Which Cyberattacks Should the United States Deter, and How?

In its obituary for legendary scholar and statesman Zbigniew Brzezinski, the New York Times noted that he “sometimes showed a tendency to believe that any disagreement between theory and reality indicated some fault on the part of reality.” That’s an observation worth bearing in mind when examining if and how the theory of deterrence can apply to current cyber threats. Wouldn’t it be nice if the United States could just threaten to impose cost on the perpetrators, and they would knock it off? After all, didn’t the United States successfully deter the Soviet Union from launching a devastating nuclear strike against it? Why can’t the same be done in cyberspace?

Conceptually, there is no reason that the principles of deterrence—principles that apply to child rearing, dog training, principle-agent modeling, and the use of nuclear weapons—are inapplicable to cyberspace. The problem is not with theory of deterrence, but with the reality of threats in cyberspace. Those looking to “cyber deterrence” to stop state-sponsored hacking should bear in mind three points to ground further discussion.

First, relying on deterrence to protect the United States is a lousy policy prescription given that it is impossible to know whether it is working. It is hard to determine in real time whether an opponent is deterred and therefore unwilling to act, or whether some other pressure makes it unable to act. Most commentators on strategic studies learned these concepts in the context of nuclear weapons. Deterrence became the only game in town because there was no realistic defense to a Soviet nuclear strike. Mutually assured destruction was no one’s first or best idea of how to proceed through the Cold War, but it offered one (albeit suboptimal) approach to the critical security need of the time: to prevent the Soviets from using nuclear weapons against the United States. Only after the Cold War did U.S. policymakers come to understand that Soviet leaders had a different understanding of deterrence and the ability to win a nuclear conflict.

Related Links: Cybersecurity’s Human Side: How Can We Solve Our People Problem?

Also read: Obama's Cyber Legacy

This leads to the second point about deterrence: clarity about what must be deterred is essential. Declaring the United States will deter “cyberattacks” or “hacking” doesn’t cut it. The problem is not the lack of definitions, but a lack of consensus about what bad conduct in cyberspace really needs to be stopped. Chances are, if your company or agency has been hacked, you will think that conduct should be deterred. But that’s an impossibly subjective standard. Some might say that critical infrastructure (water, power, etc.) are sectors that could easily be marked as off limits. Except countries can’t agree even to that.

Who would have thought that the most vocal condemnation of a cyberattack against the United States would be prompted by an attack on the entertainment company, Sony Pictures? Do recent efforts to access the business network of a nuclear power plant in the United States cross a line in the digital sand? The fact that there aren’t clear answers to these questions does not mean that government employees or white-hats haven’t thought hard enough. Instead, it reflects the cold truth that deterrence theory does not naturally lend itself to the realities of cyberspace. If the U.S. government is not specific about what needs to be deterred, attackers will not know what is off-limits and deterrence is not going to work.

But even if there could be some sort of consensus, there is a third challenge: the United States needs to have (and the ability to demonstrate) the will to impose cost for transgressions. The Obama administration made some progress here: over time, they indicted Chinese and Iranian hackers, and sanctioned Russian and North Korean enablers of hacking. It is debatable whether these countries interpreted U.S. actions as costly, but at least Washington acknowledged that something had to be done.

The Trump administration has an opportunity to build on the previous administration’s necessary but ultimately insufficient work, and to demonstrate that it will impose meaningful costs on those whose hacking threatens the lives of Americans. More than tough tweets will be needed, and tradeoffs with other critical foreign policy priorities (trade with China, checking North Korea’s missile ambitions) will tend to push cyber-related issues to the backburner. But if the Trump White House is serious at giving deterrence a shot, demonstrating the will to impose cost is a requirement.

If the United States will not or is not able to deter cyberattacks, what can be done? First, the United States can publicly own up to its strength and capabilities. Although this can be seen as a necessary but insufficient condition for trying to deter by the threat of cost imposition, it has other benefits too. Being clear about U.S. capabilities would be a first step towards a more informed dialogue with the American people about the role they will and will not play in U.S. foreign policy. Clarity can also reassure allies and encourage collective steps to be more forthright. Without being showy or flashy, the U.S. government can not only confirm its widely-known capabilities, but reinforce a commitment to use these power capabilities to protect the United States and to further its interests. For example, why hasn’t the U.S. military said more than merely acknowledging that they are dropping “cyber bombs” (whatever those are) on ISIS? There’s no need for deep technical detail. But surely U.S. officials can describe at least some of the effects the military has achieved and some of the methods of achieving them in ways that won’t compromise sources and methods.

The executive branch, Congress and the U.S. private sector also need to have a more holistic conversation about defending the United States from cyberattacks. On the whole, the U.S. defensive posture against cyberattacks is often comparable to a man leaving money on his lawn overnight and being outraged the next morning to find it stolen. The United States should learn from the British experience of establishing a centralized coordinating agency known as the National Cyber Security Centre to improve the consistency of how the government prevents and mitigates threats.

Finally, the United States need to acknowledge that bad things in cyberspace are going to happen. Just as the United States has learned how to be resilient in the face of terrorism, a similar mindset needs to be adopted for cyberspace. Such an acknowledgment in no way advocates giving up trying to keep hackers out of the United States’ most critical systems; only that the U.S. government should also be prepared to fight and defeat them quickly and decisively if they are initially successful.