By Vladimir Tsakanyan | Senior Specialist, Cyber Politics & Strategic Studies | March 3, 2026
On March 2, 2026, General Dan Caine, Chairman of the Joint Chiefs of Staff, made a public declaration that fundamentally redefines the operational architecture of American military power. Standing at a Pentagon podium, he confirmed that United States Cyber Command (USCYBERCOM) and United States Space Command (USSPACECOM) served as “the first movers” in Operation Epic Fury — the coordinated U.S.-Israeli military campaign against Iran. This disclosure is not a routine operational briefing. It represents one of the most strategically significant acknowledgments in the modern history of American defense communications.
THE OPERATIONAL SEQUENCE: ESTABLISHING THE FACTS
On February 28, 2026, U.S. and Israeli forces launched coordinated strikes against Iranian targets under the designation Operation Epic Fury. Reported targets included command and control facilities, ballistic missile infrastructure, and a senior leadership compound where Supreme Leader Ali Khamenei was present. His death has since been confirmed by both Iranian and American officials — an outcome of profound geopolitical consequence that will be addressed in detail below.
Critically, however, the kinetic phase of this operation was preceded by a deliberate, layered application of non-kinetic effects executed by CYBERCOM and SPACECOM. General Caine described these effects as “disrupting, degrading, and blinding Iran’s ability to see, communicate, and respond.” The sequence is as follows:
On February 25, 2026, Lieutenant General Gregory Gagnon of Space Force Combat Forces Command publicly described space capabilities as “baked into everything” at the Air Force Association’s Warfare Symposium — three days before the operation commenced. On February 28, 2026, Operation Epic Fury was initiated, with CYBERCOM and SPACECOM executing non-kinetic effects against Iranian sensor networks, communications infrastructure, and command architecture prior to the first kinetic engagement. On March 2, 2026, Defense Secretary Hegseth and General Caine held a formal Pentagon press conference formally designating Cyber Command and Space Command as “first movers” — a public attribution without precedent in the scope and specificity of its language.
The operational outcome speaks for itself. Iran’s retaliatory ballistic missile strikes have been intercepted across a space-enabled missile defense network spanning Qatar, the UAE, Kuwait, Jordan, and Saudi Arabia. The coordinated, large-scale counter-campaign that Iranian military doctrine calls for has not materialized. That absence constitutes meaningful evidence of the effectiveness of the non-kinetic opening phase.
THE POLITICAL CALCULUS OF PUBLIC ATTRIBUTION
For the greater part of my professional career, offensive cyber operations occupied a deliberate institutional gray zone: operationally essential, yet officially deniable. The canonical example remains the Stuxnet operation against Iran’s Natanz uranium enrichment facility — a joint U.S.-Israeli undertaking whose existence was never formally acknowledged for years, despite extensive open-source forensic analysis of its code. The governing logic was straightforward: preserve operational access, maintain plausible deniability, and avoid establishing precedents that could legitimize adversary cyber operations.
What occurred this week constitutes a marked departure from that paradigm. General Caine did not allude to cyber and space effects in passing. He explicitly named the relevant commands and positioned their actions as the initiating element of a major combat campaign. This level of attribution is extraordinary and warrants careful political analysis.
Three overlapping strategic rationales explain the decision.
The first is deterrence signaling. By publicly attributing decisive non-kinetic effects to CYBERCOM and SPACECOM, the United States communicates directly to potential adversaries — state and non-state alike — that American cyber and space capabilities are not theoretical assets held in reserve, but active instruments of warfare already embedded within adversary infrastructure. The implicit message is unambiguous: the access exists, the capability has been demonstrated, and the threshold for employment has been crossed.
The second rationale is strategic communication directed at domestic and allied audiences. The current administration has demonstrated a consistent disposition toward projecting technological dominance in explicit, public terms. This pattern is traceable to President Trump’s public attribution of power disruptions in Caracas to American cyber operations during the Venezuela campaign. What was previously an anomaly has now been institutionalized within formal Pentagon communications — a deliberate rebranding of cyber and space warfare as visible instruments of national power rather than shadow capabilities.
The third rationale is institutional. United States Space Force and Cyber Command have invested years building the doctrinal and budgetary case for front-line warfighting status. General Caine’s declaration — positioning these commands as the opening act of a major military campaign — provides the highest-profile institutional validation either organization has ever received. This language will appear in Congressional budget justifications for the foreseeable future.
However, this strategic candor carries measurable costs. Publicly disclosing the nature and sequencing of offensive cyber operations accelerates adversary hardening efforts. China, Russia, North Korea, and the successor government in Tehran will now aggressively audit their network architectures, hunt for pre-positioned access, and invest in redundant communications systems specifically designed to deny the conditions that made the opening phase of Operation Epic Fury possible. The short-term deterrent value of this disclosure may accrue at the expense of long-term operational access that required years to establish.
