Heading Off State-Sponsored Hacker Attacks

The Cipher Brief: What are some of the similarities and differences between nuclear deterrence and cyber deterrence?

Michael Sulmeyer: There are many more differences than similarities. The biggest difference is that we have a very clear sense in the nuclear space of what we are trying to deter – specifically a nuclear attack against the United States. We also have some clarity on how we were going to deter it: through the use of our own nuclear forces. When we think about cyberspace, however, we do not have a consensus about what exactly we are trying to deter, and the means through which we could even try to deter are very diverse. We don’t have consensus about which means are appropriate to achieve what kind of goals.

TCB: In the cyber domain there is a plethora of actors, and there may be different ways to deter different actors. How can we tailor our deterrence to specific actors?

Sulmeyer: A lot of scholars and practitioners have used the idea of tailored deterrence in different ways. When I hear the term, I think about being very clear about not just what conduct you are trying to deter, but also who you are trying to deter from doing it, and then tailoring ways to impose costs based on that adversary in particular. You may actually have to deal with the problem – which is the threat of cyber attacks against the United States – not just according to deterrence, but also through a combination of defense, prevention, and resilience, which are all different from deterrence. You need a whole suite of steps to prepare yourself for dealing with the problem.

TCB: Can you compare cyber deterrence to criminal deterrence?

[...]