Extinction

Even if Russia and the West avoid direct conflict this time, they might not be so lucky the next. As relations worsen, future disruption of critical Western infrastructure by Russian intelligence, such as the NotPetya and Olympic Destroyer attacks, are less likely to be viewed as mere crimes. Repeated crises bordering on war may further erode the tacit agreements and relative restraint of quieter times. After repeated iterations of intensifying cyber operations, both Russia and the West may feel their backs to the wall with few options left other than military force when the next crisis — physical or cyber — emerges. Under extreme conditions, some of the same characteristics that lead cyber capabilities to be a pressure release might have the opposite effect, a mechanism that Bob Jervis and I have described as the Escalation Inversion.

If Putin believes a direct conflict with NATO is likely and expects its adversaries to take measures to reduce vulnerabilities, he could conclude that the best possibility for success is to launch a massive preemptive cyber attack. Since the U.S. military may seem otherwise unbeatable, this may lead Russia to “compensate with audacity in order to redress the balance.” The more the United States brags about its overwhelming offensive cyber advantage, but frets over weak defenses, the more any adversary might feel the need to target the United States as early and as hard as possible.

If Russia fears war with the United States may happen on Saturday, it might feel the need to get in its cyber punches on Friday. If the United States thinks the same, it may need to start on Thursday. Cyber capabilities may be to World War III as mobilization timelines were to World War I.

Since a cyber sucker punch may also seem less escalatory, adversaries could be tempted to take risks they would not otherwise. In this situation, the sense that cyber is a pressure-release valve becomes positively dangerous: If the system is seen to be stable, then there is less reason to act with restraint, thereby making it less stable. Fortunately, the good news is leading U.S. policymakers appear attuned to this risk.

Avoiding Escalation

How can Washington reduce the risk of cyber attacks escalating into a direct conflict with Russia? First, by recognizing it. Cyber conflict may be an intelligence contest or a pressure release in peacetime and something quite different during or after a major war in Europe. Cyber war may be far easier to stumble into when states fear the wolf at their door.

Second, escalation control requires a better understanding of political psychology — specifically the mindset and desperation of one inscrutable, increasingly isolated, and blood-covered tyrant. There were more than enough expert commentators who believed that Putin would never invade Ukraine because it objectively seemed so irrational. Assessments of cyber escalation must also cover seeming irrationality, including the misperceptions, mistakes, and miscalculations that can lead even the most rational leaders to get caught up in an escalatory spiral that is no longer under their control.

Third, preventing escalation requires military and intelligence leaders to understand and respect cyber capabilities. Cyber capabilities are not “magic invisible weapons” but rather real weapons with massive, cascading consequences. They have a range of advantages and restrictions that sober-minded national leaders should approach as they would any other weapon.

Finally, even if we dodge a bullet this time, we should not become complacent. Personally, I would put the chances of cyber conflict escalating into a Russia–NATO war at less than 10 percent. With luck, escalation will not happen, and I will be written off as a “cyber catastrophist.” “Cyber doesn’t work like that,” we will tell ourselves. “Remember the lessons of the Ukrainian cyber non-war. Cyber doesn’t escalate. It isn’t useful on the battlefield or for coercing other states.”

This will hopefully continue to be true for weeks or even years. But the world is in the first few decades of an information age that will continue for a long time. The existential stakes of cyber conflict rise as more countries become more digitized and more reliant on vulnerable information technology.