Cyber Institutions & Sub-optimal Logic of Cyber Deterrence

"Cyber Institutions & Sub-optimal Logic of Cyber Deterrence"

Nadiya Kostyuk

University of Michigan, Ann Arbor

Abstract:

Can states make cyber deterrence work? Recent years have seen a proliferation ofempirical research on deterrence using cyber operations or other statecraft tools. Thisresearch has generated important new insights concerning cyber coercion, but it hastold us relatively little about cyber institutions as an effective deterrent. This projectargues that cyber institutions—publicly observable efforts aimed to signal a country’slevel of cyber offensive capability, doctrine behind its use, and to clarify which actionslead to which responses — increase the credibility of a state’s threat and signal to adversariesthat a country has the “power to hurt.” Using an incomplete-informationmodel, I develop a theory that investigates the impact of observable dimensions of cybermilitary power on deterrence success. My findings demonstrate that cyber institutionsdeter adversaries only in limited cases. Despite that, states tend to sub-optimallyover-invest resources in these institutions. Weak states over-invest to convince adversariesthat they are strong whereas strong states over-invest so that adversaries donot begin to believe that they are weak states pretending to be strong. I use a seriesof interviews of cybersecurity experts and intelligence reports to establish empiricalplausibility of my theory. My focus on the strategic logic of cyber institutions as adeterrent represents a departure from existing literature and has important policy implications.

Discussants:

Tiberiu Dragu (NYU)

Andres Gannon (PhD Candidate, UCSD)

Aaron Brantly (Virginia Tech)

OPSC Co-Coordinator:

Brad Smith (Vanderbilt University)

Graduate Assistant:

Heesun Yoo (Vanderbilt University)