As academic debates and policy discourses regarding the implications of the information revolution for society and security have unfolded over the past decade, Martin Libicki's work has consistently informed and guided both. Beginning with What Is Information Warfare? (1995) and continuing through his new book, Libicki has excelled at organizing a complex subject clearly and analyzing it insightfully. Amid the din of dire predictions—some coming from me—he has steadily maintained that there may be less than meets the eye to information warfare. Here, he seems both to affirm this view and to go beyond it by suggesting that while prospects for “hostile conquest”—via worms, viruses, and the like—are dim, overall the possibility of “friendly conquest” by fostering others' dependency on one's own systems has grown.

Libicki's basic line of argument is that defenses against direct assault on information systems are likely to be robust, perhaps even dominant, if sufficient attention is given to the matter. Thus, he explains intrusions as the products of pathways that “have been inadequately guarded,” or which arise from “defects in the software” (p. 35). Indeed, he goes so far as to assert at the outset that “[t]here is no forced entry in cyberspace” (p. 31). Given the sturdiness of sensible defensive measures against straightforward attacks, he introduces two interesting approaches for rekindling the offensive in cyberspace. The first is to flood the opposing system with confusing information instead of trying vainly to disrupt data flows. This approach is enabled, he observes, by a key vulnerability in virtually all computer systems: “Unless otherwise instructed, everything is signal—every instruction is valid, and every data item is processed as valid if it falls within specified bounds” (p. 54). Thus, the prospects for disorienting or deceiving the adversary are good.

Libicki's second suggestion for restoring the offensive in cyberspace begins with his notion of friendly conquest—enticing others to embrace the speed and efficiency of one's systems, to a point at which they are “entrapped by webs of dependence on another's cyberspace” (p. 136). It is at this point that the trap is sprung, and friendly conquest can revert to its darker, more hostile manifestation. As he sums up the relationship, there is “a complex interplay between friendly and hostile conquest in cyberspace” (p. 218). For those who might hear the stealthy footsteps of Microsoft in the background, enabling this sort of techno-imperialist approach to virtual dominance, Libicki confirms the software giant's importance from the outset: “Microsoft is the pivot on which the contrasting versions of conquest are examined” (p. 14).

While Conquest in Cyberspace crisply exposits its subject matter and lays out its argument logically, Libicki does not give disconfirming evidence its due. For example, there is virtually no mention of the significance of the many tens of billions of dollars paid by insurers annually as recompense for cybercrime—an amount that, each year, routinely exceeds the roughly $40 billion they paid out for damages in the wake of 9/11. The lack of discussion of this point means that he also neglects to consider what sort of costs might be imposed by a concerted cyberterrorist campaign. Instead, he employs a man-of-straw argument that “Information Warfare only looks strategic” (p. 37) because it pales next to nuclear weapons in destructiveness. This despite the fact that he observes the increasing potency of viruses and worms, over just a few years: “It took most of a day for the I-Love-You virus … to propagate worldwide…. The Slammer worm … had doubling and propagation times measured in minutes” (pp. 92–93). Libicki needed to consider that cyberspace-based “mass disruption” might also have strategic effects, an important line of argument in academe and policy circles carefully examined elsewhere, notably in Gregory Rattray's Strategic Warfare in Cyberspace (2001).

Though he does not explore or analyze the implications of other disconfirming evidence, Libicki does at least acknowledge some of the difficulties with his major premise about the disutility of hostile conquest in cyberspace. For example, he observes that even one classified defense information system—supposedly never breached—has apparently been penetrated on occasion. As he notes, “viruses … have been known to get past its barriers somehow” (p. 65). Further, he sows doubt about his assertion regarding the robustness of defenses: “The decision to take the offensive should be predicated on what the offense/defense balance is—no easy thing to measure” (p. 266). Thus, it seems that hostile conquest may not be as remote a possibility as he suggests.

It may also be that friendly conquest is not as smooth a path to advantage as Libicki argues either. But he does not consider the possibility that others' wariness of just such an approach might lead them to solutions of their own making, or to join in creating competing cybercoalitions. Although there is increasing evidence of these sorts of attitudes and responses, emerging in several different parts of the world, he does not give sufficient consideration to this weakness in his favored strategy. Nor, because he does not believe in “forced entry,” does he show sufficient concern for the boomerang effects that might be generated by a friendly conquest strategy undergirded by a lot of sharing of advanced technological know-how. The policy risk, in this instance, of being wrong about prospects for hostile conquest might mean that friendly approaches to others would then allow them to “ride the rails” of our information systems to strike at us.

For all these limitations, however, Conquest in Cyberspace is still a thoughtful, well-organized, and lively account of the modes of conflict that might emerge in the virtual domain. That the book leaves much about its major findings open to question will merely prompt—perhaps enliven—future debates.