Capabilities and Conflict in the Cyber Domain An Empirical Study By Anthony John Stuart Craig Dissertation submitted to the School of Law and Politics, Cardiff University in requirement for the degree of Doctor of Philosophy (PhD) in Politics and International Relations. January 2020 Acknowledgements This PhD would not have been possible without the help of my family. I especially thank my wife Natalia for being so supportive and patient. I am grateful to Cardiff University’s School of Law and Politics for funding my PhD and to the Research School on Peace and Conflict in Oslo for the opportunity they gave me to develop professionally as a researcher and for introducing me to a network of similarly minded academics. I thank my office colleagues and friends in Cardiff, my school friends in Glasgow, and Tattiana, Shaun, Edith and Andrea for their friendship and support during this time. I would not have got to this stage without the encouragement of Dr. Brandon Valeriano, who has given me self-confidence in my abilities and has remained a mentor since my time as an undergraduate at Glasgow University. I also thank my Cardiff University supervisor Dr. Andrea Calderaro for his continual advice and guidance, and Dr. Campbell Craig for his valuable feedback. Finally, I am grateful to my external reviewer, Dr. Tim Stevens and my internal reviewer, Dr. Claudia Hillebrand for their expert advice which helped me strengthen this thesis. i Summary This dissertation is a mixed method, empirical study on the causes and consequences of the proliferation of cyber capabilities among nation states in the international system from 2000 to 2017. National cyber capabilities are defined as the resources and assets used by states to project and resist influence through computer network operations (CNO). They are conceptualised and operationalised from two perspectives. Latent cyber capabilities are the societal resources that governments can draw on, including the programming skill and computer science knowledge of a population. Active cyber capabilities are the institutional developments by governments and militaries to build cyber security preparedness. They include the establishment of a computer security incident response team, a military computer network operations unit, or a national cyber security strategy. Via the quantitative analysis of an original data set (the national cyber capabilities data set), the distribution of latent and active cyber capabilities in the international system is first described and the rate at which active capabilities have been acquired over time is highlighted. By structuring the analysis according to the theory of opportunity and willingness, the findings demonstrate that the adoption of active cyber capabilities is enabled by a country’s latent resources (opportunity) and motivated by its external threat and rivalry environment (willingness). Next, the relationship between capabilities and the occurrence of computer network operations between rival states is investigated. Rather than deter conflict, cyber capabilities are positively associated with cyber-attacks. Finally, a case study of Iran is employed to illustrate how the cumulative findings of the statistical analyses apply in a real-world example. The findings of this dissertation highlight the need to develop alternative strategies for securing cyberspace to those focusing on the pursuit of military based capabilities and threats. ii Table of Contents Page Acknowledgements i Summary ii List of Tables vi List of Figures viii Chapter I. I. Introduction: The Purpose and Plan of the Thesis 1 The issue 1 The contribution 2 Research questions and theory 3 The structure of the thesis 5 II. II. Conflict and Capability in the Cyber domain 7 Introduction 7 Cyber Conflict in International Relations 8 Power and Capability 15 What do we know about cyber power and capability? 19 Theoretical Position of Thesis 24 Conclusion 28 III. III. A Theoretical Framework for Explaining the Causes and Consequences 30 of Cyber Capability Introduction 30 Part one: The determinants of cyber capability proliferation 31 Opportunity-Willingness Theory 31 Latent resources and military capabilities 33 The resource requirements for cyber capability 36 Security threats as a driver of military capability 38 The cyber threat environment and proliferation 41 Part two: The impact of cyber capability on cyber conflict 43 Deterrence, capabilities, and conflict in international relations 44 The failure of cyber deterrence 46 Capabilities as a cause of conflict 51 Opportunity-Willingness and cyber conflict 52 Summary 55 IV. IV. Methods for Quantifying National Cyber Capability 57 Introduction 57 The scope and limits of the NCC dataset 58 How is the data collected? 