Cyberattacks risk nuclear escalation – they amplify crisis instability and are misinterpreted

The United States’ experience is the norm. All nuclear-armed states have felt, and continue to feel, similar concerns. Indeed, the last few decades have seen the emergence of new potential vulnerabilities–this time in cyberspace–as nuclear weapons and C3I systems have come to rely increasingly on digital technology. To be sure, the networks involved in nuclear operations are almost certainly among the most secure anywhere. Yet there is broad agreement among technical experts that perfect network security is “impossible.”3 As a result, the possibility of cyber interference with nuclear forces and C3I systems is real.

The vulnerability of nuclear forces and C3I systems creates the risk of inadvertent escalation: that is, escalation resulting from military operations or threats that are not intended to be escalatory. So-called crisis instability, for example, could arise if a state were afraid of being disarmed more or less completely in a preemptive strike by an adversary, whether or not such fears were well founded.4 In the most extreme case, “use-’em-or-lose-’em” pressures could lead the state to employ nuclear weapons, conceivably in its own preemptive attempt to disarm its adversary, but more likely in a limited way to try to terrify the opponent into backing down. In less extreme scenarios, a state afraid of being disarmed might take steps–issuing nuclear threats, for example, or dispersing mobile nuclear forcesthat raised the likelihood of nuclear use later.

This danger is likely to be exacerbated by any cyber vulnerabilities affecting nuclear forces and C3I systems. Most directly, the existence of such vulnerabilities could intensify existing fears of being disarmed–fears that are already acute in China and Russia (as well as in Pakistan and, most likely, North Korea).5 However, because of their unique characteristics and effects, cyber threats could create at least three qualitatively new mechanisms by which a nuclear-armed state might come to the incorrect conclusion that its nuclear deterrent was under threat. First, the purpose of cyber interference could be misinterpreted. In particular, espionage could be mistaken for an attack. Second, a cyberattack could have a more significant effect than intended. Malware implanted into information technology (IT) systems associated with non-nuclear weapons could accidentally spread into more sensitive nuclear-related systems, for instance. Third, the initiator of a cyber operation could be misidentified. An operation carried out by a third party, for example, could be misattributed by one state in a bilateral confrontation to its opponent. What makes these pathways so pernicious is that the catalyst for escalation could appear to its initiator to be a relatively benign action.

To make matters worse, such pathways could lead to inadvertent escalation even if the target of the cyber interference were not afraid of being completely disarmed. Today at least, this description fits the United States. If, in a conflict against Russia, say, the United States wrongly concluded that its strategic early-warning system was under cyberattack, it might reason that Moscow was seeking to undermine U.S. missile defenses, which use early-warning data, prior to launching a nuclear attack.6 Given that U.S. declaratory policy explicitly highlights the option of a nuclear response to non-nuclear attacks on nuclear C3I assets, such a “misinterpreted warning” might lead Washington to use nuclear weapons.7 But even if it did not, its response, which might include nuclear threats, could still be escalatory.