Revealing the capabilities of the U.S. nuclear arsenal is a key part of the U.S. nuclear deterrence strategy. So when it comes to the U.S. cyber warfare capabilities, the same tactic could be used to deter cyber war, claims a new paper by the Rand Corporation. Offisive cyber operations may be a legitimate deterrence strategy.
The paper, Brandishing Cyberattack Capabilities, was prepared for the Office of the Secretary of Defense, and seeks to identify if demonstrations, or “brandishing” cyberwar capabilities, serve as effective deterrents to a potential cyber war. The paper says that brandishing cyberattack capabilities would accomplish three things: declare a capability, suggest the possibility of its use in a particular circumstance, and indicate that such use would really hurt.
“The most obvious way to demonstrate the ability to hack into an enemy’s system is to actually do it, leave a calling card, and hope it is passed forward to national decision-makers,” the report says. “This should force the target to recalculate its correlation of forces against the attacker.”
“Advertising” cyberwar capabilities may be helpful as a backup a deterrence strategy by dissuading other countries from performing harmful activities. Plus, it could limit a country’s confidence in the reliability of its information, command and control, or weapon systems, the paper says.
However, providing effective cyber warfare capabilities isn’t easy since they are relative to a specific target, which must be fully understood. Even if cyber warriors can reveal the capability of penetrating systems, this is not the same as getting the systems to fail.
Having a successful cyber deterent strategy will take considerable analysis and imagination, since there is not one clear way to suggest the cyber war capabilities of the U.S., the report admits.
“(Brandishing cyberwarfare capabilities) is no panacea, and it is unlikely to make a deterrence posture succeed if the other elements of deterrence (e.g., the will to wage war or, for red lines drawn in cyberspace, the ability to attribute) are weak,” the report says.
