The Role of Effects, Saliencies and Norms in U.S. Cyberwar Doctrine

Abstract

How should the United States respond if an adversary employs cyber attacks to damage the U.S. homeland or weaken its military capabilities? More specifically, how should the United States choose between cyber and kinetic responses to cyber attacks? We build the foundation of our analysis on a basic effects-based logic — that is, decisions about deterrence and warfighting should be based on the effect a given U.S. attack will have, not on the means via which that effect is produced. While this approach takes us part of the way toward developing a cyber doctrine, it turns out that the basic logic is too sparse and would likely provided misleading guidance in a number of situations. The shortcoming arises because states may perceive different forms of retaliation that do equal damage as differently punishing and differently escalatory. To reduce these shortcomings, we draw upon the concepts of focal points and saliences to add necessary distinctions. The result remains a largely effects-based approach, but one that incorporates a much richer understanding of effects. Attention to saliencies tends to reduce the role of kinetic retaliation for deterring and responding to cyber attacks. We also consider the possibility that cyber norms will constrain U.S. cyberwar doctrine, but find that are none are well enough established to play a significant role in the near future.Note: This paper was prepared for a workshop on the strategic use of offensive cyber operations held in March 2016 and organized by the Stanford Cyber Policy Program. On August 18, 2016, this paper was submitted to the Journal of Cybersecurity for entry into its review process and perhaps for publication.