Metaphor Theory and Cyberspace

Metaphors involve “understanding and experiencing one kind of thing in terms of another,”Footnote ¹⁰ a transfer of meaning that is especially important for thinking through new or complex phenomena.Footnote ¹¹ Metaphors, however, are not simply evocative comparisons. Instead they have complex effects through their entailments: follow-on concepts or ideas that reshape thinking, decision making, and practical outcomes.Footnote ¹² IR studies have explored the effects of metaphorical language, demonstrating that even instrumentally deployed analogies have pervasive, often unintended policy consequences.Footnote ¹³

In addition to analogies and metaphors that are used consciously, other metaphors operate on a deeper level. These conceptual metaphors are “systematic sets of correspondences … across conceptual domains” that “reflect conventional patterns of thought.”Footnote ¹⁴ In this article I introduce a new category, foundational metaphors: conceptual metaphors constituted by using particular terms as labels. Like other conceptual metaphors, they provide “mental models [that] guide our thoughts without us really being aware of them”Footnote ¹⁵—reinforcing specific assumptions, suggesting particular analogies and discouraging others, and limiting which arguments can be made convincing. Foundational metaphors, however, specifically emerge when something is labeled with a term with connotations that imply answers to foundational questions: What defines this as a “thing”? What are its fundamental characteristics? To what other things is it similar? Whether chosen deliberately or intuitively, the label itself is often presented by speakers as commonsensical, or not needing to be explained.Footnote ¹⁶ Nonetheless, whether anyone is aware of it or not, metaphorical correspondences can emerge.Footnote ¹⁷

Unlike explicitly stated metaphors (or analogies), foundational metaphors’ correspondences are implied by the connotations of terminology—yet either type of metaphor could draw the same correspondences. Because foundational metaphors are implicit, identifying them requires multiple steps: noting that a particular label is consistently used,Footnote ¹⁸ examining the range of metaphorical correspondences potentially implied, and then analyzing surrounding texts to see which of those correspondences—if any—are guiding the entailed descriptions, arguments, and explicit analogies and metaphors. The content of a foundational metaphor is shaped, as well as revealed, by surrounding language. For example, explicitly stated metaphors and implicit foundational metaphors often work in conjunction, each structuring the meaning of the other.

I focus on rhetoric and argument, where foundational metaphors play a powerful and distinct role.Footnote ¹⁹ Rhetorical contestation takes place at all levels of international politics,Footnote ²⁰ and even “rational” actors need to use acceptable “normative reasoning” to convince others.Footnote ²¹ In such arguments, language can be deployed to remove opponents’ discursive resources—not changing their minds, but denying them the “rhetorical commonplaces” needed to convince audiences.Footnote ²² Metaphorical language in contestation ranges from intentional deployments to unconscious choices. Historical analogies, for example, are often selected instrumentally by decision makers (albeit from those resonant within a community).Footnote ²³ By contrast, invoking foundational metaphors by using particular terminology is rarely so instrumental. Speakers may reach for a term because they believe it “works” as a label rather than because they think it will directly support their arguments. In fact, opposing arguments often use the same terminology and draw on the same foundational metaphors, the entailments of which then frame debate. Yet not all arguments are as readily supported by the metaphors implied by shared terms—foundational metaphors can make certain arguments more convincing.

As with other linguistic processes, foundational metaphors are simultaneously a resource, constraint, and context for political interaction.Footnote ²⁴ Like “dominant narratives” in foreign policy, these metaphors “do not fully smother contestation but channel it,”Footnote ²⁵ setting boundaries for which arguments count as legitimate. The point at which terminology comes to be at least provisionally settled—that is, presented as unproblematic and commonsensical—constitutes an important critical juncture.Footnote ²⁶ Contestation and argument continue, but within different bounds.

Metaphorical language is everywhere in cybersecurity, as designers, users, and policymakers rely extensively on analogies and metaphors—including terminology no longer even considered metaphorical (desktop, virus, firewall). Existing studies have focused on the effects, often unintended, of instrumental analogies and metaphors.Footnote ²⁷ For example, the analogy to Pearl Harbor explicitly emphasized the possibility of a catastrophic attack on infrastructure to promote specific preventive measures, but it also unintentionally minimized the threat of continuous low-level intrusions and espionage.Footnote ²⁸ Likewise, the “threat representations” that decision makers instrumentally deploy to support their arguments also shape perceptions in unintended ways.Footnote ²⁹ Foundational metaphors, implicit in terminology, have received far less attention.

The word cyberspace implies a metaphor between the Internet (and related systems) and some kind of space.Footnote ³⁰ This implicit correspondence follows a common pattern: something “relatively abstract, complex, unfamiliar, subjective, or poorly delineated” (global computer networking) is understood by reference to something “concrete, simple, familiar, physical and well-delineated” (physical space).Footnote ³¹ Yet space can be understood and defined in various ways, and identifying the specific spatial metaphor implied by a community's use of cyberspace requires examining the associated arguments and analogies, especially when they form a coherent whole.Footnote ³² Although the implication that cyberspace is a “place” is almost never meant literally, implicit metaphors nonetheless shape discussion.

