent, below-threshold operations that characterize much of it. Understanding these characteristics is understanding why states use cyber and how they use it, which shapes the cyberwarfare that defenders must understand and resist.
Key Insight: Cyberwarfare is not hacking scaled up but the projection of state power through the digital layer, distinguished from cybercrime by the actor (a state, far better resourced, more persistent, and strategically motivated than a criminal), the objective (strategic objectives of state power — espionage, sabotage, coercion, preparation, influence — rather than criminal profit), and the context (the geopolitical competition and conflict among states, of which cyber is now an instrument). Cyber's distinctive characteristics — covert, deniable, cheap, achievable at a distance, below the threshold of armed conflict, and pervasive because the digital layer underpins everything — make it attractive to states and shape how cyberwarfare is conducted. Understanding it as warfare rather than crime is the foundation of defending against it, because the crime framing misses the strategic dimension that makes the state adversary so formidable.
Cyberwarfare is the contest over the digital layer, and understanding it requires understanding the digital layer as a system — the system that cyberwarfare attacks and defends, embedded in the larger systems of the society it serves. This section develops the digital layer as a system, applying the Academy's systems thinking to the domain of cyberwarfare, because understanding the system is understanding what cyberwarfare contests and how its effects propagate.
The digital layer is the system of digital systems that underpins the functions of a modern society, and understanding it as a system is the foundation of understanding cyberwarfare. Modern societies run on digital systems: the systems that run the infrastructure (power, water, transportation, communications), the systems that run the economy (finance, commerce, logistics), the systems that run the government (administration, defense, services), the systems that run daily life (the networks, devices, and services people depend on). These digital systems constitute the digital layer — the layer of digital systems that underpins the society's functions — and this layer is a system: the digital systems interconnect, depend on each other, and together form the digital substrate of the society. Cyberwarfare is the contest over this digital layer — the attack on and defense of the digital systems that underpin the society — and understanding it requires understanding the digital layer as the system it contests.
The digital layer is embedded in the larger systems of the society, and its systemic importance comes from this embedding, because the digital layer underpins the society's functions and its compromise propagates into those functions. The digital layer is not a separate domain but the digital substrate of the society's systems — the power grid runs on digital control systems, the financial system runs on digital infrastructure, the government runs on digital systems, and so on — so the digital layer is embedded in and underpins the society's physical, economic, and social systems. This embedding is what gives cyberwarfare its systemic importance: an attack on the digital layer propagates into the systems the digital layer underpins, so a cyber attack on the digital control systems of the power grid can cause a physical power outage, an attack on the financial system's digital infrastructure can disrupt the economy, an attack on the government's digital systems can degrade its functions. The digital layer's embedding in the society's systems means that cyberwarfare's effects are not confined to the digital domain but propagate into the physical, economic, and social functions the digital layer underpins, which is what makes cyberwarfare a strategic threat to the society, not just to its computers.
The interconnection and interdependence of the digital layer create the systemic vulnerabilities that cyberwarfare exploits, and understanding them is understanding where the digital layer is vulnerable. The digital systems interconnect and depend on each other — systems connect to systems, depend on shared infrastructure, rely on common components — and this interconnection and interdependence create systemic vulnerabilities: a compromise of one system can propagate to connected systems, a vulnerability in a shared component can affect all the systems that use it, a disruption of a system others depend on can cascade to those others. These systemic vulnerabilities are what cyberwarfare exploits and what defense must address: the interconnection that allows a compromise to spread, the interdependence that allows a disruption to cascade, the shared components that create common vulnerabilities. Understanding the digital layer's interconnection and interdependence is understanding its systemic vulnerabilities — the ways a compromise or disruption propagates through the interconnected, interdependent system — which is where cyberwarfare's systemic effects originate and what defense must protect against. This connects to the cascade and systemic-risk analysis of the cybersecurity-systems course: the digital layer is a system with cascade vulnerabilities, and cyberwarfare exploits them, so defending against cyberwarfare requires understanding and protecting the systemic vulnerabilities of the digital layer.
