{"id":48140,"date":"2019-06-07T11:14:27","date_gmt":"2019-06-07T01:14:27","guid":{"rendered":"https:\/\/www.aspistrategist.ru\/?p=48140"},"modified":"2019-06-07T11:14:27","modified_gmt":"2019-06-07T01:14:27","slug":"deterrence-in-cyberspace","status":"publish","type":"post","link":"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/","title":{"rendered":"Deterrence in cyberspace"},"content":{"rendered":"
<\/figure>\n

Earlier this year, American officials acknowledged<\/a> that US offensive cyber operations had stopped Russian disruption of the 2018 congressional election. Such operations are rarely discussed, but this time there was commentary<\/a> about a new offensive doctrine of \u2018persistent engagement\u2019 with potential adversaries. Will it work?<\/p>\n

Proponents of \u2018persistent engagement\u2019 have sought to strengthen their case by arguing that deterrence does not work in cyberspace. But that sets up a false dichotomy. Properly used, a new offensive doctrine can reinforce deterrence, not replace it.<\/p>\n

Deterrence means dissuading someone from doing something by making them believe that the costs to them will exceed their expected benefit. Understanding deterrence in cyberspace is often difficult, because our minds remain captured by an image of deterrence shaped by the Cold War: a threat of massive retaliation to a nuclear attack by nuclear means. But the analogy to nuclear deterrence is misleading, because, where nuclear weapons are concerned, the aim is total prevention. Deterrence in cyberspace is more like deterring crime: governments can only imperfectly prevent it.<\/p>\n

There are four major mechanisms to reduce and prevent adverse behaviour in cyberspace: threat of punishment, denial by defence, entanglement and normative taboos. None of the four is perfect, but together they illustrate the range of means by which it is possible to minimise the likelihood of harmful acts. These approaches can complement one another in affecting actors\u2019 perceptions of the costs and benefits of particular actions, despite the problem of attribution. In fact, while attribution is crucial for punishment, it is not important for deterrence by denial or entanglement.<\/p>\n

Because deterrence rests on perceptions, its effectiveness depends on answers not just to the question of \u2018how\u2019 but also to the questions of \u2018who\u2019 and \u2018what\u2019. A threat of punishment\u2014or defence, entanglement or norms\u2014may deter some actors but not others. Ironically, deterring major states from acts like destroying the electricity grid may be easier than deterring actions that do not rise to that level.<\/p>\n

Indeed, the threat of a \u2018cyber Pearl Harbor\u2019 has been exaggerated. Major state actors are more likely to be entangled in interdependent relationships than are many non-state actors. And American policymakers have made clear that deterrence is not limited to the cyber realm (though that is possible). The United States will respond to cyberattacks across domains or sectors, with any weapons of its choice, proportional to the damage that has been done. That can range from naming and shaming to economic sanctions to kinetic strikes.<\/p>\n

The US and other countries have asserted that the laws of armed conflict apply in cyberspace. Whether or not a cyber operation is treated as an armed attack depends on its consequences, not on the instruments used. And this is why it is more difficult to deter attacks that do not reach the equivalence of armed attack. Russia\u2019s hybrid warfare in Ukraine and, as the report<\/a> by US Special Counsel Robert Mueller has shown, its disruption of the US presidential campaign fell into such a grey area.<\/p>\n

Although ambiguities of attribution for cyberattacks, and the diversity of adversaries in cyberspace, do not make deterrence and dissuasion impossible, they do mean that punishment must play a more limited role than in the case of nuclear weapons. Punishment is possible against both states and criminals, but its deterrent effect is slowed and blunted when an attacker cannot be readily identified.<\/p>\n

Denial (through hygiene, defence and resilience) plays a larger role in deterring non-state actors than major states, whose intelligence services can formulate an advanced persistent threat. With time and effort, a major military or intelligence agency is likely to penetrate most defences, but the combination of threat of punishment and effective defence can influence their calculations of costs and benefits. This is where the new doctrine of \u2018persistent engagement\u2019 comes in. Its goal is not only to disrupt attacks, but also to reinforce deterrence by raising the costs for adversaries.<\/p>\n

