Chapter Title: Tricky Terrain

Book Title: Cyberdeterrence and Cyberwar

Book Author(s): MARTIN C. LIBICKI
Published by: RAND Corporation

Stable URL: https://www.jstor.org/stable/10.7249/mg877af.17

JSTOR is a not-for-profit service that helps scholars, researchers, and students discover, use, and build upon a wide
range of content in a trusted digital archive. We use information technology and tools to increase productivity and
facilitate new forms of scholarship. For more information about JSTOR, please contact support@jstor.org.

Your use of the JSTOR archive indicates your acceptance of the Terms & Conditions of Use, available at
https://about.jstor.org/terms
This content is licensed under a RAND Corporation License. To view a copy of this license, visit
https://www.rand.org/pubs/permissions.html.

RAND Corporation is collaborating with JSTOR to digitize, preserve and extend access to
Cyberdeterrence and Cyberwar

This content downloaded from

185.244.152.143 on Wed, 29 May 2024 15:43:40 +00:00
All use subject to https://about.jstor.org/terms
CHAPTER NINE

Tricky Terrain

When facing a threat that cannot be denied, a potential target can

attempt to defend, disarm, or deter. As Figure 9.1 illustrates, the best
mix of the three may depend on what mode of warfare is at issue.
In traditional land combat, for instance, the emphasis was on dis-
arming the enemy in combat. Relying on defense generally did not
work very well (the Maginot line being a prime example), and deter-
rence by threat of punishment generally required a disarmed or poorly
Figure 9.1
Where Various Forms of Combat May Fit in the Deter-Disarm-Defend
Triangle

Disarm

18th-century
land combat

19th-century
naval combat

13th-century Air combat

land combat circa 1944

Air combat
Nuclear
circa 1930
Cyber combat
combat

Defend Deter
RAND MG877-9.1

175

This content downloaded from

185.244.152.143 on Wed, 29 May 2024 15:43:40 +00:00
All use subject to https://about.jstor.org/terms
176 Cyberdeterrence and Cyberwar

armed enemy (Sherman’s march through Georgia, for example). In late

medieval times, when castles were strong and artillery had yet to be
introduced, the optimal point was closer to the defense apex of the
triangle. In naval combat, the contest was historically over freedom of
navigation; defense played a very small role (except at the tactical level,
in terms of ship design). Yet there were vigorous debates between dis-
arming (in terms of a “fleet in being”) and deterrence by punishment (in
terms of “commerce raiding”). Early observers of air warfare believed
cities to be impossible to defend and were pessimistic about disarm-
ing invasion fleets, and so focused on deterrence.1 As World War II
commenced, populations evidenced a more stalwart attitude toward air
attacks; disarming the Luftwaffe proved possible in the Battle of Brit-
ain, but ground-based air defense was often futile.2 The optimal point
moved toward the middle of the triangle. In the nuclear age, especially
when expressed in terms of missiles, defense was nearly impossible, dis-
arming (“counterforce”) was a second-strike consideration, and so the
primary emphasis was on deterrence (“countervalue”).
What of war in cyberspace? Clearly, disarming is impossible, and
no one seriously doubts that defense is necessary (lest joyhackers, crim-
inals, and spies run riot through everyone’s systems). The question is
whether there is any role for deterrence. This investigation suggests
that, in this medium, the best defense is not necessarily a good offense;
it is usually a good defense. Granted, it is both extreme and unneces-
sary to foreswear deterrence (that is, to repeat, deterrence through pun-
ishment in kind) altogether, if only to have a credible response when
some state openly challenges the United States in that realm. Other-
wise, cyberdeterrence, as this discussion has demonstrated, is highly
problematic. Before contemplating deterrence as its primary response
to the threat of state-sponsored cyberattacks, the United States may
first want to exhaust other approaches, such as diplomatic, economic,

1 Quester, 1986, pp. 82–104, argues that British fear of air attack—there was considerable
panic after the Zeppelin raids in World War I—explained a great deal about Britain’s capitu-
lation in Munich.
2 Overy, 1995.

