H-Diplo | RJISSF Roundtable 16-17 on Lonergan and Lonergan, Escalation Dynamics in Cyberspace61 min read

Although for over a quarter century an increasing number of states have acquired and used cyber capabilities, and cyberspace has become an increasingly important arena for international security interaction, far too many national intelligence and defense scholars, practitioners, and policymakers have sidestepped its vital role, either claiming that the technical barriers to entry are too great for them to directly assess its value or clinging to dismissive assessments that cyber operations will never constitute the central communication and influence channel in international relations. In today’s world, it is frankly way too dangerous and too irresponsible to consider cyberspace operations as anything other than a core component of global power politics. In that context, Erica Lonergan and Shawn Lonergan have crafted a landmark study exploring cyber operations’ security impact on interstate conflict and crisis escalation. Despite this topic’s under-exploration, the questions these authors raise seem crucial both to deep-context understanding by academic scholars and to wise actions and responses by government decisionmakers.

H-Diplo | Robert Jervis International Security Studies Forum

Roundtable Review 16-17 

Erica D. Lonergan and Shawn W. Lonergan, Escalation Dynamics in Cyberspace. Oxford. Oxford University Press, 2023. ISBN: 9780197550885 (hardcover, $99.00).

6 December 2024 | PDF: https://issforum.org/to/jrt16-17 | Website: rjissf.org | Twitter: @HDiplo

Editor: Diane Labrosse
Commissioning Editor: Jennifer Erickson
Production Editor: Christopher Ball
Pre-Production Copy Editor: Katie A. Ryan

 

Introduction by Robert Mandel, Lewis & Clark College. 2

Review by Gil Baram, University of California Berkeley. 7

Review by Lennart Maschmeyer, ETH Zürich, Center for Security Studies 12

Review by Jacquelyn Schneider, Stanford University. 17

Response by Erica D. Lonergan, Columbia University and Shawn W. Lonergan, 75th Innovation Command. 22

 

Although for over a quarter century an increasing number of states have acquired and used cyber capabilities, and cyberspace has become an increasingly important arena for international security interaction, far too many national intelligence and defense scholars, practitioners, and policymakers have sidestepped its vital role, either claiming that the technical barriers to entry are too great for them to directly assess its value or clinging to dismissive assessments that cyber operations will never constitute the central communication and influence channel in international relations. In today’s world, it is frankly way too dangerous and too irresponsible to consider cyberspace operations as anything other than a core component of global power politics. In that context, Erica Lonergan and Shawn Lonergan have crafted a landmark study exploring cyber operations’ security impact on interstate conflict and crisis escalation. Despite this topic’s under-exploration, the questions these authors raise seem crucial both to deep-context understanding by academic scholars and to wise actions and responses by government decisionmakers.

As with closely related, rapidly-changing digital technology areas, such as “big data” and artificial intelligence, most studies of cyberspace’s national security implications have tended to be broad, sweeping, and overly general in assessing future prospects. So, it is indeed refreshing to see the Lonergan and Lonergan study tackling the narrower issue of cyber operations and escalation, facilitating their ability through detailed case-study analysis to make much more carefully qualified judgments about causes, consequences, functioning modes, and security impacts. It is particularly praiseworthy to see that in examining cyber operations’ potential to trigger dangerous escalatory spirals threatening to transform into bloody real-world kinetic warfare, Lonergan and Lonergan sharply deviate from the common tendency to emphasize the most negative alarming fear-inducing scenarios or to construct ominous rigid cyber-escalation ladders[1] designed to be universally applied. Instead, taking into account broader insights about escalation from relevant literature, Lonergan and Lonergan appropriately identify the specific conditions under which cyber operations may have differing kinds of security consequences.