Where, then, did cyberspace originate? Author William Gibson coined the word in the early 1980s, noting later that “it seemed evocative and essentially meaningless.”Footnote ³³ Yet there was a meaning embedded in the term itself, in its designation as a type of space—reinforced by the spatial language used to describe this “consensual hallucination.”Footnote ³⁴ Within a few years cyberspace had been adopted in the media and by technology companies, and by the mid-1990s it was widely used to describe where Internet users were, metaphorically.Footnote ³⁵ It was deployed in explicitly political arguments, such as the 1996 “Declaration of the Independence of Cyberspace,”Footnote ³⁶ as well as in late-1990s legal debates about regulating online activity—in which opposing arguments shared the metaphorical framework that online activity occurred “in cyberspace.”Footnote ³⁷

The popularity of a spatial term like cyberspace was in part predictable. Spatial metaphors are often used to understand abstract concepts,Footnote ³⁸ and they have been widely applied to online activities.Footnote ³⁹ Yet the embrace of this specific term was also, in part, coincidental.Footnote ⁴⁰ Many technologists had been interested in cybernetics and thus were likely to find the cyber prefix appealing.Footnote ⁴¹ In the early 2000s, however, the term largely disappeared from popular and academic discourses.Footnote ⁴² Yet it was exactly in this period that cyberspace increasingly appeared in US military language, where the term has since become ubiquitous.Footnote ⁴³

In short, cyberspace is more than just a catchy word. In the specific context of US security policy and military doctrine it has been an essential component of terminology—and implicit metaphors—used to conceptualize the political and security implications of information technology. These metaphors have provided the foundation for specific arguments and policies deployed by the US government to manage cybersecurity threats. As other states have emulated, challenged, or resisted US actions, the language and policy of the United States have played a significant role in shaping the global response to cybersecurity issues.Footnote ⁴⁴

US Doctrine and the “Cyberspace Domain”

Since computer security first arose as a policy issue, US decision makers have used an evolving set of terms. By the late 2000s, however, US military doctrine had come to rely almost exclusively on cyberspace-based terminology, further specifying that computers and networks constitute a “domain” of warfare. This dual conceptual framework has changed little in the past decade and is now deeply rooted in how the US military talks about, and organizes for, cybersecurity. To uncover this pattern, I draw on a comprehensive reading of public and declassified cybersecurity documents. They were not read for an exact count of terms, or to identify the first or last use of a particular word or phrase. Instead, I survey trends in dominant terminology and implied foundational metaphors (identified in surrounding texts). Focusing on this level of language reveals broad patterns that cut across variation in documents’ arguments, author intent, or drafting processes.Footnote ⁴⁵

In the 1980s, cybersecurity was rarely addressed in major national security statements; when it was, documents discussed the security of “telecommunications” and “information systems.”Footnote ⁴⁶ The terminology changed by the mid-1990s, especially at the Department of Defense (DoD), where “information warfare” dominated.Footnote ⁴⁷ This was a broad concept: the definition in an influential 1995 Air Force document includes not only computer-network attack and defense but also all operations targeting information, from propaganda to the physical destruction of informational hardware.Footnote ⁴⁸ “Joint Vision 2010,” released by the Joint Chiefs of Staff in 1996, reflects a similar emphasis on information warfare and operations.Footnote ⁴⁹ Neither document uses “cyberspace” or cyber-prefixed terms.

At the same time, “cyberspace” began to appear in other government documents as something within which things happen. For example, a 1995 National Security Agency (NSA) document is titled “SIGINT and INFOSEC in Cyberspace,”Footnote ⁵⁰ and in 1997 an outgoing NSA official argued that cyberspace is a distinct site of espionage and conflict akin to territorial spaces: “Almost every type of action that occurs in the physical world will have a corollary in cyberspace,” and “The Future of Warfare is Warfare in Cyberspace.”Footnote ⁵¹ Yet these documents continued to use “information warfare” language as well.

Published in 2000, the Joint Chiefs’ “Joint Vision 2020” reveals an evolution of information-warfare terminology, while setting the stage for the important later shift to “cyberspace domain.” Like its 1996 predecessor, this document continues to use information-based terms rather than “cyberspace.” Yet it now defines information as a “domain of operations,” noting that “operations within the information domain will become as important as those conducted in the domains of land, sea, air, and space.”Footnote ⁵² In contrast, earlier documents had sometimes proposed an area or realm of conflict in which information plays a special role,Footnote ⁵³ but the terminology was inconsistent and had not included the word domain. (While it is impossible to prove the complete absence of a term or usage, it is suggestive that the DoD Dictionary—which collates terms from military documents—starts defining “domains” in 1999).Footnote ⁵⁴

In the mid-2000s, US military language took a decisive shift, joining domain with cyberspace—a combination that would prove crucial. For example, the Joint Chiefs’ 2004 “National Military Strategy” uses cyberspace as a framework to understand the new domain (“The Armed Forces must have the ability to operate across the air, land, sea, space and cyberspace domains”).Footnote ⁵⁵ Soon thereafter, other documents consistently deploy cyberspace language in place of information terms. The Joint Chiefs’ classified “National Military Strategy for Cyberspace Operations” from 2006 explicitly defines cyberspace—not information—as a domain and argues that “treating cyberspace as a domain establishes a foundation to understand and define its place in military operations.”Footnote ⁵⁶ Finally, a 2008 memo from the Deputy Secretary of Defense officially defines cyberspace as a “global domain” in doctrine,Footnote ⁵⁷ a definition subsequently adopted across DoD documents.

