Crisis diplomacy and restraint disproves the impact

The risk of escalation is grossly exaggerated. Countless Track II dialogues are undertaken to reduce the risk of miscalculations that could lead a cyber incident to escalate into kinetic violence. Yet, in two decades of malicious cyber action, there has never been an incident that has led to escalation. While there have been a few instances of unintended consequences and collateral damage, these did not lead to an escalation of conflict. We can now reject the initial hypothesis of miscalculation and escalation as inaccurate. The likely reasons there have been no cyber incidents that resulted in escalation is that states maintain careful control of their most dangerous cyber capabilities and have devoted their own strategies to reduce risk. We should learn from their experience of tight leadership and control as we design our own active policies.

A new strategy must use communications, messaging, and signals with opponents, allies, and publics. This does not mean that every action should be accompanied by a press release, but a new cyber strategy will need to use public and private communications to shape opinion in ways favorable to the United States and make it clear that our actions are guided by international law and agreement. Adopting a more assertive posture in cyberspace is in itself a message that will improve our position with opponents. Diplomatic and public messaging can help manage escalation risk and strengthen collective responses with allies while shaping opponents’ planning. Decisions on timing and audience will be determined by the specifics of each action, but our overall goal should be to end Strangelovian opacity.