The digital layer's systemic character means that cyberwarfare must be understood and defended at the systems level, not just the level of individual systems, which is the framework's central implication for defense. Because the digital layer is a system, with systemic effects and systemic vulnerabilities, cyberwarfare's threat is a systems threat — the threat to the digital layer as a whole and to the society's systems it underpins — and defending against it requires defending at the systems level: protecting the systemic vulnerabilities, preventing the cascades, ensuring the resilience of the interconnected system, not just securing individual systems in isolation. A defense that secures individual systems without addressing the systemic vulnerabilities — the interconnection, the interdependence, the cascade paths — leaves the systemic vulnerabilities that cyberwarfare exploits, and is defeated by the systemic attack that propagates through the vulnerabilities the individual-system defense did not address. The systems framework's central implication is that cyberwarfare defense must be systemic — protecting the digital layer as a system, addressing its systemic vulnerabilities, ensuring its systemic resilience — which is the national cyber defense architecture that Module 6 develops. The digital layer is a system, cyberwarfare contests it at the systems level, and defending against it requires the systems-level defense that the framework establishes.
Key Insight: Cyberwarfare is the contest over the digital layer — the system of digital systems that underpins a modern society's functions — and understanding it requires understanding that layer as a system. The digital layer is embedded in the larger systems of the society (the power grid, the financial system, the government all run on it), which is what gives cyberwarfare its systemic importance: an attack on the digital layer propagates into the physical, economic, and social functions it underpins, making cyberwarfare a strategic threat to the society, not just its computers. The interconnection and interdependence of the digital layer create the systemic vulnerabilities cyberwarfare exploits — compromises that spread, disruptions that cascade, shared components with common vulnerabilities. The central implication is that cyberwarfare must be defended at the systems level, protecting the digital layer as a whole, not just securing individual systems.
Cyberwarfare is not a single kind of activity but a spectrum of operations, from espionage through disruption to destruction, and understanding the spectrum is understanding the range of what cyberwarfare involves and what defense must address. This section develops the spectrum of cyber operations, because the different kinds of operations have different objectives, effects, and defensive implications, and understanding the spectrum is understanding the range of the cyberwarfare threat.
Cyber espionage is one end of the spectrum — the use of cyber capabilities to gain intelligence, penetrating adversary systems to collect the information that serves the state's strategic understanding and advantage. Cyber espionage is the most common and most persistent cyber operation, conducted continuously by states against each other to collect intelligence — the secrets, the plans, the capabilities, the communications that intelligence collection seeks — through the digital penetration of adversary systems. It is espionage conducted through cyber means, serving the intelligence objectives states have always pursued, now pursued through the digital layer that holds so much of the information states seek. Cyber espionage's effect is the compromise of information — the adversary gaining the intelligence the penetrated systems hold — which is a serious harm (the loss of secrets, the compromise of plans, the exposure of capabilities) though not a destructive one. Understanding cyber espionage is understanding the most pervasive cyber operation and the persistent intelligence threat that defense must address — the continuous effort of states to penetrate systems and collect the intelligence they hold, which requires the continuous defense of the systems and the information they hold.
Cyber disruption is the middle of the spectrum — the use of cyber capabilities to disrupt an adversary's functions, degrading or interrupting the systems and services the adversary depends on. Cyber disruption goes beyond espionage's information compromise to actual disruption of functions: interrupting services, degrading systems, disrupting operations, denying the adversary the use of the systems and functions the disruption targets. Its effect is the disruption of function — the adversary losing the use of the disrupted systems and services — which is a more active harm than espionage, actually degrading the adversary's functions rather than just compromising their information. Cyber disruption ranges from the temporary and reversible (a service interrupted, then restored) to the more serious and persistent, and it is used by states to degrade adversary functions for strategic effect — pressuring the adversary, degrading their capabilities, demonstrating the state's cyber power. Understanding cyber disruption is understanding the active degradation of functions that cyberwarfare can achieve, which defense must protect against by ensuring the resilience and recoverability of the functions cyber disruption targets.
