Policymakers and military leaders may need to broaden their assumptions about how state and non-state actors are likely to use hacking and other cyber operations in future crises and conflicts, according to a new report, Cyber Operations in Conflict: Lessons from Analytic Wargames.
Authored by researchers from American University and published by the UC Berkeley Center for Long-Term Cybersecurity, the report details findings from a novel experiment that assessed how diverse actors—including nation-states, non-state organizations like ISIS, cyber-activist groups such as Wikileaks, and other groups—are likely to use cyber operations in the context of an escalating conflict.
The study’s authors, Benjamin M. Jensen, associate professor at the Marine Corps University and scholar-in-residence at American University’s School of International Service, and David Banks, professorial lecturer at American University, found that cyber operations are not likely to be used for provocative conflict escalations, but rather to provide a moderating influence by offering states a means of managing escalation ‘in the shadows’.
“Cyber conflict appears…to resemble covert action and looks more like the ‘political warfare’ of the Cold War than it does a military revolution,” the authors wrote. “Our work suggests that leaders should think about cyber exchanges in crisis settings more as political warfare and subterfuge than as traditional warfighting…. Even players that were more powerful than their opponents used restraint, suggesting that cyber operations may in fact help stabilize strategic interactions between rivals.”
Jensen and Banks used analytic wargames, an innovative tool that investigates competition among diverse actors, to identify strategic preferences in two hypothetical contexts: in a narrative called “Island Impact,” players represented either the U.S. or China in a simulated crisis in the South China Sea; in “Netwar,” players took on the role of either a national government or one of three opposition groups (a violent non-state actor, major international firm, or cyber activist network) in the context of an escalating conflict. The researchers first ran the wargames with university students and national security professionals to identify strategic preferences, and then surveyed more than 3,000 Internet users to assess which strategies would be chosen in different crisis contexts. A majority of players selected less escalatory responses in each game.
The newly released report provides an overview of implications for policymakers and military leaders as they anticipate how rivals will use cyberspace in future crises. “Many of the key influencers in the conversation around cyber promote a sense of alarm, yet our research suggests that the threat inflation is not necessarily warranted,” the authors concluded. “Further research may be merited to determine whether institutions are investing too much in cyber deterrence and may want to shift the investment to other related priority areas, such as defense and authentication.”
For more information about the report, please contact AUMedia@american.edu or 202-885-5950, or email the Center for Long-Term Cybersecurity at cltc@berkeley.edu.
