Policy and Technical Recommendations for Integrating Autonomy into Military Offensive Cyberspace Operations

Abstract

As AI technologies and autonomy grow, the transition to application in the military, specifically enhancing military cyberspace operations, has become both a strategic imperative and an adoption challenge. This thesis explores the challenge of effectively integrating autonomous cyber weapons systems into offensive military cyberspace operations. I offer both technical and policy recommendations to ensure autonomous technology development does not outpace its ability to be integrated.

This thesis analyzes historical case studies, such as loitering munitions and escort jammers, to examine the potential for integrating autonomous cyber weapons systems into military offensive cyberspace operations. This analysis finds that the more autonomous and lethal a weapon is, the more difficult it is to integrate it into military operations.

Subsequently, the current state of cyberspace operations is analyzed by discussing two cyberspace attacks, Stuxnet and Conficker. This analysis reveals that cyberspace operations currently demonstrate low to medium levels of autonomy and low levels of lethality. Therefore, there is a significant opportunity to adopt autonomous systems in the current context of offensive cyberspace operations. However, as the domain of cyberspace is transforming with the growth of complexity in technology, there are evolving legal, ethical, bureaucratic, and technical concerns. This thesis contains policy recommendations around technical standards, investment and acquisitions, and regulations regarding using autonomous cyber capabilities to address these challenges. Along with the policy recommendations, the core technical recommendation that enables autonomous cyber systems is the safe and effective deployment of human-machine interfaces to direct and control them. This thesis argues that interfaces are not merely supporting tools but are, in fact, the central technical mechanism for enabling traceability, oversight, and control in autonomous cyberspace operations. The future development and integration of autonomous cyber systems must prioritize interface design tailored to varying degrees of autonomy and operator control.

The technical portion of this thesis explores different interfaces for autonomous cyber systems, utilizing distinct models of autonomy within the Cyber Operations Research Gym (CybORG) simulation environment. Each interface corresponds to the three human-machine relationships discussed, which include a semi-autonomous interface (human in the loop), a supervised autonomous interface (human on the loop), and a fully autonomous interface (human out of the loop). These interfaces serve as a proof of concept, providing evidence that different levels of autonomy can be implemented on the same autonomous cyber system. Additionally, the use of LLMs to explain the actions taken by autonomous cyber systems is explored.

Ultimately, this thesis contributes technical and policy recommendations for navigating the future of autonomous cyber warfare. As autonomous systems evolve in sophistication and capability, the U.S. military must adopt policy and technical mechanisms that enable autonomy without sacrificing oversight, accountability, or effectiveness.