This book is decidedly iconoclastic. Most centrally, Lonergan and Lonergan highlight how, rather than serving to escalate hostility or war, cyber operations can counterintuitively serve a set of conflict-minimizing cooperation-maximizing purposes which up to this point have been exceedingly difficult to pursue successfully in today’s volatile multipolar global security setting. Jacquelyn Schneider underscores that Lonergan and Lonergan’s book’s primary thrust about cyber operations actually signaling willingness to avoid escalation could not be more opposite to early dominant fear-promoting widely accepted assertions preceding it. Schneider also nicely underscores how Lonergan and Lonergan effectively rebut the widely held notion that because cyber operations are characterized by secrecy and plausible deniability, the consequence is automatically escalation. Moreover, Gil Baram and Schneider comment that Lonergan and Lonergan strongly challenge the widely-held view that within cyberspace offense has the advantage over defense, reflected by the common complaint about how disconcerting it is to realize “how steeply new technology has tipped the balance in favor of those—from free-lance hackers to Russian mobsters to terrorists to states like China and Iran—who want to learn the secrets we keep, whether for national, corporate, or personal security.”[2] Furthermore, despite the wide consensus mentioned by Lonergan and Lonergan that cyber operations are poor cross-national signaling tools,[3] the authors constructively reveal when cyber operations are in reality most useful for this state-to-state signaling, including to deescalate crises, and indeed Lonergan and Lonergan’s emphasis on cyber operations’ capacity to serve as accommodative signals of restraint constitutes a major contribution to international bargaining theory.

This research undertaking is courageous in ways that go beyond its willingness to challenge widely accepted security assumptions. Lennart Maschmeyer underscores the key tradeoffs faced by Lonergan and Lonergan when undertaking rigorous social scientific research in a rapidly evolving technical field like cyberspace escalation. Although significant policy changes and groundbreaking technological advances have the potential to quickly render outmoded the conclusions that are reached, that should never constitute an excuse for burying one’s head in the sand and being unwilling to tackle such vital topics while waiting for stable behavior patterns to emerge and for voluminous previously confidential data to become available. So Lonergan and Lonergan are to be commended for their choice to enter the fray—especially with a counterintuitive central message—despite the inherent risks.

The perceptual nature of cyberspace escalation, acknowledged by Lonergan and Lonergan and noted by Baram, highlights that the interpretation of cyber operations can differ markedly in the eye of the beholder. One might well assume that because one state could misinterpret another state’s cyberspace actions, an unintended but nonetheless highly ominous action-reaction cycle could ensue. Yet Lonergan and Lonergan argue that such dangerous escalatory spirals are actually quite unlikely. In a related manner, Maschmeyer notes that the unpredictability embedded in cyber operations could over time cause risky state behavior to generate destabilizing collateral damage, with the inherent impact ambiguity preventing those who initiate offensive cyber operations from guarding against the full range of possible target responses.[4] Thus Maschmeyer legitimately calls for more consideration of the role of uncertainty on escalation in cyberspace.

The particular manner in which Lonergan and Lonergan delineate their research questions and gather their evidence is not without controversy, as voiced by the book’s reviewers. It is no surprise that Lonergan and Lonergan’s definition of offensive cyber operations involves tradeoffs: given the controversy surrounding sharply distinguishing offensive from defensive military behavior and weapons systems more generally, this distinction remains contentious in cyberspace, with Baram noting the authors’ arbitrary exclusion of computer network exploitation. Baram also points out the selection bias in Lonergan and Lonergan’s dataset, which is based largely on publicly reported cyber operations, and productively suggests that experimental war games could help remedy this deficiency. Last, Baram’s plea is well taken for the Lonergans to expand their research focus to incorporate more the intentions surrounding state initiation of cyber operations, for finding patterns here could unravel key uncertainties surrounding the timing and frequency of states’ foreign cyber operations.

The American cyberspace policy inconsistencies, which are noted in Lonergan and Lonergan’s response to Maschmeyer’s comments, are symptomatic of broader hypocrisy. The political leaders of many countries, including the United States, bemoan others’ offensive cyber operations while themselves undertaking similar kinds of offensive foreign cyber operations, usually covertly. Most states possessing relevant capabilities have not been reluctant—with purely defensive publicly-stated rationales—to engage in various forms of foreign cyber-intrusion, leading to intensified international cross-penetration: for example, even back in 2010 former American Assistant Secretary of Defense William Lynn suggested that over 100 foreign government intelligence organizations had been illegitimately trying to break into American defense networks.[5] Following security dilemma logic, a given state’s cyber-defense strategy, even if relatively restrained, can be seen by others as sovereignty-violating. Today’s tightly networked information systems can serve equally as weapons for penetrating foreign databases and as targets needing protection.[6] These patterns support Maschmeyer’s call for more consideration of the relevant parallels between cyber operations and foreign intelligence operations.

