John R. Mills is the Special Assistant for Cybersecurity in the Department of Defense. He was the DoD representative to the Executive Office of the President and the National Security Council for the 60 Day Cyberspace Policy Review conducted in the spring of 2009. He is currently a Colonel in the U.S. Army Reserve and, post-9/11, spent two years con- ducting operations and planning with the Joint Staff at the Pentagon and at Central Command.
"Data centers have become the foundation of the digital economy..." "The government must adapt to an envi- ronment where critical infrastructure is no longer under direct control..." "If the world of cyber is a contest of attri- tion, the United States has lost..."
It is said that “cyber” is distinct from other domains in that it is created by humans and does not necessarily have physical manifestations.1 The legacy domains of air, sea, land, and space, however, do have physical manifestations of distinct brick and mortar infrastructure, which are needed to gener- ate and project national power. The infrastructures in these pre-cyber domains are not only key terrain elements of the operational space, but also distinct centers of gravity that provide lucrative targets for threat vectors.
It was originally thought that we were released from the earthly bondage of brick and mortar infrastructure into cyber’s non-existent land of ones and zeros. Assuming the Cyber domain frees us of traditional Clausewitzean key terrain concepts, however, is a faulty logical starting point because Cyber does have physical manifestations. Classic theories of conflict cite the need to control key terrain. Examples of key terrain in nation-state conflict include high ground such as the Golan Heights and the critical North Atlantic sea lines during the Second World War. At the height of Operation Iraqi Freedom, the “human terrain” of the Sunni tribal families in Anbar Province of Iraq was the decisive key terrain. Moreover, as discussed by Dr. Jorge Benitez, the domestic human terrain of political will and public support could also be the decisive key terrain and center of gravity for success in Afghanistan. Clausewitzean principles of key terrain can be similarly applied to Cyber; it has a number of earthly manifestations including data centers, internet service providers, undersea cables, international standards bodies, BIOS, supply chain, the cyber work- force and the engine of technology innovation.
This article will demonstrate that the domain of cyber has several of the traditional nodes of key terrain and also contemporary key terrain elements that Clausewitz might not have foreseen but would possibly include in an updated version of his theory of key terrain. The key terrain elements identified in this article show significant pressure points for Cyber that must be considered and would likely be ruinous if discounted. (purchase article...)