The metaphorical correspondences implied by cyberspace terminology provided a consistent conceptual framework for discussing this new nonphysical domain—in other words, cyberspace gave domain a particular meaning. The earlier information-based terminology was ambiguous, with diverse connotations, and the relationship between information and physical spaces was never clarified. For example, the “Joint Vision” document from 2000 argues that information has a “multidimensional definition”: “domain of operations” and “target, weapon, resource.”Footnote ⁵⁸ Given that information was essential to military operations long before the Internet,Footnote ⁵⁹ is the “information domain” actually new? Which aspects are new and require new strategies or tactics? These questions were difficult to address with information-based terminology.

By labeling this new domain “cyberspace,” however, it could be designated as a domain and nothing else. Cyber warfare involves “operating within or through [cyberspace],” while information operations aim broadly to “influence adversary decisions.”Footnote ⁶⁰ Essential to this discursive effort was the particular spatial metaphor implied by the combination of cyberspace with domain. While each term has diverse possible meanings, when used together their definitions are narrowed. Without this further specification, cyberspace could imply various types of space: political territory, postmodern “space of flows,” notional space of ideas, or others. Likewise, domain's multiple etymologies—ranging from mathematics to medieval political authority over land—imply diverse metaphorical correspondences. Because the two terms are deployed together in US military documents, however, the metaphorical implications of each are narrowed down to a correspondence between the cyberspace domain and the four physical spaces within which the military already operates.Footnote ⁶¹ This is evident in the geographic or territorial analogies deployed in surrounding texts: “terrain,” “high ground,” “borders,” “failed state,” “ungoverned frontier,” and so on.Footnote ⁶² These explicit comparisons reveal the characteristics of the implicit spatial metaphor and they are simultaneously made more convincing by it.Footnote ⁶³

The foundational metaphor implied by cyberspace domain allowed convincing parallels to be drawn to physical spaces. Broad objectives “in cyberspace” can be framed with available concepts: for example, the 2006 Joint Chiefs document states that a key “strategic goal” is “to ensure US military strategic superiority in cyberspace” just as in air, sea, land, and space.Footnote ⁶⁴ The rhetorical power of that statement follows from the metaphor implied by the terms: here is a new space, created by computers and networks, into which existing goals can be translated.

DoD documents subsequently argue repeatedly that cyberspace is a domain, distinct from the four physical domains but similar in that the US military needs to operate within it. For example, a 2009 “Cyber Warfare Lexicon” defines a host of cyber-prefixed terms as the versions of “real world” phenomena taking place “in cyberspace.”Footnote ⁶⁵ Especially after 2010, the dual shift in terminology—deploying the “cyberspace” label and then calling it a “domain”—becomes pervasive in high-profile documents. The Pentagon's 2011 “Strategy for Operating in Cyberspace,” for instance, frames cyberspace as a domain within and through which the US and its adversaries act.Footnote ⁶⁶ Although this document actively argues that cyberspace should be treated as an operational domain, it simply asserts that there is something called “cyberspace” within which things happen.Footnote ⁶⁷ This terminology was taken up throughout the US military, as service branches used cyberspace-domain language to analogize to their existing practices and concepts.Footnote ⁶⁸

By the mid-2010s, the idea of cyberspace as a domain of warfare was fully entrenched in US military language.Footnote ⁶⁹ For example, while the DoD's 2011 cybersecurity strategy explicitly argues that cyberspace should be treated as an operational domain, the 2015 and 2018 revisions simply assume that cyberspace is a domain and discuss how to operate in it.Footnote ⁷⁰ This terminology was not only directed at external audiences; it also informed internal DoD discussions. Classified memos use the same foundational metaphor, including, for example, a 2010 secret instruction on “counterintelligence activities in cyberspace”Footnote ⁷¹ and a 2013 document on “Human Intelligence (HUMINT) Activities in Cyberspace.”Footnote ⁷² A 2012 Presidential Decision Directive authorizing offensive cyber operations also addresses threats and actions “in cyberspace.”Footnote ⁷³ Finally, internal Pentagon communications about disrupting the Islamic State's online presence discuss the need to “counter the Islamic State of Iraq and the Levant (ISIL) in Cyber Space.”Footnote ⁷⁴

This terminology has become both stable and ubiquitous, demonstrating its rhetorical power and its ability to fit logically with existing military concepts and ideas. In other words, at this point there is little contestation among military authors about the language to be used; the arguments are entirely about how to apply the cyberspace-domain concept to improve strategies and tactics. This framework's persistence for more than a decade is striking, given the incentives to propose new terms. Military documents often note the importance of language,Footnote ⁷⁵ and promoting new or different terminology can be one way to contribute to strategy or doctrine.Footnote ⁷⁶ Since at least 2010, however, efforts to innovate have continued to discuss the “cyberspace domain.”Footnote ⁷⁷

While scholarly attention usually focuses on contested aspects of language and policy, the consolidation of terminology—and implicit foundational metaphors—can be equally important. Contestation continues, but the available rhetoric has been transformed. Tracing these linguistic processes reveals new aspects of cybersecurity policymaking.