While Lonergan and Lonergan make clear that they stress systemic explanations for why cyber operations do not lead to escalation, and as Maschmeyer notes they do consider some alternative explanations, Schneider makes an important amendment to the authors’ conclusions by asserting that bureaucratic issues also contribute to cyber operations’ non-escalation, as for example cyber operations for intelligence purposes may limit the desirability of undertaking offensive escalatory cyberspace actions. This point is critical because systemic elements are not necessarily always more important or always require prior explanation relative to other contributors to cyber operations’ non-escalation.

This volume nicely sets the stage for follow-up research. First, in pursuing the premise that cyber operations can be used as a means of deescalating cross-state tensions, the hope is that subsequent studies will flesh out exactly when and how this could occur effectively and legitimately in state policies, with an underlying question surfacing about under what conditions government security decisionmakers would choose to use cyber operations as a primary means to pursue this stabilizing objective. Second, rather than emphasizing exclusively nation-state rivals, follow-up studies could productively examine cyber operations’ impact on escalation when one of the parties is a subversive subnational or transnational group[7] (especially a terrorist group or a criminal organization) or a cooperation-promoting intergovernmental organization[8] (especially the United Nations). Third, follow-up research could extend this book’s policy recommendations for the US Cyber Command to encompass advice to American allies with differing strategic objective hierarchies. Finally, integrating cyberspace operations’ impact on conflict escalation more fully into broader national security doctrine seems valuable in subsequent research efforts, for cyber-threat does not exist and cannot be evaluated in a vacuum.

There is so far a key gap in systematically formulated and executed research about the most security-relevant dimensions of cyberspace behavior. Due to careful choices made in pursuing its central thrust, Escalation Dynamics in Cyberspace provides a model useful as a future guide about how to do so—even with inevitable data limitations—in a scholarly reputable and convincing and a policy-relevant way.

 

Contributors:

Erica D. Lonergan is an Assistant Professor in the School of International and Public Affairs at Columbia University. Erica also currently serves as a member of the Board of Visitors of the US Army War College. Previously, Erica held several positions at the United States Military Academy at West Point. These include serving as an Assistant Professor in the Departments of Social Science and Electrical Engineering and Computer Science; a fellow at the Army Cyber Institute; and the Executive Director of the Rupert H. Johnson Grand Strategy Program. Erica served as a Senior Director on the US Cyberspace Solarium Commission and continues to serve as a Senior Advisor to the Cyberspace Solarium Commission 2.0. She also held an appointment as a Council on Foreign Relations International Affairs Fellow, with placement at JPMorgan Chase and US Cyber Command at the Cyber National Mission Force. Erica received her PhD in Political Science from Columbia University.

Shawn W. Lonergan is a Lieutenant Colonel in the US Army Reserve 75th Innovation Command. Prior to joining the Reserves, Shawn was an active-duty cyber officer and played key roles in the National Security Agency (NSA) in the office of Tailored Access Operations; the United States Cyber Command in the Cyber National Mission Force; and the United States Military Academy at West Point, where he taught courses on cyber operations. Shawn is also the former head of the Department of Defense pilot program to protect critical infrastructure from systemic cyber attacks. Shawn is a graduate of the United States Military Academy at West Point and holds two Masters’ degrees and a PhD in Political Science from Columbia University. Shawn most recently served as a Senior Advisor to the US Cyberspace Solarium Commission and also served as an Advisor to the Biden-Harris Presidential Transition.

Robert Mandel is Marc Messina Chair and Professor of International Affairs at Lewis & Clark College. He is the author of seventeen books and numerous articles and book chapters on global security matters, incorporating a recent skew toward integrating cybersecurity, data science, and artificial intelligence concerns. He has worked for multiple American intelligence agencies and testified before the United States Congress.

Gil Baram is a Research Scholar at the Center for Long-Term Cybersecurity and the Berkeley Risk and Security Lab, University of California Berkeley. Her work interests include states’ decisionmaking during offensive cyber operations, intelligence and covert actions, and empirical cyber research. Her work appeared in journals such as the Journal of Global Security Studies, Contemporary Security Policy, Journal of Cyber Policy, and Israel Studies Review.

Lennart Maschmeyer is a Senior Researcher in Cybersecurity at the Center for Security Studies at ETH Zurich. He holds a PhD from the University of Toronto and an MPhil from the University of Oxford. Lennart is also a co-chair of the FIRST Threat Intel Coalition (https://threatintelcoalition.com/) and the ECCRI Virtual Research Workshop series (https://eccri.eu/virtual-research-workshops/).

