Fears of cyberattacks cause decisionmakers to adopt worse case thinking, which increases escalation risks

Fears about cyber-enabled damage limitation may be particularly pernicious because of the potential difficulty of detecting a cyberattack. A sophisticated cyberattack on nuclear forces or C3I systems could conceivably occur without being detected. In the extreme case, a state might only find out that it had been attacked when it attempted to launch nuclear weapons and discovered that its ability to do so had been impeded in some way. If a state believed that it would be unlikely to detect an ongoing cyberattack, then it could rationally conclude that it might be under attack even in the absence of attack indicators. The simple belief that an opponent had highly sophisticated cyber capabilities could, therefore, precipitate a false positive–the incorrect assessment that an attack was underway–by itself. By contrast, if a state’s nuclear forces were under assault from kinetic strikes, the target would likely be aware. To be sure, it is still not entirely impossible that a state could wrongly come to believe it was under kinetic attack. Early-warning systems, for example, have produced false warnings of incoming ballistic missile strikes.27 But mistakes of this kind could be identified once the incoming weapons ceased to exist (though the window of time before they disappeared could be particularly dangerous).

To make matters worse, a state that was concerned about its nuclear forces and C3I systems coming under cyberattack might be inclined, especially in a crisis or conflict, to interpret ambiguous indicators in the worst possible light. For example, if one of its nuclear C3I systems malfunctioned because of, say, bad design or aging components, it might wrongly attribute the failure to a cyberattack (in fact, the temptation among operators to do so might be particularly strong if they would otherwise be held responsible for an internal failure). Regardless of precisely how it arose, however, a false positive that occurred in a crisis or conflict could generate significant escalation pressures.