This appears to be a trade-off the administration has made consciously and deliberately.
THE EMERGENCE OF CYBER-FIRST DOCTRINE
The concept of “effects-based operations” — shaping adversary decision-making environments prior to direct kinetic engagement — has occupied military theorists for decades. Operation Epic Fury provides the most explicit real-world validation of that concept to date, with cyber and space capabilities formally occupying the role historically assigned to strategic suppression forces.
In conventional military doctrine, first movers are forces that act prior to visible kinetic operations to degrade adversary defensive capacity and reduce risk to follow-on strike elements. This function was historically performed by suppression of enemy air defense (SEAD) aircraft, electronic warfare platforms, or special operations forces designated to mark and prepare targets. In 2026, that function has been formally assumed by cyber operators and space warfare units.
The operational logic is doctrinally coherent. An adversary’s capacity for coordinated military response depends on three interdependent systems: sensor networks that detect and characterize incoming threats, communications infrastructure that routes intelligence to decision-makers, and command nodes that translate that intelligence into coherent defensive orders. Systematic degradation of all three — executed simultaneously and prior to kinetic action — renders even a well-resourced military force operationally blind and unable to coordinate a response in the critical initial hours of a campaign.
This is precisely the sequence General Caine described. And the operational results to date suggest it was executed effectively.
SPACE AS AN OPERATIONAL WARFIGHTING DOMAIN
Lieutenant General Gagnon’s analogy — that space is to modern warfare what flour is to baking, present in everything yet rarely identified as a discrete ingredient — deserves more rigorous analytical attention than it typically receives in mainstream defense commentary.
Space-based missile warning architecture is the foundational layer of the defensive operation currently underway. Infrared satellites detect ballistic missile launches within seconds of ignition, cueing a layered network of ground and sea-based radars across the region. This architecture has enabled the interception of hundreds of Iranian ballistic missiles since hostilities began. Its removal from the operational equation would render the entire defensive construct non-functional.
Beyond missile defense, space capabilities underpin precision navigation for strike aircraft, strategic intelligence collection on Iranian military disposition and movement, secure coalition communications across a network spanning multiple national militaries and command structures, and the offensive electromagnetic and non-kinetic effects that SPACECOM executed as part of its designated first-mover role.
Chief of Space Operations General Chance Saltzman, speaking at the AFA Warfare Symposium days before the operation commenced, noted that the institutional argument for space as a warfighting domain “appears to be landing.” Operation Epic Fury is the operational proof of concept that argument has required. It will not be lost on allied or adversary space program leadership.
THE STRATEGIC IMPLICATIONS OF LEADERSHIP DECAPITATION IN A NUCLEAR-ARMED STATE
No responsible analysis of this operation can avoid the most consequential variable in the current strategic environment: the confirmed death of Ayatollah Ali Khamenei and the political vacuum it has created within the Iranian state during active combat operations.
Khamenei’s role within the Iranian constitutional system is not analogous to a conventional head of government. As Supreme Leader, he exercised singular authority over the Islamic Revolutionary Guard Corps, the judiciary, strategic foreign policy, and — critically — the country’s nuclear program and any decision-making authority associated with it. His removal from that role, under these circumstances, creates a succession crisis of the highest order of complexity and danger.
The central intelligence question — one that the U.S. intelligence community has treated with the utmost sensitivity — concerns Iran’s nuclear command and control arrangements in the event of supreme leader incapacitation. The formal and informal protocols governing authority over Iran’s nuclear assets in this scenario are not publicly known. That uncertainty is not an abstraction. It is an active variable in a live military conflict, and it demands the most sober and careful strategic management by all parties involved.
From a cyber and information operations perspective, the succession crisis also creates conditions that may drive Iranian cyber retaliation. Units affiliated with the Islamic Revolutionary Guard Corps have previously demonstrated a credible capacity for destructive cyber operations — including attacks against Gulf Cooperation Council energy infrastructure and penetration operations targeting U.S. financial institutions. Successor factions competing for domestic legitimacy, or hardline elements within the IRGC acting with diminished central oversight, may perceive asymmetric cyber operations as both strategically rational and politically consolidating. Critical infrastructure operators across the United States, Israel, and the broader Gulf region should be operating at sustained elevated defensive posture.
THE NORMATIVE AND LEGAL DIMENSIONS
The public institutionalization of offensive cyber operations as the initiating phase of major combat represents a structural rupture in the normative framework that has — imperfectly but meaningfully — governed state cyber conduct since the early 2000s.
