The rapid development of cyber capabilities for a range of purposes, including for offensive cyber operations, risks leaving behind considerations of how they can be effectively managed.
How states perceive the utility or value of developing and maintaining offensive cyber capabilities is critical, as this informs not only how states may seek to use them, but also how they may manage or mitigate any associated risks of use. For example, where the utility of a capability is very high, the user may take a more risk-acceptant attitude to using it. And in many instances, cyber capabilities have been rapidly developed before policy or doctrine can catch up. This is a concern, as enthusiasm for the perceived operational versatility of offensive cyber ‘tools’ may serve to dominate the demand for capability development, while methods for ensuring effective management of their use are deprioritized.
Versatility
Some states highlight the utility of offensive cyber primarily for military purposes: to preserve the ability to counter-attack or retaliate in cyberspace. Norway, for example, emphasizes its use in supporting tactical operations, including contributing to NATO operations or coalitions with allies. Other states explicitly highlight the utility of offensive cyber for a broad range of purposes, including following, attributing, warning about and actively counteracting digital threats before incidents occur, in situations of peace, crisis and armed conflict.
In addition, cyber capabilities were cited as an ‘enabler’ for information operations. Aside from military use, in the case of two states in particular that were considered in the research for this paper, offensive cyber is also used to counter criminal activity. In the UK, the National Cyber Force (NCF) states, for example, that it may engage in offensive cyber activity in order to interfere with a terrorist’s mobile phone, or to help prevent cyberspace from being used for serious crime such as fraud and child sexual abuse, while also keeping UK military aircraft safe from being targeted. In the US, USCYBERCOM can also use offensive cyber operations against foreign ransomware actors.
Foreign cyber operations are depicted as having considerable utility, both as a focused and a supporting activity for a wide range of threats.
The range of potential targets and activities is particularly clear in Canada’s legislation. Canada’s Communications Security Establishment (CSE) is mandated to conduct foreign cyber operations, both ‘active’ and defensive. The CSE Act reveals that the CSE has the power to conduct ‘active cyber operations’, ‘to degrade, disrupt, influence, respond to or interfere with the capabilities, intentions or activities of a foreign individual, state, organization or terrorist group as they relate to international affairs, defence or security [interests]’. Canadian active cyber operations can be used ‘to disrupt the capabilities of foreign threats to Canada, such as: foreign terrorist groups, foreign cyber criminals, hostile intelligence agencies [or] state-sponsored hackers’. Defensive cyber operations can be used to defend Government of Canada systems, as well as systems of importance to the Government of Canada, against foreign cyber threats by taking online action. Such foreign cyber operations may include ‘any other activity that is reasonable in the circumstances and reasonably necessary in aid of any other activity’. Foreign cyber operations are depicted as having considerable utility, both as a focused and a supporting activity for a wide range of threats.
Another key theme in the responses to the interviews conducted for this paper was that cyber operations are often viewed as a substitute for the use of force in peacetime, in that they can be used to affect national sources of power without conducting an armed attack or triggering conflict. This is in keeping with much of the literature on the subject. The ability this affords many states to pursue foreign policy objectives is perceived as one of the key reasons why offensive cyber has real value for some states. An interview with a representative from USCYBERCOM confirmed this view, for example: the utility of offensive cyber capabilities lies in enabling strategic effect without entitling the adversary to use force in self-defence, coupled with a unique ability to modulate the level of impact in a way that is not possible with kinetic operations. Similarly, an interview with the then commander of UK Strategic Command (UK STRATCOM), offensive cyber was explained as a means by which a message can be sent, so as to manage strategic rivalries. Sally Walker, former cyber director at the UK’s Government Communications Headquarters (GCHQ), reported in a Sky News podcast that the UK sees cyber operations as being ‘about what you can do from a distance at relatively low risk […] you can have impact in the real world and you can do it at scale’. Offensive cyber activity is thus often viewed both as a strategic alternative to war and as having value on the battlefield.
