No one’s ever died from cyber, and even the hypothetical catastrophes are not as bad as a war

Finally, an essential aspect of cyber operations’ strategic effects is the level of harm to the target. Most malicious cyber activity to date has not risen to a threshold of significant harm, violent effects, or loss of life.44 This is especially the case when compared to other military capabilities.45 That said, there are different ways to operationalize level of harm. One potential metric is loss of life. To date, no one has reportedly died as a direct result of a cyberattack, despite over thirty years of recorded cyber operations. 46 Even in hypothetical catastrophic scenarios, the cost in terms of human casualties is relatively low compared to other military capabilities. For instance, a common worst-case scenario is a cyberattack on a power grid.47 However, the 2015 Russian cyberattack against Ukraine’s power grid, the first known example of an offensive cyber operation targeting a state’s power grid, did not lead to any reported casualties.48

It is also possible to measure the harm cyber operations inflict in treasure rather than blood. According to this metric, the financial or economic costs of cyberattacks are significant. For example, the total cost of the most expensive cyberattack in history, the 2017 NotPetya attack, is estimated at $10 billion.49 However, governments have largely avoided characterizing these operations as crossing an “act of war” or “use of force” threshold.50 While still of strategic consequence, cyber operations (especially absent physical violence) appear to be perceived differently than other military operations.51

Given different approaches, we chose to measure level of harm in terms of the target state’s perception of a cyber operation’s national security consequences. Perception may not perfectly align with the objective human or economic costs. For instance, the SolarWinds supply chain breach, revealed in December 2020, compromised many US federal government and private sector networks but did not cause loss of life.52 Nevertheless, the US government chose to activate the response process outlined in Presidential Policy Directive 41, which applies to cyber incidents that rise to a certain level of significance.53 This example illustrates how the perceived level of harm ultimately is a political or strategic assessment, rather than an objective measure of calculatable damage.

Taken together, the strategic effects of most cyber operations are relatively limited when compared to other types of military operations. That said, different types of cyber operations vary in their level of effects. These two points have implications for accommodative signaling. Specifically, in the context of an international crisis, the relative effects of a cyber operation inform how the adversary perceives the intent behind the signal.54 In this sense, the key audience for a cyber operation’s effects is the adversary government. Because cyber operations lack the physical violence and permanent destruction associated with other military capabilities—and may even be less painful than some economic instruments, such as sanctions— they could signal restraint relative to other options. Moreover, the choice of a disruptive cyber operation that has temporary effects, in comparison to a destructive cyber operation with longer-term effects, could also send an accommodative signal. The sequencing of the cyber operation could also inform its interpretation. For instance, if a cyberattack follows a kinetic one, it could be perceived as a de-escalatory choice.