Metaphors and Institutional Change

In the mid-2000s, significant intrusions into US government and corporate networks intensified pressure on policymakers to respond.Footnote ⁷⁸ Yet the nature of that response was far from preordained and was shaped by the foundational metaphor implicit in cyberspace-domain terminology. This metaphor gave particular arguments more weight and made it possible to present certain institutional solutions as commonsensical. In other words, language has not driven policy directly, nor has it entirely constrained how speakers or audiences think. Instead, explicit and implicit linguistic framings have made some propositions more resonant with existing ideas, arguments, and interests, strengthening those positions in political contestation.

A critical juncture occurred in the late 2000s, with concurrent changes in US doctrine, institutions, and outcomes. The shift to an exclusive reliance on cyberspace-domain terminology allowed an implied foundational metaphor to be deployed—both instrumentally and unintentionally—to support particular institutional and policy changes, at two levels of contestation. First, as state agencies have competed for cybersecurity responsibilities and resources, this language has been successfully used to argue for increasing the role of military over civilian institutions.Footnote ⁷⁹ Second, within the military, it supported the creation of US Cyber Command, a single organization for military operations “in cyberspace.” The resulting institutional changes have had significant downstream effects, including enabling an increase in offensive cybersecurity actions by the US military. Given the ambiguity of many cybersecurity tasks—which could be framed in terms of commerce, law enforcement, homeland security, or national defense—these outcomes were not simply the most effective or “rational” responses.

Policy outcomes in cybersecurity emerge out of numerous processes, of course, many of which interact with the rhetorical effects of language. For example, DoD funding procedures can make it difficult to “mainstream” solutions to new problems, that is, to add a new task across existing organizations.Footnote ⁸⁰ Overcoming that challenge by creating a new organization, however, depends on the availability of rhetorical resources to support such an institutional change. Similarly, while the militarization of cybersecurity may reflect general post-9/11 trends,Footnote ⁸¹ the metaphors implied by cyberspace-domain language have made it possible to present this as a commonsense solution. Finally, although institutional and policy shifts have coincided with broader contextual changes—technical innovation, more skilled adversaries, turnover and learning among policymakers—the effects of those factors are, on their own, indeterminate. For example, given that there is rarely a single optimal policy, learning alone cannot explain which specific solution is chosen.Footnote ⁸² Instead, how officials revise strategies, respond to adversaries, and understand novel threats have all been framed by the terms, rhetoric, and ideas that predominate within the military cybersecurity community—including the metaphors implicit in cyberspace domain. At key moments, bureaucratic competition over cybersecurity has been shaped by this language—probabilistically, not deterministically—as cyberspace-domain terminology favored certain arguments over others.

DoD officials have actively used this framework to denote cybersecurity as a military rather than civilian concern, attempting to close the controversy around the nature of the problem and its solution. The early-2000s shift from information warfare to cyberspace domain—with its implied spatial metaphor—made it rhetorically easier to present cybersecurity activities taking place in something analogous to air, land, sea, and outer space, all of which involve nonmilitary issues and concerns but, simultaneously, are spaces in which the military legitimately operates.Footnote ⁸³ For example, in 2010 the Deputy Secretary of Defense wrote in Foreign Affairs that “the Pentagon has formally recognized cyberspace as a new domain of warfare … just as critical to military operations as land, sea, air, and space.”Footnote ⁸⁴ Officials at other agencies “were as much surprised by the article as some foreign audiences,”Footnote ⁸⁵ and they immediately protested this designation.Footnote ⁸⁶ Information-warfare concepts had not inspired such a direct reaction, but the cyberspace-domain framework suggested a more expansive—and bureaucratically threatening—claim.

This language supports military arguments, while also having an intrinsic appeal to military actors. As Michael Hayden (retired Air Force general and former NSA and CIA director) put it in 2011: “Like everyone else who is or has been in a US military uniform, I think of cyber as a domain. It is now enshrined in doctrine: land, sea, air, space, cyber. It trips off the tongue, and frankly I have found the concept liberating.”Footnote ⁸⁷

That Hayden finds this language “liberating” reflects how the implied spatial metaphors are simultaneously useful in policy arguments and appealing as a metaphorical framework for understanding a complex and challenging area.Footnote ⁸⁸ As noted earlier, they allow policymakers to apply existing ideas to new problems. The relevant questions are then straightforward (How do known strategies apply “in cyberspace”?) and less likely to require entirely new concepts or models. The ability to draw from other domains has been essential to military staffing, since many senior cybersecurity positions were initially filled by individuals who began in traditional “kinetic” operations.Footnote ⁸⁹ In short, this terminology was adopted because it intuitively fit as much as because it was instrumentally useful.

