Podcast Summary: Risky Bulletin — "Between Two Nerds: The Limits of Cyber Power"

Hosts: Tom Uren & The Grugq
Date: September 15, 2025

Episode Overview

This episode delves into the complex question of "cyber power": how should it be defined, and how significant is its role among the instruments of state power? Drawing inspiration from a nearly decade-old Dave Aitel blog post, Tom Uren and The Grugq discuss how technical prowess in cyber operations often fails to equate to meaningful outcomes for states. Using historical analogies, recent examples, and state actors such as the US, China, Russia, and North Korea, the hosts map out both the contributions and limitations of cyber capabilities in national strategy.

Key Discussion Points & Insights

1. Measuring Cyber Power: Technical Capability vs. Strategic Outcome

• Dave Aitel’s Technical Framework:
  The blog post aimed to define cyber power through technical benchmarks: exploitation, implantation, exfiltration, analysis, and integration with other intelligence methods. Uren notes this is a "very technical way to approach cyber power," whereas recent policy circles focus more on outcomes and state achievements rather than just technical ability.

  "They’re looking much more at what it achieves for a state rather than how good your technical capabilities are." — Tom Uren [01:02]

• The Limitations of Metrics:
  The Grugq draws a comparison to the "Toyota War," where technical military superiority didn’t guarantee victory; effective application and adaptability mattered more than raw capability.

  "If you were talking about military power and you started measuring who has more tanks, you would ... come away with ... this is a lopsided engagement ... Whereas in fact, what turned out to be better was investment in things that actually made sense for that domain." — The Grugq [02:22]

• Rank of Importance:
  Capability is only one aspect. Even if technical skill is high, real-world impact for the state depends on effective application and integration.

  "A measure of capability ... is very, very low down on the ladder in terms of understanding how powerful cyber has made the state." — The Grugq [05:38]

2. The Strategic Value and Limits of Cyber Operations

• Incremental and Long-Term Influence:
  Some cyber operations, like China's IP theft, have notable cumulative effects, but rarely produce immediate, strategic shifts akin to military power.

  "Could cyber power be strategic? ... Our conclusion ... was that ... yes, it can, but it’s not the same sort of power as military power, and ... it tends to be incremental and occur over a long period of time." — Tom Uren [06:44]

• Integration and Exploitation:
  The full value of cyber operations is only realized when states can integrate stolen data or intelligence into wider economic and policy machinery.

  "It’s not just that they stole things; it’s that they operationalized what they stole and then built on it." — The Grugq [07:39]

• Application Is Key:
  The US may steal more IP, "but so what?" if it isn’t used to serve state goals as efficiently as China does.

3. Cyber Power as an Asymmetric Tool for the Less Powerful

• DIME Model Context:
  Less powerful states (in Diplomatic, Informational, Military, Economic terms) rely more on cyber because other instruments are limited.

  "The weaker a state is, the more it’s relied on cyber. North Korea ... you’d rank them the bottom on that …, and so it’s relied on cyber the most." — Tom Uren [13:41]

• Russia and North Korea:
  Both are highlighted as successful, if narrowly, in using cyber offensively for goals like sowing discord (Russia) or funding regime needs (North Korea). However, achievement of broader national objectives (economic growth, military dominance) often remains elusive.

• Effectiveness of 'Spoiler' Tactics:
  Russia often succeeds in disrupting or spoiling adversaries' plans ("stopping goals"), but fails to convert that into direct gains ("scoring goals" for itself).

  "They’ve been successful at being a spoiler ... but haven’t actually scored goals of their own." — Tom Uren [16:08]

4. Diminishing Returns for the Powerful

• The Paradox of Power:
  The more powerful a state is in traditional terms, the less impactful cyber operations become for them; the USA can achieve more via economic or military means.

  "The more powerful the state, the less useful cyber is. Is that what we’re saying?" — Tom Uren [20:10]
  "The more you can invest in cyber, the less you need it, maybe. Or ... the less it can do for you." — The Grugq [20:20]

• China’s Evolution:
  As China catches up with the US, its reliance on cyber for economic advantage decreases, shifting focus toward intelligence collection akin to the NSA.

  "There’s diminishing returns to keep stealing more information ... less useful now to have cyber to augment yourself because there’s just less that it can do for you." — The Grugq [22:57]

• Cyber’s Relative Budget:
  The proportional spend on cyber remains tiny compared to national defense budgets—cyber often feels overhyped relative to its real-world effect.

  "In terms of an overall national budget, it’s like a drop in the bucket. And compared to defense, ... cyber is a fraction of the intelligence budget." — Tom Uren [28:52]

5. The Lower and Upper Bounds of Cyber’s Utility

• States Like Iran:
  For states with poor integration into the global economy (like Iran), even significant cyber capabilities may have marginal utility.

  "If you are below this level of economic integration into the global economy, cyber can’t help you either." — The Grugq [26:47]

• Smaller States (e.g., Netherlands):
  Some states "punch above their weight" technically but can't materially leverage cyber gains for outsized national advantage due to scale or contextual constraints.

Notable Quotes & Memorable Moments

• Military Analogy:
  "You could be an amazingly skilled rugby player, but unless you’re 6 foot 6 and 250 kilos of solid muscle, it’s not really going to do you very much good when the All Blacks come running." — The Grugq [06:25]

• China’s National Policy:
  "They’re bringing all those different mechanisms or tools together in a single purpose. For me, it seems like the US has not really done that using cyber, except for intelligence gathering." — Tom Uren [10:41]

• Spoiler vs. Scorer:
  "They’ve been successful at being a spoiler for other people, but ... haven’t actually scored goals of their own." — Tom Uren [16:08]

• Diminishing Returns:
  "I think that might be the paradox in a way. Like, the more you can invest in cyber, the less you need it ... the less it can do for you." — The Grugq [20:20]

• Cyber vs. Defense Spending:
  "States tend to spend on intelligence collection ... but in terms of an overall national budget, it’s a drop in the bucket. Compared to defense, it’s a fraction of the defense budget, and cyber is a fraction of the intelligence budget." — Tom Uren [29:10]

Chronological Timestamps for Key Segments

• Dave Aitel’s Blog & Defining Cyber Power: [00:13]–[02:22]
• Analogy: Technical Capability vs. Outcomes: [02:22]–[04:55]
• How State Power Is Measured: [05:38]–[06:44]
• Case Study—China’s Integration of Cyber: [07:39]–[11:13]
• State Power and Cyber Dependence (DIME Model): [12:50]–[14:00]
• Russia as ‘Spoiler’ and Operational Caveats: [14:12]–[17:48]
• Limits and Paradox of Cyber for the Powerful: [19:06]–[21:18]
• China’s Technological Shift and Diminishing Returns: [21:18]–[23:33]
• Discussion on Iran and Lower Boundaries: [25:39]–[27:02]
• Cyber Budget Perspective: [28:52]–[30:37]

Conclusion

Takeaways:
Cyber power, while dazzling at the technical level, rarely shifts the balance of power by itself. For weaker states, it’s a crucial asymmetric tool, but for the most powerful, it’s simply one option among many—with rapidly diminishing returns as their broader capabilities overshadow anything cyber alone might achieve. Integration, context, and clear state objectives matter more than sheer cyber skill.