Kaminska, M.

Leiden University Scholary Publications

Risk aversion is at the heart of the cyber response dilemmaKaminska, M.CitationKaminska, M. (2021). Risk aversion is at the heart of the cyber response dilemma. CouncilOn Foreign Relations Net Politics. Retrieved from https://hdl.handle.net/1887/3492521 Version: Publisher's VersionLicense: Creative Commons CC BY-NC-ND 4.0 licenseDownloaded from: https://hdl.handle.net/1887/3492521 Note: To cite this publication please use the final published version (if applicable).17/11/2022, 15:48 Risk Aversion Is at the Heart of the Cyber Response Dilemma | Council on Foreign Relationshttps://www.cfr.org/blog/risk-aversion-heart-cyber-response-dilemma 1/6from Net Politics and Digital and Cyberspace Policy ProgramRisk Aversion Is at the Heart of the Cyber ResponseDilemmaWestern countries view the cyber domain as a highly uncertain and potentially escalatoryenvironment, which takes more forceful response options off the table.U.S. President Joe Biden is seated. REUTERS/Jonathan Ernst by Guest Blogger for Net PoliticsMarch 31, 2021 12:09 pm (EST)Blog PostMonica Kaminska is a postdoctoral researcher at the Hague Program for Cyber Norms,Institute for Security and Global Affairs at Leiden University and a PhD candidate inCyber Security at the University of Oxford.17/11/2022, 15:48 Risk Aversion Is at the Heart of the Cyber Response Dilemma | Council on Foreign Relationshttps://www.cfr.org/blog/risk-aversion-heart-cyber-response-dilemma 2/6The New York Times recently received swift pushback from the White House againsta claim that it was preparing a “cyberstrike” against Russia in retaliation for theSolarWinds/Sunburst campaign. The Biden administration’s desire to tone downsuch rhetoric is not a surprise. Although the SolarWinds campaign appears to havebeen limited to espionage, the kind which the Five Eyes doubtlessly engage inthemselves, meaningful and commensurate responses have proven difficult for theUnited States, even in the context of more disruptive or destructive cyberoperations.The question is why the United States restrains its responses, despite formallyadopting a strategy of deterrence [PDF] and despite the wide set of economic,political, and cyber tools at its disposal. In a recent publication, I argue that thecyber domain is viewed as a highly uncertain and potentially escalatoryenvironment, which takes more forceful response options off the table. The recentintroduction of the strategies of persistent engagement and defend forward stemsnot from a shift to a more offensive approach but is instead an extension of theculturally engrained concern to limit uncertainty and risk.The Problem With Current ResponsesCFR experts investigate the impact of information and communicationtechnologies on security, privacy, and international affairs. 2-4 times weekly.View all newsletters Net PoliticsSubscribeEmail Address>17/11/2022, 15:48 Risk Aversion Is at the Heart of the Cyber Response Dilemma | Council on Foreign Relationshttps://www.cfr.org/blog/risk-aversion-heart-cyber-response-dilemma 3/6The United States’ usual recourse has included economic sanctions, legalindictments, and public attribution statements—or some combination of theseinstruments. However, the precise policy objective of imposing “risks andconsequences” through them is often unclear. Sanctions and indictments tend totarget a number of individual hackers for a variety of incidents, which confuses thesignal they intend to deliver to the seats of power in Moscow and Pyongyang. Take,for example, the Justice Department’s October 2020 indictment of individuals fortheir cyber interference in Ukraine, Georgia, the French presidential elections,investigations into the Russian Novichok attack, and the 2018 PyeongChang WinterOlympic Games. The indictment was responding to hacks that ranged fromintrusions into electrical grids to “hack and leak” election interference. Theadversary could be forgiven for thinking they were being punished for the meansused rather than for the operation’s intent or effects.Economic sanctions can be an inconvenience—although the perpetrators of themost brazen cyber campaigns tend to be some of the most heavily sanctionedregimes on earth, which lessens the impact of new measures. In fact, the blowbackeffect of sanctions can sometimes mean that they have a greater effect on thesanctioning government than on the sanctioned one. For example, in 2018, theTrump administration was forced to back down from sanctions it imposed on Rusal,a Russian company, after they caused a spike in aluminum prices. Public attribution,for its part, has the objective of clarifying “the rules of the game” in cyberspace butin reality could even be seen as a badge of honor by some of the agencies to whichthe operations