Analysis & Opinions - Council on Foreign Relations

Which Cyberattacks Should the United States Deter, and How Should it Be Done?

| July 24, 2017

Preview

In its obituary for legendary scholar and statesman Zbigniew Brzezinski, the New York Times noted that he “sometimes showed a tendency to believe that any disagreement between theory and reality indicated some fault on the part of reality.” That’s an observation worth bearing in mind when examining if and how the theory of deterrence can apply to current cyber threats. Wouldn’t it be nice if the United States could just threaten to impose cost on the perpetrators, and they would knock it off? After all, didn’t the United States successfully deter the Soviet Union from launching a devastating nuclear strike against it? Why can’t the same be done in cyberspace?

Conceptually, there is no reason that the principles of deterrence—principles that apply to child rearing, dog training, principle-agent modeling, and the use of nuclear weapons—are inapplicable to cyberspace. The problem is not with theory of deterrence, but with the reality of threats in cyberspace. Those looking to “cyber deterrence” to stop state-sponsored hacking should bear in mind three points to ground further discussion.

First, relying on deterrence to protect the United States is a lousy policy prescription given that it is impossible to know whether it is working. It is hard to determine in real time whether an opponent is deterred and therefore unwilling to act, or whether some other pressure makes it unable to act. Most commentators on strategic studies learned these concepts in the context of nuclear weapons. Deterrence became the only game in town because there was no realistic defense to a Soviet nuclear strike. Mutually assured destruction was no one’s first or best idea of how to proceed through the Cold War, but it offered one (albeit suboptimal) approach to the critical security need of the time: to prevent the Soviets from using nuclear weapons against the United States. Only after the Cold War did U.S. policymakers come to understand that Soviet leaders had a different understanding of deterrence and the ability to win a nuclear conflict.

This leads to the second point about deterrence: clarity about what must be deterred is essential. Declaring the United States will deter “cyberattacks” or “hacking” doesn’t cut it. The problem is not the lack of definitions, but a lack of consensus about what bad conduct in cyberspace really needs to be stopped. Chances are, if your company or agency has been hacked, you will think that conduct should be deterred. But that’s an impossibly subjective standard. Some might say that critical infrastructure (water, power, etc.) are sectors that could easily be marked as off limits. Except countries can’t agree even to that.

Who would have thought that the most vocal condemnation of a cyberattack against the United States would be prompted by an attack on the entertainment company, Sony Pictures? Do recent efforts to access the business network of a nuclear power plant in the United States cross a line in the digital sand? The fact that there aren’t clear answers to these questions does not mean that government employees or white-hats haven’t thought hard enough. Instead, it reflects the cold truth that deterrence theory does not naturally lend itself to the realities of cyberspace. If the U.S. government is not specific about what needs to be deterred, attackers will not know what is off-limits and deterrence is not going to work.

But even if there could be some sort of consensus, there is a third challenge: the United States needs to have (and the ability to demonstrate) the will to impose cost for transgressions. The Obama administration made some progress here: over time, they indicted Chinese and Iranian hackers, and sanctioned Russian and North Korean enablers of hacking. It is debatable whether these countries interpreted U.S. actions as costly, but at least Washington acknowledged that something had to be done.

[...]

For more information on this publication: Please contact Cyber Project
For Academic Citation: Sulmeyer, Michael.“Which Cyberattacks Should the United States Deter, and How Should it Be Done?.” Council on Foreign Relations, July 24, 2017.