6th European Conference - Academic Conferences

Merritt Baer
1.5), there seems to be no way to guarantee China‟s (or North Korea‟s or Russia‟s) compliance
unless there are some enforcement machineries, and some remedies in instances of transgression.
Cheating seems almost assured considering that, for instance, North Korea continually reneges on its
nuclear negotiations, and cyber disarmament would be pragmatically much easier to cheat.
Even if we could get a global cyber-enforcement organization in place, cyber attribution problems
would allow for rogue states (let alone non-nation-state actors which have no real duty to comply and
are harder to retaliate against) to act outside of the red tape. Defectors could get a comparative
advantage by cheating (think to the classic prisoners‟ dilemma, in which defecting is always the
optimal strategy even though it doesn‟t produce optimal outcome overall), and could do it remotely
through US computers, as in the Estonia attack. For a disarmament agreement to be enforceable
would require a change in the Internet architecture in the sense of decreasing anonymity or some
other sea change to incentivize compliance. One could impose sanctions on nations that allow attacks
to happen-- but this strict liability regime would confront practical problems: finding accurate attribution
is difficult and in fact, the latest numbers reflect more botnet-appropriated computers in the U.S. than
anywhere else (Prince 2010). Establishing cyber rules and then not being able to enforce them
because of attribution problems could be embarrassing.
Moreover, like nuclear war game theory, cyberwar game theory decision paths are complicated by the
fact that there are differences in risk tolerance among players. Thus, while “the usual assumption is
that an opponent evaluation function uses a subset of the heuristics in our own evaluation function,
with different weights” (Hamilton et al. 2002: 4), the heuristics of cyber players may vary dramatically,
especially in interactions between countries with generally greater risk tolerance regimes in
government. Since “players' decisions are optimally based not only on their own cost functions (which
each knows) but also on their opponent's cost structure (which is known only in probability)”
(McCormick and Owen 2006), we cannot assume that our incentives for desiring disarmament match
other players‟.
Larger values-based issues require us to evaluate what kind of behavior we find acceptable online
and what is a violation of international ethics or human rights. This is part of a dialogue that needs to
occur before a legal framework can enforce it. As I have written, we all have a stake in this
determination (Baer 2010a). The purpose of this paper, however, was the strategic possibilities and
not the broader development of a code of human rights online.
7. Conclusions
Game theory is not a panacea. As I have described, cyberwarfare defies a number of common game
theoretic assumptions. However, it is worth exploring game theory‟s applications to cyberwarfare
strategy because game theory lends itself to viewing larger patterns, and approaching problems
holistically. In cyber, the lines between fighting and research melt away, and the computer scientists
mobilizing the tools to wage cyberwar look more like Mozart or Einstein than Napoleon. Following the
symmetries that occur in the natural world, the responses of epidemiology and the growth patterns of
evolutionary biology, game theory allows us to gauge efficacy in a non-linear dimension. Many
experts have compared cyberwar strategy to kinetic-world models, from nuclear strategy (Chertoff, in
Espiner 2010) to air warfare strategy (Baker 2010). I find that kinetic-world models of warfare fall short
of describing the problem of cyberwarfare or its possible treatments. There is no real winning in
cyberwar; there is continual reorientation.
Game theory, worked upon a biological model, holds promise for cyberwar strategy because it
transcends linear models that assume aspects of the landscape to be fixed. Cyberwarfare is delicate
but not haphazard, and game theory can lead decisions that address true threats by avoiding human
bias. If we maintain a robust workforce, game theory can also allow decisionmakers to identify
emerging nodes on the decision tree. In an occam‟s razor sense, it may be that to anticipate the curve
in the cyberwarfare game, we ought to return to the simple beauty of early programming, when the
Internet was unmolded, an organic cell of potential energy. Cyber development eludes kinetic-world
models because it is not just about harnessing power, it is about creating new pockets of utility and
exploiting them in creative ways.
Acknowledgements
Thanks to Professor Jack Goldsmith for the opportunity to write a first version of this research in
seminar and for the exposure to many of cyberwarfare‟s leading minds.
29