Considering strategic competition between America and its allies on the one hand and increasingly connected authoritarian regimes on the other, we are in the midst of a century shaping development that will impact every individual, corporation, and country. Russia’s unprovoked, brutal attack on Ukraine has shattered the long held peace in Europe while setting off energy and food shortages that are spreading misery across the globe, particularly in emerging nations. The war that still rages is proof that attempts to deter Russia’s aggression were insufficient.

The US Defense Department’s 2022 National Defense Strategy, lays out the case that to avoid what could arguably be a more disruptive aggression toward Taiwan from China we must effectively deter it. The Strategy makes clear that effective deterrence is not only a whole of nation effort but requires close coordination with allies. Here, the “for want of a nail” proverb resonates. Let us consider a key nail contributing to effective deterrence—the ability to mobilize the military amid efforts to disrupt such efforts, both real and perceived. If a rival nation believes they can disrupt America’s mobilization, no amount of capability is likely to be a deterrence.

Threats to Critical Infrastructure Essential for Mobilization

The Biden administration's 2022 National Security Strategy identified the leading challenge for the United States in the coming years as “outcompeting China and restraining Russia.” It focuses on the imperative to deter aggression and the need for a “coordinated, multifaceted approach to reducing competitors’ perceptions of the net benefits of aggression relative to restraint.” It says that both China and Russia “are already using non-kinetic means against our defense industrial base and mobilization systems” and that they “target our critical infrastructure.” Finally, it points to the cyber domain as key to defending critical infrastructure and the ability to mobilize:

Because the cyber and space domains empower the entire Joint Force, we will prioritize building resilience in these areas. Cyber resilience will be enhanced by, for example, modern encryption and zero-trust architecture…We will bolster our ability to fight through disruption by improving our defensive capabilities and increasing options for reconstitution. We will assist allies and partners in doing the same.

This heightened focus on cyber resilience should not come as a surprise because the rapid advancement of digital technology is transforming nearly every human activity. Their growing importance to national security is reflected in Congress passing legislation with strong bipartisan support to create the Cybersecurity and Infrastructure Security Agency within the Department of Homeland Security in 2018, and the plethora of activities stemming from the Biden-Harris Administration’s Executive Order on Improving the Nation’s Cybersecurity. This paper will focus on bolstering the cyber or digital capabilities required for mobilizing “through disruption” to ensure this nail of deterrence is secure.

Russia’s attack on the Ukraine is instructive. It has conducted physical attacks to destroy vital material infrastructure and cyber-attacks to disrupt critical digital infrastructure. The nature of warfare is becoming more complex. As the National Security Strategy notes, “Denying the benefits of aggression also requires resilience—the ability to withstand, fight through, and recover quickly from disruption.” It further asserts, “Working with Allies and partners, we will build and exercise force elements needed in crisis and conflict, such as infrastructure, logistics, command and control, dispersal and relocation, and mobilization.”

 

Allied Critical Infrastructure

The National Defense Strategy asserts that, “Mutually-beneficial Alliances and partnerships are our greatest global strategic advantage—and they are the center of gravity for this strategy.” Recognizing this, it commits to “…improve its ability to operate in the face of multi-domain attacks on a growing surface of vital networks and critical infrastructure, both in the homeland and in collaboration with Allies and partners at risk.”

Recognizing the benefits of the United States’ key power projection bases in its territory of Guam, and hosted in nations like Japan and the Republic of Korea, China has developed a missile arsenal meant to limit their use. Therefore, the US military has developed strategies for the dispersal of forces. The United States Air Force Agile Combat Employment strategy “shifts operations from centralized physical infrastructures to a network of smaller, dispersed locations or cluster bases.” Another dispersal strategy is being implemented by the United States Marines. It’s “Expeditionary Advanced Base Operations is a form of expeditionary warfare that involves the employment of mobile, low-signature, operationally relevant, and relatively easy to maintain and sustain naval expeditionary forces from a series of austere, temporary locations ashore or inshore within a contested or potentially contested maritime area in order to conduct sea denial, support sea control, or enable fleet sustainment.”

These strategies limit the dependence on any one location, multiplying the geographies where critical infrastructure security enables US mobilization. Given their proximity to the potential theater of conflict around Taiwan, it is little wonder why the National Security Strategy asserts, “We will invigorate multilateral approaches to security challenges in the region, to include by promoting the role of the Association of Southeast Asian Nations in addressing regional security issues.” The Philippines, with whom America has a mutual defense treaty, has many islands that stretch Northward to Taiwan, offering multiple options for Air Force combat and advance base operations. It is an example of a nation where America seeks closer security ties. An effective strategy to deter deployment must focus not just on America’s homeland, but nations such as the Philippines.

