This paper will identify, raise awareness of, and help reduce risks to NATO’s nuclear weapon systems arising from cybersecurity vulnerabilities. It aims to respond to the need for more public information on cyber risks in NATO’s nuclear mission, and to provide policy-driven research to shape and inform nuclear policy at member-state level.
4. Entanglement of Conventional and Nuclear Command and Control
The increasing reliance on dual-use C3 assets, those used both for conventional and nuclear operations, raises the issue of entanglement and the risk of rapid escalation. These dual-use assets can range from communications satellites to early warning systems, radars and transmitters. According to recent research, notably by James M. Acton, parties to a conflict ‘could have strong incentives to attack the adversary’s dual-use C3I [command, control, communication and intelligence] capabilities to undermine its nonnuclear operations’.117 An attack on a dual-use C3 asset would particularly hold strong incentives for adversaries possessing nuclear weapons and not ruling out their potential use. For instance, a cyberattack on early warning satellites will provide a tremendous advantage to the adversary by either delaying the detection of a missile launch (conventional or nuclear) or even preventing it from being identified in the first place.
According to recent research, parties to a conflict ‘could have strong incentives to attack the adversary’s dual-use C3I [command, control, communication and intelligence] capabilities to undermine its nonnuclear operations’.
James M. Acton addresses two mechanisms that lead to escalation.118 First is a ‘misinterpreted warning’, probably at a time of crisis, where a state’s dual-use C3 assets are targeted by conventional weapons or cyber interferences and the target state might misinterpret these attacks as ‘preparations for an incoming use of nuclear weapons’ by their adversary.119 The targeted state might miscalculate and respond in a highly escalatory way that leads to full-scale conventional or nuclear war. Second, if a state’s C3 capability was attacked by conventional means, it might lose its advantage to destroy an adversary’s nuclear weapon systems. In order to prevent such a situation happening, the state might use pre-emptive countermeasures that would themselves lead to escalation,120 thus adding nuclear ‘use it or lose it’ pressures to conventional crises.
It is important to note that the escalation mechanisms identified by Acton rest on hypothetical situations in which states that have been forced, for the purposes of the argument, into adopting an inherently escalatory posture; in reality, this may not be the inevitable outcome. The role of conventional forces and cyber interferences is highlighted primarily and under specific conditions as a route to escalation, rather than also as a source of potential de-escalation. Although risks of escalation through entanglement might be greater in some cases, it is hard to judge a state’s possible actions only by counting its conventional or nuclear capabilities or by assigning an escalatory role to them. Escalation is a choice, and the logic of escalation mechanisms removes the factor of human agency for conflict avoidance. Ultimately, survival of a state may not, in all instances, be linked to the survival of its nuclear forces.
Sometimes, from a cybersecurity perspective, an attack on dual-use C3 systems may lead to increased uncertainty as regards who conducted such an attack, what is the intention behind it, and how quickly the system would recover. These last two points are further called into question in a context of reliance on increasingly autonomous technologies, which are now already assisting the conduct of cyber defensive operations – which implies the potential for their future use in underpinning offensive operations as well.
In other cases, cyberattacks may not in themselves be enough to make deterrence less stable. Deterrence is all about perception, and ensuring that states can continue to project confidence. This may be false confidence, however, where their nuclear C3 assets are concerned. Once a state starts to question the credibility of its NC3 assets, suspecting that these assets are already penetrated, the assets may lose the associated value of deterrence. During a crisis, how a state assesses whether an incident is a glitch or a surprise attack also crucially depends on the trust that the state puts in deterrence, as well as on state’s capacity to conduct and be certain of the findings of cyber forensic investigation. Thus, for some states it is hard to let go of – or to even question – deterrence assumptions.
117 Acton, J. M. (2018), ’Escalation through entanglement’.
118 Ibid.
119 Ibid., p.58.
120 Ibid., p. 59.