Resistance and the Cyber Domain is the ARIS volume that asks what the internet did to resistance movements, and what it did to the people who have to work with them. At 432 pages across ten chapters it is the longest study in the series, and the only one that treats cyberspace as a domain of resistance in its own right rather than as a communications annexe. This page records what the document is, what it contains, where it came from, and links the full text hosted by The Resistance Hub.
| Full title | Resistance and the Cyber Domain |
| Series | Assessing Revolutionary and Insurgent Strategies (ARIS) |
| Publishing body | The United States Army Special Operations Command, Fort Bragg, North Carolina, with the Johns Hopkins University Applied Physics Laboratory, National Security Analysis Department |
| Edition | First Edition |
| Date | 2019 |
| Named staff | Kristen Ryan, Study Lead, JHU/APL. Chapter authors credited individually: Bruce Milligan, Summer Agan, Matthew Dinmore, Chris Scheidler, Patrick Allen, Anthony Guess-Johnson, Kimberly Glasgow, Ian McCulloh, Jason Spitaletta, Erin Hahn and W. Sam Lauber. |
| ISBN | None assigned. The copyright page prints unfilled placeholders, “ISBN (print): ####” and “ISBN (e-book): ####”. |
| Pages | 432 pages in the hosted PDF |
| Language | English |
| Suggested citation | Printed on the copyright page: “Ryan, Kristen, et al. Resistance and the Cyber Domain. Fort Bragg: US Army Special Operations Command, 2019.” |
| Rights | Printed on the copyright page, verbatim: “Resistance and the Cyber Domain is a work of the United States Government in accordance with Title 17, United States Code, sections 101 and 105.” The same page adds “Copyright © 2019 by the United States Army Special Operations Command.” and, separately, “Reproduction in whole or in part is permitted for any purpose of the United States government.” |
What this document is
The study opens with an analogy it then spends four hundred pages earning. In 1911 Ferdinand Foch called aircraft interesting toys of no military value. Seven years later he commanded the Allied armies on the Western Front and no major operation was attempted without first securing the air above it. The authors argue that military thinking has been equally slow with the cyber domain, and that the slowness is now expensive, because the acquisition, denial and employment of information is a weapon that resistance movements picked up faster than states did.
The organising question is narrower than the title suggests, and better for it. This is not a book about cyber warfare between states. It is a book about what happens to the four components of a resistance movement, the underground, the auxiliary, the armed element and the public face, when each of them acquires a digital equivalent. Chapter 7 is the clearest expression of that: it takes the structure set out in Undergrounds in Insurgent, Revolutionary, and Resistance Warfare and rebuilds it for a cyber underground, working through recruitment, intelligence, financing, logistics, training, command and control, and security as online functions rather than physical ones.
The distinction the study keeps returning to is between cyber activists, hacktivists, hackers and cyber terrorists. These are treated as four organisational types with different motivations, different relationships to violence and different legal exposure, not as points on a single scale of severity. The same discipline runs through the treatment of the hacker ethic, of the criminal nexus that supplies capability to movements that cannot build it, and of why people join, stay in and leave a cyber underground.
Two chapters are unusually practical. Chapter 4 on resistance security is close to a field guide, covering mobile phones, email, removable media, cloud storage, websites, social media, pirate and internet radio, and supply chain compromise, with worked examples of movements that were penetrated through each. Chapter 8 on attribution is its mirror image, setting out how a state attributes an action to a nation, a network, an organisation or a person, and then how a movement frustrates each of those techniques through encryption, Tor, technical misattribution, blending into a crowd or facilitating multiple actors against the same target.
The study does not claim that the cyber domain changes the nature of resistance. Chapter 2 argues the opposite, that new media alters the organisation of collective action rather than its causes, and that connective action succeeds under conditions that would have been recognisable to an analyst in 1965. What changes is speed, reach and cost, and the closing chapter tests that claim against the Syrian civil war, the conflict in Ukraine, nonviolent movements, and an invented scenario built for training rather than analysis.
Contents
Ten chapters, an executive summary, a bibliography and an index. Descriptions follow the subsection headings printed in the document’s own table of contents.