This content downloaded from

185.244.152.143 on Wed, 29 May 2024 15:43:40 +00:00
All use subject to https://about.jstor.org/terms
 Tricky Terrain 177

and prosecutorial means. At very least, the topic needs far more careful
consideration than it has received to date.
Beyond deterrence lies combat in cyberspace, little of which is
intuitive and less of which is straightforward. Ambiguity is ubiquitous.
Every success in that medium relies on deception. Whoever declared
the electron to be the “ultimate precision weapon” had or should have
had his tongue planted firmly in his cheek.3 In that medium, even
the basic questions of journalism may lack answers: Who attacked?
Where did they come from? What did they damage? How did they do
it? When did the attack take place? Why did they bother? Cyberspace
may be digital, but digital clarity is a property of high-definition televi-
sion, not cyberwar.
To someone locked in a fight to the death, such ambiguities pose
operational difficulties of the sort that apply to all weapons. Whether
problematic weapons are useful depends on what it costs to employ
them and what their likely effects are. By this criterion, cyber might
look good. Cyberweapons come relatively cheap. Because a devastating
cyberattack may facilitate or amplify physical operations and because
an operational cyberwar capability is relatively inexpensive (especially
if the Air Force can leverage investments in CNE), an offensive cyber-
war capability is worth developing. An attacker can use them without
worrying overly much about whether its own side suffers more than
the target does, assuming a few reasonable precautions: Avoid creating
self-replicating code (e.g., worms); make sure that the system you break
is not something you or your friends actually use (without knowing
it); etc. How much the military services should spend to build up an
operational cyberwar capability is a classic how-much-is-enough issue.
At this point, it appears that the operational corps should be small and
elite, while the intelligence and planning cells should receive the most
manpower and resources—a “measure twice, cut once” philosophy.
If combatants are not locked in a death struggle, the operational
difficulties of cyberdeterrence; cyberwar; and, to a lesser extent, opera-
tional cyberwar risk becoming strategic difficulties—and all that fog-

3 From testimony on June 24, 1996, by John M. Deutch, Director of the Central Intel-
ligence Agency, before the Senate Permanent Committee on Investigations.

This content downloaded from

185.244.152.143 on Wed, 29 May 2024 15:43:40 +00:00
All use subject to https://about.jstor.org/terms
178 Cyberdeterrence and Cyberwar

giness is not just about accuracy. If these elements are misused, the
warrior risks fighting the wrong foe at the wrong time in the wrong
place (e.g., in real space when cyberspace would have been less bloody)
for the wrong reason.
Cyberdeterrence ought not to be confused with nuclear deter-
rence: Retaliation is so horrifying that none dares get close to test-
ing it. Neither should it be confused with criminal deterrence: The
law has a clear legitimacy advantage over the lawless. In an anarchic
world, cyberattack and cyberretaliation might resemble the dynamic
that governs rival urban gangs, mutually suspicious desert clans, or the
Hatfields and McCoys—until someone escalates.
The dynamics of cyber confrontations also come perilously close
to theater. Much depends on whether a confrontation plays out in the
shadows, involving sysadmins, spooks, and presidents, or whether it
plays out in the sunlight, where the whole world is watching. What
may be a strategic minuet in the first case could well descend to farce
in the second. What is actually happening can matter less than what
people believe is happening.
Can the United States avoid cyberdeterrence and cyberwar alto-
gether? Perhaps there is a foe so foolish as to attack the world’s stron-
gest military power by causing great annoyance to its society (perhaps
by turning off everyone’s lights, were it possible) and, in effect, asking:
What are you going to do about it? The United States should probably
be able to answer that query.
Whether any nation answers such a question in cyberspace,
through less hostile means (e.g., prosecution, diplomacy), or through
more violent means, however, would depend on a great many factors,
not least of which is the confidence its leaders have in what really hap-
pened and why. Cyberretaliation—with all its difficulties—should not
be the only response in the repertoire.

This content downloaded from

185.244.152.143 on Wed, 29 May 2024 15:43:40 +00:00
All use subject to https://about.jstor.org/terms