The Damoclean sword of offensive cyber: Policy uncertainty and collective insecurity

Abstract

Cyberspace is a new domain of operation, with its own characteristics. Cyber weapons differ qualitatively from kinetic ones: They generate effects by non-kinetic means through information, technology, and networks. Their properties, opportunities, and constraints are comparable to the qualitative difference between conventional and nuclear weapons. New weapons and their target sets in a new domain raise a series of unresolved policy challenges at the domestic, bilateral, and international levels about deterrence, attribution, and response. They also introduce new risks: uncertainty about unintended consequences, expectations of efficacy, and uncertainty about both the target’s and the international community’s response. Cyber operations offer considerable benefits for states to achieve strategic objectives both covertly and overtly. However, without a strategic framework to contain and possibly deter their use, make state and non-state behavior more predictable in the absence of reciprocal norms, and limit their impact, an environment where states face persistent attacks that nonetheless fall below the threshold of armed conflict presents a policy dilemma that reinforces collective insecurity.