62 Indicators of latent cyber capability 63 iii Indicators of active cyber capability 69 V. V. Research Design for Investigating the Causes and Consequences of 75 Cyber Capability Introduction 75 Establishing causality 76 Methods of statistical analysis 77 Part one: Describing the distribution and proliferation of cyber 78 capability Part two: Identifying the determinants of cyber capability 79 Part three: Investigating the impact of capabilities on cyber conflict 83 Part four: Illustrative case study of Iran 90 Summary 91 VI. VI. A Descriptive Analysis of Cyber Capability in the International System 92 Introduction 92 Latent cyber capabilities: where do countries stand? 92 Active cyber capabilities and strategies: temporal and spatial 108 proliferation Discussion 115 VII. VII. Determinants of Cyber Capability 116 Introduction 116 Hypotheses for capability adoption 116 Bivariate analysis: latent capability and active capability 118 Bivariate analysis: external threat environment and active capability 125 Multivariate analysis: Opportunity and willingness theory tested 131 Discussion 140 VIII. VIII. Capability and Conflict: The Effect of Defensive Capabilities 142 Introduction 142 Research Design 143 Defensive capabilities and cyber incidents at the system level 143 Defensive capabilities and cyber incidents at the country level 146 Multivariate analysis 150 Defensive capabilities and the success of cyber incidents 152 Discussion 155 IX. IX. Capability and Conflict: The Effect of Capability Parity and 156 Preponderance on Cyber Conflict Introduction 156 Parity and preponderance 157 Research Design 158 Relative latent cyber capability and cyber conflict 160 Relative active cyber capability and cyber conflict 164 Multivariate analysis 166 Discussion 170 iv X. X. Capability and Conflict: The Initiators Capability and Cyber Conflict 172 Introduction 172 System level capabilities and the initiation of cyber incidents 173 The initiator’s capability and the frequency of cyber incidents 176 The initiator’s capability and the likelihood of cyber incidents 179 Rivalry intensity and cyber incidents 183 Multivariate analysis 185 The initiator’s capability and the severity of cyber incidents 189 Discussion 191 XI. XI. The Case of Iran: Illustrating the Findings 193 Introduction 193 Describing Iran’s cyber capabilities 194 How latent capability and rivalry has driven Iran’s active cyber 195 capabilities Has Iran’s cyber defence succeeded? 202 Iran’s capabilities and offensive operations 205 Discussion 209 XII. XII. Conclusion: What Do We Now Know About Cyber Capability and 211 Conflict Introduction 211 Summary of theory and approach 211 What do we know about cyber capabilities now? 214 Policy implications 217 Caveats and future research 219 List of References 222 Appendix: Active Cyber Capability and Strategy Data 244 v List of Tables Table Page 1. NCC dataset variables and measurement 74 2. Explanatory variables for investigating the determinants of active 83 capability 3. Frequency of cyber incidents between rival dyads (2000-2016) 85 4. National performances at the IOI and IMO by country (2016) 93 5. Computer science publication output by country (2016) 95 6. Software companies by country (2016) 96 7. ICT service exports by country (2016) 97 8. Internet penetration, top and bottom 10 countries (2016) 99 9. Secure Internet servers, top ten countries (2016) 99 10. Latent cyber capability index country ranking (2018) 102 11. Correlation of latent cyber capability with cyber and material capability 106 indices 12. Organisational age of national CSIRTs (2017) 110 13. Organisational age of military CNO units (2017) 112 14. Organisational age of national cyber security strategies (2017) 114 15. Summary statistics for opportunity-based variables 118 16. National resources and military CNO unit possession 120 17. National resources and national CSIRT possession 121 18. Conditional Probabilities of military CNO unit capability by resources 123 19. Conditional probabilities of National CSIRT capability by resources 124 20. Summary statistics for willingness-based variables 125 21. Threat environment and military CNO unit possession 126 22. Threat environment and national CSIRT possession 128 23. Conditional Probabilities of military CNO unit capability by threat 129 environment 24. Conditional Probabilities of national CSIRT capability by threat 130 environment 25. Logistic regression of military CNO unit possession 133 26. Logistic regression of national CSIRT possession 135 27. Effect of changes in independent variables on the probability of military 137 CNO unit 28. Effect of changes in independent variables on the probability of national 138 CSIRT 29. Likely next adopters of military CNO units 139 30. Likely next adopters of national CSIRT 139 31.