6th European Conference - Academic Conferences

The Uses and Limits of Game Theory in Conceptualizing
Cyberwarfare
Merritt Baer
Harvard Law School, Cambridge, USA
mbaer@post.harvard.edu
Abstract: In cyberwarfare, there are obstacles to reaching minimax stasis: unlike in checkers, game theory
cannot follow each decision path to its conclusion and then trace the right decisions back. However, I contend
that because the rational predictability of game theory will continue to drive decisions and seek out patterns in
them, game theory may identify (and intelligently weight) nodes of a decision tree that are not immediately
recognizable to or favored by human decision-makers. While we can‟t create a network that is maximally
resistant to random faults and maximally resistant to targeted faults, we can take into account the particular
weaknesses and likelihoods of attack so that the weaknesses overlap in resistant ways-- ways that correspond to
risk preferences and security priorities. Moreover, using game theory to make a security strategy that is a
calculated derivative of mapped potential outcomes will help us to avoid human biases and to respond to threats
proportionately/economically. Rather than a process of continual growth, cyber evolution, like biological evolution,
seems more aptly characterized as punctuated equilibrium—periods of relative stasis followed by quick, drastic
periods of breakthrough. Reaching Nash equilibrium is unlikely in the cyberwar context because under unstable
conditions, evolutionarily stable strategies don‟t run a typical course. While there may be no set of moves that is a
“solution” in cyberwar strategy, game theory allows human decisionmakers to intelligently identify and weight
decision paths to transcend cognitive biases. This paper seeks to change the way of thinking about cyberwar--
from one of stockpiling weapons, to one of looking for patterns-- thinking about the problem of cyber insecurity
more holistically. The paper challenges some of the myopia in thinking about cyber in existing "warfare" terms
and proposes that organic models‟ tendency toward game theoretic equilibrium may help us conceive of the
cyberwar decisionmaking landscape more effectively.
Keywords: cyberwarfare, game theory, layered defense, Nash equilibrium
1. Introduction
In this paper I explore the applications and limitations of game theory to cyberwarfare at a conceptual,
not case study, level. My focus is on federal strategy—especially the United States Department of
Defense (DoD)—so I do not focus on addressing cybercrime or cyberattack that has as its purpose
money or a local, ideological message, or even those with cyber -terrorist or -anarchist goals. My
focus is on large-scale acts of war aimed at military, governmental or infrastructural targets that
currently only certain nation-states are likely to be able to execute, thus the other “players” in the
game are nation-state-level actors.
I recognize that cyberwarfare is among the rarer forms of online violence in comparison with other
forms of cybercrime, but its high stakes and opportunities for more contained strategic study attracted
my focus. For the purposes of this paper, I assume we have available all existing sophisticated game
theoreticians, human or computerized.
I find that game theory is useful to the extent that it allows us to transcend some of our systemspecific
biases (based on established or institutional ways of approaching problems) and threatspecific
biases (rooted in evolutionarily-derived disproportionate reactions to certain threats). Game
theory can allow us to weigh the nodes of the decision tree more accurately; it is not a solution as
such, but a tool for holistic cyberwarfare strategy.
2. Background: Nash equilibrium and complications to game-theoretical
stasis in the cyber context
Game theory scholars have written, though not extensively, on the application of game theory to
information warfare. (See, e.g., Hamilton et al, “The Role of Game Theory in Information Warfare” and
“Challenges to Applying Game Theory to Information Warfare”). The US Cyber Consequences Unit
(US-CCU) claims it primarily employs an analytic method called “Value Creation Analysis” that
“draws…broadly on cooperative game theory.” (See US-CCU website, "http://www.usccu.us/"
http://www.usccu.us/).
Two-player stochastic games may be useful in the escalation context (deciding whether to launch a
preemptive attack or responding to an attack could be a two-player interaction). A study by SPIE has
23