Jacquelyn Schneider is a Hoover Fellow at Stanford University and a faculty affiliate at the Center for International Security and Cooperation, also at Stanford University.

 

Why has the international system not experienced meaningful cyber escalation? This is the main question Erica D. Lonergan and Shawn W. Lonergan examine in their new book, Escalation Dynamics in Cyberspace. Their answer is both detailed and comprehensive. In their view, the conventional wisdom about cyber escalation—that expects a “cyber Pearl Harbor” and a “cyber war”[9]—is wrong, mainly because it does not reflect empirical reality.[10] They argue that escalation, whether intentional or accidental, is fundamentally a political action made by individuals within organizations—it is not driven solely by technology. Importantly, what is considered an act of escalation, regardless of the tools used, is always subject to the perception of the observer.

Lonergan and Lonergan proposed an important distinction between escalation in crises and potential escalation patterns during outright conflict. They show that vast majority of cyber activities take place in scenarios of strategic rivalry among nations that do not reach the threshold of military conflict. In such circumstances, they find minimal proof that cyber activities prompt escalation. Rather, they offer a very interesting argument—which they test empirically—that the characteristics that render cyber activities ineffective for escalation might also allow countries to employ these operations to de-escalate tensions. Their goal is to “reframe the conversation away from binary debates about whether or not escalation is likely, and we identify the conditions under which escalation—or de-escalation—may be more or less likely as a result of cyber operations” (9). The robust investigation they conduct, which includes detailed case studies and scholarship discussions, certainly achieves this aim.

Throughout Escalation Dynamics in Cyberspace, Lonergan and Lonergan follow a clear and straightforward analytical path: after discussing the main definitions of offensive cyber operations, they discuss and examine their main argument that cyber operations do not escalate. Lonergan and Lonergan then go a step further and argue that cyber operations can de-escalate crises because they are visible but not clearly linked to a government and do not have costly effects that would compel the other side to retaliate painfully and thus escalate the crisis. As a final part of their analysis, they discuss plausible although hypothetical escalation scenarios, which, while they have yet to occur, greatly enrich their argument.

Escalation Dynamics in Cyberspace makes an important contribution to the scholarship in both International Relations and Cybersecurity, as well as the combination of the two areas, which for a while were studied almost separately. In the book, secrecy and plausible deniability are discussed extensively in the context of cyber operations. The authors demonstrate that cyber operations extend beyond technical feats to become instruments of national strategy and policy by revealing the intricate political and strategic layers governing these actions. Furthermore, Lonergan and Lonergan examine cyber capabilities’ dual-use potential. They offer a nuanced analysis of how cyber technologies are used both for military purposes and for intelligence gathering, thus demonstrating the blurred lines between different forms of statecraft. To counter the concept that cyberspace technology favors offensive strategies, Lonergan and Lonergan demonstrate the extensive time, skill, and resources that are required for a successful cyber offensive.

Moreover, the authors offer a number of insights regarding cyber operations as a crisis management tool. By doing so, Escalation Dynamics in Cyberspace contributes to the literature on cyberwarfare and signaling,[11] suggesting that cyber operations can de-escalate crises because of their limited effects. According to Lonergan and Lonergan, cyber engagements can be used to de-escalate conflicts due to their limited physical effects and their perception among adversaries. Since cyber operations are often covert and ambiguous in their origins and intentions, they are often seen as ineffective signals of resolve. They argue that in certain contexts cyber operations can, however, be advantageous due to their unique characteristics. As the discreet and controlled nature of these operations permits nuanced communication and strategic flexibility in tense international scenarios, they can be particularly useful for accommodative signaling and crisis de-escalation. Adding this dimension to our collective understanding of cyber warfare allows it to function not only as an instrument of aggression but also as a potential conflict resolution and signaling mechanism.

Another important contribution of Escalation Dynamics in Cyberspace involves the ongoing debates on intelligence and cyber operations, and the question of whether offensive cyber operations should be seen as intelligence operations.[12] Lonergan and Lonergan acknowledge the importance of cyber operations in intelligence gathering, with intelligence serving as a key element aimed at strategic, secure targets that require specialized access and exploits. There are trade-offs involved in accessing an adversary’s network for both military and intelligence purposes. Intelligence gained by infiltrating an adversary’s network is often more valuable than the results of an offensive operation. In that sense, the excellent timing of the book is worth mentioning, as it contributes to the evolving scholarly “competition” between perceptions of cyber operations as intelligence operations versus cyber operations as an ongoing conflict and a kind of “agreed competition.”[13]

Moving from the book’s scholarship to its empirical research, the robust methodology and an awareness of the limitations of data stand out. According to Lonergan and Lonergan, their theory is derived from the technical foundations of offensive cyber operations, and not from a theory of resources or political will. They are thus able to examine the states in the case studies clearly and independently (78).

