Cyber Deterrence is Overrated

Deterrence

Deterrence is the potential use or threat of punishment to achieve a change in be­haviour of an opponent. Deterrence is based on the formula that the offensive behaviour (X) of an attacker (A) can be changed by the defender (D), if he is threat­ening him with negative consequences (Y). The logical for­mula for deterrence is: Do not do X, because otherwise consequences Y will follow. The cost of Y must outweigh the gains to be expected from an attack X. This form of deterrence always contains an element of coercion and is therefore called “deterrence by punishment”. It differs from “deterrence by denial”, which aims to in­crease the cost of attacks by hardening systems and increasing resilience so that attacks no longer seem worthwhile. Unless otherwise stated, I mean deterrence by punishment when speaking of deterrence in this paper.

In order for deterrence to work, at least three conditions must be met:

• The threat of consequences must be clearly communicated and understood by all parties (“signaling”).

• Both actors must have as complete information as possible about the capabilities, intentions and ideally the thought processes of their counterparts in order to be able to rationally assess costs and benefits.

• The threat of punishment must be credible, i.e. technically feasible and backed by political resolve.

Successful deterrence requires the threat of punishment to be communicated in a clear, audible and, above all, credible man­ner. Deterrence is considered successful if A does not perform an action, i.e. a cyber-attack. The causality of a non-event cannot be proven logically. One can never say exactly whether it was the threat of punish­ment that led to the change in behaviour, or whether there were other reasons for it. Consequently, deterrence is sometimes considered to be a myth in academic literature.

Deterrence is based on Rational Choice Theory. The assumption is that actors weigh the costs and benefits of their actions and rationally choose the less costly option. The theory has been criticized because actors never have all objective information and can therefore never fully assess the con­sequences of their actions. Furthermore, they often act irrationally, rely on bounded rationality, or act according to norms or habits. Deterrence works only in the head of the attacker, where one has no insight. So it is ultimately a guessing game: “I be­lieve that you believe that I believe” and so on. The logical problem with all deterrence theories is that you never know if deterrence works, until it fails.

Cyber Deterrence

Transferring a deterrence strategy to the cyber domain is regarded as problematic by cyber security researchers. Nuclear deter­rence was assumed to be successful due to unique conditions, i.e. the particularities of the bi-polar world and the extraordinary damage potential of nuclear weapons, which made defence strategies less feasible. In the bipolar world of the Cold War, de­terrence was symmetrical and applied by roughly equally strong actors who were able to assess their motives sufficiently well. Cyber deterrence is multipolar and takes place between asymmetric opponents. Cyber capabilities are mostly opaque and easily proliferate. In this respect, cyber deterrence can fail more easily and is there­fore not a reliable policy option.

Deterrence and “Persistent Engagement” in the US Doctrine

Deterrence is thus not easily transferable to the digital domain. Hawks and national security advocates, however, disagree and believe that, in case of doubt, the possession of fearful cyber capabilities produces deterrent effects. They advocate a stronger offensive, because although the US is a formidable cyber power, it could not deter Russia from influencing the 2016 US presi­dential election with cyber capabilities. In response to this deterrence failure, the Pentagon introduced a new cyber doctrine in 2018. This contains new concepts such as “defending forward”, “persistent engagement” and “preparation of the battlefield”. The doctrine gives the US Cybercommand greater scope for offensive action, for which no presidential authorization is required.

Defending forward means that networks are no longer defended in one’s own perim­eter or territory, but on the systems of po­tential attackers. This potentially includes unwitting third parties worldwide. Attacks against opponent systems are primarily used to gain intelligence in order to detect enemy attacks and burn capabilities at an early stage.

“Persistent engagement” means binding enemy forces by permanently exposing them to attacks by American hackers. Op­po­nents would constantly have to defend themselves against American intrusion at­tempts so that – according to the theory – they no longer have resources for their own offensives. Since no other state has such large personnel resources as the USA, the costs for attackers would be increased in this way. The doctrine clearly mentions China and Russia as potential targets for these measures.

Defending forward and persistent engagement are operational strategies that by themselves are not designed for strategic deterrence. However, it can be argued that the third concept, the “preparation of the battlefield”, might have deterrent effects.

Opponent networks are to be penetrated in order to implant so-called back doors or logic bombs which can be exploited in future conflicts. A logic bomb is malware that lurks undetected in a network until it is activated at a later point in time. This implies a concrete threat of punishment. An opponent would then always have to ask themselves whether they have un­covered all the attack vectors of the Ameri­cans or whether they overlooked a hidden back door in their own network. In view of this uncertainty, attackers could refrain from serious cyber attacks, for example against critical infrastructures. Russia has recently complained vociferously about attempts by American hackers to penetrate the Russian power grid in order to implant backdoors. The Kremlin also warned against an escalation in the cyber area. This is an indication that the USA’s new cyber doc­trine, which is even more offensive than its predecessor called “active defence”, might be fuelling escalations. Whether it does so empirically remains to be seen.

