SIPRI Policy Paper CYBER-INCIDENT 55 MANAGEMENT September 2020 Identifying and Dealing with the Risk of Escalation johan turell, fei su and vincent boulanin STOCKHOLM INTERNATIONAL PEACE RESEARCH INSTITUTE SIPRI is an independent international institute dedicated to research into conflict, armaments, arms control and disarmament. Established in 1966, SIPRI provides data, analysis and recommendations, based on open sources, to policymakers, researchers, media and the interested public. The Governing Board is not responsible for the views expressed in the publications of the Institute. GOVERNING BOARD Ambassador Jan Eliasson, Chair (Sweden) Dr Vladimir Baranovsky (Russia) Espen Barth Eide (Norway) Jean-Marie Guéhenno (France) Dr Radha Kumar (India) Ambassador Ramtane Lamamra (Algeria) Dr Patricia Lewis (Ireland/United Kingdom) Dr Jessica Tuchman Mathews (United States) DIRECTOR Dan Smith (United Kingdom) Signalistgatan 9 SE-169 72 Solna, Sweden Telephone: + 46 8 655 9700 Email:
[email protected] Internet: www.sipri.org Cyber-incident Management Identifying and Dealing with the Risk of Escalation SIPRI Policy Paper No. 55 johan turell, fei su and vincent boulanin September 2020 © SIPRI 2020 All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted, in any form or by any means, without the prior permission in writing of SIPRI or as expressly permitted by law. ISBN 978-91-85114-99-3 Contents Preface v Acknowledgements vi Summary vii Abbreviations x 1. Introduction 1 2. Analytic framework: The concepts of escalation and de-escalation 4 and the actors involved Escalation and de-escalation: A brief review of the literature 4 Definitions of escalation and de-escalation in this paper 5 Types of actor involved in cyber incidents 8 3.