The Cartwright Conjecture: The Deterrent Value and Escalatory Risk of Fearsome Cyber Capabilities

Abstract

In light of advocates that argue cyber deterrence can result simply from the existence and showboating of cyber capabilities, this paper explores a variety of historical case studies to illustrate that cyber conflict is often more escalatory than not, including relevant cases such as Stuxnet (involving the United States, Iran, and Israel), North Korea, Russia, and China. These analyses demonstrate that U.S. cyber-related actions often lead to misinterpretations and overreactions by adversaries, resulting in those states increasing their own cyber capabilities as a result of fear. Thus, this paper suggests that a policy of deterrence built on the existence, and showcasing, of cyber capabilities is just as likely to lead to inflamed relationships between states as it is to lead to improved deterrence. In terms of policy implications, this paper largely argues that even the simplest of technical changes or advancements in U.S. cyber capabilities can cause a number of unintended consequences, due in large part to political leaders’ tendencies to react illogically and with certain hawkish and optimistic bias, leading to general geopolitical uncertainties. This argument coincides with the Journal of Cybersecurity’s efforts to demonstrate the importance of melding perspectives from both technological and political experts, and argues that foreign policy decisions cannot be isolated from technological ones.

Keywords: Cyber Conflict, Deterrence, Denial, Punishment, Cost Imposition, Escalation, Uncertainty, Retaliation, Cyber Capability, Cyber Attack, Cyberwar, Credibility, Perception, Offensive Cyber