While few argue that the military should play no role in cybersecurity, the DoD's gradual expansion of its remit is potentially reshaping US civil-military relations, which are defined by such “haggling over prerogatives.”Footnote ⁹⁰ Beyond the core problem of civilian control—formally settled in the United States—factors like the balance of funding affect how power within the state is distributed and whom the public perceives to be “in charge” in a particular policy area.Footnote ⁹¹ Contestation thus affects the relative primacy of civilian goals, the choice of solutions to new problems, and how problems are defined to begin with—especially with novel or ambiguous issues. If the military's definition of cybersecurity problems comes to be accepted as commonsensical and beyond debate, that definition will frame which solutions are in or out of bounds.Footnote ⁹² The recent expansion of the military's role thus represents an important shift in how the US government approaches cybersecurity.Footnote ⁹³

Within the Defense Department as well, there has been competition over cybersecurity roles and resources.Footnote ⁹⁴ Diverse elements within the DoD have attempted to claim cybersecurity as “their” issue area, with the Air Force most prominent among the service branches. In the 1990s, for example, Air Force documents argued that the “information realm” was most similar to air,Footnote ⁹⁵ and in 1995 it created one of the first “true combat” units for information attack.Footnote ⁹⁶ A decade later, Air Force officials drew on emerging cyberspace language to propose an Air Force Cyber Command, describing its core mission as “to fly and fight in the Air, Space, and Cyberspace.”Footnote ⁹⁷

Yet it was officials advocating for a joint approach, particularly within the Office of the Secretary of Defense, who successfully deployed the cyberspace-domain framework. Had the discussion simply been about cyberspace—that is, had cyberspace not been designated as a domain—Air Force arguments could have been more convincing: cyberspace is complex, and operating there shares features with maneuvering in air and space more than with acting on land or sea. Framing cyberspace as one of five domains, however, implies that each domain, while distinct, shares certain characteristics (i.e., those making it a domain), supporting the need for parallel organizations. This fits better with building a joint force for cybersecurity than with subsuming cyberspace under the Air Force, a service already dedicated to a “traditional” domain.Footnote ⁹⁸ In 2008, Air Force Cyber Command's permanent activation was denied.

Instead, in 2009 the relevant tasks were newly combined in US Cyber Command, one of the most significant organizational changes in US cybersecurity policy in the last two decades.Footnote ⁹⁹ Creating an independent command for both defensive and offensive cyberspace operations represents a combat-focused “military paradigm” that favors specific “legal and policy choices,”Footnote ¹⁰⁰ supported rhetorically by the foundational metaphor implied by cyberspace-domain terminology. Unfortunately, the explicit analogies that have followed (e.g., maneuver or deterrence in cyberspace), while succinct and evocative, may compromise key cybersecurity goals.Footnote ¹⁰¹ Military institutions are always guided by more than official mandates or rational decision-making processes, and foundational metaphors shape outcomes in ways similar to organizational procedures or service “personalities.”Footnote ¹⁰²

While distinct from the service branches, Cyber Command has been tightly linked to another military organization: the National Security Agency (NSA). Its commander is “dual hatted” as NSA director, and both headquarters are at Fort Meade. These connections reflect the Command's need to coordinate with NSA signals-intelligence activities—and, even more, to draw on NSA resources and expertise.Footnote ¹⁰³ Nonetheless, the Command is organizationally separate, with authority to conduct combat operations rather than espionage. This distinction has enabled actions that would have been extremely unlikely to emerge from an intelligence organization, including Cyber Command's recent uptick in “offensive operations.”Footnote ¹⁰⁴ Revealing capabilities by engaging in attack or disruption runs contrary to the goal in intelligence collection to keep capabilities secret—and thus usable—for as long as possible. Overall, both organizations have likely seen advantages as well as disadvantages to this arrangement.Footnote ¹⁰⁵ Thus, while the dual hat can certainly be read as NSA “winning” a bureaucratic battle, the expansion of Cyber Command's combat-oriented activities—supported by the DoD's dominant cyberspace-domain language—suggests a limited NSA victory at best.Footnote ¹⁰⁶

Cyberspace-domain language provided essential rhetorical tools for those advocating for the new command. For example, the 2009 memo establishing Cyber Command emphasizes various threats “in cyberspace” and the need “to secure freedom of action in cyberspace.”Footnote ¹⁰⁷ In 2010, the Deputy Secretary of Defense argued that, because “the military must be able to defend and operate within [cyberspace] … the Defense Department needs an appropriate organizational structure.”Footnote ¹⁰⁸ Which institutional solution is deemed “appropriate,” of course, is conditioned by how problems are framed—here, entirely in terms of operating “in cyberspace,” making Cyber Command the correct solution. The Command's mission statement also draws on implicit spatial metaphors: the Command will “ensure US/Allied freedom of action in cyberspace and deny the same to our adversaries.”Footnote ¹⁰⁹ In later documents and testimony related to Cyber Command, cyberspace-domain language continues to be essential to further argument—and goes largely unremarked.Footnote ¹¹⁰

Even when recent statements explicitly emphasize new threats—requiring new responses—discussion continues to rely on the same terminology and spatial analogies. For example, the 2018 “Command Vision” outlines a significant shift in strategy toward a more offensive posture through “defending forward” and “persistent engagement,” repudiating the more reactive 2011 strategy.Footnote ¹¹¹ Cyberspace-domain language helps to legitimize the new posture—including potentially controversial elements like “operating outside our borders, being outside our networks.”Footnote ¹¹² Operating in another state's territory could be interpreted as a form of aggression, or raise concerns about possible escalation.Footnote ¹¹³ Those concerns, however, are undercut by arguments drawing on spatial metaphors. For example, in 2019 Paul Nakasone, the head of Cyber Command, wrote:

