"Nodes and Codes" explores the reality of cyber warfare through the story of Stuxnet, a string of weaponized code that reached through a domain previously associated with information operations to bring about the physical, and potentially lethal, destruction of an adversary's critical infrastructure nodes. Stuxnet served as a proof-of-concept for cyber weapons and provided a comparative laboratory to study the reality of cyber warfare from the military powers most often associated with advanced, offensive cyber attack capabilities. The reality of cyber warfare holds significant operational implications for military forces armed with weapons platforms based on Network Centric Warfare Theory. This monograph traces the open source story of Stuxnet through the trail of blogs and online articles that served as waypoints for the international digital detectives who deciphered the virus and determined its intentions. It provides a window to view the context of modern cyber warfare according to problematic attribution of actions in cyberspace, ambiguous concepts of cyber attack as acts of warfare, and trends of increasing vulnerability to supposedly sophisticated weapon systems and critical infrastructure. Three case studies evaluate cyber policy, discourse, and procurement in the US, Russia, and China before and after Stuxnet to illustrate their similar, yet unique, realities of cyber warfare. Evidence suggests that all three nations are taking extraordinary measures to build cyber armies capable of exploiting adversary vulnerabilities in closed and open networks. A final section provides operational considerations for the employment of military force based on the reality of modern "cyber fires." Ultimately, the cyber domain represents an additional, and rapidly evolving, means by which actors can inflict violence and attempt to compel an adversary to their political will through Stuxnet-like attacks. This new phase of conflict, in which adversaries use cyber weapons to create physical destruction, defines the reality of cyber warfare and the expanding number of critical nodes vulnerable to malicious codes.

Approved for public release; distribution is unlimited. The opinions and conclusions expressed herein are those of the student-authors and do not necessarily represent the views of the U.S. Army Command and General Staff College or any other governmental agency. (References to these studies should include the foregoing statement.)