Canadian Military Journal [Vol. 26, No. 3, Summer 2026 – Special Issue on the Cyber Domain and Artificial Intelligence]

Dr. Kristen Csenkey is a Social Sciences and Humanities Research Council (SSHRC) postdoctoral fellow at the Brian Mulroney Institute of Government, St. Francis Xavier University. She is also a fellow with the Canadian Maritime Security Network, the Centre for Military, Security and Strategic Studies at the University of Calgary, and the North American and Arctic Defence and Security Network (NAADSN), among others. Dr. Csenkey has previously led multiple Department of National Defence-funded projects on the defence and security implications of quantum technologies, connected aviation systems, and cyber-resilient electric vehicles. She currently leads a SSHRC Partnership Engage Grant focused on responsible global quantum technology governance. She holds H.B.Sc., M.A., M.A.P., and Ph.D. degrees.

Alexis Rapin is an associate fellow with the Raoul-Dandurand Chair of Strategic and Diplomatic Studies (affiliated with the University of Quebec in Montreal). His research focuses on cybersecurity and on the international security implications of digital technologies. In 2023, he testified before the Standing Committee on National Defence of the House of Commons of Canada on issues related to Canadian cyber defence and strategy. He is also a member of the editorial committee for Le Rubicon, a francophone platform dedicated to the analysis of international and strategic affairs.

In their novel 2034 (published in 2021), authors Elliot Ackerman and former United States (US) Admiral James G. Stavridis imagine a major future conflict between the United States and China.^Footnote1 The first pages open with an incident in which an American F-35 fighter is suddenly captured by Iran, after a cyber attack has enabled them to remotely take control of the aircraft. Later in the book, faced with a desperate situation, the US Navy decides to retire its F-35 fleet and reactivate its old F-18s, which are stripped of most of their on-board electronics in the process. As its adversaries have managed to compromise its high-tech aircraft, the United States is forced to rely on its technological ancestors, assumed to be digitally safer.

Although an intriguing and fictional situation,^Footnote2 the scenario narrated in 2034 relates to an idea gaining traction in the strategic literature: namely, that the current approaches to technological superiority that have been the hallmark of Western militaries for almost 40 years may now represent a vulnerability.^Footnote3 As cyber-warfare capabilities expand, it now seems possible for adversaries to take advantage of the emerging dependencies and possible vulnerabilities associated with highly connected technologies. Additionally, varying collective risk management practices, as well as legacy systems and an enlarged attack surface, increase exposure to sophisticated cyber attacks and potentially compromisable electronic components, systems, processes, technologies and people. We can observe this blending and complexity materializing in current geopolitical conflicts. For example, in the face of the ongoing Russian invasion, the Ukrainian military is reusing old field telephones along the frontline, fearing that its modern transmission systems may be compromised by its adversary.^Footnote4

In this paper, we take an expansive view of cyber-warfare and connected technologies, encompassing both cyber and electronic warfare. Although operations in the cyber domain and electromagnetic sphere can have distinct characteristics (especially with regard to the units, capabilities and know-how involved), we focus on the implications of the associated human and technological vulnerabilities, capabilities and activities. Broadly, we contextualize this situation as part of a holistic cyber concept where electromagnetic tools, such as radio frequency jamming, and cyber tactics, such as hacking, comprise a dynamic space where humans and technologies interact in a digital-physical environment.^Footnote5 This environment poses challenges for operations and activities in all domains, and we thus argue for solutions to both human and technical vulnerabilities.

The problem of interconnected technologies and threats proves especially meaningful to the aviation sector, in which aircraft, drones, helicopters,^Footnote6 and the digital-physical infrastructure that supports them are now highly digitized and connected. In a scenario that may well have inspired Ackerman and Stavridis, in 2011, the United States lost an observation drone after Iran hacked into its GPS system to land the drone on an Iranian base.^Footnote7 Drones are no longer considered part of a “poor man’s air force,”^Footnote8 especially when paired with new cyber tactics,^Footnote9 procedures,^Footnote10 and increasingly available commercial technologies.^Footnote11 Others have also detailed how the F-35, which is deployed by a growing number of Western armies, represents the epitome of a weapon system that is highly vulnerable to cyber threats.^Footnote12 Cyber threats are no longer a hypothetical danger: they are a reality for modern air forces to constantly be aware of, act upon, mitigate, and understand in terms of their connections in digital-physical spaces. The challenge before the forces is clear: identify how to deal with these threats, without renouncing their cutting-edge technologies.