The Command's new posture thus involves activity “in cyberspace” analogous to uncontroversial actions in the physical domains. Of course, the idea that these all follow the “same logic” depends on the underlying foundational metaphor that connects cyberspace to physical spaces, especially to global commons like the high seas.Footnote ¹¹⁵

Nakasone's statement, moreover, operates at multiple levels of contestation simultaneously. It explicitly defends Cyber Command's new proactive posture. It justifies the Command as the military's centralized cybersecurity organization—if the high seas have the Navy and airspace has the Air Force, cyberspace requires Cyber Command. Finally, it implicitly promotes the broader role of the military: civilian agencies do not contest the DoD securing physical domains, so why should they protest the “same logic” applied to cyberspace? All three arguments rely on the metaphor implied by cyberspace domain.

Within the US military, this language appears to be firmly consolidated. It was first explained and advocated, then officially declared as doctrine, and finally taken as given. Cyberspace-domain terminology continues to justify the existence of Cyber Command and, at the same time, the institutionalization of this language in the Command's mission—and even its name—makes it increasingly difficult for an alternative framework to replace it. In fact, while discursive communities outside the government have long resisted this terminological framework—domain, cyberspace, even the cyber prefixFootnote ¹¹⁶—the military's terms and implied foundational metaphors have spread into broader discussions across the federal government.Footnote ¹¹⁷ This terminology continues to shape policy outcomes, not just rhetoric: the 2019 National Defense Authorization Act expanded Cyber Command authorities to respond to a wide array of threats “in cyberspace,” resulting in a significant increase in offensive actions.Footnote ¹¹⁸

Counterfactuals and Comparisons

How might different language have led to different outcomes? Without the foundational metaphor implied by the combination of cyberspace with domain, cybersecurity debates would have played out differently. Essential here is the conjunction of the two terms and how that specified and strengthened the particular metaphorical implications that emerged: namely, that the Internet has created a virtual space with territorial features, within which military ideas, strategies, goals, and actions apply. Without the specification as a domain, cyberspace could have continued to be associated with a wide range of spatial ideas and implications—in fact, before the military adopted this term, its most prominent political uses were explicitly nonterritorial.Footnote ¹¹⁹

Without the combined term, arguments for increasing the military's cybersecurity role would have lacked a powerful rhetorical resource, and counterarguments by other agencies might have been more successful. Consider, for example, a published back-and-forth between officials from the DoD and the Department of Homeland Security (DHS).Footnote ¹²⁰ In response to the DoD's assertion that cyberspace constituted a “domain of warfare,” the DHS officials first deployed a nonspatial concept: “cyber-ecosystem—not just technology, but also policy, procedure, practice, and law.”Footnote ¹²¹ Yet the cyberspace term could not be ignored, so the DHS response also tried to redefine it: “cyberspace is fundamentally a civilian space.” But land, sea, air, and space are “civilian spaces” and “warfighting domains” at the same time. Thus “domain” specifies exactly what the DoD means by “cyberspace” and makes it possible to undermine counterarguments that use cyberspace language. Without this ability to set the terms of the debate (literally), the DoD position would have lacked a key rhetorical advantage it has enjoyed against civilian agencies’ arguments.

We can also ask what might have happened if Gibson had not coined the specific term cyberspace to begin with. It is certainly possible that a different term implying a spatial metaphor could have emerged and become widely adopted.Footnote ¹²² If combined with domain (or the like), another spatial term could in theory have constituted similar rhetorical resources.Footnote ¹²³ Yet not every candidate term with spatial connotations would have worked as effectively. For one, “cyberspace” does not just connote a space, it literally contains the word space. And the term is syntactically efficient: speaking about events or actors “in cyberspace” is more succinct than many alternatives.Footnote ¹²⁴ Without the specific word cyberspace, it is unlikely that arguments supporting the role of military actors and interests in this domain would have been so convincing.

Without cyberspace-domain language, nonspatial terms and implicit foundational metaphors might have become more prominent in these cybersecurity debates. For example, when “the Internet” is used as an overall label for networking and computing,Footnote ¹²⁵ it can imply a set of metaphorical correspondences to networks rather than spaces.Footnote ¹²⁶ The resulting emphasis on network features (e.g., nodes and connections) rather than operating in a virtual space yields different interpretations of cybersecurity problems and solutions.Footnote ¹²⁷ Biological terms and metaphors like ecosystem, similarly, might be more prevalent in the absence of cyberspace-domain language, yielding different rhetorical resources.Footnote ¹²⁸ While these and other terminologies have come in and out of use,Footnote ¹²⁹ few have become as firmly consolidated within a community—and thus as consequential—as the US military's use of cyberspace domain.