Securing Critical Infrastructure

Even as the military commits to be prepared to act despite disruptions to critical infrastructure, the Security Strategy highlights the importance of “enhancing the resilience of US systems the PRC (Peoples Republic of China) may seek to target.” In other words, the US must be able to maintain the necessary defense, energy, communications, and IT infrastructure in the midst of significant cyber-attacks. This ability increases deterrence and decreases the likelihood of conflict.

Ukraine offers an example of how such a scenario might play out, as critical infrastructure was targeted by both kinetic and cyber-attacks. While Russia was successful in certain areas, their efforts largely undershot expectations on the cyber front. This was due in large part to the significant investments that both the US and the private sector made in enhancing the resilience of Ukrainian infrastructure—such as migrating government systems to the cloud—and providing contingency capabilities in the event of outages—such as the provision of Starlink terminals to overcome blackouts within core communications networks.

The Russia-Ukraine conflict was thus instructive in that it:

• Failed to deter Russian aggression
• Demonstrated Russia’s limited ability to execute coordinated cyber and kinetic attacks
• Highlighted the importance of protecting critical infrastructure from cyber attacks
• Underscored the ability of the US and allied governments and the private sector to implement security and contingency measures to make critical infrastructure resilient against such attacks

Just as the US will learn lessons from this conflict, so too will its adversaries. Thus, any American strategy must assume that the same mistakes will not be repeated.

The significant forward deployment of US troops to support Indo-Pacific region defensive capabilities is ultimately reliant upon the resilience of critical infrastructure in host countries. Guam, Japan, South Korea, and the Philippines deserve particular attention, but any “digital umbrella” should account for the needs of a broader set of regional allies.

Key steps have already been taken to better position allies, including:

• Operational cybersecurity engagement to support incident response and the sharing of threat intelligence
• Advocating to remove untrusted vendors in telecommunications networks, and diversify the vendor base (largely by promoting the cellular radio access standards of Open RAN)
• Launching the International Counter Ransomware Initiative and associated capacity building activities across its 36 members

While it’s impossible to determine how well US allies’ critical infrastructure would withstand cyber-attacks that were intended to disrupt service, frequent data breaches would indicate that challenges remain. To ensure maximum infrastructure resilience, the US should implement the following recommendations.

Recommendations

 

1. Understanding critical infrastructure risk

Just as the United States government has taken steps to evaluate the resilience of critical supply chains, it should understand and bolster the resilience of critical infrastructure essential to military mobilization. The Cyber Infrastructure Security Act is focused on this task for domestic infrastructure. Understanding the state of allies’ infrastructure will be more difficult, but may be equally important.

2. Emphasize digital security in global infrastructure investment efforts

While “digital connectivity” was one of the four priorities listed when announcing the launch of the Partnership for Global Infrastructure and Investment, the program needs to focus on connectivity and digital security. 

While the Export Import Bank of the United States’ China and Transformational Exports Program  aims to counter export subsidies provided by China and/or other designated countries, it has fallen far short of its target to reserve up to 20 percent of its total financing authority to support such exports. The United States International Development Finance Corporation needs a similar initiative.

3. Leverage private sector capabilities

The private sector provided critical cybersecurity support to the Ukrainian Government during its conflict with Russia, which significantly undermined the effectiveness of Russian cyber-attacks. Capacity building efforts in the Indo-Pacific region should leverage private sector capabilities and facilitate partnerships between regional critical infrastructure owners/operators and trusted cybersecurity companies.

4. Emphasize the Indo-Pacific

The National Security Strategy identifies that “The PRC is the only competitor with both the intent to reshape the international order and, increasingly, the economic, diplomatic, military, and technological power to do it.” As such, US military and civilian preparations should prioritize those nations in pivotal roles to help deter Chinese aggression.

As Richard Fontaine recently observed, “Washington wishes no country to employ Huawei infrastructure for its 5G network, but US efforts should be focused squarely on dissuading allies and close partners from doing so rather than on trying to stop everyone from using it.” When it comes to cybersecurity and digital security, the US’s first priority for capacity building should also be among allies in the Indo-Pacific.

The failure to deter aggression against Taiwan or other targets would have catastrophic effects. While a greater focus on securing critical infrastructure may come at a cost, it must be remembered that effective deterrence is cheaper than any alternative. America must prioritize securing the ability to mobilize in allied locations to secure the peace. Let’s make sure this nail for deterrence is in place.

This informational piece is not intended to provide legal advice or opinion. Such advice may be given only when it is related to specific fact situations that Venable has accepted an engagement as counsel to address. The views expressed in this article are those of the author(s) and do not reflect either way the views of Venable LLP.