It is important to highlight Lonergan and Lonergan’s transparent acknowledgment of the inherent bias in their data. Their approach to data selection is particularly commendable; they consciously chose cases that present a more strenuous test of their theory, rather than opting for those that would easily corroborate their hypotheses. The authors’ dataset, covering a range of cyber incidents from 2005 to 2020, is primarily composed of publicly reported and observable cyber operations. The dataset suffers from an inherent selection bias, as it is predominantly based on cyber operations that have been observed and publicly reported. By focusing on incidents that have gained public attention, the dataset may inadvertently emphasize the more “visible” aspects of cyber operations, potentially overlooking the subtler, less observable tactics.[14] This selection criterion, while necessary, introduces a selection bias that the authors openly recognize.

Interestingly, Lonergan and Lonergan argue that this bias may actually work against their thesis. The observable nature of these cyber operations implies that they are the “noisiest” cases, those with some level of public knowledge. This visibility could potentially heighten the risks of escalation, as publicly known cyber operations might elicit more pronounced responses from states, seeking to defend their public image or retaliate for perceived aggressions. As noted, in their approach to case selection and analysis, Lonergan and Lonergan intentionally challenge their own theory with difficult cases. This, combined with their recognition of data limitations, enhances the discussion on cyber operations and makes a substantial contribution to the field of international politics. Although this limitation exists, the authors attempt to cover the full range of state responses to cyberattacks. It is particularly valuable, since it allows us to see how states respond to various types of cyber aggressions.

Lonergan and Lonergan have also demonstrated a commendable ability to distill complex technical cybersecurity concepts into simpler terms, which significantly enhances the accessibility of the topic of cyber operations for non-specialists. Their effective demystification of technical jargon allows the subject matter to resonate with a broader audience. This approach is not merely a pedagogical triumph but also plays a vital role in expanding the conversation surrounding cyber warfare to encompass a more diverse range of participants. Escalation Dynamics in Cyberspace stands out for its inclusion of technical terminology, which Lonergan and Lonergan skillfully elucidate in an exceptionally clear manner. This clarity is instrumental in making the content of the book understandable and engaging for a wider audience.

Furthermore, Escalation Dynamics in Cyberspace’s relevance to policy cannot be overstated. Lonergan and Lonergan dedicate the last chapter for policy relevance recommendations for the United States. As a part of the “Bridging the Gap” book series, this chapter comes as an important practical contribution. Here, Lonergan and Lonergan focus on the US Cyber Command strategy, emphasize the importance of defining the scope of the “defend forward” strategy, currently lacking clear boundaries (226). The recommendation is to narrow its focus to specific offensive cyber operations, which aims to disrupt and degrade adversaries’ cyber capabilities. This approach would force adversaries to divert resources into less effective areas. Additionally, the authors highlight a critical need for clarity in defining the threshold for the use of force in offensive cyber operations (237-239). They note that while to date no cyberattack against the US has crossed this threshold, adversaries of the US are exploiting this vagueness for smaller-scale cyber campaigns. Lonergan and Lonergan argue for a more explicit delineation of different thresholds for various cyber actions. Such clarity, they suggest, would aid in conveying US intentions, manage escalation risks, and facilitate coherent communication about the US cyber strategy. This, in turn, supports shared objectives and mutual understanding.

In their analysis of escalation dynamics, Lonergan and Lonergan acknowledge that there are disagreements in the literature about how to define offensive cyber operations, especially regarding the distinction between computer network exploitation, which involves gaining access to a targeted network, and computer network attack. They draw a clear distinction between exploitation and offensive cyber operations:

we categorize exploitation itself as distinct from an offensive cyber operation, which we define as a cyber operation that causes some type of effect against a network or system […] we exclude exploitation operations that lack a follow-on attack from our definition of offensive cyber operations, which enables us to explore the implications of the links between espionage and military action in cyberspace (15-16).

