The United States Army War College Strategic Studies Institute (SSI) published on April 4, 2013 an interesting paper titled "Making Strategic Sense of Cyber Power: Why the Sky is Not Falling" by Colin S. Gray. At 83 pages it is a long read, but was a refreshing contrarian view from the FUD that fuels our industry to sell products and services. Also, I've been really enjoying War Nerd lately, so I feel I should take an interest in arm-chair military strategy in a domain I know about. Below are some of my favorite quotes (categorized and re-arranged by me).

Anything can be made scary if you assume the worst of the unknowns.

Cyber attack may be so stealthy that it escapes notice for a long while, or it might wreak digital havoc by complete surprise. And need one emphasize, that at least for a while, hostile cyber action is likely to be hard (though not quite impossible) to attribute with a cyberized equivalent to a “smoking gun.” Once one is in the realm of the catastrophic “What if . . . ,” the world is indeed a frightening place.

David J. Betz and Tim Stevens strike the right note when they conclude that “if cyberspace is not quite the hoped-for Garden of Eden, it is also not quite the pestilential swamp of the imagination of the cyber-alarmists.”

Cyber, in terms of strategy, is not unprecedented.

Assuredly, cyber is technically extraordinary, but so too was the electric telegraph in the 1840s. The telephone, radio, and television were each on the frontier of technological achievement for a short while.

Once we shed our inappropriate awe of the scientific and technological novelty and wonder of it all, we ought to have little trouble realizing that, as a strategic challenge, we have met and succeeded against the like of networked computers and their electrons before. The whole record of strategic history says: Be respectful of, and adapt for, technical change, but do not panic.

Cyber warfare is not, however, entirely unprecedented in its potential to do harm to people without applying force directly. For example, economic warfare in the two World Wars was confined not only to the infliction of harm kinetically, but also by the manipulation of commodity and other markets in neutral countries, in order to starve belligerent populations and deprive their industries of necessary raw materials

Cyber doesn't kill people. It will be most effective when used in conjunction with physical force.

cyber power will prove most useful (or dangerous [...]) as an enabler of joint military operations.

cyber is only one among many ways in which we collect, store, and transmit information ... From the beginning of time, armies have clashed in relative ignorance. This is not to demean the value of information, but to remind ourselves that information, even knowledge (or its absence), is not a wholly reliable key to strategic success or failure

My understanding of this is that even if all our computers and networks are destroyed, we can still fight.

Unlike land, sea, air, and space, we built cyber space and it is governed by the rules we made for it.

Although it continues to be orthodox to assert that cyberspace is by its scientific nature an environment friendly to offense, rather than defense, this fashionable belief almost certainly either is wrong, or, to be generous, is seriously misleading. On November 10, 1932, Stanley Baldwin was not correct when he claimed that “the bomber will always get through,” at least it would not get through well prepared defenses in strategically lethal numbers able to attack critical targets.

The cyberspace we use is that which we have chosen. If that cyberspace is found vulnerable to attack, or unexpectedly prone to technical failure, the fault will be ours. This cannot be said in these terms of the land, sea, air, and Earth-orbital military domains. [...] If we are lethally vulnerable to harm in our use of cyberspace, it will largely, if not wholly, be our own fault.