CHILDREN AND FAMILIES The RAND Corporation is a nonprofit institution that EDUCATION AND THE ARTS helps improve policy and decisionmaking through ENERGY AND ENVIRONMENT research and analysis. HEALTH AND HEALTH CARE This electronic document was made available from INFRASTRUCTURE AND www.rand.org as a public service of the RAND TRANSPORTATION Corporation. INTERNATIONAL AFFAIRS LAW AND BUSINESS NATIONAL SECURITY Skip all front matter: Jump to Page 16 POPULATION AND AGING PUBLIC SAFETY SCIENCE AND TECHNOLOGY Support RAND Purchase this document TERRORISM AND HOMELAND SECURITY Browse Reports & Bookstore Make a charitable contribution For More Information Visit RAND at www.rand.org Explore RAND Project AIR FORCE View document details Limited Electronic Distribution Rights This document and trademark(s) contained herein are protected by law as indicated in a notice appearing later in this work. This electronic representation of RAND intellectual property is provided for non-commercial use only. Unauthorized posting of RAND electronic documents to a non-RAND website is prohibited. RAND electronic documents are protected under copyright law. Permission is required from RAND to reproduce, or reuse in another form, any of our research documents for commercial use. For information on reprint and linking permissions, please see RAND Permissions. This product is part of the RAND Corporation monograph series. RAND monographs present major research findings that address the challenges facing the public and private sectors. All RAND mono- graphs undergo rigorous peer review to ensure high standards for research quality and objectivity. Crisis and Escalation in Cyberspace Martin C. Libicki Prepared for the United States Air Force Approved for public release; distribution unlimited PROJECT AIR FORCE The research described in this report was sponsored by the United States Air Force under Contract FA7014-06-C-0001. Further information may be obtained from the Strategic Planning Division, Directorate of Plans, Hq USAF. Library of Congress Cataloging-in-Publication Data is available for this publication. ISBN: 978-0-8330-7678-6 The RAND Corporation is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND’s publications do not necessarily reflect the opinions of its research clients and sponsors. R® is a registered trademark. © Copyright 2012 RAND Corporation Permission is given to duplicate this document for personal use only, as long as it is unaltered and complete. Copies may not be duplicated for commercial purposes. Unauthorized posting of RAND documents to a non-RAND website is prohibited. RAND documents are protected under copyright law. For information on reprint and linking permissions, please visit the RAND permissions page (http://www.rand.org/publications/ permissions.html). Published 2012 by the RAND Corporation 1776 Main Street, P.O. Box 2138, Santa Monica, CA 90407-2138 1200 South Hayes Street, Arlington, VA 22202-5050 4570 Fifth Avenue, Suite 600, Pittsburgh, PA 15213-2665 RAND URL: http://www.rand.org To order RAND documents or to obtain additional information, contact Distribution Services: Telephone: (310) 451-7002; Fax: (310) 451-6915; Email: [email protected] Preface This report presents some of the results of a fiscal year 2011 RAND Project AIR FORCE study on the integration of kinetic and nonkinetic weapons, “U.S. and Threat Non-Kinetic Capabilities.” It discusses the management of cybercrises throughout the spectrum from precrisis to crisis to conflict. The basic message is simple: Crisis and escalation in cyberspace can be managed as long as policymakers understand the key differ- ences between nonkinetic conflict in cyberspace and kinetic conflict in the physical world. Among these differences are the tremendous scope that cyberdefense affords; the near impossibility and thus the pointless- ness of trying to disarm an adversary’s ability to carry out cyberwar; and the great ambiguity associated with cyberoperations—notably, the broad disjunction between the attacker’s intent, the actual effect, and the target’s perception of what happened. Thus, strategies should con- centrate on (1) recognizing that crisis instability in cyberspace arises largely from misperception, (2) promulgating norms that might modu- late crisis reactions, (3) knowing when and how to defuse inadvertent crises stemming from incidents, (4) supporting actions with narrative rather than signaling, (5) bolstering defenses to the point at which potential adversaries no longer believe that cyberattacks (penetrat- ing and disrupting or corrupting information systems, as opposed to cyberespionage) can alter the balance of forces, and (6) calibrating the use of offensive cyberoperations with an assessment of their escalation potential. iii iv Crisis and Escalation in Cyberspace The research reported here was sponsored by Gen Gary North, Commander, U.S. Pacific Air Forces, and conducted within the Force Modernization and Employment Program of RAND Project AIR FORCE. It should be of interest to the decisionmakers and policy researchers associated with cyberwarfare, as well as to the Air Force strategy community. RAND Project AIR FORCE RAND Project AIR FORCE (PAF), a division of the RAND Corpo- ration, is the U.S. Air Force’s federally funded research and develop- ment center for studies and analyses. PAF provides the Air Force with independent analyses of policy alternatives affecting the development, employment, combat readiness, and support of current and future air, space, and cyber forces. Research is conducted in four programs: Force Modernization and Employment; Manpower, Personnel, and Train- ing; Resource Management; and Strategy and Doctrine. Additional information about PAF is available on our website: http://www.rand.org/paf/ Contents Preface ............................................................................. iii Figures and Table ................................................................ ix Summary .......................................................................... xi Acknowledgments ............................................................ xxiii Abbreviations ................................................................... xxv CHAPTER ONE Introduction ....................................................................... 1 Some Hypothetical Crises ......................................................... 2 Mutual Mistrust Is Likely to Characterize a Cybercrisis ...................... 5 States May Have Room for Maneuver in a Cybercrisis .......................10 A Note on Methodology .........................................................16 Purpose and Organization .......................................................17 CHAPTER TWO Avoiding Crises by Creating Norms ..........................................19 What Kind of Norms Might Be Useful? ...................................... 20 Enforce Laws Against Hacking .............................................. 20 Dissociate from Freelance Hackers .......................................... 22 Discourage Commercial Espionage .......................................... 23 Be Careful About the Obligation to Suppress Cybertraffic ............... 24 How Do We Enforce Norms? .................................................. 24 Confidence-Building Measures ................................................. 26 Norms for Victims of Cyberattacks ............................................ 28 Norms for War ....................................................................29 Deception ....................................................................... 30 v vi Crisis and Escalation in Cyberspace Military Necessity and Collateral Damage ..................................31 Proportionality ..................................................................33 Reversibility ......................................................................35 Conclusions ....................................................................... 36 CHAPTER THREE Narratives, Dialogue, and Signals ............................................39 Narratives to Promote Control ................................................. 40 A Narrative Framework for Cyberspace ........................................41 Victimization, Attribution, Retaliation, and Aggression .................... 44 Victimization ....................................................................45 Attribution ...................................................................... 46 Retaliation .......................................................................47 Aggression .......................................................................49 Emollients: Narratives to Walk Back a Crisis ................................. 50 “We Did Nothing” .............................................................51 “Well, At Least Not on Our Orders” ........................................ 54 “It Was an Accident” ...........................................................57 “This Is Nothing New” ........................................................58 “At Least It Does Not Portend Anything” .................................. 60 Broader Considerations ........................................................61 Signals ..............................................................................62 Ambiguity in Signaling ........................................................65 Signaling Resolve ...............................................................67 Signaling That Cybercombat