Effects Against a Dual-Use Logistics Node
You are the lead planner for a cyber operation supporting a theater campaign. The objective is to delay resupply of a paramilitary unit for 96 hours without permanent destruction and without exfiltrating data. The target is a regional logistics company's ERP system hosted by a managed-service provider that serves 14 tenants, including a civilian food distributor and a ministry of health cold-chain system. Access is available through a compromised supplier credential. Three courses of action are on the table: (A) deploy reversible encryption to the ERP database and hold the key; (B) alter shipping labels so scheduled deliveries misroute; (C) conduct a distributed denial-of-service against the provider. A kinetic strike on a bridge on the same route is scheduled in 72 hours, and deconfliction is required. The host nation is an ally, and discovery would cause political fallout. The commander asks for a recommendation that preserves the option to walk back effects.
1. Evaluate the three courses of action against necessity, distinction, proportionality, and reversibility.
Read the worked answer
Necessity: the objective is delay, so a precision effect on shipping labels (B) is more necessary than broad encryption. A is reversible only if the key and backups are intact; if the ERP is multi-tenant with weak isolation, encryption can spread to the food distributor and the health cold chain, which fails distinction and proportionality. C is the least discriminating: a DDoS on the provider affects all 14 tenants, is hard to scope, and creates a visible crisis that invites attribution. Reversibility: B can be corrected with a second label change; A depends on key custody and on the adversary not wiping backups. Recommend B with a hard exclusion list for cold-chain shipments, or a tailored A only if the provider confirms tenant isolation. Set a 96-hour stop condition and a rollback plan before execution.
2. What indicators and OPSEC considerations would you impose, and how do you deconflict with the kinetic strike?
Read the worked answer
Indicators: changes to label-routing rules, API calls from the supplier credential, and a rollback script. OPSEC: use the existing supplier credential, introduce no new tooling, keep no persistent implant beyond 96 hours, and avoid commands that reveal the supplier as the source. Deconfliction: the kinetic strike on the bridge at H+72 means cyber-induced rerouting could put civilian or friendly traffic on the bridge at the wrong time. Give the strike cell the expected routing changes and a no-effects window around H+72; if label manipulation would push convoys over the bridge, delay or cancel. Also deconflict with the allied host nation's intelligence service to avoid duplicate operations. Log the decision; a cyber effect that causes kinetic casualties is a proportionality failure, not just a coordination error.
3. The ERP also manages a vaccine cold chain for the health ministry. Does that change the recommendation?
Read the worked answer
The cold-chain function changes the target from a purely military logistics node to a dual-use object with immediate civilian health consequences. Under distinction, cold-chain shipments must be excluded; under proportionality, even a temporary misroute of vaccines could cause loss of life and is disproportionate to a 96-hour delay. If the ERP cannot separate military from cold-chain records, B becomes too risky unless the exclusion list is verified. A is worse because encryption could halt the cold chain. Recommend suspending the operation, or restricting it to label changes on a verified military-only shipping lane with human review before execution. Escalate to policy and legal; the commander needs a written risk acceptance. The fact that the effect is reversible in 96 hours does not cure harm to patients in that window.