by Jonathan Movroydis
Jacquelyn Schneider is a Hoover Fellow at the Hoover Institution. A former US Air Force intelligence officer and professor at Naval War College, Schneider conducts research focusing on the intersections of technology, national security, and political psychology, with special interests in cybersecurity, unmanned technologies, and Northeast Asia.
In this interview, Schneider discusses the role of cyber operations, unmanned weapons, and artificial intelligence in the US military; cyber threats from adversaries including China, Russia, North Korea, and Iran; and present and future challenges to America’s cybersecurity.
What inspired you to work in the fields of cybersecurity and strategy?
I studied economics and political science at Columbia University. When I was accepted to Columbia, my parents told me to find a way to pay for tuition. At the time, the only scholarships that paid for an entire Ivy League education was ROTC. I joined Air Force ROTC and served six years as an active-duty intelligence officer in the US Air Force.
I then left the military for civilian life and began working towards my PhD at George Washington University. My primary area of study was the causes of war between states. This led me to the think about how conflict in the cyber domain can escalate to full-scale war.
While in graduate school, I was also an Air Force reservist in the strategy and plans shop at US Cyber Command, where I worked on cyber deterrence and stability. I believed, and still do, that cyber’s role in conflict is one of those puzzles that really hasn't been solved, and I concluded that there is a lot of study and work to be completed in this field.
In 2016, I joined Naval War College as an assistant professor, and began deeper study on emerging technologies, unmanned systems, cyber operations, and naval strategy and operational capabilities.
Then I had the opportunity to join the Hoover Institution as a fellow. In my current position, I have the robust institutional support from Stanford University, including access to researchers at the top of their field and the nation’s best science labs. Hoover has provided me with tremendous support, and with the space and time I need to run hard on big and important projects, including war games that explore how cyber vulnerabilities affect nuclear stability.
How does Air Force Intelligence’s role compare with those of other intelligence agencies?
The big difference between the armed service and the national intelligence agencies is that the former are focused on service-related missions as opposed to overarching situational awareness, which is the domain of the Central Intelligence Agency.
Most of my work as a young intelligence officer encompassed intelligence gathering for US forces deployed in Northeast Asia. This included supporting U-2 pilots in South Korea, and conducting political and economic analysis that I presented to senior Air Force officials so that they could make informed decisions about targeting operations, or how to build what used to be called the “effects-based operations,” which combines military and nonmilitary assets for US defenses. Some of the work was highly technical and weapons specific, while other aspects dealt with political and economic matters.
Tell us about the war games you have developed.
I have been working on the war game series for over a year and have run approximately 100 games all over the world. I ran an iteration in Hoover’s Blount Hall on March 6, 2020. Each game includes five people, so that brings us to approximately 500 players worldwide. We have a diverse group of players, including business and tech executives, senior military officers, and former defense and foreign ministers.
In each game, players simulate a national security council and are introduced to two crisis scenarios for which they craft crisis responses. My goal with these simulations is to develop an alternative research tool to study rare or catastrophic scenarios, rather than using traditional methods like surveys or interviews.
I have been working with scholars at Stanford’s Center for International Security and Cooperation, including Reid Pauly and Erik Lin-Greenberg, who is currently at the University of Pennsylvania developing war gaming as a methodology to better understand emerging technologies in warfare, including hypersonic weapons and artificial intelligence.
When did the United States start developing a cyber strategy?
I have a book coming out very soon, which is an edited volume that I compiled with associates at US Cyber Command. It is called Ten Years in the Implementation of Cyber Strategy. It looks at the formation of US Cyber Command ten years ago, and the development of strategies from then to today.
Cyber Command is located at Fort Meade, Maryland, and operates in the same building as the National Security Agency [NSA]. The head of Cyber Command also serves concurrently as director of the NSA.
In 2010, Cyber Command was set up as a response to a very serious cyberattack on US Department of Defense information systems. At the time, it was a sub-unified command under US Strategic Command, and its influence was minimal. Many people questioned its mission asking, “How is it different from the NSA or the Defense Information Systems Agency?”
Then in 2013, the Obama administration laid out the first ever cyber defense strategy, which focused Department of Defense efforts on cyber deterrence and how to respond to a full-scale cyberattack. President Obama, however, didn’t authorize Cyber Command to take any actions that were independent of the US efforts in declared campaigns, like Iraq or Afghanistan.
In 2018, the Trump administration recalibrated America’s cyber strategy to focus more on offensive operations, what the new strategy calls “defend forward.” This means that the Department of Defense is actively conducting cyberattacks to decrease our adversaries’ capabilities. Deterrence thus became a secondary effort under the Trump defense cyberspace strategy.
