STRATEGIC

Is the World Falling Apart (And How Would We Know)? 59
stores information in digital form without adequate backup or redundancy.
44 This is a hard problem, not least because of limitations on the
ability to store electricity. Director of National Intelligence James L.
Clapper said that the United States does not foresee a “Cyber Armageddon
scenario that debilitates the entire U.S. infrastructure” but
rather “an ongoing series of low-to-moderate level cyber attacks from
a variety of sources over time, which will impose cumulative costs.” 45
However, he warned:
. . . The cyber threat cannot be eliminated; rather, cyber risk must
be managed. Moreover, the risk calculus some private sector entities
employ does not adequately account for foreign cyber threats
or the systemic interdependencies between different critical infrastructure
sectors. 46
Traditional concepts of deterrence may not function well in
cyberspace. Effective deterrence requires that one knows the source of
the threat, has made known an intention to deny the attacker victory
or to invoke costly punishment, and has the capability to do so. It is not
clear that those conditions can be met. Clapper articulated the problem
as follows:
[E]ven when a cyber attack can be attributed to a specific actor, the
forensic attribution often requires a significant amount of time to
complete. Long delays between the cyber attack and determination
of attribution likewise reinforce a permissive environment. 47
Yet where deterrence fails, resilience can help prepare the country
for new forms of disruption as well as familiar acts of nature. Good
disaster preparedness and policies aimed at building redundant and
44 Ted Koppel, Lights Out: A Cyberattack, a Nation Unprepared, Surviving the Aftermath,
New York: Crown Publishers, 2015.
45 James R. Clapper, Director of National Intelligence, “Worldwide Cyber Threats,” statement
to House Permanent Select Committee on Intelligence, September 10, 2015, p. 1.
46 Clapper, 2015, p. 2.
47 Clapper, 2015, p. 3.