Cyber destruction is the far end of the spectrum — the use of cyber capabilities to cause destructive effects, damaging or destroying the systems and, through them, the physical things the systems control. Cyber destruction goes beyond disruption to actual destruction: causing physical damage through the digital control of physical systems (the destruction of equipment through the manipulation of its control systems), destroying data or systems irrecoverably, causing effects that destroy rather than merely disrupt. Its effect is destruction — the irrecoverable damage to systems, data, or the physical things digital systems control — which is the most serious cyber effect, crossing into the destruction that conventional warfare causes, achieved through the digital layer's control of physical systems. Cyber destruction is rarer than espionage and disruption, because it is more difficult, more escalatory, and more clearly an act of war, but it is the most serious end of the spectrum, and its possibility — the potential for cyber attack to cause physical destruction through the digital control of physical systems — is one of the gravest concerns of cyberwarfare. Understanding cyber destruction is understanding the destructive potential of cyberwarfare, which defense must protect against by securing the systems whose compromise could cause destruction, especially the systems that control physical infrastructure.
The spectrum has a crucial strategic dimension in the thresholds it crosses, because the different points on the spectrum cross different thresholds of severity and escalation, with different strategic implications. Cyber espionage, though harmful, is generally treated as below the threshold of armed conflict — states spy on each other, including through cyber, without it being considered an act of war. Cyber disruption occupies an ambiguous middle — more serious than espionage, potentially approaching the threshold of armed conflict depending on its severity and effects. Cyber destruction, especially if it causes physical destruction and casualties, can cross the threshold of armed conflict, potentially constituting an act of war that justifies a military response. This threshold dimension is strategically crucial, because it determines the escalation implications of cyber operations and the responses they justify, and it is central to the legal frameworks (Module 5) and the strategic logic of cyberwarfare. Understanding the spectrum includes understanding the thresholds it crosses — where cyber operations move from the below-threshold espionage that states tolerate to the potentially-act-of-war destruction that justifies military response — because the thresholds determine the escalation dynamics and the strategic stakes of cyber operations, which are central to understanding cyberwarfare as the strategic contest it is. Much of cyberwarfare is deliberately conducted below the thresholds — in the space of espionage and ambiguous disruption that does not clearly justify a strong response — precisely because this below-threshold space allows states to pursue objectives through cyber without triggering the escalation that crossing the thresholds would cause, and understanding this below-threshold logic is understanding much of how cyberwarfare is actually conducted.
Key Insight: Cyberwarfare is a spectrum of operations with different objectives, effects, and thresholds. Cyber espionage (penetrating systems to collect intelligence) is the most pervasive, harming through information compromise but generally treated as below the threshold of armed conflict. Cyber disruption (degrading an adversary's functions) is more active, harming through the disruption of function, and occupies an ambiguous middle that may approach the armed-conflict threshold. Cyber destruction (causing destructive effects, including physical destruction through the digital control of physical systems) is the gravest, crossing into the destruction of conventional warfare and potentially the threshold of an act of war. The threshold dimension is strategically crucial, determining escalation implications and justified responses — and much of cyberwarfare is deliberately conducted below the thresholds, in the space that lets states pursue objectives without triggering escalation.
A defining feature of cyberwarfare, distinguishing it from conventional warfare and shaping its entire strategic logic, is the attribution problem — the difficulty of determining who conducted a cyber operation — and this section introduces it as a foundational feature of the cyberwarfare system, because it shapes everything about how cyberwarfare is conducted and defended against. (Module 2 develops attribution in depth; this section establishes its foundational strategic significance.)
