Brandishing Cyberattack Capabilities

Martin C. Libicki

RAND Corporation

RAND Corporation

关键词: The Internet;    Nuclear Deterrence;    Cyber Warfare;    Low-intensity Conflict;    Military Information Technology Systems;   

DOI  :  10.7249/RR175
RP-ID  :  RR-175-OSD

学科分类：自然科学（综合）

美国|英语

来源: RAND Corporation Published Research

【 摘 要 】

Deterrence is possible only when others know or at least have good indications of what the U.S. military can do, something that underlies U.S. nuclear deterrence strategy. Cyberattack capabilities resist such demonstration. No one knows quite what would happen if a country suffered a full-fledged cyberattack, despite the plethora of skirmishes. While cyberattack capabilities cannot easily be used to shape the behavior of others, this does not mean they cannot be used at all. This report explores ways that cyberattack capabilities can be brandished and under what circumstances, both in general terms and in the nuclear context. It then goes on to examine the obstacles and sketches out some realistic limits on the expectations. There is both promise and risk in cyber brandishing, but it would not hurt to give serious thought to ways to enhance the U.S. ability to leverage what others believe about its capabilities. Recent events have certainly convinced many others that the United States can do many sophisticated things in cyberspace (regardless of what, if anything, it has actually done). Applying brandishing as a strategy would take considerable analysis and imagination, inasmuch as none of the various options presented here are obvious winners. But brandishing is no panacea and also may not work; it could even backfire if misinterpreted as, say, a bluff. It is unlikely to make a deterrence posture succeed if the other elements of deterrence are weak.