That same year, Cyber Command was established as a unified command. It now has command over its own personnel and resources. The edited volume looks at the implementation of strategy and evaluates what has succeeded and what has not.
I am also currently advising the US Congress’s Cyberspace Solarium Commission. We have been evaluating the effectiveness of US cyber strategy and what Congress can do to help in this area.
Are cyberattacks an effective deterrent?
Based on the war games that I have conducted, I don’t think cyberattacks are an effective deterrent—either to deter against other cyberattacks or to deter conventional or nuclear attacks. Cyberattacks on critical infrastructure can cause uncertainty and lead to high economic costs to states. However, threats of punishment from more conventional military operations are much more impactful.
My research suggests that people do not think cyber threats are credible, nor do they have a strong emotional response to cyberattacks. This is partly because of how cyberattacks create effects that are long term and usually not first order. Even if a country deploys a large-scale cyberattack, it would need to have immediate (and salient) effects for it to change people’s behaviors at all. A better use of deterrence would be military operations that can be credibly and immediately attributed to the United States. Air strikes are an example of a punishment option with salient results.
Are cyber operations used to complement conventional forces?
I think that was the initial hope. If you look at the development of US Cyber Command, you will see that the initial focus of cyber operations was to complement our conventional forces. However, it is really difficult to have a confident probability assessment for the effectiveness of a cyberattack before it is launched.
If a cyber operation is not pivotal to the mission, then commanders are going to be very leery of its use. For example, we are not going to base the success of an air strike on how well we performed in cyber operations. However, as the United States military continues to become more advanced in conventional campaigns, it may at times supplement with cyber as a way to increase effectiveness.
How are America’s allies and adversaries deploying cyber operations?
Israel is probably one of the most competent cyber actors, both on defense and offense. Israel has a history of using cyber operations in concert with conventional operations to increase their effectiveness. They also use it frequently in intelligence gathering. There have been reports that Israel has deployed cyber operations to take down their adversaries’ integrated air defenses before an airstrike was launched.
The British are also very capable. Their cyber capabilities function within the Government Communications Headquarters, the United Kingdom’s equivalent to the US National Security Agency. Like the British, the Australians are forward leaning and have integrated cyber operations into conventional military campaigns. France is also an extraordinarily capable actor, although the United States is not as closely tied to them in cyber operations.
On the adversary side, the most capable actors are China and Russia. China is very disciplined and has the capability to develop “advanced persistent threat capabilities” against US critical infrastructure, but they likely won’t use them unless they really need to. China’s focus is to use cyber operations to acquire data and steal intellectual property. For their part, Russia is conducting large amounts of influence operations, intelligence gathering, and attacks against both critical infrastructure and US military networks. Russia is the most willing actor in cyberspace, which makes it also probably the most dangerous.
North Korea is quite formidable, but they primarily focus cyberattacks in order to extort resources in support of the Kim regime. They have also acted in retribution, as seen in the attacks against Sony Pictures in 2014. They are not as sophisticated as the Chinese or the Russians, but they are very prolific.
The Iranians are similar to North Korea but perhaps even more prolific. They have had some successful attacks against Saudi Arabia and other adversaries in the Middle East. They have hit several US financial institutions with marginal effectiveness and have had less success against critical infrastructure. In one instance, for example, they were able to shut down a small dam in New York.
At present, what is the biggest cyber threat to the United States?
The biggest threat right now is the use of information to magnify domestic schisms and undermine our democratic and economic systems. These are insidious and existential threats.
Our elections and financial system are both built on the credibility of data. Actors like Russia undermine the trust in that data. They do this not through a singular attack but by gradually eroding the digital foundations of our democracy and economy.
Financial institutions generally have very strong cybersecurity systems, because they understand that the backbone of banking is the belief that the numbers projected on a computer screen represent monetary value. If the credibility of those numbers is undermined, it spells danger for firms and the economy at large.
Similarly, democracies utilize data that are input by voters at the ballot box. If Russia hacks our electoral system, then doubt is immediately raised about the accuracy of the number of people registered to vote or ballots cast. In the short term, I am more concerned about the future of democracy, because banks have more resources than state and local governments, who normally administer elections, to invest in cybersecurity.
The centralization of networks and the migration of data to the cloud are also causing potentially destabilizing effects in the cyber world. The centralization of data causes immense vulnerabilities because it creates major hubs for vulnerabilities that extend across companies and digital resources.
Thus, as our society technologically advances, its vulnerabilities increase?
Yes. One of the things that we always say in the cyber world is that our society constantly needs to build up resilience. Part of resiliency is being able to function without digital capabilities. In terms of elections, this means having a credible paper backup.