| Chapter | What it covers |
|---|---|
| 1. History of ARSOF and Information Operations | A short history of information operations. The US military and the cyber domain. ARSOF and information operations. An overview of the chapters. |
| 2. The Science of Resistance in the Cyber Domain | Public, regime and resistance communications in the information environment. Social media and authoritarian stability. Early internet communication strategies. New media against analog media. Collective and connective action. |
| 3. An Introduction to Cyber Operations | Military operations in cyberspace and categories of operations. Purposes, actors and targets, including IT networks, internet exchange points and backbone, industrial control and SCADA systems, and the internet of things. |
| 4. Resistance Security in the Cyber Domain | Cyberspace as a vector of compromise, and why resistance use of it differs. Worked examples of compromise and mitigation. Internal communications: mobile phones, email, removable media, the cloud. External communications: websites, social media, pirate and internet radio, supply chain. |
| 5. Narratives, Social Media, and Social Networks in Information Operations | What narratives are and how they express themselves in social media, including memes and fabricated news. Factors enabling transmission and adoption. Network topology, the Dunbar number, network effects on social psychology, astroturfing and censorship. |
| 6. Implications of Cyber-Physical Systems | Security implications of cyber-physical systems, and their impacts in cyberspace and in the physical domains. |
| 7. Human Factors Considerations in Undergrounds in Cyber Resistance | The cyber underground as an organisation. The hacker ethic. Cyber activist, hacktivist, hacker and cyber terrorist organisations. The cyber auxiliary, leadership and the criminal nexus. Joining, staying in and leaving. Recruiting, intelligence, financing, logistics, training, command and control, security. Subversion, sabotage and nonviolent resistance online. |
| 8. Attribution and Cyber Resistance Movements | The need for anonymity. The web, the deep web and the dark web. Attributing to a state, to networks and botnets, to an organisation, to an individual. Technical and human attribution. Encryption, Tor, criminal websites, cyber mercenaries, technical misattribution, blending into a crowd. |
| 9. Legal Issues in Cyber Resistance | Where legal questions arise. Social media. International humanitarian law and cyber. How level of organisation and intensity affect the legal status of participants. |
| 10. Application in Case Studies and Fictional Scenarios | The Syrian civil war. The conflict in Ukraine. Cyber in nonviolent movements. A fictional Redlands resistance movement scenario built for training. |
Provenance and lineage
This is a first edition with no SORO predecessor. It belongs to the newer half of the ARIS catalogue, the volumes written to address subjects the 1960s studies could not have anticipated, alongside The Science of Resistance and Threshold of Violence. Its own list of recent ARIS volumes places it after the 2013 revisions of the SORO undergrounds studies and alongside the 2019 work, and it lists Science of Resistance as still forthcoming, which dates the manuscript to the same production cycle.
Kristen Ryan of the Johns Hopkins University Applied Physics Laboratory is named as study lead. Unusually for the series, the copyright page credits each chapter to its authors by name rather than crediting the volume as a whole, which is why the chapters differ so markedly in register. The legal chapter is the work of Erin Hahn and W. Sam Lauber, who also wrote the ARIS volume on the legal status of persons in resistance. Patrick Allen is credited on three chapters, on cyber operations, on human factors in cyber undergrounds and on narratives and social networks.
The research was carried out at the Applied Physics Laboratory by its National Security Analysis Department, described on the copyright page as a nongovernmental agency operating under the supervision of the USASOC Sensitive Activities Division. The same page carries the standard series disclaimer, that the analysis and opinions are solely those of the authors and do not necessarily reflect the positions of the US Army or the Applied Physics Laboratory. Corrections are invited by post to USASOC G-3X, Sensitive Activities Division, 2929 Desert Storm Drive, Fort Bragg, NC 28310. The letter of introduction is printed as an unfilled placeholder.
How The Resistance Hub uses it
This is the reference behind our coverage of the digital side of irregular warfare. COL (Ret.) Patrick D. Allen, one of the volume’s chapter authors, writes for us, and his two pieces here develop arguments that begin in this book: cyber security differences between states and resistance movements extends the asymmetry that Chapter 4 sets out, and the information sphere as a domain takes up the definitional problem that Chapter 1 leaves open. Read the book first and both pieces land harder.
Chapter 7 supplies the vocabulary we use whenever a movement’s organisation is the subject, and it should be read against Undergrounds in Insurgent, Revolutionary, and Resistance Warfare, whose four-component model it adapts. Chapter 7 also treats subversion and sabotage as underground functions carried into the cyber domain, which is the framing we use. Definitions are recorded in our irregular warfare and resistance glossary, and the rest of the series sits in the ARIS archive.
Download
The document states that all ARIS products are available from USASOC at soc.mil under the ARIS link. For scholarly citation, prefer the official USASOC ARIS index as the canonical source. The copy hosted here is a mirror provided for readers who need the text immediately.
Print edition
Resistance and the Cyber Domain is published in print and for Kindle by The Distillery Press, typeset for reading rather than for a 432-page PDF on a screen. The full original text above remains free.
Kindle edition → Paperback →Sources used on this page: the hosted PDF itself, specifically its title page, copyright page, series page and table of contents, read directly on 3 August 2026; and the USASOC ARIS publication index at soc.mil.
Every bibliographic field above is transcribed from the document’s own front matter. Where the document prints nothing, this page says so rather than inferring a value. Updated: August 2026.