Backdoors Are Not Secrets

Making Cyber Power Visible Without Giving It Away

There is a moment in WarGames that still captures something essential about cyber, long before the term entered military doctrine. Matthew Broderick’s character visits a technology company and asks how its engineers broke into a system. One engineer casually suggests looking for a backdoor. Another snaps, “Hey, you’re giving away all our best secrets.” The reply is instant and dismissive, “Hey, Mr. Potato Head, backdoors are not secrets!”

That line draws a boundary we still struggle to enforce. The existence of backdoors, zero days, vulnerabilities, and the capabilities designed to exploit them is not secret knowledge—it is foundational. What deserves protection are the specifics: which backdoor, where, how it works, and how it is exploited. WarGames understood that secrecy applied at the wrong level does not create security. It creates confusion. That confusion persists because the national security enterprise rarely distinguishes between what must be protected and what must be classified. Sometimes those overlap. Often they do not. Seventy-plus years of institutional culture have pushed us toward convergence when precision is what we need.

Thanks for reading Chris’s Substack! Subscribe for free to receive new posts and support my work.

Top of Form

Bottom of Form

“Offensive” Cyber has made this worse. We collapse existence and execution into the same overclassified bucket, speaking in hushed tones as if acknowledging that cyber operations happen is itself a disclosure. That posture does not protect operations. It prevents understanding. Without understanding, there is no integration, no coherent planning, no advocacy, no resources. We have been running a successful cognitive warfare campaign against ourselves.

The Columbia-Class Standard

The Columbia-class submarine is the most strategically sensitive program in the Department of the Navy. Nearly everything that matters tactically is classified: how deep it goes, how quiet it runs, its patrol patterns, the range, yield, and accuracy of its weapons.

And yet we talk about the Columbia-class every day.

We know it exists. We know how many hulls will be built and roughly what each costs. We know where they will be homeported, that they carry ballistic missiles, and that they underpin nuclear deterrence. None of that gives anything away. Congress must appropriate the resources. Strategists must explain how the platform fits into deterrence theory. The public must understand why the program exists. The Navy did not declassify the Columbia-class so it could be discussed, it learned to separate strategic purpose from classified performance.

That discipline was learned the hard way. Cyber has not learned it yet.

The Cost of Silence

It is not a secret that nations conduct cyber operations, that cyber warfare is continuous, and that it touches military operations, critical infrastructure, and strategic stability. Adversaries know this. They plan for it.

What is secret—and must remain so—are cyber’s equivalents of depth and quiet: tools, accesses, exploits, dwell time, thresholds, targets, and effects. Disclosed carelessly, those things reduce capability, compromise sources and methods, and cost lives.

But refusing to talk openly about cyber’s purpose, role, and value carries its own cost. Legislators cannot resource what they cannot articulate. Policymakers cannot advocate for a capability they cannot describe. Commanders cannot integrate what they cannot plan around. The public cannot understand why cyber matters until the lights go out or the pipelines stop flowing.

Operation Midnight Hammer and the Asymmetry of Visibility

Visibility matters because success drives prioritization, and prioritization drives resources.

Operation Midnight Hammer makes the case—and exposes the gap. Seven B-2 Spirit bombers. Fourteen Massive Ordnance Penetrators. Tomahawk cruise missiles from a submarine that had been on patrol, undetected, for weeks. Over 125 aircraft in the strike package: fighters, tankers, decoys, electronic warfare platforms. Every one of those systems is named. Every one has a program office, a budget line, a Wikipedia page, and a history of public advocacy. The B-2 has flown over Super Bowls. The Tomahawk has led every major news cycle since 1991. The Night Stalkers—the 160th Special Operations Aviation Regiment—have a book and a movie.

Once acknowledged, the operation became visible. News outlets produced graphics showing bomber routes, refueling tracks, escort aircraft, missile trajectories. None of that revealed sensitive tactics. It told a coherent story: this is what American military power looks like when it works. Arguments followed almost immediately that the force structure was insufficient—that more bombers were needed. The logic was simple: look at what worked, fund what worked.

Cyber was there too. Gen. Dan Caine acknowledged it publicly at the Pentagon press conference, crediting Cyber Command with supporting the strike package. Cyber Command issued a statement expressing pride in its contribution. In Operation Absolute Resolve—the raid that captured Maduro in Caracas—Caine went further, describing how forces began “layering different effects” from Space Command, Cyber Command, and other agencies to “create a pathway” for incoming forces. President Trump put it his own way: the lights in Caracas, he said, were “largely turned off due to a certain expertise that we have.”

