History disproves escalation

The NotPetya case is just one example. Nevertheless, the overall absence of any meaningful instances of cyber escalation raises questions about the extent to which the cyber domain is truly escalatory, let alone more dangerous than other domains of warfare or strategic competition. In other words, there is a significant mismatch between the cyber escalation views held by many prominent experts and the available evidence. Three factors could account for this gap.

First, differences between theoretical expectations and empirical reality may stem from definitional issues—specifically, how those who assert that the cyber domain is inherently escalatory define what "escalation" means. As we discuss in detail later in this chapter, we conceptualize escalation as something that changes the nature of a strategic interaction between parties in a way that makes war more likely or, if conflict is already taking place, more severe. According to this definition, neither the sheer volume of cyber incidents in the international system nor evidence of any type of response to a cyber incident necessarily constitutes escalation.2, In contrast, some may point to the observation of a high volume of cyber incidents or any form of tit-for-tat dynamic (irrespective of the relative level of cost and risk they may generate) as forms of escalation. However, the mere presence of behavior or activity per se is not sufficient evidence of escalation.

Alternatively, some may acknowledge that cyber escalation has not yet occurred, but it could be lurking around the next corner. This reasoning has some parallels to academic debates about the success of nuclear deterrence during the Cold War. Deterrence optimists opined that the absence of nuclear war between the United States and Soviet Union was due to the success of the strategy, while others have argued that the world simply got lucky.28 However, unlike the Cold War, where neither superpower ultimately chose to unleash its nuclear arsenal on the other, the offensive employment of cyber capabilities is hardly unthinkable. States have developed and employed offensive cyber capabilities since the 1980s and their use is only becoming more prevalent.29 The sheer number of cyber incidents that has occurred over the course of multiple decades raises questions about how likely it is that cyber escalation would take place in the future, given the multi-decade track record of cyber incidents not causing that outcome. That said, as part of our analysis in this book we explore plausible hypothetical escalation scenarios, with a focus on cyber operations that take place during conflict. Finally, there may simply be a mismatch between the conventional wisdom about cyber escalation and the empirical reality because the conventional wisdom is wrong. This is the core contention of our book.