Is America Really Ready for a Cyber War?

Emma Schroeder

Security, Americas

A defensive cyber strategy cannot rely on the ability to guarantee defense.

The United States faces new types of military threats that challenge traditional organization and strategy, including those emanating from the cyber domain. This challenge, however, can be made more solvable by using a well-known theory of warfare to provide a model upon which theorists of today can build an understanding of modern warfare. The most widespread framework with which cyber conflict is modeled is that of deterrence. As different as these two may seem, both are characterized by offense ascendancy and costly defense, providing the base for the borrowed theory. The theoretical and practical application of the deterrence model to cyberspace was included as a crucial component of the 2015 Department of Defense cyber manual, citing a key mission as contributing to “the development and implementation of a comprehensive cyber deterrence strategy to deter key state and non-state actors from conducting cyberattacks against U.S. interests.” While this way of thinking helps prepare for—and prevent—a large-scale cyber Pearl Harbor, it has significant limitations in regards to practical use. A better framework for this kind of activity is the irregular-conflict model.

Limits of the Deterrence Model

The fundamental-element-of-deterrence theory is the existence of a credible threat. Kinetic weaponry, like bombs and missiles, cause obvious and devastating consequences through methods which the populations of the world can understand and fear. In the cyber domain, attacks have not proven to hold this same psychological power, especially in that the most powerful cyber weapons we have are those our enemies know nothing about.

One of the key points of the deterrence model is the ability to assure retaliation. Though the difficulty of cyberattack attribution is no longer as large a hurdle as it once was, it is difficult to accurately identify all attack parameters within the accelerated time frame that the deterrence model demands.