Those are the most direct public acknowledgments of offensive cyber capability in U.S. history. They are also nameless. No platform. No program. The President of the United States described a cyber effect significant enough to black out a capital city and reached for a pronoun. Caine said cyber provided “effects.” The Cyber Command statement offered pride without a single noun.

Compare that to what we said about everything else. Every kinetic system that flew or fired is named, described, and now being argued over in budget hearings. Cyber—which suppressed air defenses, kept aircraft alive, and achieved effects no missile could replicate—is a rhetorical gesture. “A certain expertise.” “Effects.” “Support.”

Sen. Mike Rounds, chair of the Senate Armed Services cyber subcommittee, spotted the gap in real time. He argued that the public deserved to understand what had happened—not only because it was remarkable, but because visibility into cyber’s role could pull the next generation of talent toward the mission. His colleagues declined to add detail, defaulting to generalities.

The will to acknowledge is there. The language is not.

The Lightning Bolt Without a Label

The CNN graphic from Midnight Hammer named everything. The B-2. The GBU-57. The Tomahawk. The EA-18G Growler flying electronic warfare. There was no lightning bolt. There was a gap on the map where a capability had operated—filled, in press briefings, with words like “support,” “effects,” and “expertise.”

Put a lightning bolt on that map. A simple line from the United States to Iran labeled “Cyber Effect.” No targets. No methods. No timelines. No specific exploits named. Just the acknowledgment that something happened, that it mattered, and that it was ours.

Nothing classified is revealed. But suddenly leaders can ask the right questions. What did cyber allow us not to do kinetically? What did that effect cost compared to a weapon? How did it reduce risk to the aircrew? How does it scale? Those questions produce budget lines.

The B-2 and follow on B-21 do not struggle for advocates. Neither does the Tomahawk. Both are named, visible, legible to every appropriator on Capitol Hill. Cyber—which kept Iranian surface-to-air missiles from firing at American aircrews, which blacked out a capital city without a bomb—is described by the Commander in Chief as “a certain expertise that we have.” That is not a capability. That is a rumor.

This is not a call to reveal sources and methods. It is a call to do what we already do for every other domain: give the capability a name, attach it to an outcome, and let the argument make itself.

The Success We Couldn’t Acknowledge

Stuxnet is the sharpest version of this problem.

More than a decade later, U.S. involvement is still officially unacknowledged, even as the public has long since accepted it. The details remain classified. Those directly involved do not discuss it.

The effect is harder to ignore. Stuxnet appears to have set back Iran’s nuclear program by years at a moment when kinetic options against hardened underground facilities were limited, escalatory, or politically untenable. It achieved strategic delay without a single aircraft crossing a border, without bombs on targets, without putting aircrews or submariners at risk.

It was also invisible. Because it could not be acknowledged—even at the level of existence and strategic effect—it generated none of the secondary returns that visible success normally produces. No public articulation of what cyber had accomplished. No debate about scaling the capability, institutionalizing it, investing in the forces and authorities needed to repeat it.

What conversations might have followed if senior leaders had been able to say simply—years later, no details—that a cyber operation delayed Iran’s nuclear program by years? How much earlier might resources have flowed into offensive cyber capability, access development, industrial control system expertise? How different would today’s force posture look?

And what did our adversaries absorb from the silence? The architects of Volt Typhoon, Salt Typhoon, and Flax Typhoon were watching. They studied, built, and operationalized in the years that followed. What actions might critical infrastructure sectors have taken to improve resilience if the strategic signal had been legible?

Stuxnet became a paradox: arguably the most strategically consequential cyber operation ever conducted—and one that could not be used to justify the future of the capability that made it possible.

Cyber’s Columbia-Class Moment

We learned to talk about the most survivable leg of the nuclear triad without giving anything away. The same discipline is available for cyber. Until we apply it, cyber will deliver outsized value while receiving undersized support—not because the capability is insufficient, but because we refuse to make it legible to the people who control resources and set priorities.

Loose lips sink ships. Sealed mouths starve capabilities.

Cyber needs its Columbia-class moment: the confidence to explain what it is, why it matters, and what it costs to go without it—without giving anything away.