Making Sense of Cyber Capabilities for Small States

Case Studies from the Asia-Pacific

Francis C. Domingo

• Publisher: Routledge
• Year: 2022
• eBook ISBN: 9781000553062
• Edition: 1
• Topic: Politica e relazioni internazionali
• Subtopic: Sicurezza informatica

Domingo explores the potential of cyber capabilities for small states in the Asia-Pacific, the most active region for cyber conflict. He develops a systematic explanation for why Brunei, New Zealand, and Singapore have developed or are developing cyber capabilities.

Studies on cyber conflict and strategy have substantially increased in the past decade but most have focused on the cyber operations of powerful states. This book moves away from the prominence of powerful states and explores the potential of cyber capabilities for small states in the Asia-Pacific, the most active region for cyber conflict. It develops a systematic explanation of why Brunei, New Zealand, and Singapore have developed or are developing cyber capabilities despite its obscure strategic value. The book argues that the distribution of power in the region and a "technology-oriented" strategic culture are two necessary conditions that influence the development of cyber capabilities in small states. Following this argument, the book draws on neoclassical realism as a theoretical framework to account for the interaction between these two conditions. The book also pursues three secondary objectives. First, it aims to determine the constraints and incentives that affect the utilization of cyber capabilities as foreign policy instruments. Second, the book evaluates the functionality of these cyber capabilities for small states. Lastly, it assesses the implications of employing cyber capabilities as foreign policy tools of small states.

This book will be an invaluable resource for academics and security analysts working on cyber conflict, military strategy, small states, and International Relations in general.

1 Introduction Small states and cyber capabilities

DOI: 10.4324/9781003208679-1

Information revolution has profoundly influenced the interaction between states in the twenty-first century. Cyber-enabled technologies sustain the global financial system, global trade, international institutions, and even the conduct of military operations.¹ Due to this, the level of dependence on cyber-enabled technologies has risen exponentially during the past decade (Carr, 2016, pp. 1–2). However, while these technologies strengthen cooperation between states, hostile actors have exploited the advantages of computer networks through various means such as distortion of information, corruption of data, and aggravation of armed conflicts. In this regard, academics, analysts, and policymakers continue to grapple with the challenges of developing commensurate strategies that can mitigate disruption and conflict in cyberspace.

Several academics have emphasised the significance of understanding the impact of cyber interactions before developing strategies to manage cyber conflict. One perspective contends that the Internet is not useful for the execution of political conflict because it cannot function as the final arbiter of physical violence (Gartzke, 2013, p. 72). A second perspective stresses the sizable empirical gap between a constructive analysis of critical international processes and the actual assessment of cyber interactions (Valeriano and Maness, 2015, p. 45). A third view argues for the need to develop established interpretations of cyber phenomena since it involves the analysis of new experiences that existing explanations and theories may not be able to clarify (Kello, 2013, 7–8). Lastly, there is also a contention that prevailing theoretical paradigms in International Relations are out of date and are “superseded by novel ideas and critical reframing during the latter decades of the century” (Choucri, 2012, pp. 15–16).

Policymakers, on the other hand, have prioritised the development of cyber capabilities despite its limited strategic utility for states (Gartzke and Lindsay, 2015; Smeets, 2018; Hoffman, 2019). For example, former President Donald Trump argued for crippling cyber capabilities: “As a deterrent against attacks on our critical resources the United States must possess … the unquestioned capacity to launch crippling cyber counter attacks” (Trump cited in Newman, 2016). In response to the increasing number of cyber incidents against South Korea, former President Park Geun-hye pledged to develop an “active pre-emptive deterrence strategy,” which entails the development of offensive cyber capabilities to strengthen the nation’s posture against adversaries in cyberspace (Akutsu, 2013; Keck, 2014; Kim, 2015).

The significance of cyber security in maintaining the single digital market has also been a critical issue for the European Union because weak responses to widespread ransomware attacks such as NotPetya and WannaCry may result in consumers losing confidence, businesses losing money, and even the compromise of national security systems (Ansip, 2017). Furthermore, investing in cyber capabilities is also a top priority in the U.K.:

as the cyber threat grows, we are making a very significant additional investment on the £1.9 billion we spend on cyber capabilities. That’s funding to improve offensive cyber, putting the command-and-control structures in place across-Government. And, it will give us extra money to protect our network resilience from online attacks.

(Williamson, 2019)

Following this trend, there are at least forty-seven states with cyber security programmes that involve military forces and sixty-seven with solely civilian-oriented cyber security programmes (Lewis and Neuneck, 2013, p. 1).

Despite the prevalence of cyber intrusions against states, there has been limited policy direction and scholarly consensus on the strategic utility of cyber capabilities as a foreign policy tool of states (Maness and Valeriano, 2015; Smeets, 2018). The gap between academic research and policy interpretations has generated disorientation about the strategic utility of cyber operations. Policymakers consider the significant potential of utilising cyberspace for military operations while downplaying the vulnerabilities of increased dependence on cyber-enabled technologies. On the other hand, academics argue that while cyber capabilities can provide more strategic options for states, the utility of cyber capabilities should not be overstated.