“Persistent engagement” was applied during the Midterm Elections of 2018. A central hub of low-level Russian cyber activ­ity, the “troll factory” or Internet Re­search Agency in St. Petersburg, was tempo­rarily disrupted. However, it resumed its activities shortly afterwards. Tactically, the operation may have been a success. How­ever, it is doubtful whether this form of deterrence has a strategic, i.e. long-term effect. It is to be expected that other cyber powers will now also invest more offensively and train more personnel in order to withstand or outmanoeuvre such “persistent engagement”.

The result would be an intensified arms race with the aim of always being able to mobilize more cyber forces than its rival. It remains to be seen whether persistent engagement will work against more than a handful of opponents at the same time. Low-threshold attackers cannot be stopped in this way either.

Persistent engagement is a NOBUS strategy – nobody but US – and thus cannot be easily replicated by other cyber powers. However, if all cyber powers were to pursue such a doctrine and start placing back doors everywhere, global cyberspace would be highly volatile. Backdoors are not exclusive and can potentially be exploited by any knowledgeable attacker. The cost of such an offensive policy for collective security would probably be higher than the theo­retical gain in national security. The new doctrine thus goes far beyond the concept of “active cyber defence” of the Obama era. The concept was to react offensively to cyber attacks, but only to stop them at their source. This is also the concept that the German government is currently considering in a modified form.

Cyber Deterrence by German Active Defence?

Whether the mere possession of German cyber offensive capabilities would have a deterrent effect is doubtful. All the prob­lems of attribution, demonstration, propor­tionality and controllability of cyber retali­ation described above still apply. Furthermore, it is hard to believe that Germany would be prepared to enter into a dynamic of escalation in cyberspace and then possess the necessary resolve. The culture of re­straint in foreign and security policy is still very pronounced. The population is critical of a more active foreign policy or the as­sumption of greater responsibility. This is particularly true if the use of force is in­volved, whether physical or digital.

Germany would probably have a credibility problem, if it were to adopt a deter­rence-by-punishment posture. A strong opponent would want to test whether Ger­many is politically prepared to use active cyber defences as a deterrent and is willing to endure the consequences of an escalation. So far, Germany lacks a political strategy on how to deal with such a situa­tion. It would have to be tailored to all rele­vant cyber threats and include the afore­mentioned elements of threat com­munica­tion as well as measures to provide propor­tional and effective cyber reaction tools. Additionally, political will is required to use cyber capabilities as a form of punishment, even in the face of a probable escalation dynamic. Whether this actually exists is doubtful.

Since an escalation strategy and political resolve for deterrence by punishment does not exist, “deterrence by denial” is a better strategy for Germany. This conclusion can be derived from the deficits of deterrence by retaliation itself. It fails inter alia be­cause targets are too easily attackable. The bottom line is that it is always cheaper for the attacker to exploit weaknesses than not to do so.

The first step towards an effective deterrent system should therefore be to increase cyber security and resilience in order to make cyber attacks more costly. Of course, deterrence by denial faces several problems itself, so this will not be easy. As a second step, deterrence that accompanies foreign policy measures should be extended. There is much to suggest that deterrence, if at all, only works in concert with other measures – at best within the framework of an inter­national cyber regime that does not yet exist. This would include international diplomacy, deterrence through norms or international interdependence or entangle­ment, but also through regimes and orga­nisations that subject state behaviour to rules. The efforts of cyber foreign policy should be intensified in this direction. However, this is a long way off.

Cyber-conflicts are largely unregulated. Established norms for appropriate behaviour and red lines do not yet exist. Conse­quently there is a high risk that deterrence will fail and trigger an escalation dynamic. Germany should therefore consider wheth­er it wants to participate in this game, and whether it is prepared to endure any negative consequences. Cyber security by resilience is in any case the more long-lasting strategy, since it works against all opponents in the same way, and does not need to be tailored to specific opponents.

Summary

The existence of offensive cyber capabilities alone does not act as a deterrent, especially if it is not credibly communicated that there is a willingness to use them. There are many pitfalls that make deterrence by punishment an ineffective policy concept with many risks. The risks of deterrence failure are more prevalent than in the ana­logue world. Deterrence by punishment is most likely a strategy doomed to fail.

If even the more active cyber powers like the US regularly fail with cyber deterrence, then a German cyber deterrence policy – due to the traditional restraint in foreign and security policy – cannot be expected to be successful either. As long as Germany has no escalation strategy and is not pre­pared to endure the possible consequences of an offensive cyber deterrence policy, this approach should be avoided. Instead, German policy should continue to focus on “deterrence by denial” by hardening systems and building resilience.