One of the major issues is that the military “techno-solutionism,” inherited from the 1990-2000s,^Footnote13 may be replaced by a “techno-pessimism,” in which armed forces in general (and air forces in particular) may have declining confidence in their high technologies and devices and end up discarding some of them, as in 2034. Indeed, one of the great strengths of cyber capabilities is not only that they may undermine the availability and usability of military technologies, but also that they reduce the trust placed in them by a decision maker. By simply instilling doubt about the integrity of a system, cyber attacks may dissuade an actor from using a wider set of capabilities, thus producing a result disproportionate to their actual effects. Some, such as Christopher Coker,^Footnote14 have surmised that this could be the future strategy of foreign powers like China. A state could attempt not to match a technologically superior competitor, but instead force a reduction in the use of certain technologies by persuading the adversary that these have been compromised or rendered inept.

Consequently, cultivating and securing the confidence of Western militaries in the technologies they employ, and in which they have invested considerable resources, appears to be a crucial issue of strategic importance.^Footnote15 This may prove all the more important in a crisis context, where quick and difficult decisions may have to be made about the reliability of information technologies. The aim of this article is to present possible solutions to this challenge. We propose an approach that puts people at the heart of securing air power against cyber threats. This involves cultivating the human capital and organizational structures needed to maintain a high degree of trust and technological resilience within an air force. As the Royal Canadian Air Force celebrates its centennial, adapts to defend and protect Canada, and continues to support the defence of North America with the United States, there is an opportunity to explore the increasing connectivity between domains, technologies, and the continued importance of people in a dynamic environment.

Boyd 2.0: Reinventing the Loop

To fully understand the issue at hand, we must first go back to the origins of the techno-solutionist paradigm and especially to one of its key concepts: the famous “OODA loop” (for Observe, Orient, Decide, Act), theorized by US Air Force Colonel John Boyd in the 1980s.^Footnote16 Intended to describe the process by which an actor perceives a situation, analyzes it, deliberates, and acts accordingly, the OODA loop has since acquired much celebrity and—for better or worse—has been applied to a variety of non-military purposes, from business to sport. In the military domain, the OODA loop concept gradually gave rise to a full-fledged theory of victory, embraced by several major Western armed forces,^Footnote17 such as the United States, the United Kingdom and France.^Footnote18 In short, the core concept is that an actor who manages to complete the OODA cycle in the shortest possible time acquires an advantage over their adversary. Among other advantages, a rapid completion of the OODA loop is assumed to provide an actor with better situational awareness, ultimately enabling them to control the tempo of operations.^Footnote19 Over the course of the 1990s, this logic led militaries to acquire increasingly sophisticated Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance (C4ISR) technologies, to rapidly complete the OODA loop.

The OODA loop paradigm may now appear undermined by the increasing complexity and development of electronic and cyber-warfare capabilities. As cyber means have the potential to compromise the information technologies upon which the fluidity of the OODA loop heavily depends, they seem to threaten the viability of a way of war largely based on technological and information superiority.^Footnote20 Some approaches to contextualizing cyber operations demonstrate that an adversary can be restrained in the context of open warfare by hacking their information collection capabilities or communications systems.^Footnote21 In this regard, cyber threats appear of particular importance in the air domain, where digital technologies are not only omnipresent and critical to mission completion, but also represent potential attack vectors. Indeed, air forces around the world must now contend with cyber-related threats, the risks enmeshed within the usage of and connection to complex technologies, and varying human actions, such as GPS spoofing,^Footnote22 onboard software hacking,^Footnote23 or compromised data links,^Footnote24 in addition to threats relating to ground bases and physical installations. For instance, during the 2019 Gulf of Oman crisis, the US military hacked a database operated by the Islamic Revolutionary Guards in order to cripple Iran’s targeting capabilities (including through the use of attack drones).^Footnote25 The above-mentioned vulnerabilities, if exploited, may considerably slow down or even paralyze the completion of the OODA loop.

