The Cybersecurity Dilemma: Where Thucydides Meets Cyberspace

"The great Greek historian Thucydides wrote of the Peloponnesian War, “It was the rise of Athens, and the fear this inspired in Sparta, that caused war to be inevitable.” This statement hints at a broad pattern. As nations rise, and especially as they secure themselves, they in the process threaten other nations who have no choice but to take the threat very seriously. Often, this threatening behavior is unintentional. In the time since the ancient Greeks, international relations scholars have named this idea the “security dilemma” and found it occurring time and again, both in strategic matters and at the operational level of conflict.

What about in cybersecurity? My new book argues that we are fast approaching an era—if we’re not there already—in which the cybersecurity dilemma will pose serious concern. The argument rests on three ideas.

First, developing the capacity to do significant and targeted damage with a cyber operation requires a lot of preparation. In previous kinds of conflict, the development of weapons was done at home, and then the weapons were deployed overseas as needed. Cyber operations are a little more complicated. Developing and tailoring a cyber capability usually requires gaining access to the target system in advance, doing reconnaissance that informs the development, and sometimes refining the code in replica test environments. In this vein, NSA Director Michael Rogers alluded to other states conducting preparatory intrusions as they seek to “generate options and capabilities for themselves should they decide that they want to potentially do something.”

All of this is time-consuming, requires covert access to potential adversary networks, and results in capabilities that aren’t easily retargeted..."