Further, the UK has recently given more public detail on how the NCF seeks to deliver a ‘doctrine of cognitive effect’ through cyber operations which seeks to affect adversaries’ abilities in three main ways. First, to affect their ‘ability to acquire, analyse and exploit the information they need to advance their objectives’, second, to ‘limit their ability to communicate and coordinate with others’, and third, to ‘affect their confidence in their digital technology and the information it is providing them’. The UK is clear that offensive cyber activity can also achieve effects in more subtle ways, below the level of the use of force.
Cyber limits
While states rightly highlight the value of offensive cyber in the ways set out above, less attention is publicly paid to its limitations – or, to put it another way, what offensive cyber is not. It is important that any perception of the versatility of offensive cyber capabilities as ‘silver bullets’ does not diminish awareness of their limitations. While offensive cyber operations may have utility in armed conflict, and in peacetime, as a means of projecting both hard and soft power, understanding their limitations is important so as to avoid an over-reliance on offensive cyber capabilities at the expense of other levers of power.
For example, as Smeets has highlighted, while many more states now publicly avow their offensive cyber capabilities, very few are actively using them to any significant effect, suggesting that in fact their utility may be more limited than previously assumed. The requirement for highly tailored, target-specific capabilities, dependent on reliable and often painstaking intelligence, also makes effective offensive cyber capabilities a challenge, particularly in wartime. The few publicly known examples of offensive cyber operations used in conjunction with conventional kinetic activity on the battlefield are difficult to assess in terms of how decisive they have been in determining the outcome of an operation. For example, according to Maschmeyer, four out of the five cyber operations conducted by Russia in Ukraine between 2014 and 2022 produced no measurable strategic value, and Russia’s resort to kinetic, conventional war in 2022 was in part precisely because its ongoing cyber activity against Ukraine was failing to achieve strategic goals. There are also a number of other views which seek to highlight the limits to the military potential of offensive cyber. As the UK chief of the General Staff noted, for example, in 2022, ‘you can’t cyber your way across a river’.
Offensive cyber capabilities are also not a ‘one size fits all’ capability, and can take considerable time, effort and intelligence to construct and employ effectively. For example, offensive cyber capabilities used by the UK are reported to have been ‘highly tailored and system specific’. Successful cyber operations appear in reality to be the work of painstaking, highly tailored operations with only a brief opportunity for success. Their military utility therefore remains an open question. And below the level of armed conflict, other studies have argued that ‘empirical evidence for this cyber revolution remains scarce’ as cyber operations are hampered by a so-called ‘operational trilemma’ that restricts their value, making them ‘too slow, too low in intensity, or too unreliable to provide significant utility’.
Deterrence
Several states have published cyber strategies which mention the deterrent value of offensive cyber capabilities. The Netherlands, for example, bases its Defence Cyber Strategy on deterrence, as ‘the operational capabilities of the Defence Cyber Command contribute to the arsenal of deterrence means available to the government’. Belgium and Denmark also cite deterrence as a key justification for developing offensive cyber capability, while the Norwegian Defence Commission reported in 2021 that both ‘defensive and offensive cyber operations can act as a deterrent and affect an adversary’s perception of vulnerability and opportunity for retaliation’. Yet most states give little detail as to how or why offensive cyber capabilities may serve as a deterrent in or through cyberspace. While public statements to this effect may be scarce for a variety of reasons, a more nuanced internal understanding of this area is important, as assumptions about the deterrent value of offensive cyber may serve, for example, to downplay the importance of cyber resilience.
There has also been rigorous academic challenge to the application of deterrence theory to cyberspace. For example, Harknett’s conclusions that ‘using a legacy construct of deterrence, whose measure of effectiveness is the absence of action, to explain an environment of constant action will not prevent adverse actions in cyberspace’ are now well rehearsed among cyber experts. It is clear that conventional deterrence theory does not sit well in cyberspace and there is significant evidence and scholarship that offensive cyber operations do not, on their own, necessarily deter, particularly below the threshold where most day-to-day cyber competition takes place.
