Technology does not advance; it accelerates. It is exponential – one technological advancement facilitates speedier and more expansive future advancements. This rapidly accelerating train is tough to board at any time, but it will be more difficult tomorrow than today.

And those who boarded yesterday have a substantial first-mover advantage.

Throughout history, information has repeatedly been a core element of humankind’s most transformative technological advancements. Looking back from the internet to the personal computer, the radio, the telegraph, the printing press, paper, the written word, the spoken word – all have profoundly impacted all of humanity.[1] Recent developments in generative artificial intelligence (AI) have begun amplifying humankind’s ability to create and spread information, and disinformation, on an unprecedented scale.

And people are not ready for this change.

Research led by the Australian National University revealed people fail, two thirds of the time, to distinguish AI-generated images from reality.[2] As advances in quantum computing take hold, the next leap in processing power will be as transformative as the shift from vacuum tubes to microchips.[3]

And this presents both opportunity and threat.

Most people worldwide now own a smartphone, and the world’s littoral zones concentrate population density at twice the global average.[4] Whether or not we actively engage in the cyber domain, our people are engaged by and within it. A force that isn’t technologically agile risks being outmanoeuvred in this densely populated, data-rich environment.

And we are not technologically agile.

Bringing a Luddite[5] force into this setting is like deploying a blind, three-legged military working dog into combat: he’s a good boy and all, but ill-equipped for the environment or the task. To achieve dominance in this technology-driven domain, we need an approach as broad, adaptable, and agile in cyber operations as our kinetic actions.

And that means people are more important than gadgets.

Many of the resources allocated to the cyber domain focus on the prevention and employment of sophisticated technological intrusions into secure networks for the purpose of stealing data or collapsing critical infrastructure.[6][7] Yet technological hacking[8] is only one half of the cyber domain threat dyad, and it may not even be the most dangerous half.

The human terrain[9] underpins all warfare and has done throughout human history. While battles may be won by kinetic effects, wars are won – and lost – on the human terrain.[10] When most humans in a country at war are no longer willing to support the effort, the war is lost. The information environment[11] influences the human terrain, and the technology-driven cyber domain broadens and amplifies this influence.

And our adversaries are way ahead of us.

The M1 Abrams tank has been the king of the land battlefield for more than 30 years. In the tank-on-tank battles of Operation Desert Storm in 1991, Abrams destroyed Iraqi Soviet-bloc tanks by a ratio of some 1600 to zero.[12] But in 2016, a regiment of Abrams tanks was defeated by a hashtag. The hashtag was #AllEyesOnISIS, which swept ahead of the Islamic State advance through Iraq and compelled thousands of heavily armed Iraqi soldiers to surrender or abandon their posts and their state-of-the-art war machines.[13]

We can confidently assert that #AllEyesOnISIS would not achieve the same effect against Australian troops, but this misses the point. An information attack is not effective in the way a bomb indiscriminately affects all within its blast radius. Australian soldiers would not be affected by #AllEyesOnISIS because it would not speak to their cultural landscape, their world view, and their existing uncertainties about whether they were standing on the right side of their God and history, as it did for the Iraqi soldiers. But an opponent who identifies similar points of uncertainty and division within Australian culture, then amplifies them over years of subtle information manipulation, could achieve a comparable outcome here.

And our adversaries are already doing this.

For state actors, cyber-domain information operations provide the opportunity to achieve human-terrain and even kinetic outcomes without risking kinetic retaliation. For non-state actors, this domain offers the added benefit of accessibility. There are an estimated 7.2 billion active smartphones in the world.[14] Never before have military forces been able to influence most of the world’s population, while knowing their own and others’ locations to near pinpoint accuracy, accessing every book ever written, every academic paper and news story ever published, and publishing their own to a global audience. This is the capability now available to any individual among about 80 per cent of the world’s population.

Political experts stress the need to build disinformation resilience, making voters more informed and sceptical – not sceptical about the medical benefits of vaccines or the scientific community’s general assumption that birds are not government spy drones, but about dubiously sourced social media posts which seek to nudge a user’s world view steadily towards the extreme.[15] Building similar resilience among soldiers means integrating knowledge-building habits into Army culture from the junior-enlisted level up. As the “internet of things” propagates, and dozens of household items are connected with cyberspace at large, few places will remain where an ill-considered remark from an unthinking digger will be free from the risk of public broadcast.[16]

And this is just the body armour of the cyber domain.

Although this may provide some defence against information attacks, it’s not a very manoeuverist[17] defence. To win in cyber warfare, the ADF will also need to employ information offensively. This cannot be achieved by centralising information and counter-disinformation[18] decisions at the highest levels. For starters, those who employ disinformation start by undermining trust in official and reputable sources.[19] Furthermore – and more importantly – centralised information campaigns cannot achieve the necessary tactical agility in a cyber domain where 510,000 comments are posted on Facebook, 350,000 tweets are sent on X, and 625,000 videos are watched on TikTok – every minute.[20]

Australian section commanders in combat have at their disposal enough destructive firepower to cause a major international incident if employed recklessly. They lack, however, the tools, training, or authority to share their daily positive actions with the global community and debunk the enemy’s disinformation. Russia’s ongoing invasion of Ukraine has not only been a war of kinetic military hardware, but an information war. The antagonist’s infamously prolific cyber disinformation capability has been employed in full force against the Ukrainian government and people, both before and since the conventional invasion began. Ukraine’s defence in this space, however, has been asymmetrically robust.[21] When Russia falsely claims a battlefield victory, it is not only the Ukrainian establishment that contradicts this message, but individual Ukrainian troops on the ground in the still-unconquered territory posting to social media. When Russia attempts to hide its forces’ war crimes, these crimes are first revealed, not by journalists, but by the Ukrainian troops who discover them.[22] This grassroots approach has proved one of the few effective weapons against cyber-enabled disinformation attacks, as the global public turns away from traditional media sources and towards social media as their sole news resource.[23]

This is not to suggest that our soldiers should deploy with their own electronic devices and start posting status updates. Cyber domain agility means equipping soldiers with both the physical technology that enables secure cyber connections and the understanding to competently use it. New threats emerge when all soldiers are actively engaged in the cyber domain – this is as complex and dangerous a terrain as any battlefield. But hiding from the technology is like sending troops into battle without weapons because “guns are dangerous”. They are dangerous – that’s why we use them.

And we don’t really have a choice.

Locking the force into a virtual Maginot Line[24] in the cyber-enabled information environment achieves only the appearance of security. Choosing whether to train, equip, and empower our troops to operate in the cyber domain is a question of exercising some control over this space, or surrendering control to whoever wishes to take it. There is no option to exert absolute control.

Although about 7 per cent of Army roles are focused on communications and cyber,[25] all soldiers will need to navigate the cyber domain, counter its threats, and employ its resources to achieve heretofore unrealised asymmetric advantages. These now-basic soldier skills cannot be taught in an online course; they must be trained and rehearsed alongside all other tactical proficiencies. Empowering junior personnel to employ their cyber-domain expertise in operational contexts will require a mindset shift among senior leaders, who must be willing to entrust subordinates with weightier responsibilities and manage the risks associated with this greater autonomy.

And we already do.

Technology has never transformed war into something fundamentally different from what it has always been – an interpersonal clash of human wills. Just as in 1939, when reliable aeroplanes, armoured vehicles, and radio communications increased the tempo and complexity of warfare, so too does the cyber domain. Successful armies in the Second World War navigated these new challenges by adopting mission command principles. Addressing the acceleration of technology in warfare now will mean applying the same approach when training and employing the joint force in the rapidly advancing cyber domain.

End Notes