On the military side, it means having weapons systems that can function in a digitally degraded environment. For instance, if a data link goes down, many sophisticated weapons cannot function. This dilemma presents a choice between resiliency and effectiveness. If we invest more in resiliency by buying cheaper weapons, than we reduce the effectiveness that comes with having more sophisticated weaponry. Consequently, every conversation our military leaders have about artificial intelligence should also include one about cybersecurity.
Does working in Silicon Valley give you a new perspective about your field?
I am used to working with Washington government types. They see conflict everywhere. In Silicon Valley, there is much more optimism about the development of technology and how it can be used for peaceful purposes and to foster cooperation between actors across the globe. I am also learning a lot about new and groundbreaking technological innovations that originate from the Valley.
I spend most of my time researching individual and organizational decision making, especially in the emerging area of artificial intelligence. I think it is important to think less about the capabilities of technology versus how human beings interact with technology, as well as its impact on society at large. I have really enjoyed my conversations with the experts at Stanford’s Institute for Human-Centered Artificial Intelligence, who are doing great work in this area.
Can you tell us about your research on the use of drones in warfare?
I am working on a research project with Julia Macdonald from the University of Denver’s Korbel School of International Studies that explores this subject within the US Department of Defense. We surveyed the different beliefs of individuals and the budget cycles of various organizations that have led to the current trajectory of unmanned systems. We have looked at the Bush administration’s willingness to take higher risks in military operations, compared to the Obama administration’s more frequent use of unmanned systems.
We also conducted interviews with JTACs [Joint Terminal Attack Controllers], the individuals that call in air strikes, about whether they preferred manned or unmanned systems. One of our findings was that there was a trust deficit in unmanned systems among the JTACs.
We are also working on a larger Minerva Grant with Mike Horowitz of the University of Pennsylvania that looks at the proliferation of autonomous systems and the barriers to their use, not only in the Department of Defense but also in populations across the United States.
How effective are drone strikes relative to those by manned aircraft?
That is a complicated question. Effectiveness of unmanned systems is measured in two ways: One, what is the weapon (the bomb or missile, for instance) that is being used in the attack? And two, what is the platform that is carrying the munition (F-35, MQ-9, etc.)? A munition has a certain effectiveness (a probability of a kill) and a platform has a different effectiveness that also impacts whether the munition will destroy the target. This platform effectiveness is about an airframe’s ability to find a target (the sensors), communicate with ground and remote controllers, and evade and survive enemy air defenses. Most of the munitions that unmanned systems carry can be carried by a manned system as well, so overall effectiveness comes down to the platform and what unique characteristics it brings to the combat environment.
On the one hand, the ability to target precisely is not a unique characteristic of an unmanned system. However, what is unique about unmanned systems is their ability to mitigate risk. If our forces are flying in airspace where we do not have permission, we are much more willing to lose an unmanned system than a manned system. Unmanned systems also have the advantage of staying in the air and on target for longer periods of time (called persistence). In that sense, I think they allow more political space for assassination types of operations. Some believe that their use is less escalatory.
Throughout the past two decades of war in Afghanistan and Iraq, we have developed weapon systems that optimized risk mitigation while sacrificing effectiveness in other combat characteristics (for instance surviving in weather or evading enemy air defenses). I think the Pentagon has to think about this issue a little differently and build weapons systems that instead optimize effectiveness and cost. This means, when planning for combat against a peer competitor, investing less in highly complex unmanned systems and focusing instead on buying cheaper ones that allow the United States to make up for their deficit in mass (or the numbers of weapons or platforms that we have). If we are faced with a large-scale conflict today, we would run out of these sophisticated unmanned weapons systems very quickly.
Do adversaries like Russia and China have advanced unmanned systems in their arsenal?
There is a prestige element in acquiring expensive unmanned systems that both the Chinese and the Russians seem to have embraced. Such investments will not be advantageous in the long run. If Russia and China are going to build “over-the-horizon” unmanned systems, like the United States has, they will also have to rely on very sophisticated satellites as back-end support. That is expensive and makes them vulnerable. More worrisome is the use of cheap unmanned weapons as sensor platforms or as “missile soakers” or decoys.
Which Hoover colleagues have been influential on your thinking and research?
Amy Zegart and I have similar research interests. She is an extraordinary thinker and is a rare breed of person who is equally respected in the academic and policy fields. She has brought me into the information operations working group, which includes scholars from various disciplines, schools, and departments across the Stanford campus. I have also been influenced by Herb Lin, who is conducting a lot of research on information operations right now. It is also remarkable to have notable national figures as colleagues, including James Mattis, H. R. McMaster, Condoleezza Rice, and George Shultz.