But policy analysts cannot limit themselves to the classic instruments of nuclear deterrence\u2014punishment and denial\u2014as they assess the possibility of deterrence and dissuasion in cyberspace. They should also pay attention to the mechanisms of entanglement and norms. Entanglement can alter the cost-benefit calculation of a major state such as China, but it probably has little effect on a state such as North Korea, which is weakly linked to the world economy.<\/p>\n

\u2018Persistent engagement\u2019 can, however, aid deterrence in such difficult cases. Of course, entering any adversary\u2019s network and disrupting attacks poses a danger of escalation. Rather than relying just on tacit bargaining, as proponents of \u2018persistent engagement\u2019 often emphasise, more explicit communication may help.<\/p>\n

Stability in cyberspace is difficult to predict, because technological innovation there is faster than in the nuclear realm. Over time, better attribution forensics may enhance the role of punishment and encryption or machine learning may increase the role of denial and defence.<\/p>\n

Cyber learning is also important. As states and organisations come to understand better the limitations and uncertainties of cyberattacks and the growing importance of the internet to their economic wellbeing, cost-benefit calculations of the utility of cyberwarfare may change. Not all cyberattacks are of equal importance; not all can be deterred; and not all rise to the level of significant threats to national security.<\/p>\n

The lesson for policymakers is to focus on the most important attacks, recognise the full range of mechanisms at their disposal and understand the contexts in which attacks can be prevented. The key to deterrence in the cyber era is to acknowledge that one size does not fit all. \u2018Persistent engagement\u2019, when viewed from this perspective, is a useful addition to the arsenal.<\/p>\n","protected":false},"excerpt":{"rendered":"