In spite of its many uses and misuses throughout the years, the OODA loop remains a useful thinking framework for our purpose, as it helps emphasize two crucial aspects related to the management of cyber threats. First, the principle of the OODA loop is applicable to situations relating to cyber attacks, posture and planning. When faced with a cyber incident, for example, a military must ultimately be able to Observe the impact of hacking activities, Orient itself amidst the impacts caused by the attack, Decide with confidence which capabilities are compromised and which remain serviceable, and finally Act on the basis of this analysis. The OODA loop concept can thus be applied to understanding the impact of an attack and the appropriate resulting actions. To be sure, the OODA loop is not used for reacting to a cyber incident; however, it is a useful concept to develop confidence in both people and technologies, as we will further demonstrate.^Footnote26

Second, although information technologies appear to be important enablers and accelerators of the OODA loop, they are by no means its only components. The processes by which a military gathers and processes information include crucial human and organizational components, which are as important as the technologies themselves.^Footnote27 As others have shown, modern militaries may display a less-than-optimal use of cutting-edge technologies due to poor management of human and organizational issues.^Footnote28 Of course, an increase in the speed of completion of the OODA loop is not the only factor in achieving mission success in modern warfare. Nevertheless, human and organizational components are involved in the process and must be further developed to ensure its rapid completion. The challenge then becomes trying to determine how to make the best use of available human and organizational resources to maintain or re-establish the fluidity of the OODA loop in a context where technologies are (or appear to be) degraded.

In the sections that follow, we provide examples drawn from Canada’s international allies, as well as suggestions to further develop resilience in digital and physical contexts of conflict. We conclude by drawing together our discussion and recommendations in the context of NORAD modernization and cooperation, as emphasized in the recently released defence policy update, Our North, Strong and Free: A Renewed Vision for Canada’s Defence. In doing so, we make connections between cyber, air, and people power.

Train and Plan: Preparing for Crisis Scenarios

There are several measures that militaries can take to anticipate and prepare for major cyber attacks. These measures may include conducting exercises that simulate military systems being compromised. As early as 1997, the US Department of Defense (DoD) conducted their first such exercise, Eligible Receiver 97, in which a National Security Agency (NSA) red team attempted to infiltrate the US Indo-Pacific Command’s networks.^Footnote29 Although the results proved catastrophic for the defenders, the exercise nevertheless helped identify various areas of cyber vulnerability within the DoD and demonstrated several ways to harden their defences. Such practices have since become increasingly common,^Footnote30 and take on a variety of forms.

These exercises are frequently practiced on an annual basis, and can include multinational cooperation, bring together mainly cyber specialists, and aim to simulate the active defence of a network against hypothetical hostile actors. Other types of exercises involve “traditional” forces who practice their ability to operate in the context of cyber attacks, with the goal of cultivating a conventional unit’s digital resilience. France, for instance, is increasingly conducting such training in “digitally degraded conditions” to better prepare units to carry out a mission even when certain technologies are rendered unavailable or unusable.^Footnote31

Exercises combining digital and traditional approaches can be particularly useful because they bring together cyber specialists and conventional forces personnel, and train units to synchronize their operations with cyber protection and remediation efforts. Several authors define this kind of synergy as “mission assurance,” whereby an organization’s mission capability is safeguarded by specific processes in the event of a system failure.^Footnote32 For example, in early 2024, the French Air Force simulated a cyber attack (and the restoration) on a Phénix refueling and transport aircraft’s onboard system,^Footnote33 bringing together aviators and cyber defence personnel as part of the major annual DEFNET exercise.^Footnote34 In such cases, the aim is not only to train a command to switch back to legacy technologies (in the manner of 2034), but also to practice confidently identifying the systems that remain trustworthy and those that seem compromised, and assessing the viability and speed of their restoration to operational status.^Footnote35 In other words, such exercises create opportunities to simulate and train in the Observe and Orient phases of the OODA loop in the context of cyber attacks.

Additionally, these types of exercises can help a military develop another important tool of resilience: contingency plans. Pre-established procedures can stipulate the appropriate actions in a crisis scenario where technological capabilities are degraded. In the air domain, the US Air Force is currently testing navigation methods based on the analysis of anomalies in the earth’s magnetic field to help its pilots find their way even if their GPS is neutralized.^Footnote36 These are only a few examples of procedures that can be devised and deployed in the event of a cyber attack. These types of responses, however, should be a part of comprehensive contingency plans, including ensuring that personnel have a minimum level of training in using alternative or “low tech” methods. When properly designed and disseminated, such plans can facilitate the Decide and Act phases of the OODA loop. These plans can serve to provide tested and potentially viable options for commanders and ensure that tasked personnel have the necessary information for implementation.

