In the late 19th century, naval strategist Captain Alfred Mahan developed a new theory of naval power. This theory combined six factual, quantitative, and qualitative factors: a country’s geographic position, its physical conformation, extent of its territory, number of population, its national character, and the character of its government. Core to his theory were two fundamental strategic shifts. First, technological improvements – such as steel hulls and steam power – afforded navies greater range, speed, and potency. Second, as technological advancements moved the shipment of goods and services from land to sea, protecting and controlling the sea lanes was essential for those nations seeking military, political, and economic power. His works influenced naval strategy and doctrine for the next 100 years.
The cyber revolution is the latest in a series of waves of ‘creative destruction’ that arise when disruptive technologies, new organizational models, and innovative processes converge to spawn new sources of national power. As in Mahan’s age, the nations that successfully harness revolutionary technologies and master new industries will emerge the global powers of the 21st century – strengthening their military might, transforming their economies, and enriching their societies. But what will be the primary sources of their comparative power, e.g., military, economic, or cultural factors? And how does one measure them?
Why Measure Cyber Power?
Today, human beings are creating more content with fewer barriers and in a more dispersed fashion than ever before. We are harnessing that content to produce knowledge, wealth, and power in new ways independent of, in many cases, traditional geographic and national boundaries. This liberation of individuals and small groups from many (but not all) prevailing power structures enable them to compete with governments, multinational corporations, think tanks, and media in a flatter, more open marketplace of ideas. Consider the Green Revolution, the Arab Spring, and even the Tea Party and Occupy Wall Street movements in the United States – they were flat, open, connected, and exerted power in ways that defied conventional wisdoms and institutional structures. These movements – and many other examples – point to a secret sauce that spurs the Internet’s global expansion and adoption: openness.
The enabling power of cyberspace has certainly not been lost on countries. Most nations have, or are developing cyber capabilities (both offensive and defensive). Cyber incidents in Estonia in 2007, Georgia in 2008, and Iran in 2010 (e.g., the Stuxnet worm) demonstrate that nations are increasingly targets in cyberspace. Moreover, military and competitive concerns about the exfiltration of sensitive military or trade secrets abound. For good or ill, discussions of cyberspace are dominated by the fears of large-scale, debilitating attacks against critical infrastructure; the theft of intellectual property to gain comparative advantage; or the manifestation of a new cold war, this time in cyberspace, this time between the US and China. Complicating matters, the lightning pace of evolution in cyberspace challenges the ability of governments – legally, institutionally, and culturally – to grasp, anticipate, and adapt to the enduring implications. But one thing is clear: nations are moving to secure their “portion” of cyberspace against threats, real or perceived.
The result is a conundrum – openness versus security. Those favoring openness worry that security regimes will slow the Internet, reduce connections, shut down the free flow of information. Those favoring security worry that openness creates an endless number of seams that adversaries and criminals will exploit, often shielded with a veil of anonymity. What this zero-sum view fails to grasp is this is a false choice. Security and openness are both necessary to establishing a country as a future cyber power, as are several other factors.
What to Measure?
Eighteen months ago, largely inspired by the writings of Mahan, several of my colleagues and I embarked on a journey to explore the future sources cyber power. Taking a page from the Captain’s book, we did not choose to focus on measuring military power (i.e., we did not want to create a 2011 ‘tank-for-tank’ or ‘plane-for-plane’ equivalency for cyberspace). Instead, we wanted to understand those factors that would provide the foundation for cyber power – military, economic, competitive, technological, and cultural. Partnering with the Economist Intelligence Unit, we have developed a dynamic quantitative and qualitative model composed of 39 indicators that measure specific attributes distributed across four categories that we believe form the foundation of cyber power:
Nature of Legal and Regulatory Frameworks
A first premise was those countries most able to, through a legal and regulatory framework, maximize the value of the Internet and cyberspace will emerge as cyber powers. We favored additive versus restrictive measures in cyberspace and elements such as openness (e.g., do their legal frameworks embrace the free flow of ideas), security (e.g., do they participate in cybercrime conventions and agreements), and collaboration (e.g., do they create platforms for public and private sectors to work together). As noted above, some see security and openness as a zero-sum trade; however, our assertion is that much like efforts to create an open, free economy in the West during the Cold War as part of a larger security strategy to contain Soviet power, those nations that carefully balance these two factors are more likely to emerge as global cyber powers.
Economic and Social Context
A second premise was that countries that demonstrate a history of and capacity to adopt cyber technologies will gain a measurable comparative advantage. As populations increasingly integrate new technologies into their daily lives, they will drive the creation of new models and industries to propel economic development. They will be prepared to adapt to changes in the underlying technologies, being first to market with new ideas, services, and products. They will integrate these technologies into their socio-cultural fabrics, transforming their social norms and behaviors to meet both the opportunities and challenges of the 21st century.
Technology Infrastructure
A third premise is a country needs a strong technology infrastructure (core infrastructure; mechanisms and incentives to invest, invent, and innovate; and strategies to improve) to thrive as a cyber power. Those countries with a strong core technology infrastructure, the argument holds, have potential to emerge as cyber powers. However, those with strong models for investment and sustainment are those likely to retain their position as cyber powers for the bulk of the 21st century.
Industry Application
A fourth and final premise is that those countries most likely to emerge as cyber powers will be those who demonstrate measurable progress in integrating cyber technologies into core industry sectors, such as energy, finance, and health. These efforts will accelerate transformational change, introduce new efficiencies and business models, and position a nation to develop a balanced cyber power perspective: military, economic, and socio-cultural.
Measuring a World of Possibilities
Like every other era of historic transformation, cyberspace will require countries to adopt new ways of thinking. Today’s prevalent – and often apocalyptic – perspectives on cyberspace portray it solely as a digital battlefield where nations will engage in new forms of warfare. Undoubtedly, conflict will take place in cyberspace between nations. But history shows these waves of creative destruction do not limit themselves to the battlefield. New economic models will emerge that will create new innovations, jobs, and wealth. Societal and cultural norms will be transformed as technologies are adopted and integrated. Developing a better understanding of the forces that underpin cyber power will enable countries to measure the return on their public and private sector investments, will open these countries to accrue benefits from the opportunities cyberspace offers, and will help them adapt to the inevitable unintended consequences that will emerge over the course of the 21st century.