The international legal discourse around offensive cyber operations has long depended upon a degree of state ambiguity: ambiguity about whether specific effects constituted acts of war, whether pre-positioned network access violated sovereignty, and what threshold of effect triggered the law of armed conflict. The Tallinn Manual process, the UN Group of Governmental Experts, and bilateral confidence-building mechanisms have all proceeded within that ambiguity as a structural condition.
The United States has now publicly stated, through its most senior military officer, that cyber operations are employed as a first-strike instrument prior to kinetic action in large-scale military campaigns. That statement does not merely document a practice. It establishes a public precedent that other state actors will cite, adapt, and employ in future conflicts — including conflicts in which the United States is not a party.
The effort to construct international norms limiting first-use of destructive cyber capabilities was already under considerable strain. It is materially more difficult to sustain following this week’s disclosures.
THE VENEZUELA PRECEDENT AND THE INSTITUTIONALIZATION OF CYBER CANDOR
The public attribution of offensive cyber effects did not originate with Operation Epic Fury. The pattern was established during the Venezuela operation, when President Trump publicly credited American cyber capabilities with power disruptions in Caracas. That disclosure was treated at the time as anomalous — an instance of presidential improvisation inconsistent with established operational security norms.
It was not anomalous. It was the first expression of what I characterize as a Doctrine of Cyber Candor: a deliberate, politically motivated decision to convert offensive cyber capability from a tool of strategic ambiguity into a publicly acknowledged instrument of deterrence and coercive signaling. The Venezuela disclosure has been followed, with institutional regularity, by the formal Pentagon attribution in Operation Epic Fury. The pattern is now policy.
The doctrine is rational within its own strategic logic. In an environment where projecting technological dominance and resolve constitutes an independent foreign policy objective, publicizing cyber and space capabilities as decisive warfighting instruments serves a deterrent function that covert operations cannot. The trade-off — accelerated adversary hardening, erosion of operational access, normative permissiveness — represents a calculated acceptance of long-term costs in exchange for short-term strategic signaling.
CRITICAL QUESTIONS FOR THE PERIOD AHEAD
As Operation Epic Fury continues — General Caine explicitly characterized it as “difficult and gritty work” over an extended operational timeline — four questions will determine the strategic trajectory of both the conflict and its broader implications.
The first concerns operational sustainability. Pre-positioned cyber access requires sustained investment and may take years to establish. Maintaining disruptive non-kinetic effects across a weeks-long campaign, as adversaries adapt, harden, and implement workarounds, is a qualitatively different challenge from executing a high-impact opening strike. The mission profile of CYBERCOM may evolve from active disruption toward persistent intelligence collection as the campaign matures — a different function, but one of equal strategic value.
The second concerns the form and timing of Iranian cyber retaliation. Iranian offensive cyber units retain meaningful capability regardless of the current command disruption caused by Khamenei’s death. The question is not whether Tehran or successor factions will attempt cyber retaliation against U.S., Israeli, or Gulf state targets, but when, at what scale, and with what degree of central coordination.
The third concerns the lessons drawn by China and Russia. Both states operate sophisticated offensive cyber programs and have been analyzing Operation Epic Fury with professional rigor. The explicit, public institutionalization of a cyber-first doctrine by the United States validates strategic investments both states have already made and is likely to lower their threshold for employing these capabilities in future contingencies — including scenarios in which the United States has a direct interest.
The fourth concerns kinetic munitions sustainability. Defense analysts have identified serious concern regarding the rate of expenditure of interceptor munitions required to defeat Iran’s ballistic missile campaign. The cyber and space dimensions of this conflict are sustainable over an extended timeline. The kinetic missile defense architecture, by contrast, may generate a material vulnerability if the campaign extends significantly beyond its current phase. This tension between the sustainability of non-kinetic and kinetic components represents a structural challenge that operational planners will need to manage carefully.
CONCLUSION
The events of this week mark a definitive threshold in that trajectory. The matter-of-fact, formal, public designation of Cyber Command and Space Command as “first movers” in a major military campaign is not a communications anomaly. It is a doctrinal statement — one that closes the era of strategic ambiguity around offensive cyber operations and opens an era in which cyber and space warfare are openly acknowledged as the initiating instruments of armed conflict.
The political, legal, and normative implications of that transition will occupy strategists, legal scholars, and policymakers for years. What is already clear is this: the modern battlefield does not begin with an airstrike or a naval bombardment. It begins with operators at keyboards and satellites repositioned in orbit. Operation Epic Fury did not create that reality. It declared it, formally and publicly, for the record.
Leave a comment