Deterrence Signaling and Cyberwar: Why Cyberwar is Imminent

Abstract

A decade ago, Secretary of Defense Leon Panetta warned of an imminent “Cyber Pearl Harbor” attack on U.S. military and civilian critical infrastructure. Secretary Panetta’s prediction has not materialized, and many scholars believe it is unlikely that the U.S. will fall victim to a coordinated campaign of large-scale cyber-attacks (i.e., cyberwar). But given recent reports that Russia and China have developed the capability to wage a cyberwar against the United States, a reassessment of this risk is in order. Most scholars agree that if a cyberwar erupts, it will be caused by a failure of deterrence. Consequently, this thesis re-examines the debate over whether cyber deterrence is possible. Those who doubt that large-scale cyber-attacks can be deterred highlight the difficulty of credibly threatening retaliation and convincing adversaries that their attacks are unlikely to succeed. Meanwhile, those who believe cyber deterrence is feasible respond that the threat of retaliation is effective, as proven by the absence of past cyberwars. The quality of signaling in cyberspace, however, is an underexplored dimension of the cyber deterrence debate. There has yet to be a rigorous analysis of current and past efforts by the U.S., Russia, and China to signal in cyberspace that builds from an understanding of (1) what, specifically, must be signaled, (2) what makes a signal effective or ineffective, and (3) the consequences of failing to signal. In Chapter 3, I argue that failure by states to signal their intentions, capabilities and redlines in cyberspace—which induces first-strike instability—is a pathway to cyberwar. Chapters 4, 5, and 6 assess efforts by the U.S, Russia, and China, respectively, to signal in their strategic documents and with their actions in cyberspace. In Chapter 7, I provide five policy recommendations that address ways for the U.S. to improve the quality of its signaling, manage escalation in crises, and eliminate incentives for other states to conduct first-strike cyber-attacks.