Cyberspace is a new domain of conflict, one guided by few accepted rules or standards of behavior. Policymakers find offensive cyber operations attractive because they are relatively inexpensive, can be designed to be less destructive than kinetic strikes (i.e., those against physical targets), and can provide a high degree of anonymity to the attacker. The vast majority of these operations include cyber espionage (theft of military and political secrets or intellectual property) and political disruptions (website defacement or distributed denial-of-service [DDoS] attacks, which flood a website with so much data that it can no longer respond).

The White House’s 2018 National Cyber Strategy states that “all instruments of national power are available to prevent, respond to, and deter malicious cyber activity against the United States.” However, although experts generally assume that a cyberattack that causes death or physical destruction would be considered an armed attack, the threshold for a military response to other forms of cyberattack remains uncertain. Defending against cyber threats is extremely difficult. Would-be defenders need to worry about millions of lines of computer code, hundreds of devices, and scores of networks, but an attacker need find only one vulnerability.

Moreover, attribution of cyberattacks is difficult and slow, which makes them different from other weapons. Attackers can hide their tracks with relative ease, and the attacks can happen in minutes, if not seconds. Many countries rely on proxies, criminal groups, or patriotic hackers to conduct operations: even if the location of the hackers can be determined, anyone anywhere could have authorized the attack. This conundrum greatly complicates efforts to retaliate and prevent attacks.

Successful attacks could also risk escalation. If, based on past trends, military leaders fear that their networks or weapons systems could be subjected to cyberattacks—which would limit their ability to order forces in the field or to launch weapons—they would have an incentive to use their weapons systems preemptively; such a move would escalate and further destabilize a conflict.