Rethinking strategic advantages

The revolutionary potential of cyber capabilities is underpinned by three core assumptions: asymmetric advantage, offence dominance, and the inapplicability of deterrence (Lynn, 2010; Nye, 2011). The first core assumption is that the asymmetric nature of cyber capabilities allows weaker actors to counter the military advantages of stronger adversaries. While some policymakers highlight the advantages of employing cyber capabilities in military conflicts, these ideas are mostly applicable to powerful states. A strong counterargument against this assumption is that cyber capabilities cannot achieve strategic effect unless supported by considerable government resources and operational capabilities, therefore, diminishing the asymmetric advantage of weaker states (Betz, 2012, p. 695). This assertion is based on the fact that the most sophisticated cyber operation to date, Operations Olympic Games, required a substantial amount of resources in addition to a strong intelligence network to inflict physical damage on an Iranian uranium enrichment facility. A second counterargument is that because of its inherent nonphysicality, cyber capabilities should be considered as an enabler of joint military action, instead of an independent means of stand-alone military action useful for coercive strategic effect (Gray, 2013, p. 54). Based on this argument, it is useful to consider cyber capabilities as supporting instruments because they cannot achieve conquest or independently coerce enemies into complying with the preferences of the attacking state (Gartzke, 2013, pp. 72–73).

A third counterargument offers a fundamental critique against the idea of cyberspace as a domain for warfare. Libicki (2012) contends that it is misleading to think of cyberspace as a war-fighting domain because it functions differently from traditional domains of warfare – land, sea, and air. For instance, the concept of domain superiority or the idea that power can prevent rivals from engaging in anything consequential is not applicable to cyberspace because this environment is not unitary, opponents are not clearly identified, and the number of actors involved in a conflict can also be ambiguous (Libicki, 2012, pp. 332–333). Considering these arguments, it is appropriate to evaluate the validity of the asymmetry assumption for small, less powerful states precisely because they have limited resources and influence in the international system. The book engages with these debates by exploring why small states have developed cyber capabilities as well as the utility of these capabilities as a tool for foreign policy in the Asia-Pacific Region. If cyber capabilities are indeed revolutionary tools that empower the weak then these capabilities can potentially alter the foreign policy interactions between states.

The second core assumption is that cyberspace is offence dominant. Offence dominance refers to the relative ease of conquest against targets (van Evera, 1998, p. 5). A number of policymakers are convinced that asymmetry between weak and strong actors is intensified by the relative ease of attacking networks of adversaries compared to defending against attacks (Lynn, 2010; Panetta, 2012; Alexander cited in Aftergood, 2013; Mullen cited in Zenko, 2015). From a technical perspective, offensive measures seem to be easier than defensive measures because the attacker can vary vectors and signatures faster than the defender can detect and close them (Lindsay, 2013, pp. 375–376). In terms of resources, offence seems to have the advantage as some policymakers are concerned with the high cost of defence given “a cyber environment in which emerging technologies are developed and implemented before security responses can be put in place” (Clapper cited in Garamone, 2012).

This assumption is problematic because the empirical evidence that supports this premise is weak and still untested. First, assessing the overall offence–defence balance during cyber operations is not feasible given the difficulty of obtaining data about cyber operations (Gartzke and Lindsay, 2015, p. 343). Second, offence–defence balance during military operations is typically measured based on several factors such as cumulatively, nationalism, force lethality, force protection, and force mobility (Glaser and Kaufmann, 1998, pp. 79–81; Adams, 2003, pp. 52–59). These factors have yet to be applied to the conditions of cyberspace. While Gartzke and Lindsay (2015, p. 346) have reported that attack severity, organisational competence, and actor resolve affect the offence–defence balance in cyber operations, a consensus about these factors has yet to be achieved. Given these considerations, assessing the utility of cyber capabilities for small states is necessary to clarify what cyber-enabled technologies can actually contribute to the strategy of the less powerful states. While this book does not directly contribute to the debates on the cyber offence–defence balance, it focuses on understanding a more basic aspect of cyber interactions: the purpose of cyber capabilities.

The third core assumption is that deterrence is not effective in cyberspace. Certain policymakers believe that traditional deterrence models of assured retaliation do not apply to cyberspace (Lynn, 2010; Hayden, 2011; Krepinevich, 2012). Deterrence is only possible when enemies are fully aware of the military capabilities of a particular state, but cyber capabilities resist such demonstration due to a number of technical and operational reasons (Libicki, 2013, p. vii). Since attribution requires time and resources to achieve, deterrence would be a weak strategy against cyber intrusions (Lynn, 2010, p. 99).

This assumption has also been disputed based on the alternative interpretations of deterrence. One interpretation is by denial, particularly by countering the use of certain classes of cyber weapons that already have existing countermeasures (Denning, 2015, p. 12). A second is to consider ...

Table of contents

• Cover
• Half-Title
• Series
• Title
• Copyright
• Dedication
• Contents
• List of illustrations
• Acknowledgements
• 1 Introduction: Small states and cyber capabilities
• 2 Mind the gap: The literature on cyber security and international relations
• 3 Explaining cyber capability development
• 4 Distribution of power and cyber capability development
• 5 Strategic culture and cyber capability development
• 6 Cyber capabilities as a foreign policy instrument
• 7 Conclusion: Small states in cyberspace
• Appendix 1: List of interviews
• Index