In defense scenario planning, the most feared future is the confluence of three geopolitical challenges: unchecked tensions between China and the United States, armed conflict over Taiwan, and escalating gray-zone conflicts between China and claimants in the South China Sea. The confluence of these three issues could lead to a maritime crisis marked by a situation in Southeast Asia that is on the brink of regional conflict.
Looking at the way conflicts are unfolding in Ukraine and the Middle East, a maritime crisis in Southeast Asia could have a cyberspace dimension. How can the region prepare?
Pre-war scenario
If armed conflict over Taiwan were to break out, the Taiwan Strait could become a proxy battleground between China and the U.S. China would likely strengthen its military presence in the South China Sea to deter U.S. forces stationed in the Philippines and resupplying U.S. forces in Singapore and to project power.
Chinese naval forces in the South China Sea would be a target for U.S. forces, perhaps within 72 hours of a conflict starting. If China were to impose a blockade on Taiwan, the U.S. could conduct operations in the Straits of Malacca and Singapore as a counterblockade to disrupt shipping to China.
At the same time, Southeast Asia may see an increase in cyberspace operations coordinated with rival nations, particularly China and the United States, the world's leading cyber powers, aimed at dissuading regional nations from great-power confrontations, influencing public opinion about the region's foreign and defense postures, digital espionage, and using Southeast Asian nations' poorly secured digital infrastructure as a foothold for cyber attacks.
Digital Challenges in the Regional Maritime Crisis
A maritime crisis could have multifaceted ramifications for the region, affecting the diplomatic, intelligence, military, and economic interests of Southeast Asian nations. Cyberspace could play a key role in the crisis as a cross-cutting factor affecting these national interests. Cyberspace could also play an important role at the regional level, as competing parties in the crisis may want to influence the Association of Southeast Asian Nations (ASEAN) to ensure that ASEAN does not act against their own strategic objectives and that ASEAN's diplomatic process produces outcomes favorable to their own strategic interests.
The impact of cyber challenges related to regional maritime crises needs to be anticipated and planned for. Cyberspace-related challenges arising from regional maritime crises could be twofold: digital warfare and digital sanctions.
The first challenge is digital warfare or cyberspace operations. This includes a wide range of activities, from minor disruptions such as website and social media hacks, phishing attacks for digital espionage, and online disinformation campaigns that may occur simultaneously with cyberattacks and physical incidents at sea, to major disruptions of critical maritime infrastructure and the computer and communications systems of civilian, coast guard, and naval vessels. Some activities may be the work of proxy cyber actors acting on behalf of or independently of nation states. The more severe the maritime crisis, the more demanding the cyberspace operations will be.
Given Southeast Asia's vast geographical extent and the diversity of political stances taken by its states, a maritime crisis could play out differently across the region.
In geographic regions distant from the contested areas of the South China Sea and Taiwan, cyberspace operations, including espionage and intelligence activities, may be conducted to shape and influence public opinion and political decisions. Competing powers may use a combination of cyberspace operations and conventional maritime force postures to maintain strategic advantage or intentionally influence diplomatic relations.
In the online war of words, each power will portray its actions as protecting regional security and the interests of its countries, and accuse the other of undermining peace and stability. If one power tries to sound the alarm about cyber attacks, the other may accuse it of a disinformation campaign.
Cyberspace operations could be most severe in geographical areas close to the disputed waters of the South China Sea and Taiwan, which would be the epicenter of armed conflict. Military conflict at sea and in the air could occur in parallel with more disruptive cyberspace operations affecting essential services, intended to weaken civilian resilience and the military’s will and ability to defend itself. Cyberspace operations could target civilian digital targets such as populations and ports, as well as functions essential to military operations, such as communications, navigation, digital infrastructure services, and maritime domain awareness. Underlying these operations is also the assumption that cyberspace is a critical component of naval power.
The second challenge is digital sanctions, which could impact the economies of Southeast Asian countries. A maritime armed conflict involving China and the United States could lead both powers to be much more cautious in imposing tougher and more stringent sanctions and counter-sanctions on digital technologies and services. The aim of these measures would be to target each other's economies and military-industrial bases, denying access to dual-use digital technologies such as semiconductors and cloud computing that enable military systems and cyberpower.
The impact of these sanctions could ripple throughout Southeast Asia. For example, in 2023, ASEAN and China launched an initiative to strengthen cooperation on artificial intelligence (AI) and e-commerce, including cross-border trade. U.S. digital sanctions targeting China could hinder such initiatives, just as the withdrawal of digital services in Western countries and the SWIFT ban on Russian banks aim to digitally isolate Russia from global markets.
What if the US were to expand its sanctions against semiconductors to target Chinese companies operating in Southeast Asia? It is quite possible that the US is monitoring how Chinese tech companies are using transshipment hubs and the neutrality of Southeast Asia to circumvent US semiconductor export controls. Similarly, if it can curb China's cyber power, Washington may consider its options against Chinese cloud service providers such as Alibaba and Huawei in Southeast Asia.
Southeast Asia Preparations
As the risk of war in the Asia-Pacific region becomes increasingly real, it is timely for countries in the region to consider preparing for the cyber-military and digital-economic impacts of a maritime crisis in Southeast Asia resulting from an armed maritime conflict involving major powers, Taiwan, and South China Sea claimants.
To address the risks of operating in cyberspace, Southeast Asian countries need to strengthen their digital resilience through an appropriate mix of digital technologies, operational concepts and procedures, human capabilities, and civil-military cooperation. Regional civilian initiatives such as the ASEAN Regional Computer Emergency Response Team (CERT) may need to coordinate strategies and efforts with defense-related initiatives such as the ASEAN Cyber Defense Network (ACDN) and the ADMM Cybersecurity Information Centre of Excellence (ACICE). ASEAN needs to evaluate how the complementarity between the ACDN and ACICE should play out during a regional crisis.
And given the multifaceted impact of a maritime crisis and the importance of trade in the region, there may be growing calls for an ASEAN grouping to overcome the taboo of discussing the impact of armed conflict on the defense and economic sectors.
In conclusion, a maritime crisis would have far-reaching implications for Southeast Asia's ambitions to advance the digital economy and a safe and stable cyberspace. What should regional governments do? There are no easy answers, but Southeast Asian countries should start planning for scenarios.
