No cyber impact---every scenario is empirically denied

The most dangerous and damaging attacks required resources and engineering knowledge that are beyond the capabilities of nonstate actors, and those who possess such capabilities consider their use in the context of some larger strategy to achieve national goals. Precision and predictability—always desirable in offensive operations in order to provide assured effect and economy of force—suggest that the risk of collateral damage is smaller than we assume, and with this, so is the risk of indiscriminate or mass effect.

State Use of Cyber Attack Is Consistent with Larger Strategic Aims

Based on a review of state actions to date, cyber operations give countries a new way to implement existing policies rather than leading them to adopt new policy or strategies. State opponents use cyber techniques in ways consistent with their national strategies and objectives. But for now, cyber may be best explained as an addition to the existing portfolio of tools available to nations.

Cyber operations are ideal for achieving the strategic effect our opponents seek in this new environment. How nations use cyber techniques will be determined by their larger needs and interests, by their strategies, experience, and institutions, and by their tolerance for risk. Cyber operations provide unparalleled access to targets, and the only constraint on attackers is the risk of retaliation—a risk they manage by avoiding actions that would provoke a damaging response. This is done by staying below an implicit threshold on what can be considered the use of force in cyberspace.

The reality of cyber attack differs greatly from our fears. Analysts place a range of hypothetical threats, often accompanied by extreme consequences, before the public without considering the probability of occurrence or the likelihood that opponents will choose a course of action that does not advance their strategic aims and creates grave risk of damaging escalation. Our opponents' goals are not to carry out a cyber 9/11. While there have been many opponent probes of critical infrastructure facilities in numerous countries, the number of malicious cyber actions that caused physical damage can be counted on one hand. While opponents have probed critical infrastructure networks, there is no indication that they are for the purposes of the kind of crippling strategic attacks against critical infrastructure that dominated planning in the Second World War or the Cold War.

Similarly, the popular idea that opponents use cyber techniques to inflict cumulative economic harm is not supported by evidence. Economic warfare has always been part of conflict, but there are no examples of a country seeking to imperceptibly harm the economy of an opponent. The United States engaged in economic warfare during the Cold War, and still uses sanctions as a tool of foreign power, but few if any other nations do the same. The intent of cyber espionage is to gain market or technological advantage. Coercive actions against government agencies or companies are intended to intimidate. Terrorists do not seek to inflict economic damage. The difficulty of wreaking real harm on large, interconnected economies is usually ignored.

Economic warfare in cyberspace is ascribed to China, but China's cyber doctrine has three elements: control of cyberspace to preserve party rule and political stability, espionage (both commercial and military), and preparation for disruptive acts to damage an opponent's weapons, military information systems, and command and control. "Strategic" uses, such as striking civilian infrastructure in the opponent's homeland, appear to be a lower priority and are an adjunct to nuclear strikes as part of China's strategic deterrence. Chinese officials seem more concerned about accelerating China's growth rather than some long-term effort to undermine the American economy.6 The 2015 agreement with the United States served Chinese interests by centralizing tasking authority in Beijing and ending People's Liberation Army (PLA) "freelancing" against commercial targets.

The Russians specialize in coercion, financial crime, and creating harmful cognitive effect—the ability to manipulate emotions and decisionmaking. Under their 2010 military doctrine on disruptive information operations (part of what they call "New Generation Warfare"). Russians want confusion, not physical damage. Iran and North Korea use cyber actions against American banks or entertainment companies like Sony or the Sands Casino, but their goal is political coercion, not destruction.

None of these countries talk about death by 1000 cuts or attacking critical infrastructure to produce a cyber Pearl Harbor or any

of the other scenarios that dominate the media. The few disruptive attacks on critical infrastructure have focused almost exclusively on the energy sector. Major financial institutions face a high degree of risk but in most cases, the attackers' intent is to extract money. There have been cases of service disruption and data erasure, but these have been limited in scope. Denial-of-service attacks against banks impede services and may be costly to the targeted bank, but do not have a major effect on the national economy. In all of these actions, there is a line that countries have been unwilling to cross.

When our opponents decided to challenge American "hegemony," they developed strategies to circumvent the risks of retaliation or escalation by ensuring that their actions stayed below the use-of-force threshold—an imprecise threshold, roughly defined by international law, but usually considered to involve actions that produce destruction or casualties. Almost all cyber attacks fall below this threshold, including, crime, espionage, and politically coercive acts. This explains why the decades-long quest to rebuild Cold War deterrence in cyberspace has been fruitless.

It also explains why we have not seen the dreaded cyber Pearl Harbor or other predicted catastrophes. Opponents are keenly aware that launching catastrophe brings with it immense risk of receiving catastrophe in return. States are the only actors who can carry out catastrophic cyber attacks and they are very unlikely to do so in a strategic environment that seeks to gain advantage without engaging in armed conflict. Decisions on targets and attack make sense only when embedded in their larger strategic calculations regarding how best to fight with the United States.

There have been thousands of incidents of cybercrime and cyber espionage, but only a handful of true attacks, where the intent was not to extract information or money, but to disrupt and, in a few cases, destroy. From these incidents, we can extract a more accurate picture of risk. The salient incidents are the cyber operations against Iran's nuclear weapons facility (Stuxnet), Iran's actions against Aramco and leading American banks, North Korean interference with Sony and with South Korean banks and television stations, and Russian actions against Estonia, Ukrainian power facilities, Canal 5 (television network in France), and the 2016 U S. presidential elections. Cyber attacks are not random. All of these incidents have been part of larger geopolitical conflicts involving Iran, Korea, and the Ukraine, or Russia's contest with the United States and NATO.

There are commonalities in each attack. All were undertaken by state actors or proxy forces to achieve the attacking state's policy objectives. Only two caused tangible damage; the rest created coercive effect, intended to create confusion and psychological pressure through fear, uncertainty, and embarrassment. In no instance were there deaths or casualties. In two decades of cyber attacks, there has never been a single casualty. This alone should give pause to the doomsayers. Nor has there been widespread collateral damage.