The Deterrence and Prevention of Cyber Conflict

For all its apparent complexity, deterrence is built upon a relatively straightforward premise: that fear of adverse consequences can serve to prevent unacceptable behaviour. In traditional deterrence theory, particularly that which matured during the Cold War, prevention could be achieved both by fear of punishment and by fear of failure: by punitive measures that would be undertaken in response to a transgression and intended to inflict some pain, damage, or loss upon the transgressor; or by a denial posture intended to impress upon an adversary that the complexities of the defences will be technologically insurmountable and/or the costs of doing so unbearably high. Fresh thinking is required to make deterrence relevant to the cyber era. The challenges of cyber warfare are described here as the ‘four zeros’: ‘zero day’ vulnerability to novel malware; ‘zero source’ or non-attribution of an attack; ‘zero effect’ or covert, non-detectable attack; and ‘zero intent’ or lack of clarity as to an adversary’s intentions. These challenges can be met by allowing deterrence to function in different ways as circumstances allow or require: punitive, constructive, and protective deterrence.