1 The Escalation Inversion and Other Oddities of Situational Cyber Stability

Abstract

Are cyber capabilities escalatory?It is one of the most important and debated questions for policymakers and scholars of cyber conflict.The pessimists, in whose camp we normally reside, observe a two-decade trend of increasing cyber aggression acting like a ratchet, not a pendulum.Adversary groups aligned with states have caused physical destruction (starting with the US-Israeli Stuxnet attack on Iran); savaged private sector companies (Iran's attacks on US banks or the North Korean dismembering of Sony); 1 disrupted national healthcare systems (North Korea's WannaCry which disrupted the UK National Health Service), 2 electrical grids in wintertime (Russia's takedown of the Ukrainian grid), 3 and national elections (Russia again); 4 and recklessly created global havoc (Russia's NotPetya). 5If "escalation" means a meaningful and potentially destabilizing upward spiral in the intensity of cyber hostilities, then cyber conflict may be "the most escalatory kind of conflict that humanity has ever come across." 6States are getting closer to crossing the threshold of death and major destruction outside of wartime.How long until one state, through mistake, miscalculation, or maliciousness, crosses that line?The optimists have equally compelling arguments, however -not least the contention that, so far, none of these admittedly worrying cyber attacks has ever warranted an armed attack with kinetic weapons in response. 7How, they argue, can cyber conflict be escalatory when states have never responded to cyber attacks with traditional violence?Indeed, there is at least as much evidence for cyber capabilities reducing rather than causing or intensifying international crises -as when US President Donald Trump called off a deadly airstrike against Iran in June 2019 but allowed a non-lethal cyber strike as retaliation for attacks on oil tankers and the downing of a US drone. 8

Topics & Concepts