The Rise of Cyber Warfare The Digital Age and American Decline Hanyu Chwe In May 2007, unknown attackers de- advantages in cyberspace; the increasing clared cyberwar on Estonia. Estonians importance of cyberwarfare will accelerate woke up to find that the websites of their the relative decline of American military banks, newspapers, and government agen- power. cies had been systematically dismantled. This was one of the world’s first cyberwar- For the purposes of this paper, I define fare attacks; I argue that it won’t be the cyberwarfare as the use of computer pro- last. grams to attack, disrupt, destroy, disable, In the future, the amount of cyberwar- or steal anything of military, economic or fare will increase drastically. First, the in- general strategic value or e↵orts to defend creased value of cyberspace increases the against such attacks. I am not considering incentives to wage cyberwarfare. Second, industrial corporate espionage, cyber at- the logic of cyberwarfare nullifies several tacks meant to aid the use of conventional mechanisms that constrain territorial war. military force, or the use of internet media Finally, the o↵ensive advantage inherent to organize social action. In my definition, in cyberwarfare exacerbates the security cyberwarfare is not intentionally accompa- dilemma. The United States lacks many nied by corresponding actions in the real of its traditional military and economic world. Cyberwarfare Incentives The strategic and economic value of state needs to guard its cyberspace in order cyberspace is huge. Facebook and to ensure stability. Google were worth 200 billion dollars It’s unlikely internet reliance will de- and 400 billion dollars in 2014 respec- crease. Humanity’s relationship with the tively. (Bloomberg.com, 2014) Billions of internet changes rapidly—as new technol- people use the Internet daily, hundreds of ogy develops, more opportunities exist for billions of dollars are traded yearly (Pew companies and inventions to a↵ect our Research Centers, 2013)—cyberspace is lu- lives. For example, the rise of smart- crative. However, the value of cyberspace phones provided opportunities for dozens is limited in internet companies or transac- of new start-ups and another way for tions; almost every large organization uses humans to interact digitally. (Dougherty, the internet to communicate. (Meltzer, 2015) Finally, millions of people have yet 2014) A corporation or government can to come online. In the United States, cell- be crippled by the loss of their digi- phone usage almost doubled from 2011 to tal infrastructure from su↵ering cyberat- 2014. (Pew Research Centers, 2013) Mi- tacks, Sony was completely shut down for crosoft predicts that there will be 4 bil- four days. (Cunningham & Waxman, 2014) lion internet users by 2020, most new users Four days of no internal communication coming from developing countries. (Cyber in the American federal government would Trust Blog, 2013) As the internet popula- be a disaster. Few human activities don’t tion increases, the value of cyberspace will go through the internet: it controls every- increase even more. thing from our bank accounts to television shows, from Facebook to large swathes of Cyberspace is valuable today and will the American power grid. (Tucker, 2014) A almost certainly be more valuable tomor- The rise of Cyber Warfare 44 row.1 States need to protect their own attackers. “digital territory” in order to shield their The increasing strategic value of cy- governments, militaries, and corporations berspace does not, by itself, imply a cor- from disruption. As the value of cy- responding rise in cyberwarfare. However, berspace increases, the incentives to wage the anonymous nature of cyberwarfare re- cyberwarfare increase as well. The stakes moves three causal mechanisms that dis- have risen—states need allocate more re- courage conventional conflict. Without sources to cyberwarfare, either in hopes of these conflict-reducing e↵ects, increased hurting other states or defending against conflict becomes more likely. No More Restrictions Scholars have discussed multiple reasons skilled not only at hiding their identity for the current decline in conventional war- but also making it look as if someone fare. Unfortunately, three proposed expla- else was responsible”. (International Re- nations for why conflict is discouraged in lations And Security Network, 2009) At- the modern system are rendered invalid by tackers can disguise their IP addresses or cyberwarfare. “transmit their attacks through multiple First, as hegemon armed with dom- nodes of transmission” (Rattray, 2001, 66) inant conventional military force, the in order to disguise themselves or blame United States has the incentive and the other actors. It’s almost impossible for means to quash weaker states’ attempts to cyber defenders to be completely certain expand or balance against it. (Wohlforth, about an attacker’s identity—even if the 1999) It is possible that the threat of evidence clearly points to one actor, it American retaliation and intervention has may just be an attempt to shift blame prevented dozens of