What War Games Tell Us About the Use of Cyber Weapons in a Crisis

Last week, Jason Healey argued that “there is now a well-documented instance of cyber deterrence,” pointing to a report of conversations within the Obama administration. Some White House officials argued against a cyberattack, citing asymmetric vulnerabilities in tit for tat engagements within the cyber domain. Healey highlights a powerful example of cyber restraint within the Obama administration, but is it deterrence? The United States has also exercised restraint in the nuclear domain, but it is unclear even now whether that restraint is a result of adversary deterrence efforts or a normative nuclear taboo. So what is driving the cyber restraint Healey identified?

In order to understand the motivations behind cyber behaviors, I performed a longitudinal analysis of strategic war games conducted at the Naval War College from 2011-2016. These free-play games, which feature 150-200 U.S. government experts and senior leader players, situate players within crisis scenarios and then allow them to play all instruments of national power to resolve the crisis. Over the years that I analyzed, these war games varied the adversary, the intensity of the crisis, and the players. Like the evolution of cyber operations in real life, the way cyber capabilities were designed in the games evolved in complexity, representing the institutions and capabilities that developed from 2011 to 2016. Bottom line: a lot of things changed between the games. 

However, what remained remarkably consistent across the games was how players utilized cyber operations. In five of the six games, players launched offensive cyber operations only after conventional weapons conducted destructive attacks. Additionally, players were more willing to place systems on nuclear alert than to launch cyberattacks or even cyber-enabled information operations. Over and over players cited concerns about escalation in their cyber restraint, articulating fears that cyberattacks could “lead to nuclear war.” Further, in all of the six games, despite large scale adversary cyberattacks (up to nuclear effects in allied countries), none of the “blue” teams chose to respond to cyberattacks. In one game, a player explained, “this is cyber—it’s different psychologically.” In all of these games, players were told who had attacked them in cyberspace, essentially priming them for retaliation. The lack of support for retaliation in these games is, therefore, especially compelling.

This research suggests two types of restraint: restraint in using cyber operations and an overall restraint in responding to cyber operations. What causes this restraint? Is it deterrence or is it a cyber taboo? These games couldn’t definitively answer this puzzle, but they do suggest a series of potential hypotheses about cyber restraint. First, restraint in utilizing cyber operations could be a uniquely U.S. phenomenon tied to a perception of asymmetric cyber vulnerabilities combined with overwhelming conventional superiority (what Healey’s article alludes to). In other words, why open the Pandora box of cyber operations when the United States has the option to respond to any significant problems with economic punishment or military might? A secondary hypothesis suggests that cyber restraint derives from a false cyber-nuclear equivalency in which the institutional legacy of Strategic Command and the narrative of “strategic” cyber weapons has led to an extension of the nuclear taboo to the cyber domain. These hypotheses are largely agnostic to the adversary—mainly because the games I analyzed featured different adversaries with different cyber, conventional, and nuclear capabilities. Restraint was consistent despite these threat differences, suggesting that cyber restraint was not a product of adversary-tailored deterrence but instead internally derived incentives.

Perhaps more puzzling is why these games also show restraint when responding to cyber operations—a phenomenon not found in the nuclear domain. Once again, this could be a strictly U.S. form of restraint, in which the United States—as the largest economic and military power—can withstand significant cyberattacks without retaliation because it relies on a greater conventional and nuclear superiority. However, there could be a more generalizable explanation which links cyber restraint to emotions and argues that the virtual and novel threat of cyber operations fail to generate the kind of fight or flight gut reaction created by more evolutionarily-primed threats. If this final hypothesis is true, then the restraint in cyber response may permeate beyond U.S. borders and suggest that cyber operations are highly unlikely to lead to escalation in other domains.

Finally, the one war game which did not display cyber use restraint has important implications for foreshadowing the long-term strength of the cyber taboo. In that game, the player leading the blue team executed an extraordinarily risk-acceptant “escalate to dominate” strategy that featured early first use of cyberattacks against a series of domestic and military targets followed by a large-scale conventional offensive. This game highlighted how important the risk proclivity and personality of leaders are to when and how cyber operations are used. Previous research highlighted the large role that risk aversion played in the Obama administration and restraint across a series of domains. The Trump administration is much more risk acceptant, which may lead to less incentives for self-restraint in cyberspace.