Earlier this year, American officials acknowledged that US offensive cyber operations had stopped Russian disruption of the 2018 congressional election. Such operations are rarely discussed, but this time there was commentary about a new offensive …<\/p>\n","protected":false},"author":500,"featured_media":48142,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[391,2138,1755,116],"acf":[],"yoast_head":"\nDeterrence in cyberspace | The Strategist<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Deterrence in cyberspace | The Strategist\" \/>\n<meta property=\"og:description\" content=\"Earlier this year, American officials acknowledged that US offensive cyber operations had stopped Russian disruption of the 2018 congressional election. Such operations are rarely discussed, but this time there was commentary about a new offensive ...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/\" \/>\n<meta property=\"og:site_name\" content=\"The Strategist\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/ASPI.org\" \/>\n<meta property=\"article:published_time\" content=\"2019-06-07T01:14:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2019\/06\/0706cyber.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"470\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Joseph S. Nye\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ASPI_org\" \/>\n<meta name=\"twitter:site\" content=\"@ASPI_org\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Joseph S. Nye\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#website\",\"url\":\"https:\/\/www.aspistrategist.ru\/\",\"name\":\"The Strategist\",\"description\":\"ASPI's analysis and commentary site\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.aspistrategist.ru\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-AU\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/#primaryimage\",\"url\":\"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2019\/06\/0706cyber.jpg\",\"contentUrl\":\"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2019\/06\/0706cyber.jpg\",\"width\":800,\"height\":470,\"caption\":\"Cyber warfare operators assigned to the 275th Cyber Operations Squadron of the 175th Cyberspace Operations Group of the Maryland Air National Guard configure a threat intelligence feed for daily watch in the Hunter's Den at Warfield Air National Guard Base, Middle River, Md., Dec. 2, 2017. (U.S. Air Force photo by J.M. Eddins Jr.)\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/\",\"url\":\"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/\",\"name\":\"Deterrence in cyberspace | The Strategist\",\"isPartOf\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/#primaryimage\"},\"datePublished\":\"2019-06-07T01:14:27+00:00\",\"dateModified\":\"2019-06-07T01:14:27+00:00\",\"author\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/edb0a4c6105071db2b5d7d716d4d7eed\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/#breadcrumb\"},\"inLanguage\":\"en-AU\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.aspistrategist.ru\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Deterrence in cyberspace\"}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/edb0a4c6105071db2b5d7d716d4d7eed\",\"name\":\"Joseph S. Nye\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3e5157ecfa6b59807d2cf04084bc0ed9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3e5157ecfa6b59807d2cf04084bc0ed9?s=96&d=mm&r=g\",\"caption\":\"Joseph S. Nye\"},\"url\":\"https:\/\/www.aspistrategist.ru\/author\/joseph-s-nye-jr\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Deterrence in cyberspace | The Strategist","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/","og_locale":"en_US","og_type":"article","og_title":"Deterrence in cyberspace | The Strategist","og_description":"Earlier this year, American officials acknowledged that US offensive cyber operations had stopped Russian disruption of the 2018 congressional election. Such operations are rarely discussed, but this time there was commentary about a new offensive ...","og_url":"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/","og_site_name":"The Strategist","article_publisher":"https:\/\/www.facebook.com\/ASPI.org","article_published_time":"2019-06-07T01:14:27+00:00","og_image":[{"width":800,"height":470,"url":"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2019\/06\/0706cyber.jpg","type":"image\/jpeg"}],"author":"Joseph S. Nye","twitter_card":"summary_large_image","twitter_creator":"@ASPI_org","twitter_site":"@ASPI_org","twitter_misc":{"Written by":"Joseph S. Nye","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"https:\/\/www.aspistrategist.ru\/#website","url":"https:\/\/www.aspistrategist.ru\/","name":"The Strategist","description":"ASPI's analysis and commentary site","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.aspistrategist.ru\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-AU"},{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/#primaryimage","url":"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2019\/06\/0706cyber.jpg","contentUrl":"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2019\/06\/0706cyber.jpg","width":800,"height":470,"caption":"Cyber warfare operators assigned to the 275th Cyber Operations Squadron of the 175th Cyberspace Operations Group of the Maryland Air National Guard configure a threat intelligence feed for daily watch in the Hunter's Den at Warfield Air National Guard Base, Middle River, Md., Dec. 2, 2017. (U.S. Air Force photo by J.M. Eddins Jr.)"},{"@type":"WebPage","@id":"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/","url":"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/","name":"Deterrence in cyberspace | The Strategist","isPartOf":{"@id":"https:\/\/www.aspistrategist.ru\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/#primaryimage"},"datePublished":"2019-06-07T01:14:27+00:00","dateModified":"2019-06-07T01:14:27+00:00","author":{"@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/edb0a4c6105071db2b5d7d716d4d7eed"},"breadcrumb":{"@id":"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/#breadcrumb"},"inLanguage":"en-AU","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.aspistrategist.ru\/deterrence-in-cyberspace\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.aspistrategist.ru\/"},{"@type":"ListItem","position":2,"name":"Deterrence in cyberspace"}]},{"@type":"Person","@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/edb0a4c6105071db2b5d7d716d4d7eed","name":"Joseph S. Nye","image":{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3e5157ecfa6b59807d2cf04084bc0ed9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3e5157ecfa6b59807d2cf04084bc0ed9?s=96&d=mm&r=g","caption":"Joseph S. Nye"},"url":"https:\/\/www.aspistrategist.ru\/author\/joseph-s-nye-jr\/"}]}},"_links":{"self":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/48140"}],"collection":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/users\/500"}],"replies":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/comments?post=48140"}],"version-history":[{"count":4,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/48140\/revisions"}],"predecessor-version":[{"id":48143,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/48140\/revisions\/48143"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/media\/48142"}],"wp:attachment":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/media?parent=48140"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/categories?post=48140"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/tags?post=48140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}