The attribution problem is that cyber operations can be conducted in ways that make it difficult to determine, with confidence, who conducted them. Unlike a conventional attack, where the attacker's identity is usually apparent (the missile came from a known location, the forces wore identifiable uniforms), a cyber operation can be conducted covertly, through intermediary systems, with techniques that obscure the origin, so that the victim may not be able to determine with confidence who conducted it. The attacker can route the operation through compromised systems in other countries, use techniques that do not reveal their identity, and deny involvement, leaving the victim uncertain of the attacker's identity. This attribution difficulty is a defining feature of cyberwarfare, arising from the nature of the digital layer, where actions can be conducted at a distance, through intermediaries, with obscured origins, in ways that conventional attack cannot.
The attribution problem shapes the strategic logic of cyberwarfare, because the difficulty of attribution enables the deniable, below-threshold operations that characterize much of cyberwarfare. Because attribution is difficult, states can conduct cyber operations with a degree of deniability — pursuing their objectives through cyber while denying involvement, exploiting the attribution difficulty to avoid the responses that clear attribution would justify. This deniability is central to cyberwarfare's strategic logic: it allows states to pursue objectives through cyber that they could not pursue openly, to operate below the threshold of response by exploiting the uncertainty of attribution, to conduct operations they can deny. The attribution problem thus enables much of cyberwarfare, allowing the deniable operations that the attribution difficulty makes possible, and shaping the strategic logic toward the covert, deniable, below-threshold operations that exploit the attribution uncertainty. Understanding cyberwarfare's strategic logic requires understanding the attribution problem that enables its deniability, which is central to why and how cyberwarfare is conducted as it is.
The attribution problem shapes cyber defense and response, because the difficulty of attribution complicates the response to cyber operations, which depends on knowing who conducted them. The response to a cyber operation — whether retaliation, sanction, or other response — depends on attributing the operation to its perpetrator, because a response requires a target, and the target is the perpetrator, whose identity the attribution problem obscures. When attribution is uncertain, the response is complicated: the victim may not know whom to respond against, may be unable to justify a response without confident attribution, may be deterred from responding by the uncertainty. The attribution problem thus weakens the deterrence and response that would otherwise constrain cyberwarfare, because the deterrence and response depend on attribution, and the attribution difficulty undermines them. This is a central challenge of cyber defense: the attribution problem weakens the deterrence and response that constrain other forms of attack, and defending against cyberwarfare requires addressing the attribution problem — developing the attribution capability that enables the response and deterrence the attribution difficulty otherwise undermines. Module 2 develops this attribution capability, which is central to cyber defense because it is the foundation of the deterrence and response that the attribution problem otherwise weakens.
The attribution problem has a crucial nuance that shapes its strategic effect: attribution is difficult but not impossible, and the degree of attribution achievable shapes the strategic dynamics. Attribution is not simply impossible — it is difficult, achievable to varying degrees of confidence through the attribution techniques Module 2 develops, and the degree of attribution achievable shapes the strategic dynamics. Where attribution can be achieved with confidence, the deniability erodes and the response becomes possible; where attribution remains uncertain, the deniability holds and the response is complicated. The strategic dynamics of cyberwarfare thus depend on the evolving attribution capability — as attribution improves, the deniability that enables deniable operations erodes, changing the strategic logic; as attackers develop new ways to obscure attribution, the deniability is restored. The attribution problem is thus not a fixed feature but an evolving contest between the obscuring of attribution and the achieving of it, and the strategic dynamics of cyberwarfare depend on where this contest stands. Understanding the attribution problem includes understanding this contest and its strategic significance — that attribution is difficult but achievable, that the degree of attribution shapes the strategic dynamics, and that the evolving attribution contest is central to the evolving strategic logic of cyberwarfare. Developing the attribution capability, which improves the achievable attribution and thus strengthens the deterrence and response, is one of the most important things cyber defense can do to constrain cyberwarfare, because it erodes the deniability that enables it.
