Publication: Survival: Global Politics and Strategy
30 January 2015
When it comes to cyber war, the United States is ambivalent. While persuaded of the utility of offensive cyber operations, it dreads where they might lead. The advantages of cyber war are swamped by the disadvantages if it cannot be kept under control – and there are nagging doubts about whether it can. That computer systems are often interconnected and multi-purpose, and that there are no sharp ‘firebreaks’ in cyber war, compounds the dangers of escalation to unintended levels and effects, including the disruption of critical civilian services. In a crisis or war, the United States might, despite misgivings, feel compelled to attack computer systems that enable the enemy to strike US forces, only to find itself engaged in cycles of attack and retaliation that produce more pain than gain.
This situation is the product of conditions likely to persist: potential US adversaries – China, for one – are both vulnerable to US cyber attacks and capable of cyber attacks to which the United States is vulnerable. The United States cannot escape this predicament by making its own computer systems invulnerable: with technology as it is, few systems can be satisfactorily defended against attacks by sophisticated opponents. Nonetheless, the United States may not have to make a binary choice between reaping the benefits and averting the harm of cyber war. This essay is about trying to have it both ways.
The United States is capable of disrupting enemy computer systems, and could find itself in situations that argue for doing so. It might attack an enemy’s military computer systems in preparing for or fighting a war. Conceivably, it might conduct cyber attacks against civilian computer systems in order to coerce a hostile state, perhaps as an alternative to war. Yet, owing to its own dependence on computer systems, the United States could, as a consequence, suffer harm to its armed forces’ ability to wage war, to the health of its economy, to the workings of its government and to the functioning of its society. Of course, US decision-makers would presumably weigh benefits and risks case by case. However, if there are general ways of reducing the risks of cyber war while retaining the benefits, the United States should pursue them.
China, Russia and Iran are often posited as potential adversaries in cyberspace. Their offensive capabilities and vulnerabilities vary: China is very capable, but its dependence on computers leaves it vulnerable; Russia is very capable, but less dependent than China, and hence less vulnerable. Iran is the least capable in offense, and the least dependent, but also far less capable in defence, increasing its vulnerability. For what follows we will use China as the test case; it is capable of conducting cyber attacks and has declared it would use them in war.