Global Insecurity

U.S. Cyber Deterrence and Foreign Salami Tactics

If the U.S. doesn't act seriously in response to cyber hacking, it can expect more in the near future

---

About the author: u/miskellaneousness is a political junkie and regular contributor to r/politicaldiscussion.

---

To some, deterrence may seem a tired concept. It’s a buzzword from yesteryear, a Cold War era concept closely linked with nuclear security. But far from being obsolete, the concept of deterrence is of crucial importance in a new realm: cyber. In fact, it is a lack of attention given to deterrence by the United States security establishment that has left the country vulnerable to a series of devastating and high profile cyber attacks. A classified assessment by the NSA, for example, indicates that China has used cyber-espionage to exfiltrate “five Libraries of Congress” worth of sensitive and classified data, including information on high ranking American military personnel and cutting edge U.S. weapons systems.

In its most basic form, the idea of deterrence is readily understood: prevent the subject from taking unwanted action by threat of punishment. Indeed, the notion of deterrence is so intuitive that parents of young children use it on an almost continuous basis: “Justin! If you throw that block you are going right to timeout!” But as these parents can attest to, while the concept behind deterrence may be simple, employing it effectively is a whole ‘nother matter.

So what makes deterrence effective? Most theorists recognize three important elements, all of which should be present for a deterrent threat to be effective: clarity, capability, and credibility. Your threat must be clearly communicated, you must be capable of inflicting the punishment, and your target must believe you are willing to follow through.

In the Cold War era, when the academic fascination with deterrence was at full throttle, these criteria were relatively easily met via nuclear arms (sometimes referred to as the “ultimate deterrent”). After the development of second-strike capabilities by both the U.S. and the USSR, nuclear war became unthinkable to many because it would almost certainly result in “mutually assured destruction.” The clear and credible capability of each side to threaten nuclear retaliation in response to an attack is part of what caused the Cold War to remain a “cold” through periods of enormously high tensions, such as the Cuban Missile Crisis and the Berlin Crisis of 1961.

Despite the myriad academic works on deterrence over the course of the Cold War, then, deterrence during this period was — at its core — simplified by the devastating power of nuclear weapons. Taken out of the nuclear context and into the context of the rapidly developing and highly ambiguous realm of cyber, deterrence is much, much trickier. To demonstrate this, it’s worth examining how each of the core elements of deterrence are complicated in the cyber realm.

First, for effective deterrence to exist, a clear threat of punishment must exist. Is such clarity of threat against cyber assailants present from the United States? Not at all — but not for lack of trying. In 2011, the Obama administration sought to bring some clarity to its cyber deterrence by stating that cyber attacks against the US can be considered acts of war and may elicit a conventional military response. Still, though, the necessary clarity is not there. What level of cyber attack would result in a conventional military response? For attacks that do not meet the threshold for conventional military response, what will be the consequences? At present, the threatened US response to cyber attacks is completely ambiguous: the nation may respond to cyber attacks with any action resulting from nothing to war (and has often opted for the former).

Capability is the realm of cyber deterrence where the United States likely isn’t lacking. Because most of the offensive cyber capabilities of the U.S. are highly classified, it’s very difficult to accurately assess the nation’s ability to inflict retaliatory cyber punishment on other nations. Nonetheless, there’s little reason to assume the security community’s offensive cyber capabilities are lagging. Moreover, given that U.S. doctrine indicates that a cyber attack may result in a response from America’s highly powerful traditional military forces, capability can clearly be seen as present.

Credibility, however, is where the United States is most lacking. Given how difficult it is pin down the origin of a cyber attack, it seems almost inconceivable that the US would respond to a cyber attack with kinetic action. Further, because a conventional military response to a cyber attack seems a disproportionate reaction and could quickly escalate to war, it’s a tough sell to an American public highly wary of new foreign entanglements. These considerations make the United States’s threat of conventional retaliation ring hollow, reducing the credibility of our threat and heavily undermining our deterrence.

The failure of the United States to clearly project a credible threat to would-be cyber-assailants is compounded by the aggressive cyber postures of geopolitical adversaries such as Russia and China. In describing techniques to circumvent deterrence during the Cold War, Thomas Schelling wrote in Arms and Influence of what he called “salami tactics.” These tactics rely on the ambiguities of an adversary’s threats of punishment and, via an escalating series of low-level probes, erode the adversary’s credibility of responding. As with deterrence generally, salami tactics can be understood (and witnessed) in the parent-child relationship. Here Schelling makes precisely that comparison:

“Salami tactics,” we can be sure, were invented by a child; whoever first expounded the adult version had already understood the principle when he was small. Tell a child not to go in the water and he’ll sit on the bank and submerge his bare feet; he is not yet “in” the water. Acquiesce, and he’ll stand up; no more of him is in the water than before. Think it over, and he’ll start wading, not going any deeper; take a moment to decide whether this is different and he’ll go a little deeper, arguing that since he goes back and forth it all averages out. Pretty soon we are calling to him not to swim out of sight, wondering whatever happened to all our discipline.

Like a child obfuscating his own actions to avoid admonishment from a parent, Russia and China have been active in the cyber realm employing salami tactics to degrade American deterrent threats. Each time a cyber attack is met without a response, the threshold for retaliation is pushed to a new level.

And, in accordance with the escalatory principle of salami tactics, Russian cyber acts have recently elevated to the level of direct interference in U.S. elections. On October 7th, 2016, the United States government officially accused the Russian government of hacking emails of the DNC and other political organizations with the intent of influencing electoral outcomes. According to some analysts, these cyber attacks were effective enough to swing the outcome of the election.

Disturbingly, there is no indication that such cyber assaults will result in any clear retaliation from the United States. This is hugely problematic. As a headline from Wired puts it, “Trump’s Win Signals Open Season for Russia’s Political Hackers.”

All, however, is not lost. The United States can still rework its doctrine of cyber deterrence to add much needed credibility to the equation. The way to do this is to shift away from a retaliatory threat that is massively damaging but unlikely to be employed, such as a conventional military strike, and towards a threat that is somewhat less devastating but can readily and consistently be employed: economic sanctions. Because its economy is the largest in the world, the U.S. has an unmatched capacity to act through unilateral sanctions to inflict palpable harm on its adversaries without crippling itself.

Responding to cyber attacks with economic sanctions wouldn’t be painless for the U.S. There would be some economic cost. But that cost needs to be weighed against the cost of the current lack of credible cyber deterrence. In dollars and cents, that cost is already high as countries like China have used cyber espionage to steal information on aircraft like the F-35, which the U.S. has spent $400 billion developing. In a more abstract sense, that cost may be a loss of integrity of America’s democratic processes as foreign countries attempt to influence our elections. In both cases, these costs will continue to rise unless the U.S. acts to rapidly infuse its cyber deterrence doctrine with a substantial degree of credibility.