What War Games Tell Us About The Use Of Cyber Weapons

Recently, Jason Healey a senior research scholar at Columbia University’s School of International and Public Affairs and past  member of the USDefense Science Board’s task force on cyber deterrence has argued that “there is now a well-documented instance of cyber deterrence,” pointing to a report of conversations within the Obama administration. 

Some White House officials argued against a cyberattack, citing asymmetric vulnerabilities in tit for tat engagements within the cyber domain. Healey highlights a powerful example of cyber restraint within the Obama administration, but is it deterrence? 

The United States has also exercised restraint in the nuclear domain, but it is unclear even now whether that restraint is a result of adversary deterrence efforts or a normative nuclear taboo. So what is driving the cyber restraint Healey identified?

In order to understand the motivations behind cyber behaviors, a longitudinal analysis of strategic war games was conducted at the US Naval War College from 2011-2016. These free-play games, which feature 150-200 U.S. government experts and senior leader players, situate players within crisis scenarios and then allow them to play all instruments of national power to resolve the crisis. 

Over the years, these war games varied the adversary, the intensity of the crisis, and the players. Like the evolution of cyber operations in real life, the way cyber capabilities were designed in the games evolved in complexity, representing the institutions and capabilities that developed from 2011 to 2016. Bottom line: a lot of things changed between the games. 
However, what remained remarkably consistent across the games was how players utilised cyber operations. In five of the six games, players launched offensive cyber operations only after conventional weapons conducted destructive attacks. 

Additionally, players were more willing to place systems on nuclear alert than to launch cyberattacks or even cyber-enabled information operations. Over and over players cited concerns about escalation in their cyber restraint, articulating fears that cyberattacks could “lead to nuclear war.” 

Further, in all of the six games, despite large scale adversary cyberattacks (up to nuclear effects in allied countries), none of the “blue” teams chose to respond to cyber-attacks. In one game, a player explained, “this is cyber, it’s different psychologically.” 

In all of these games, players were told who had attacked them in cyberspace, essentially priming them for retaliation. The lack of support for retaliation in these games is, therefore, especially compelling.

This research suggests two types of restraint: restraint in using cyber operations and an overall restraint in responding to cyber operations. 

What causes this restraint? Is it deterrence or is it a cyber taboo?  These games couldn’t definitively answer this puzzle, but they do suggest a series of potential hypotheses about cyber restraint. 

First, restraint in utilizing cyber operations could be a uniquely US phenomenon tied to a perception of asymmetric cyber vulnerabilities combined with overwhelming conventional superiority (what Healey’s article alludes to). 
In other words, why open the Pandora box of cyber operations when the United States has the option to respond to any significant problems with economic punishment or military might? 

A secondary hypothesis suggests that cyber restraint derives from a false cyber-nuclear equivalency in which the institutional legacy of Strategic Command and the narrative of “strategic” cyber weapons has led to an extension of the nuclear taboo to the cyber domain. 

These hypotheses are largely agnostic to the adversary, mainly because the games analysed, featured different adversaries with different cyber, conventional, and nuclear capabilities. Restraint was consistent despite these threat differences, suggesting that cyber restraint was not a product of adversary-tailored deterrence but instead internally derived incentives.

Perhaps more puzzling is why these games also show restraint when responding to cyber operations, a phenomenon not found in the nuclear domain. 

Once again, this could be a strictly US form of restraint, in which the United States, as the largest economic and military power, can withstand significant cyberattacks without retaliation because it relies on a greater conventional and nuclear superiority. However, there could be a more generalisable explanation which links cyber restraint to emotions and argues that the virtual and novel threat of cyber operations fail to generate the kind of fight or flight gut reaction created by more evolutionarily-primed threats. 

If this final hypothesis is true, then the restraint in cyber response may permeate beyond US borders and suggest that cyber operations are highly unlikely to lead to escalation in other domains.

Finally, the one war game which did not display cyber use restraint has important implications for foreshadowing the long-term strength of the cyber taboo. 

In that game, the player leading the blue team executed an extraordinarily risk-acceptant “escalate to dominate” strategy that featured early first use of cyber-attacks against a series of domestic and military targets followed by a large-scale conventional offensive. 

This game highlighted how important the risk proclivity and personality of leaders are to when and how cyber operations are used. 

Previous research highlighted the large role that risk aversion played in the Obama administration and restraint across a series of domains. The Trump administration is much more risk acceptant, which may lead to less incentives for self-restraint in cyber-space.

CouncilOnForeignRelations:      Journal of Conflict Resolution

You Might Also Read: 

AI In Conflict: Cyberwar & Robot Soldiers:

AI Increases The Risks of Nuclear War:

 

« Cyber Attackers Tunnel Into Financial Services Firms
Get Started with Predictive Analytics »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

AcceptLocal

AcceptLocal

AcceptLocal is a payments industry consultancy with expertise in payment processing, payment security, anti-money laundering and fraud prevention.

NRI Secure Technologies

NRI Secure Technologies

NRI SecureTechnologies is a Cybersecurity group company of the Nomura Research Institute (NRI) and a global provider of next-generation Managed Security Services and Security Consulting.

Cyber Security Raad (CSR) - Netherlands

Cyber Security Raad (CSR) - Netherlands

The Cyber Security Council (CSR) is a national, independent advisory body of the Dutch government undertaking efforts at strategic level to bolster cyber security in the Netherlands.

Cyber Craft

Cyber Craft

CyberCraft is an innovative and dynamic software development, outsourcing and consulting company. Services offered include penetration testing.

Salt Security

Salt Security

Salt Security protects the APIs that are the core of every SaaS, web, mobile, microservices and IoT application.

Bellvista Capital

Bellvista Capital

Bellvista Capital connects entrepreneurs with capital and unmatched business expertise in the technology areas of Cloud Computing, Cyber Security and Data Analytics.

Ukrainian Special Systems (USS)

Ukrainian Special Systems (USS)

Ukrainian Special Systems (USS) is a state-owned commercial enterprise providing confidential communication, trust services and services in the field of information protection.

INE

INE

INE is a premier provider of Technical Training for the IT industry.

Udacity

Udacity

Udacity's mission is to train the world’s workforce in the careers of the future. Our programs range from beginner to expert levels and deliver the hands-on skills for real-world expertise.

Axiado

Axiado

Axiado Corporation is a security processor company redefining hardware root of trust with hardware-based security technologies, including per-system AI.

Progress Partners

Progress Partners

Progress Partners is a corporate advisory firm that works with buyers and sellers of emerging growth companies to complete M&A or private placement transactions. Our sectors include cybersecurity.

NXM Labs

NXM Labs

NXM is a leader in a leader in advanced cybersecurity software for connected devices.

TokenEx

TokenEx

TokenEx Cloud Security Platform protects sensitive data to strengthen our clients' security postures while future-proofing their operations.

PreVeil

PreVeil

We started PreVeil to bring radically better security to ordinary business and personal communication and information storage.

AnzenSage

AnzenSage

AnzenSage is a cybersecurity advisory consultancy specializing in security risk resilience for the food sector: agriculture, food manufacturing, food supply chain, vineyards, and wineries.

AI Safety Institute (AISI)

AI Safety Institute (AISI)

The AI Safety Institute’s mission is to minimise surprise to the UK and humanity from rapid and unexpected advances in AI.