Cyber attacks won’t escalate - empirically

Rather than dangerous escalatory spirals that threaten to spill over into kinetic conflict, even the most heated interactions between rivals in cyberspace are characterized by limited, tit-for-tat retaliations that are often separated by significant periods of time and that remain far below any conflict or armed attack threshold. Indeed, in a survey of cyber incidents and responses between 2000 and 2014, Brandon Valeriano et al. find that "rivals tend to respond only to lower-level [cyber] incidents and the response tends to check the intrusion as opposed to seek escalation dominance. The majority of cyber escalation episodes are at a low severity threshold and are nonescalatory."20 Similarly, Sarah Kreps and Jacquelyn Schneider conduct an original experiment to test different logics of cyber escalation and find that cyber attacks "create a threshold that restrains the escalation of conflict."21 Specifically, they find that Americans are less likely to support using kinetic force to respond to a cyber attack, even when the effects of the latter are comparable to other types of kinetic attacks.22

Even the most destructive cyber attack in history, NotPetya, launched by Russia in the spring of 2017 (reportedly using a leaked National Security Agency tool, EternalBlue), did not cause escalation. NotPetya wreaked $10 billion worth of damage across the globe, including to large multinational companies such as Maersk, Merck, and FedEx.23 If cyber operations are likely to cause escalation, NotPetya would be a prime contender, not only because of the extent of the damage inflicted, but also because it was carried out by a longstanding adversary of the nations it affected, which included some of the most powerful states in cyberspace.

Yet, the response on the part of the countries affected by NotPetya was rather restrained. In February 2018—nearly a year after the attack, seven allied nations (the United States, United Kingdom, Denmark, Lithuania, Estonia, Canada, and Australia) issued official statements attributing the NotPetya cyber attack to Russia.24 Concurrent with the coordinated attribution, Rob Joyce, then the White House cybersecurity czar, threatened other ambiguous consequences in remarks delivered at the Munich Security Conference in Germany. Joyce warned that the United States would "work on the international stage to impose consequences. Russia has to understand that they have to behave responsibly on the international stage ... So we're going to see levers the U.S. government can do to impose those costs."25 However, it took nearly a year for allied governments to organize a public, diplomatic attribution effort. The only observable costs that were imposed on Russia were sanctions targeting a limited number of individuals associated with the NotPetya attack as well as with the 2016 U.S. Presidential election interference and cyber penetration of the U.S. power grid.26 Of course, it's possible that there were additional, covert measures taken to impose costs on Russia. But if so, there was no demonstrable effect on any escalation dynamic with Russia.