Organize: Keeping Your Friends Close

Another set of measures that can increase an air force’s resiliency to cyber threats relates to its organizational and bureaucratic structure: specifically, to the place occupied by cyber defence personnel within that structure. Like a jigsaw puzzle, the coherence of a military organization depends not only on the presence of all the pieces, but also on their appropriate position within the ensemble. The challenge in this case is to ensure that the “cyber pieces” of an air force are arranged in such a way as to be able to react effectively and efficiently in the event of a crisis.

As in many organizations, a major challenge lies in the fact that cyber defence specialists and units often remain a peripheral support element of military organizations, isolated from decision-making centres. Field commanders and cyber defence specialists do not often collaborate and may not really know each other professionally. To make matters more complicated, the two groups may have different educational backgrounds and ways of communicating about operational problems, and thus may not understand each other. As Michael Hayden, former US Air Force General and later NSA Director, laments: “After a few sentences, the cyber briefer often sounds vaguely like Rain Man to many of the seniors in the room. With a few more sentences, most are convinced that he is.”^Footnote37 Speaking the same language and being able to switch between languages may prove useful in bridging gaps in strategic and operational planning.

This gap is especially problematic because cyber threats can produce major effects on the trust that militaries place in technologies without nuance about the interconnections and complexities embedded within digital-physical systems. A component of this trust is based in part on the confidence that “traditional” military personnel place in the cyber specialists tasked with securing their systems.^Footnote38 To be sure, securing systems is not a function for cyber specialists alone – there is a broader role for commanders and their staff to play. In the military world, as in other contexts, it is easier to trust someone you know, and whose expertise you have already seen and experienced. More meaningful integration and interaction of an air force’s cyber personnel into its overall operations could be an organizational priority to consider, in addition to fostering mutually trusting relationships where commanders understand their dependence on cyberspace. Commanders would need to ensure that they and their staff (including the cyber specialists) play a role in the defence of systems. This cultivation of trust and expertise is especially important as many cyber attacks exploit human and technical vulnerabilities.

For instance, meaningful integration may involve setting up reciprocal learning mechanisms that enable personnel to better understand what cyber specialists do, how they think and work, and how this work fits into the strategic, operational, and organizational functioning of an air force. Other efforts may involve simply bringing cyber specialists physically closer to certain areas of operation. In the current war in Ukraine, for instance, Ukrainian and Russian forces have reportedly started to position cyber teams closer to the frontline, to better coordinate with forward-deployed troops (this decision may be due in part to the importance of ensuring the effective operation of drones).^Footnote39 In addition to shortening the communication chain, bringing diverse teams together may help both cyber operators and traditional personnel to better understand each other’s needs and foster greater synergies.^Footnote40 Introducing this proximity or familiarity may thus contribute to streamlining the efficiency of the OODA loop process.

Inspire: Creating the Right Incentives

The isolation of cyber specialists is not only due to their position in the organizational chart, but is also rooted in organizational cultures that influence the way they are viewed by the military community. Whether army, navy or air force, military organizations maintain certain norms, ideas and traditions that they perpetuate over time.^Footnote41 These specific cultures have a direct impact on the way organizations work; however, they can also contribute to issues relating to operational posture.

In an article, Rebecca Slayton explores how the persistence of the cult of the “warrior figure” directly contributes to the ostracization of cyber specialists in the US military.^Footnote42 The warrior figure paradigm refers to an institutional reverence for individuals from certain services, such as special forces or combat arms personnel, whose functions are perceived as more noble because they are closer to the martial ideal of the traditional soldier.^Footnote43 In the aviation domain, this logic applies particularly to the pilot figure, which is associated with an image of authority largely cultivated in popular culture.^Footnote44 As a result, these positions are often perceived to hold greater credibility in the military establishment to the detriment of branches seen as “less combative” and secondary, such as logistics or communications. There are practical implications of the cult of the warrior figure: for example, functions considered more prestigious are often guaranteed privileged access to certain positions or commands,^Footnote45 potentially making certain career choices more attractive than others.

