3Faces%20of%20the%20Dragon

Can retaliators hold assets of the attacker at risk? There is no guarantee that attackers in
cyberspace will have assets that could be put at risk. 193 Is it reasonable to retaliate against
a hacker who has done significant damage to a banking or industry infrastructure? What
assets does a hacker possess?
Can retaliators do so repeatedly? Can a retaliatory attack ensure that an attacker will not
attack again? While this was probably the case during a nuclear attack it is far less likely
after a cyber attack, when the attacker may close off vulnerabilities.
Can retaliatory cyber attacks disarm cyber attackers? If the attacker is a hacker who could
be anywhere, the answer is probably not.
Will third parties stay out of the way? Nation-states may stay out of the way but it is
uncertain if other elements (non-state actors such as terrorist or criminal groups who want
to get in on the action) will do so.
Might retaliation send the wrong message? An explicit deterrence policy defining cyber
attacks as acts of war may encourage private enterprises to lose their incentive to invest in
cyber security, knowing that someone above them (government policy) has a larger
incentive to protect their business.
Can states set thresholds for response? It is difficult to establish a threshold and to prove
when it has been crossed and by whom.
Can escalation be avoided? While retaliation may or may not be “in kind” (another cyber
attack), it does not guarantee that a counter-retaliation will also be “in kind.” A fight that
starts in cyberspace may carry over to other means. 194
These are all tough, legitimate questions. Another question that might have been proposed is “what
is the actual intent of electrons involved in an attack? Were they intended to conduct reconnaissance
but were misinterpreted? How would an irrational actor respond to a reconnaissance effort?” If a
nuclear weapon was involved, everyone would know about the incident.
Some reviewers of Libicki’s work found that it had omissions. Retired Colonel Jeffrey Caton noted
that the work had missed how state sovereignty is defined in cyberspace; had compartmentalized
military aspects of cyberspace from other instruments of power (diplomatic, economic, information);
had not discussed second- and third-order effects; and had oversimplified the assumption that
deterrence and war in cyberspace are uniquely ambiguous. 195
In addition to urging caution against the implementation of a cyber deterrence concept for the
reasons mentioned here, Libicki also suggests that the US and the US Air Force “should not make
strategic cyber war a priority investment area. Strategic cyber war, by itself, would annoy but not
disarm an adversary.” 196 Further, if strategic cyber war is not a priority for the US, then why spend
money on cyber defense and cyber security? Libicki appears to abandon even the concept of a
defensive strategic cyber war policy.
Conclusions: What Does This Mean for the Deterrence Concept?
The discussion above indicates some significant differences exist in the nuclear and
information/cyber deterrence concepts. And there are other differences not addressed above. Of