The effects of the DoD's cybersecurity language are further illustrated by comparing how different terminology has worked within other agencies—and by considering how those terms could have altered outcomes at DoD. For example, since its creation in 2002, DHS has not characterized cyberspace as a spatial domain but has instead discussed cybersecurity in terms of protecting critical infrastructure. More than a description of Internet hardware, “critical infrastructure” implies a metaphorical correspondence between the Internet and other communication and transportation systems. The terminology first became prominent in a 1997 presidential commission report that focused on “cyber” threats to civilian infrastructure, without framing them as threats within digital spaces and without using “cyberspace” at all.Footnote ¹³⁰ Although later DHS documents occasionally use the term, it is not discussed as a domain and the metaphor of actions in a virtual space is absent.Footnote ¹³¹

The contrast between DHS and DoD language has had observable consequences. The two have reacted differently to major cybersecurity incidents, with each organization's response guided not only by its mission but also by its foundational metaphors. In 2016, as evidence of Russian interference in US elections surfaced, the DHS largely stayed within the frame of monitoring, preventing, and mitigating direct attacks on election infrastructure.Footnote ¹³² The department's institutional response was then to reorganize its relevant components as the Cybersecurity and Infrastructure Security Agency (CISA). The DHS Secretary argued that this change “allows us to confront the threats of today.”Footnote ¹³³

The Pentagon's response to 2016 election interference, on the other hand, has involved a command whose mission is entirely framed in terms of operating “in cyberspace,” defined as a military domain. Russian actions are thus labeled as “cyberattacks,” and threats to the territory and sovereignty of the United States.Footnote ¹³⁴ In March 2018 comments on Russian interference, for example, the head of Strategic Command argued that “Cyberspace needs to be looked at as a warfighting domain … and if somebody threatens us in cyberspace, we need to have the authorities to respond.”Footnote ¹³⁵ The response by US Cyber Command has then focused on operating proactively “in cyberspace” to prevent or disrupt future interference, including the 2018 election-day operation discussed earlier.

How would the two organizations respond differently if their terminologies and metaphors were reversed? If the DoD were to use critical infrastructure as a cybersecurity framework,Footnote ¹³⁶ its response to foreign interference would likely be framed by its existing definition of “critical infrastructure protection” in general: “Actions taken to prevent, remediate, or mitigate the risks resulting from vulnerabilities of critical infrastructure assets. Depending on the risk, these actions could include changes in tactics, techniques, or procedures; adding redundancy; selection of another asset; isolation or hardening; guarding, etc.”Footnote ¹³⁷ None of this is about defending those “assets” by operating in adversaries’ territory and interfering with their corresponding systems. Actions like the 2018 cyberattack on Russian sources of election interference would not easily fit in this frame, making them more difficult to present as commonsensical and proportionate responses.

Likewise, DHS would pursue different policies if it relied on spatial terminology and metaphors. While using “domain” would be unlikely—since that term emerged from a specific context at DoD—a spatial model that DHS could conceivably draw on is an analogy to border protection (one of “six overarching homeland security missions”).Footnote ¹³⁸ This would place less emphasis on vulnerability and resilience in core infrastructure and more on preventing intrusions at network locations analogous to territorial boundaries (i.e., away from election hardware itself).Footnote ¹³⁹ Yet DHS's long reliance on critical infrastructure language, which predates the department itself, appears to undermine other frameworks—just as DoD's cyberspace-domain terminology has, thus far at least, remained impervious to alternatives.

“Cyberspace” Beyond the United States

In this article I have analyzed how cybersecurity has been constructed by language, going beyond the focus in existing literature on technical and strategic aspects. In particular, foundational metaphors, implied by widely used terminology, have shaped arguments, policy responses, and institutional changes. In US military doctrine and strategy, the cyberspace domain label has constituted a set of underlying spatial metaphors since the mid-2000s—providing instrumental rhetorical tools and, simultaneously, structuring the arguments, analogies, and policies brought to bear. This has shaped contestation within the US government, supporting militarization and the creation of a unified Cyber Command. In circumstances of rapid technological change, uncertain consequences, and novel vulnerabilities—conditions clearly present in cybersecurity—how issues are framed in terminology and then institutionalized can have significant effects. While I have focused on the United States, cybersecurity language and metaphors also shape contestation in other contexts.Footnote ¹⁴⁰

For one, US terms—and implicit metaphors—have appeared in documents from other states, particularly among US allies.Footnote ¹⁴¹ NATO documents have also drawn directly on US concepts,Footnote ¹⁴² and even US adversaries have, on occasion, used US language.Footnote ¹⁴³ While the military, economic, and diplomatic power of the United States explains why US language has sometimes been emulated,Footnote ¹⁴⁴ the consequences of that emulation result from the content of US terminology, including its implicit foundational metaphors.