Key Insight: The attribution problem — the difficulty of determining who conducted a cyber operation, which can be routed through intermediary systems with obscured origins — is a defining feature of cyberwarfare that shapes its entire strategic logic. It enables the deniable, below-threshold operations that characterize much of cyberwarfare, letting states pursue objectives they could deny and exploit the attribution uncertainty to operate below the threshold of response. It weakens deterrence and response, which depend on knowing whom to respond against, so the attribution difficulty undermines the constraints that limit other forms of attack. But attribution is difficult, not impossible — achievable to varying confidence — and the evolving contest between obscuring and achieving attribution shapes the strategic dynamics, which is why developing attribution capability is among the most important things cyber defense can do, eroding the deniability that enables cyberwarfare.
The course's title names the Intelligence layer, and this section develops the information dimension of cyberwarfare — the use of the digital layer not just to compromise systems but to shape perceptions, beliefs, and decisions through information, which is a distinct and crucial dimension of the cyber contest. This information dimension connects cyberwarfare to the influence-operations and information-warfare topics of the broader Academy, framed here, as throughout, for understanding and defense.
The information dimension of cyberwarfare is the use of the digital layer to shape the information environment — the perceptions, beliefs, and decisions of populations and decision-makers — as an instrument of state power. Beyond the compromise and disruption of systems, cyber capabilities can be used to shape the information that flows through the digital layer: spreading narratives, manipulating perceptions, influencing beliefs, shaping the decisions that populations and leaders make based on the information they receive. This information dimension exploits the digital layer's role as the medium through which information flows in modern societies — the networks, platforms, and channels through which people receive information and form their perceptions — using this medium to shape the information environment for strategic effect. The information dimension is a distinct kind of cyber operation, targeting not the systems themselves but the perceptions and decisions of the humans who use them, through the manipulation of the information that flows through the digital layer.
The information dimension serves strategic objectives distinct from the system-compromise objectives, and understanding them is understanding what information operations seek. Information operations seek to shape the information environment for strategic effect: influencing the perceptions and beliefs of an adversary's population (to divide, demoralize, or manipulate them), influencing the decisions of an adversary's leaders (through the information they receive), shaping the narratives that affect the strategic contest (the interpretations of events, the perceptions of the actors), and generally using the information environment as a domain of strategic competition. These objectives are distinct from the system-compromise objectives of espionage, disruption, and destruction — they target the information environment and the human perceptions and decisions it shapes, not the systems themselves — and they connect cyberwarfare to the broader contest over information and perception that states conduct. Understanding the information dimension's objectives is understanding the distinct strategic purpose of information operations — the shaping of perceptions, beliefs, and decisions through the information environment — which is a major dimension of the cyber contest and one of growing importance.
Defending against the information dimension requires a distinct kind of defense, because the information dimension attacks perceptions rather than systems, and the defense must protect the information environment and the perceptions it shapes. Defending systems against compromise is one thing; defending the information environment against manipulation is another, requiring different defenses: the resilience of the population's perceptions against manipulation (the media literacy and critical thinking that resist manipulation), the integrity of the information environment (the trustworthy information sources and the detection of manipulation), the detection and attribution of information operations (recognizing when the information environment is being manipulated and by whom), and the counter-narratives and resilience that resist the manipulation. This defense of the information environment is a distinct challenge from the defense of systems, and it is developed in the disinformation-detection and counter-narrative topics of the broader Academy, framed for the recognition of and resistance to information manipulation. Understanding the information dimension of cyberwarfare includes understanding this defensive challenge — the protection of the information environment and the perceptions it shapes against manipulation — which is a major and growing dimension of cyber defense, distinct from the defense of systems and requiring its own approaches.