potential armed con- by a sophisticated attacker. Gregory Rat- flicts. Second, nuclear deterrence discour- tray adds, “Depending on the sophistica- ages war. The threat of mutually as- tion of the attacker, it’s possible to leave sured destruction prevented conventional the defender unsure if an attack actually warfare during the Cold War. Third, in- occurred”. (Rattray, 2001) The ability for creased economic interdependence makes attackers to completely disguise themselves economic costs from war too high—the cur- completely topples conventional security rent system of global trade is so intertwined logics. that few countries would gain from conflict. Actors can attack in cyberspace with- Any one of these factors, or more likely a out fearing retaliation. Without knowing combination, may drastically reduce con- the attacker’s identity, the United States flict in the modern era. However, these ob- can’t intervene. Similarly, if states don’t stacles simply don’t apply to cyberwarfare. know the identity of their attacker, nu- clear deterrence is useless. It would be For the first time in history, it irresponsible to threaten nuclear reprisal is possible for a state to weather at- over cyberattacks when it is so difficult to tacks that damage their military, eco- accurately determine the identity of the nomic, or industrial infrastructures and attacker. Even if the identity of the at- not be able to confidently determine tacker seems obvious, it’s impossible to the identity of their attacker. James completely rule out the possibility of an- Lewis states, “Identity is easily concealed other actor shifting blame onto an innocent in cyberspace...sophisticated attackers are party. Finally, in cyberwarfare, a state can 1Iwouldarguethatthevalueofphysicalspaceisdecreasingaswell.Afull-fledgedexplanation is outside the scope (and word count) of this paper, but the decreased value of physical territory also increases the value of cyberspace. 45 Hanyu Chwe attack another state and trade with it at By itself, the increased value of cy- the same time. States can engage in cyber- berspace and the increased ease of con- warfare without risking losses from trade; flict doesn’t guarantee more cyberwarfare. defending states wouldn’t know with whom However, due to the o↵ensive advantage of they should stop trading. Cyberwarfare cyberwarfare, the security dilemma in cy- doesn’t invalidate all possible reasons for berspace is greatly exacerbated. Even if the reduction of conflict, but it completely states don’t intend to wage o↵ensive cyber- dismantles three major ones. warfare, it is difficult for states to escape the security dilemma. O↵ensive Advantage and the Security Dilemma The security dilemma states that when protect thousands of nodes in a network; states attempt to increase their security, attackers need only to gain access through they almost always inadvertently threaten one. Accordingly, the amount of code other states. This causes other states to needed to construct defense towers over attempt to increase their own security, ul- the few hundred lines of code needed to timately decreasing security for the first conduct an attack. (Singer & Friedman, state and increasing the likelihood of con- 2014) Defensive programs cost more time, flict. There are two variables that tend money, and e↵ort. Not only is it easy to exacerbate or ameliorate the security to find holes in opponents’ defenses, but dilemma. the locations of those vulnerabilities is eas- First, the relative advantage of of- ily disseminated, making it easy for even fensive weapons, tactics, and strategies unsophisticated attackers: Rattray says, over their defensive equivalents exacerbates “Widely used products contain vulnerabil- the security dilemma. Robert Jervis ex- ities to digital disruption that are easily plains that when o↵ensive advantage ex- identified...the tools and techniques to ex- ists, even status-quo states “must then ploit them are quickly disseminated among act like aggressors; the fact that they potential attackers”. (Rattray, 2001, 470) would gladly agree to forego the oppor- Finally, o↵ensive advantage is bolstered tunity for expansion in return for guaran- by the rapidly changing nature of cyber tees for their security has no implications weapons. It’s easy for attackers to de- for their behavior”. (Jervis, 1978, 87) In sign new weapons; when a government a world with o↵ensive advantage, it is dif- agency or corporation designs an e↵ective ficult for states to defend themselves; the counter to one o↵ensive technique, several best way to maintain security is to attack. more weapons can be created. David T. Clearly, this greatly exacerbates the secu- Fahrenkrug says, “The current o↵ensive rity dilemma—if states are more likely to advantage results from the ability to ma- attack than defend, any perceived increase neuver against a network combined with in military power is extremely dangerous. rapidly adaptive tools to attack networks Furthermore, the expectation of easy vic- and information”. (Czosseck, 2012) O↵ense tory increases the incentives for o↵ensive is more e↵ective, easier, and cheaper.