are traced back.The “Risk Society” and the Roots of RestraintWriting in the early 1990s, German sociologist Ulrich Beck coined the term “risksociety” to describe a society defined by the anticipation of catastrophe, stemmingfrom an awareness of the unintended side effects of modernization. The Chernobylnuclear incident, global financial crises, transnational terrorism, and mounting17/11/2022, 15:48 Risk Aversion Is at the Heart of the Cyber Response Dilemma | Council on Foreign Relationshttps://www.cfr.org/blog/risk-aversion-heart-cyber-response-dilemma 4/6evidence of environmental degradation generated a realization that geographicdistance no longer offered protection from far-flung disasters and hazards.Moreover, these disasters and hazards were increasingly understood to be self-inflicted—the price that modern societies paid for progress.This led to the development of the risk society—a pervasive sense of insecurity andfear, born of uncertain future events, that underpins policymaking and strategicthinking. The major trauma of the 9/11 terrorist attacks only served to cement thisattitude. In a risk society, each decision is carefully weighed up between the costs ofaction versus inaction, often resulting in either overzealous pre-emption or paralysis.This new stage of modernity has not, however, affected every society equally. Beckreminds us that risk is culturally framed. Thus, different societies have different riskthresholds.The Risk Society Goes CyberThe complexity of the cyber operational environment and the United States’dependency on internet-connected systems and networks means that it feelsasymmetrically vulnerable to cyberattacks. Modernization, as Beck explained, hasproduced unanticipated and unintended side effects. The awareness of thisasymmetric vulnerability features front and center when U.S. decision-makers facethe dilemma of how to respond to foreign cyber aggression. Fearful of blowbackfrom their own response or of triggering a cyber tit-for-tat exchange andunintentionally escalating a conflict, they opt instead to employ weaker measures.Domestic publics support such an attitude according to recent survey research.Adversaries are aware of these dispositions, so risk aversion poses a problem for thecredibility of deterrent signals.To address the uncertainties inherent in cyberspace, the United States has opted forrisk management practices. These practices do not substitute for the imposition ofcosts in response to damaging adversary actions, but instead seek to mitigate as17/11/2022, 15:48 Risk Aversion Is at the Heart of the Cyber Response Dilemma | Council on Foreign Relationshttps://www.cfr.org/blog/risk-aversion-heart-cyber-response-dilemma 5/6much as possible the scale and effects of hostile cyber operations on digitalinfrastructures.Particularly notable have been the preventive practices of persistent engagementand defend forward, which aim to proactively “counter attacks close to their origins”in order to “render most malicious cyber and cyber-enabled activity inconsequential[PDF].” In adapting to the cyber domain, U.S. Cyber Command has shifted frombeing a “response force” to a “persistent force [PDF].” While on the face of itpersistent engagement could seem like a more assertive and offensive strategy, it isin fact an outgrowth of the same aversion to risk that produced limited responses—which could seem paradoxical to those in the academic community who haveexpressed concerns about the strategy’s escalatory potential. By aiming to eliminatepotential threats before these reach the homeland, persistent engagement impliesthe non-acceptance of adverse consequences of potential hostile campaigns andinvolves constantly surveilling foreign networks and anticipating the actions ofadversaries to mitigate risks.In noting the presence of the guiding risk paradigm informing the American cyberresponse calculus, we should not expect significant retaliation. In fact, it could bethe case that deterrence strategies are simply incompatible with Western riskDigital and Cyberspace Policy program updates on cybersecurity, digitaltrade, internet governance, and online privacy. Bimonthly.View all newsletters Digital and Cyberspace UpdateSubscribeEmail Address>17/11/2022, 15:48 Risk Aversion Is at the Heart of the Cyber Response Dilemma | Council on Foreign Relationshttps://www.cfr.org/blog/risk-aversion-heart-cyber-response-dilemma 6/6dispositions towards retaliation.Creative Commons: Some rights reserved.

Risk aversion is at the heart of the cyber response dilemma

https://scholarlypublications.universiteitleiden.nl/access/item%3A3492522/download

Risk aversion is at the heart of the cyber response dilemma

Abstract

Similar works

Full text

Available Versions

Leiden University Scholary Publications