Those consequences are evident in debates around how international law applies to cybersecurity—especially debates that have drawn directly on US language.Footnote ¹⁴⁵ For example, the two Tallinn Manuals were written by a group of experts (largely from NATO states) seeking to codify how state practices reveal customary and treaty-based international law of “cyber warfare” and “cyber operations.”Footnote ¹⁴⁶ The Manuals build on the spatial concepts in US cybersecurity language, even quoting from a US document that “international norms guiding State behavior … also apply in cyberspace,” and defining terms like “cyber operations” and “cyberspace” very similarly to US terminology.Footnote ¹⁴⁷ Yet the spatial metaphors implied by this terminology can complicate—maybe unnecessarily—the application of international law.Footnote ¹⁴⁸

Because the Tallinn Manuals discuss cybersecurity actions as occurring in or through cyberspace, nearly all issues are framed in terms of territorial sovereignty, defined as control over or independence of “a portion of the globe.”Footnote ¹⁴⁹ This is unproblematic for analyzing states’ rights and responsibilities with regard to physical Internet infrastructure (states have a clear claim over hardware within their boundaries) or actions that involve physically crossing a border. Yet there is more to cybersecurity than direct control over hardware—one “point of leverage” over Internet activityFootnote ¹⁵⁰ but a crude tool of Internet governance and rarely successful on its own.Footnote ¹⁵¹

The Tallinn Manuals, therefore, also attempt to classify actions that rely exclusively on informational or nonphysical means, especially actions that intentionally cross state boundaries. This ranges from using “remote cyber operations” to effect damage inside another stateFootnote ¹⁵² to sending “cyber weapons” through the infrastructure of a neutral party.Footnote ¹⁵³ The spatial metaphor implied by cyberspace terminology has complicated this analysis, preventing consensus within the Tallinn group of experts: some treated cyberspace as a spatial extension of state territory (and thus subject to the same rules, metaphorically translated “into cyberspace”), while others treated cyber operations as informational actions that should not be understood through spatial analogies. With progress unlikely on any treaty-based international law for cybersecurity,Footnote ¹⁵⁴ even nonbinding discussions like the Tallinn process will guide further developments in international law and norms, including by framing questions with largely unquestioned terms and implicit metaphors.Footnote ¹⁵⁵

In other international settings, less dominated by US interests, the interactions across diverse languages, terminologies, and metaphors have been more complex. For example, in two UN cybersecurity bodies—the Group of Governmental Experts (GGE) and the more recent Open Ended Working Group (OEWG)—US language has not predominated. In consensus reports in 2013 and 2015 (hailed for demonstrating a surprising degree of international agreement), the GGE framed its work as developing norms regarding the use of “information and communication technologies” (ICTs) and the “conduct of ICT-related activities”Footnote ¹⁵⁶—not actions “in cyberspace.” It is possible that agreement was enabled, albeit temporarily,Footnote ¹⁵⁷ by the broad language being used: “ICT activities” favors neither the US cyberspace-domain concept nor the very different language of “information security” used by some other participating states, including Russia and China.Footnote ¹⁵⁸

Outside of international forums, there are other pathways by which US language may have global effects. For example, important aspects of Internet governance could be reshaped by an unintended correspondence between US terminology and authoritarian governments’ Internet policies. The metaphors implied by cyberspace-domain language in US doctrine may inadvertently legitimize controls like China's “great firewall”—the US's spatial metaphors naturalize the idea of boundaries and state authority “in cyberspace.” The Chinese government's claim of sovereignty over the Internet within its borders has even been justified with reference to the Tallinn Manuals.Footnote ¹⁵⁹ In other words, the cyberspace-domain concept and the resulting spatial metaphors could implicitly support “Internet fragmentation,” especially the “alignment” of Internet controls with state boundaries.Footnote ¹⁶⁰

Given that cybersecurity metaphors are likely to persist (it would be nearly impossible to avoid them entirely),Footnote ¹⁶¹ we should at a minimum be aware of how the metaphors implied by terminology shape arguments in policymaking—and in scholarship. Research in IR and Security Studies often uses cyberspace terminology, asking whether and how conflict, power, norms, deterrence, or other “traditional” security issues and concepts apply “in cyberspace.”Footnote ¹⁶² Using other language may add new analogies, comparisons, and policy recommendations.Footnote ¹⁶³ Or it could be helpful to avoid conceptualizing the Internet and its effects as one “thing,” by any name, and instead discuss it for what it is: a collection of actors, technologies, systems, institutions, problems, policies, effects, and so on.Footnote ¹⁶⁴ Finally, one could use multiple terminologies simultaneously, and thus draw on diverse underlying metaphors.Footnote ¹⁶⁵ While the “imperfections” of any particular metaphor are a possible constraint, they can also be “a source of creativity and innovation,”Footnote ¹⁶⁶ especially when disparate metaphors are put in conversation with one another.

For IR in general, this study of terminology, metaphors, and their effects suggests two additions to how we analyze language and its consequences. First, it shows that examining implicit meanings and metaphors, not just explicitly made arguments, can be useful for understanding rhetorical processes and effects. Second, in addition to the customary focus on open contestation—arguments and analogies deployed instrumentally—we can look at what elements of language are not contested and what underlying ideas are then supported or precluded. To identify how language becomes consolidated, it is useful to trace it back to the point at which it was still unsettled—when terminology remained an open rather than closed controversy.Footnote ¹⁶⁷ Both points apply outside of cybersecurity, especially to the politics of other new technologies.Footnote ¹⁶⁸

Quite a lot, it turns out, can be in a name. The labels and implicit metaphors that militaries, analysts, and even scholars use can reshape the technological environment, redefine the “terrains” of conflict, and determine what is and is not a “domain of warfare.”