6th European Conference - Academic Conferences

Merritt Baer
refined the metrics for estimating impact and intent of cyberattack, and applies Markov game theory, a
stochastic approach. (Shen et al. 2007) However the two-player stochastic model is not valid any time
when more than one player is involved, and this is the more likely scenario— as in the case of a
generalized security model that would account for more than one player as a potential threat, or a
model that includes potential alliances.
The minimax solution in zero-sum games is Nash equilibrium (where each player is at her optimal
level, taking into account the other players' strategy). There exists “at least one Nash equilibrium,
possibly involving mixed strategies, for any normal- form static game with a finite number of players
and strategies” (Jamakka, 2005:14). However, in cyberwarfare, there are obstacles to reaching
minimax stasis: there is no assumption that it is a zero-sum game (power may exist relative to others
but in cyber there can be emerging forms of power and there may be no clear endpoint that signifies
“winning”); there may be more than two players; players may make simultaneous and overlapping
moves (instead of taking turns like in chess); and there is no valid assumption of perfect information
(one‟s minimax strategy may depend on knowing the capabilities of the other players).
Moreover, the possibility of alliances disrupts Nash equilibrium because if players can agree on
strategies different from minimax, they may achieve higher payouts. The classic example of this is a
cartel manipulating the market; in the cyber realm, it could take the form of inter- national or even nonnationstate
collaboration among players. U.S. vulnerability to alliance-making by other players is
accentuated by the fact that we have more to lose— our government and our private-sector cyber
capabilities/ data are overall more valuable than other countries' (Hathaway, 2009:16).
Some, including former Department of Homeland Security Secretary Michael Chertoff (in Espiner
2010) compare nuclear strategy to cyber strategy. However, cyber weapons defy nuclear game
theoretic strategy because cyber weapons are amorphous and can be pinpointed— used as a scalpel
instead of, or as well as, a hammer. Even cyber weapons that are clearly war-oriented, like Stuxnet,
can be more controlled and monitored in use than nuclear weapons, may take time to detect and may
cover the executor‟s tracks. Unlike the nuclear arena, in which even those with capabilities have so far
resisted employing nuclear weapons, cyberwar weapons have been and will continue to actually
come into use—but in nuanced and creative ways that elude traditional definitions of use of force,
weapons, or war.
For all these reasons, it seems likely that we cannot use game theory in the traditional method of
modeling the game‟s endpoints and then reversing the moves that would lead to stasis, because we
may never reach equilibrium. This is another way of saying that the game may have multiple Nash
equilibria-- “Game theory cannot necessarily predict the outcome of a game if there are more than
one Nash equilibriums [sic] for the game. Especially when a game has multiple Nash equilibriums [sic]
with conflicting payoffs...” (Jamakka et al., 2005: 14). If the parties do not reach stasis then by
definition the game will continue because players have an incentive to change their decision--it is only
at equilibrium that (optimal payout exists and therefore) there is no incentive to change decisions.
Accordingly, this paper‟s analysis begins from an acknowledgment that in cyberwar, there may be no
“solution.” In cyberwar, unlike in checkers, game theory cannot follow each decision path to its
conclusion and then trace the right decisions back. The “right decisions” may evolve and the endpoint,
if there is one, is unknown. However, game theory continues to be useful in cyberwar strategy
because the rational predictability of game theory will continue to drive decisions and seek out
patterns in them, and because game theory may identify and intelligently weight nodes of a decision
tree that are not immediately recognizable or historically favored by human decision-makers.
The paper begins by acknowledging a number of ways in which cyberwar defies traditional game
theory models. It describes why a biological model is the most useful analogy, including the
epidemiological response to invasion and the evolutionary tendency toward equilibrium. Then it
explores the benefits of game theory, describing ways in which it is a uniquely useful tool for
cyberwarfare strategy as an ongoing set of decisions in a changing set of conditions.
24