The Myth of the Cyber Offense; The Case for Restraint; Policy Analysis, January 15, 2019, Number 862

16, [2] pages, including covers. Contents include an Executive Summary; an Introduction; Cyber Command's New, More Aggressive Policy; The character of Cyber Operations, 2000-2016; The Myth of the Offense; and a Conclusion. The appendix contains a table on Retaliation dynamics, and a Table on Cyber objectives and retaliation severity. A bibliography of sources is also included. Brandon Valeriano is a Senior Fellow at the Cato Institute. He is also the Bren Chair of Military Innovation at the Marine Corps University, and serves as Senior Advisor for the Cyber Solarium Commission. Dr. Valeriano has published six books and dozens of articles for such outlets as the Journal of Politics, International Studies Quarterly, and the Journal of Peace Research. His two most recent books are Cyber War versus Cyber Reality and Cyber Strategy, both with Oxford University Press. Dr. Valeriano has a Ph.D. from Vanderbilt University. In the context of recent shifts in cybersecurity policy in the United States, this paper examines the character of cyber conflict through time. Data on cyber actions from 2000 to 2016 demonstrate evidence of a restrained domain with few aggressive attacks that seek a dramatic, decisive impact. Attacks do not beget attacks, nor do they deter them. But if few operations are effective in compelling the enemy and fewer still lead to responses in the domain, why would a policy of offensive operations to deter rival states be useful in cyberspace? We demonstrate that, while cyber operations to date have not been escalatory or particularly effective in achieving decisive outcomes, recent policy changes and strategy pronouncements by the Trump administration increase the risk of escalation while doing nothing to make cyber operations more effective. These changes revolve around a dangerous myth: offense is an effective and easy way to stop rival states from hacking America. New policies for authorizing preemptive offensive cyber strategies risk crossing a threshold and changing the rules of the game. Cyberspace to date has been a domain of political warfare and coercive diplomacy. An offensively postured cyber policy is dangerous, counterproductive, and undermines norms in cyberspace. Many have promoted the idea of a coming "Cyber Pearl Harbor," but instead the domain is littered with covert operations meant to manage escalation and deter future attacks. Cyber strategy and policy must start from an accurate understanding of the domain, not imagined realities. Senior leaders throughout the federal government should consider a more prudent and restrained approach to cyber operations. We argue for a defensive posture consisting of limited cyber operations aimed at restraining rivals and avoiding escalation. At the same time, the United States should focus on protective measures to make U.S. systems less vulnerable and on sharing intelligence with allies and partners. A policy of restraint that maintains control over the weapons of cyber war is strategically wise. Presumed First Edition, First printing thus.…