About 30 countries are developing so-called offensive cyber capabilities — complex computer codes (e.g., worms and viruses) used to damage or destroy computer networks. Chief among them are the United States, Russia, China, Israel, and Britain.
Like the European armies prior to the outbreak of the First World War, militaries and intelligence agencies across the world are increasingly assuming a more offensive posture in cyberspace. This is partially because cyberspace favors the attacker. It is difficult to defend all known, and more important, all unknown vulnerabilities of a network.
Computer networks are the foundation for advanced military power in the 21st century. Cyber-enabled war is already a reality, the commanding channel of war. Neither the ongoing precision airstrikes against ISIS in Iraq and Syria nor the Special Operations Forces raid that killed Osama Bin Laden would have been possible without cyberspace and its enabling information infrastructure.
At the same time, every nation in the world is engaged in buttressing cyber defenses, i.e., developing technical and human capabilities to protect civilian and military computer networks, as well as their supporting infrastructure.
What will be President-elect Donald Trump’s policy on the use of offensive cyber weapons? If you analyze past statements of Mr. Trump and his team, two prospects stand out. It is conceivable that he may adopt a more aggressive cyber position, with the subsequent risk of an accelerated cyber arms race.
At the same time there is reason to believe he may loosen cyber alliances and abandon the quest for norms of state behavior in cyberspace. Both prospects could potentially make cyberspace more dangerous for the United States.
First, his administration is likely to more aggressively pursue the development of offensive cyber capabilities than the Obama administration, having already signaled a greater willingness to employ them.
During his campaign, Mr. Trump repeatedly vowed to expand United States offensive cyber capabilities. “I will make certain that our military is the best in the world in both cyber offense and defense,” Trump said in a campaign speech on Oct. 3, 2016. “As a deterrent against attacks on our critical resources, the United States must possess the unquestioned capacity to launch crippling cyber counter-attacks.” He added, “America’s dominance in this arena must be unquestioned.”
Yet to date, the president-elect has not shared details as to what he precisely means by offensive cyber capabilities. His public statements suggest adopting the interpretation revealed in the leaked Presidential Policy Directive/PPD-20 that defines offensive cyber capabilities as ranging from subtle to severely damaging attacks that could include loss of life, significant damage to property, and serious economic impact on a country.
The concern is that while a more aggressive U.S. cyber policy may deter some adversaries, it can also backfire and accelerate the emerging cyber-arms race. Given the fact that cyber-weapons-programs originate from the world of intelligence and are cloaked in secrecy, their capabilities are largely unknown, thus fostering greater uncertainty for policy makers.
This would be further accentuated should Mr. Trump choose to disregard continuing U.S. government efforts to help shape international norms of behavior in cyberspace and develop confidence building measures to de-escalate cyberspace tensions with countries like China and Russia, the United States’ most capable cyber adversaries. For example, the U.S. would be well served to maintain its leadership role in the United Nations Group of Governmental Experts (GGE) on Developments in the Field of Information and Telecommunications in the Context of International Security. Failing to promote a level of cooperation and foster globally acceptable norms may in turn compel nations to build up their cyber weapons arsenals even further.
Second, Trump’s rhetoric during his presidential campaign has left many allies concerned about the United States’ overall defense commitment. At present, United States’ allies can no longer take for granted that they will be shielded under the U.S. “cyber umbrella,” i.e. U.S. support in defending their networks paired with the threat of retaliatory U.S. cyber strikes.
This is accentuated by Trump’s statements that underscore a lack of faith in alliances, with demands that allies pay a greater share of the costs associated with security, paired with the president-elect’s overall isolationist tendencies.
Countries like Japan, the second most advanced ICT country after the United States, which until now, have chosen not to develop their own offensive cyber capabilities, will have to rethink their stance. Moreover, Mr. Trump’s current ambiguity over U.S. defense commitments may in turn impact ongoing global cooperation on offensive cyber capabilities, such as the “five-eyes” and intelligence partners, Australia, Canada, Great Britain, and New Zealand.
The level of interconnectivity in today’s world effectively demands a certain level of cooperation and knowledge share. Should the president-elect decide to reduce cooperation with current allies, it may diminish not only the cyber deterrence capabilities of the United States, but also that of its closest intelligence partners, which can hardly be in anyone’s national interest.
In addition, if the new administration decides to abandon its leading role in trying to formulate norms of state behavior (the word “norms” has thus far never been mentioned by Mr. Trump in the context of cybersecurity), while simultaneously accelerating the buildup of offensive cyber capabilities, the result could be a more militarized cyberspace with fewer rules: a 21st century version of the Dark Ages.
While the world is carefully watching what path the new administration will adopt, offensive cyber capabilities will continue to expand. However, the U.S. runs the risk of accelerating this cyber weapons race before adequate norms for their use are established. Unpredictability paired with bellicosity is always a dangerous mix in global politics, but even more troublesome in an increasingly militarized cyberspace.