It is also challenging to establish metrics as to whether deterrence is working. States may refrain from conducting more destructive offensive cyber operations due to a combination of fears which may include other concerns, such as risks of collateral damage and/or strategic blowback. The inherent uncertainties of cyber operations in terms of second- and third-order effects is also likely to constrain activity. Examples may include the US reluctance to retaliate against Iran in response to the 2013 distributed denial-of-service (DDoS) attacks on US banks and the US decision not to conduct offensive cyber operations against Libya in 2011 given fears of the precedent this would set. According to Kaminska, the muted responses of the UK to the WannaCry attacks of early 2017 also show how states seek to minimize risk in their responses.
It is likely that, in what has been termed the ‘deterrence gap’, states may increasingly realize that deterrence in cyberspace works, but only above a certain threshold of harm. In other words, deterrence works to prevent widespread destructive cyberattacks by nation-states, but day-to-day low-level harmful cyber activity below this level continues undeterred, as most offensive cyber activity takes place below the threshold of armed conflict and ‘[falls] well short of threats to infrastructure’. While there have been some known cases of malicious state-sponsored cyber activity on critical infrastructure, for example during the Iran–Israel so-called ‘tit-for-tat’ cyberattacks in 2020 (which included cyberattacks on water management facilities and port facilities), on the whole targets are of minor value and/or the disruption or harm is only temporary. Offensive cyber operations that amount to a use of force under international law remain scarce.
Deterrence works to prevent widespread destructive cyberattacks by nation-states, but day-to-day low-level harmful cyber activity below this level continues undeterred.
A more rigorous analysis of the deterrent value of offensive cyber capabilities is therefore important. The UK’s National Cyber Strategy 2022 acknowledges that ‘our approach to cyber deterrence does not yet seem to have fundamentally altered the risk calculus for attackers’. The US ‘defend forward’ strategy, set out in a case study below, is also premised on the notion that deterrence does not work in cyberspace below the threshold of armed conflict. The US 2022 National Defense Strategy speaks of ‘integrated deterrence’, focusing on using diplomatic, economic and military tools in combination rather than as standalone mechanisms, hinting at a shift in how some states are perceiving the deterrent value of cyber capabilities on their own. The UK has also outlined a more detailed position recently on the relationship between cyber activity and deterrence, stating that its NCF ‘may also potentially contribute to deterrence’, but highlighting that it is important to distinguish ‘between deterring cyber activity, or using cyber effects to deter other activities’ and that ‘[while] evidence is limited for cyber operations being a primary contributor to deterrence, they can form a secondary or supporting element in an integrated approach’. There is a need for a more nuanced approach, which addresses what it is that states seek to deter and by whom, and which incorporates other levers of power and influence outside cyberspace. The US 2018 Department of Defense Cyber Strategy, for example, specifically refers for example to deterring ‘malicious cyber activities that constitute a use of force against the United States’ (emphasis added).
In conclusion, a better understanding of the utility of offensive cyber capabilities should be fostered within states. Despite all the rhetoric as to versatility and possible range of effect, we are essentially none the wiser as to where offensive cyber activity may have best effect or may be best utilized. Overly blunt interpretations of the advantages of offensive cyber may increase the likelihood that such activity becomes a default or ‘go-to’ offensive method of choice, particularly in the context where these capabilities become ‘normalized’ as more states adopt them. A more complex balancing act may be required to assess the trade-offs or benefits the cyber operation may bring, set against the risks of use, as explored in the following chapter. This would not only help to avoid any complacency as to their power and utility, but also can help, for example, to reinforce the need to consider other ‘tools in the toolbox’, as different strategic contexts will demand different capabilities and responses. Offensive cyber may not always be the best answer to a given problem. In this way, states can also ensure they consider how offensive cyber can be used in line with a commitment to responsible state behaviour in cyberspace.
Finally, national cyber strategies should also account for the limitations surrounding the application of deterrence theory in cyberspace, rather than making broad generalizations as to the value of offensive cyber as a deterrent in its own right. Whatever conclusions one may reach as to the efficacy of deterrence in or through cyberspace, it is also important that they do not come at the expense of other critical aspects of cyber strategy such as enhanced cyber resilience and/or cyber defence. An over-reliance on the deterrent value of offensive cyber capabilities may bring a false sense of security, or perpetuate the so-called ‘cybersecurity dilemma’.
