Deterrence ambiguities in cyber-warfare

I previously mentioned some of the challenges of deterrence as a tool of statecraft when applied to conflict in space, namely the fact that strategically defensive but tactically aggressive states with modest technological capacity can cause no end of trouble. Cyberspace offers a different set of issues, mostly relating to the much lower entry costs for low-intensity cyber-activity which allow for non-state actors to seriously "play" in the cyber realm.

In a contest between major states traditional deterrence may in fact hold reasonably well. Huge budgets for cyber-security, and the apparent vulnerability of cyber-warfare personnel and physical assets to more traditional forms of surveillance and espionage, will likely improve the prospects for attributing cyber-attacks mounted by major world powers. As cyber-warfare inevitably becomes bureaucratized it would be rather strange if increasingly mature agencies failed to adopt certain "best-practices" that may improve managerial or fiscal efficiency but also reduce innovation and lend great-power cyber-operations distinct "signatures". At the same time the huge resources available to these relatively slow-moving government organizations will also allow them do deliver devastating punishment on a wide variety of targets. In this cyber deterrence apes nuclear deterrence, with great powers able to attribute attacks reasonably accurately and then respond in kind and on a massive scale. Given the relatively level degree to which many major states rely on digital technologies this suggests restrain in terms of cyber-attacks; cyber-espionage, conversely, will likely remain marginally acceptable due to the fact that such techniques are only moderately distinct from physically stealing memos, blueprints or for that matter hard-drives.

When great powers deal with less prominent states (much less non-state entities) the lack of a pronounced cyber "taboo" as seen with many other high-destruction weapons (poison gas, nuclear devices, etc) will likely lead the major states to adopt cyber-warfare into integrated war-fighting doctrine as applied to weaker opponents. At the same time these weaker opponents will either lack the need to maintain a wide array of infrastructure networks reliant on digital technology (non-state actors) or rule over states that either lack such technologies or can accept considerable widespread damage in the event of an attack (many small developing countries). Given the fact that the primary competitive advantage that major states hold over everyone else remains access to large-scale "kinetic" means of destruction (i.e. bombs) cyber-war doctrine in this realm will likely remain modest given the marginal improvements it can make for governments possessing precision weapons, air superiority, orbital assets and special operations forces. Only when great powers see kinetic operations as unacceptable, as the US currently does with Iran, will attacks such as Stuxnet occur.

Small states or non-state groups, however, will increasingly find cyber-operations critical to their strategies for fighting against major powers, or deterring such conflict in the first place. The costs of developing cyber-weapons is unlikely to reach the level of precision-weapons, advanced air and sea vehicles, space-travel, or nuclear weaponry, all of which require enormous industrial infrastructure and in some cases can lead to serious diplomatic problems. Conversely software industries have relatively low capital requirements and raise no serious international questions about weaponization. As a result recruiting software and electrical engineers remains much simpler than getting nuclear physicists familiar with weapons development or aerospace engineers knowledgeable about stealth technologies. Coupled with the hypothetical capacity of cyber-weapons to wreak havoc on great-power military networks or even civilian infrastructure such tools become extremely useful to relatively weak states attempting to deal with powerful external threats. Against each other, however, weak states or non-state groups will likely use more conventional weapons due to mutual resistance to cyber-attack and vulnerability to more traditional weapons.

Cyber-deterrence will remain deeply problematic due to the difficulty of reliably tracing incoming cyber-attacks. Nonetheless the risks of retaliation in kind will likely keep major powers from attacking each other on a large scale in the absence of more general warfare, especially since standardization of cyber-operations will likely make such attacks easier to trace. Major powers moreover will see little reason to use cyber-weapons except when more overt warfare remains unacceptable. Small states or non-state actors, however, will find the low cost of entry and possibly very high rate of return from cyber-activity against more powerful foes to be very interesting indeed.