Cyber specialists, who are not typically perceived as “real warriors,” may be negatively impacted by the perpetuation of the cult of the warrior figure. These negative impacts can include being more confined to menial roles, slowly climbing the institutional hierarchy, and being less likely to obtain certain prestigious commands.^Footnote46 Inevitably, this reality pushes many potential recruits towards other military functions or encourages experienced cyber specialists to join the civilian sector (where there are considerable opportunities in this domain).^Footnote47 In the United States, the US Air Force remains the service whose organizational culture has historically proved most welcoming to cyber specialists, perhaps due to a long standing “victory-through-technology” institutional mindset.^Footnote48 Yet, even in this seemingly successful case, the cyber-warrior status remains largely supplanted by the pilot as the ideal warrior figure. In a 2019 study, the RAND Corporation found that fighter pilots, followed by bomber pilots, remained by far the two most promising career paths for those wishing to climb the US Air Force hierarchy among the US military services.^Footnote49

If an air force aims to effectively deal with cyber threats in the future, then the status of cyber specialists needs to be elevated and paired with greater incentives to encourage members to embrace this vocation. This may involve reforming established recruitment, training, and retention mechanisms, or as Nicholas Romanow terms it, the “Cyber Talent Management Triad.”^Footnote50 Romanow argues that although military leaders understand the importance of cyber operations, there is a shortage of personnel to fill associated roles, and this may be because of workforce competition with the private sector and a military culture that is not attractive to the cyber community. One way to rectify this problem is to invest in developing strong cyber leaders and drawing on the military’s established service culture.^Footnote51 The US Air Force recently launched a program aimed at accelerating the commissioning of cyber specialists.^Footnote52 With a view to revising the traditional military career pipeline, one of the aims of this program is to reward cyber-related skills (relative to other conventional military experiences). Another is to make it easier for cyber professionals to attain a rank and pay that is comparable to related positions within the civilian sector.

As authors such as Max Smeets have shown, developing a military’s cyber capabilities requires properly combining a wide range of skills and people—and this goes beyond strictly technical personnel.^Footnote53 If human capital is important in maintaining the confidence of militaries in their technologies, and if human assets are deemed critical to the effective completion of the OODA loop process, then cyber personnel should feel encouraged and meaningfully engaged in this endeavour. In this case, the training and education of cyber personnel could be expanded to include cyber specialists, leaders and generalists. The bottom line is that all military personnel—particularly those in command positions—need to have the skills to understand their mission dependence on cyberspace and play their role in addressing cyber mission risk.

Conclusion

Maintaining confidence in digital technologies in the face of cyber threats must be paired with confidence in humans and their ability to work together. As we have shown, actively practicing cyber attack scenarios and developing contingency plans to deal with such situations help build and maintain confidence. Another approach is to focus on organizational structures with the aim of better integrating cyber specialists and establishing greater familiarity and synergy with other personnel. Shifts in organizational culture may also play an important role in confidence-building by creating greater incentives for individuals to embrace cyber-related functions.

In the recent defence policy update, the Department of National Defence details plans for implementing several technological innovations within NORAD, including in the domain of information and communication, stressing the need for command and control “to be digitalized to operate at machine speed.”^Footnote54 In this regard, Canada has begun adopting and integrating cloud-based command and control systems for Canada-based NORAD installations.^Footnote55 Although these new technologies provide opportunities for increased information flow, data collection, and analysis for enhanced situational awareness, they must be considered as a part of a system—or embedded within the loop with humans. Another important aspect to consider is that NORAD is a partnership based on interoperability and trusted cooperation. As such, confidence in information technologies is important; just as traditional personnel need to trust a cyber operator’s capacity to secure their systems, the bi-national partners must promote and maintain trust in their ability to maintain the integrity of their NORAD-related networks. Paying close attention to the human component of cyber may prove important in rectifying recruitment and retention issues within the Canadian Armed Forces.^Footnote56 Thus, the Canadian Armed Forces in general, and the Royal Canadian Air Force in particular, has a clear interest not only in ensuring that it remains an attractive employer for cyber professionals, but also in making the best possible use of the innovative people power it currently possesses in this domain.

While information technology is both a key component and a source of vulnerability for modern militaries, human and organizational factors represent critical safeguards for guaranteeing their operational capabilities. In this article, we sought to contextualize the problems associated with cyber within the air domain. The issues we raised are relevant for leadership in the Royal Canadian Air Force to consider both individually and jointly with the Canadian Army and Royal Canadian Navy. Long-term cybersecurity planning requires a whole-of-forces approach—not silos. We demonstrated that various instruments already exist, or are in development, and may be leveraged in a meaningful way. As the integration of emerging technologies becomes a priority area in continental defence and in other trusted cooperations,^Footnote57 allies will need to ensure that they are future-proofing technological and human capabilities to defend in unison. Faced with the risk of excessive techno-pessimism, air forces can therefore work towards maintaining confidence in their digital technologies by making sure they “keep humans in the loop.”