The information dimension's defense is fundamentally about resilience and recognition, not censorship, and this framing is essential to the defensive orientation. The defense of the information environment against manipulation is not about controlling or censoring information — which would itself be a harm to the open information environment a free society depends on — but about building the resilience and recognition that resist manipulation: the population's ability to recognize and resist manipulation (through media literacy and critical thinking), the detection and attribution of manipulation (so that it can be recognized and countered), the integrity and trustworthiness of information sources (so that reliable information is available), and the counter-narratives that correct manipulation with truth. This resilience-and-recognition approach defends the information environment while preserving its openness, resisting manipulation through the population's own capacity to recognize and reject it rather than through control that would itself harm the open information environment. This framing is essential to the defensive orientation of the course: the defense against the information dimension of cyberwarfare protects the open information environment against manipulation by building resilience and recognition, not by imposing control, because the goal is to protect the free society's information environment against hostile manipulation, which is served by resilience and recognition and harmed by the control that would itself degrade the openness the defense protects. Understanding the information dimension's defense as resilience and recognition, not control, is understanding how a free society defends its information environment against manipulation while preserving the openness that is itself a value worth defending.
Key Insight: The information dimension of cyberwarfare uses the digital layer not to compromise systems but to shape the information environment — the perceptions, beliefs, and decisions of populations and leaders — as an instrument of state power, exploiting the digital layer's role as the medium through which information flows. Its objectives (influencing an adversary's population and leaders, shaping strategic narratives) are distinct from the system-compromise objectives, targeting human perceptions rather than systems. Defending against it requires a distinct defense of the information environment — but fundamentally through resilience and recognition (media literacy, critical thinking, detection and attribution of manipulation, trustworthy sources, counter-narratives), not through censorship or control, which would itself harm the open information environment a free society depends on. The goal is to protect the free society's information environment against manipulation while preserving the openness that is itself worth defending.
This final section draws the systems framework together as the foundation for the defensive understanding the course develops, showing how the framework establishes what cyberwarfare is and organizes the following modules' development of the understanding needed to defend against it. The framework is the foundation, and understanding how it grounds the defensive purpose is understanding the course's structure and aim.
The systems framework establishes what cyberwarfare is — the projection of state power through the digital layer, contesting the digital system that underpins the society, across a spectrum of operations, shaped by the attribution problem and the information dimension — and this understanding is the foundation of defending against it. Defense requires understanding the threat, and the framework provides the understanding: cyberwarfare as state power projection (not crime), as a systems contest (not isolated attacks), across a spectrum (from espionage to destruction), shaped by attribution (the deniability problem) and the information dimension (the perception contest). This understanding is what defense is built on, because defending against cyberwarfare requires understanding what it is — the strategic state adversary, the systemic contest, the spectrum of operations, the attribution challenge, the information dimension — and the framework provides this foundational understanding that the defense the following modules develop is built on.
The framework organizes the following modules as the development of the defensive understanding. Module 2 develops the state actors and the attribution capability — understanding the adversaries and developing the attribution that is central to deterrence and response. Module 3 develops the critical infrastructure targets — understanding what cyberwarfare targets and how to defend it. Module 4 dissects notable campaigns — learning from the actual cyberwarfare that has occurred, understanding the patterns to defend against them. Module 5 develops the legal frameworks and rules of engagement — understanding the law and norms that constrain cyberwarfare and govern the response to it. Module 6 develops the national cyber defense architecture — the systemic defense that protects the digital layer against cyberwarfare. Each module develops an aspect of the defensive understanding the framework establishes, and together they constitute the understanding needed to defend against cyberwarfare, which is the course's purpose. The framework is the foundation; the following modules build the defensive understanding on it.
The defensive orientation is the course's fundamental commitment, and the framework serves it throughout. Everything in the framework — the understanding of cyberwarfare as state power projection, the systems understanding of the digital layer, the spectrum of operations, the attribution problem, the information dimension — serves the purpose of understanding cyberwarfare in order to defend against it, attribute it, and respond to it lawfully and effectively. The course does not teach the conduct of cyber operations; it teaches the understanding of cyberwarfare that defense requires — the understanding of the threat, the adversaries, the targets, the patterns, the law, and the defenses — so that those responsible for defending societies and organizations against cyberwarfare can do so from genuine understanding. This defensive orientation is the course's fundamental commitment, and the framework, like everything in the course, serves it: understanding cyberwarfare well enough to defend against it, which is one of the central security challenges of the digital age and the purpose the whole course serves.
The framework, finally, connects cyberwarfare defense to the systems thinking and the intelligence disciplines of the broader Academy, locating it within the larger discipline. Cyberwarfare is understood through systems thinking (the digital layer as a system), analyzed through the intelligence disciplines (the attribution as an intelligence problem, the adversaries as entities to be understood), and defended through the systems-level defense that the Academy's systems thinking implies. Cyberwarfare defense is thus an application of the Academy's general disciplines to the specific domain of the cyber contest, and the framework connects it to those disciplines — the systems thinking that understands the digital layer, the intelligence disciplines that attribute and understand the adversaries, the strategic understanding that grasps the state competition cyberwarfare serves. This connection locates cyberwarfare defense within the larger discipline the Academy teaches, and it means that the understanding developed in the other courses — the systems thinking, the intelligence analysis, the strategic understanding, the influence-operations recognition — all contribute to the understanding of cyberwarfare and its defense that this course develops. The framework is the foundation of the defensive understanding, organizing the following modules and connecting the cyberwarfare defense to the broader discipline, all in service of the defensive purpose that is the course's fundamental commitment: understanding cyberwarfare well enough to defend the digital layer and the society it underpins against the projection of hostile state power.
Key Insight: The systems framework establishes what cyberwarfare is — the projection of state power through the digital layer, a systems contest across a spectrum of operations, shaped by the attribution problem and the information dimension — and this understanding is the foundation of defending against it, because defense requires understanding the threat. The framework organizes the following modules as the development of the defensive understanding: the state actors and attribution (Module 2), the critical infrastructure targets (Module 3), the campaign patterns (Module 4), the legal frameworks (Module 5), and the national defense architecture (Module 6). The defensive orientation is the course's fundamental commitment — understanding cyberwarfare to defend against it, attribute it, and respond lawfully, not to conduct it. And the framework connects cyberwarfare defense to the Academy's systems thinking and intelligence disciplines, locating it within the larger discipline in service of defending the digital layer and the society it underpins.
This module established the systems framework for understanding cyberwarfare — the projection of state power through the digital layer, distinguished from cybercrime by its state actors, strategic objectives, and geopolitical context; the digital layer understood as a system embedded in the society's systems, with the systemic vulnerabilities cyberwarfare exploits; the spectrum of operations from espionage through disruption to destruction, with the thresholds that shape its strategic logic; the attribution problem that enables deniability and complicates response; and the information dimension that contests perceptions as well as systems. The through-line is that cyberwarfare must be understood as warfare — with the strategic logic, the state adversaries, and the systemic effects that warfare involves — in order to defend against it, and that the defense must be systemic, protecting the digital layer as a whole against the projection of hostile state power.
The framework is the foundation for the defensive understanding the following modules develop. State Actor Tactics & Attribution comes next, developing the understanding of the state adversaries and the attribution capability that is central to the deterrence and response the attribution problem otherwise undermines. Critical Infrastructure as a Target develops the understanding of what cyberwarfare targets and how to defend the critical infrastructure the digital layer underpins. Notable Cyber Campaigns Dissected learns from the actual cyberwarfare that has occurred, understanding the patterns to defend against them. Cyber Law & Rules of Engagement develops the legal frameworks and norms that constrain cyberwarfare and govern the response. And National Cyber Defense Architecture develops the systemic defense that protects the digital layer against cyberwarfare.
Throughout, the defensive orientation established here is the course's fundamental commitment: the understanding of cyberwarfare serves the purpose of defending against it, attributing it, and responding to it lawfully and effectively, not the purpose of conducting it. The framework connects the cyberwarfare defense to the systems thinking and intelligence disciplines of the broader Academy, and the following modules build on it the understanding needed to defend the digital layer and the society it underpins against the projection of hostile state power — one of the central security challenges of the digital age, and the challenge this course exists to help meet through the understanding that effective defense requires.