For the authors’ purposes, and to allow them to offer such a detailed analysis, it is reasonable to use a definition that does not include exploitation. However, the primary challenge in this approach lies in the operationalization of what constitutes an offensive cyber operation. Depending on the types of exploitation excluded, the analysis might focus on less impactful attacks such as Distributed Denial of Service (DDoS) and website defacement. As a result, it might leave behind other types of cyberattacks—such as hack-and-leak—that may not have a follow-up attack, but may cause chaos and panic in the public, for which government action is needed. The ongoing cyberattacks between Iran and Israel during the years 2020-2022, and specifically the ones targeting civilians, are an example for such dynamics.[15]

Lonergan and Lonergan also delve into the significance of dyadic relationships and historical rivalries in the context of cyber capabilities. They rightly focus “on the technical aspects of cyber operations and the constraints and opportunities they provide to leaders, because these are a necessary foundation to exploring the political aspects of decision-making around their employment” (9). The analysis could have been strengthened by delving into the intentions of the leaders who are behind these cyber operations. Intentions play a crucial role in shaping a state’s cyber strategy and are as influential as technical capabilities. For instance, Lonergan and Lonergan could have drawn a comparative analysis between North Korea and China in their strategic use of cyber operations. North Korea’s approach, which is primarily focused on using cyber capabilities as a source of revenue,[16] contrasts sharply with China’s inclination towards information gathering and intelligence and even harming the US critical infrastructures.[17] This distinction is not merely technical but is deeply rooted in the strategic objectives and political intentions of the leadership in these countries. Although it is beyond the scope of the book, understanding these intentions is vital, as they can provide a lens through which the impact and potential escalations of cyber operations can be assessed.

In conclusion, Escalation Dynamics in Cyberspace is a pivotal contribution to the scholarship on cybersecurity and international relations. Its comprehensive exploration of state behavior in cyberspace–with the focus on the United States–is underpinned by a rigorous methodology and a rich data, providing a well-founded analysis of the potential for escalation in offensive cyber operations. Overall, I find their argument to be persuasive, despite some initial decisions regarding data selection and bias. It not only offers a broad examination of various escalation and de-escalation patterns but also acknowledges the complexities and limitations inherent in such an analysis, adding a layer of depth and realism to its findings. Lonergan and Lonergan’s book successfully bridges the technical and political aspects of cyber escalation, making Escalation Dynamics in Cyberspace a valuable resource for both practitioners and scholars in the field.

For decades, scholars and defense planners have warned of dire escalation risks of cyber conflict. Yet in practice, there has been no escalation. Russia’s full-scale invasion of Ukraine in February 2022 provides the most recent example. Ever-more dramatic warnings of impending cyberwar and escalation preceded it. A Politico piece summed up assessments by senior military leaders and cybersecurity experts in January 2022 as follows: “in a full-scale cyber assault, Russia could take down the power grid, turn the heat off in the middle of winter and shut down Ukraine’s military command centers and cellular communications systems.”[18] Mark Warner, meanwhile, stressed wider escalation risks such as a scenario where “a Russian cyber-attack causes deliberate or inadvertent harm to civilians in Europe, prompting NATO to retaliate.”[19] Former NSA Director Keith Alexander went even further, highlighting that escalating cyberwar in Ukraine “poses a threat to the global system.”[20]

These fears reflect longstanding assumptions about the escalatory nature of cyber conflict among scholars, which are perhaps best summed up by Robert Jervis and Jason Healey’s diagnosis of cyber conflict being “quintuply dangerous” and thus in a league of its own ahead even of nuclear conflict.[21] Yet such escalation has not happened, either in Ukraine or in other scenarios. This mismatch between expectations and observed practice poses a puzzle for a large chunk of cybersecurity scholarship. While it is not the first to tackle this question, Erica and Shawn Lonergan’s new book provides the most authoritative answer yet to this puzzle. It is persuasive, tightly argued, and rich in empirical analysis—in short, it is one of the best books on cyber conflict yet.

Building on their excellent work over the past years, Lonergan and Lonergan make a persuasive case that the inherent limitations of cyber operations have prevented not only intentional, but also inadvertent, escalation. While cyber conflict continues to evolve, they argue, cyber operations have four stable attributes that severely limit their escalatory potential: the importance of secrecy, the challenges involved in planning and conducting them, the modest costs they can impose, and the trade-offs resulting from their importance for espionage. Building on this analysis, Lonergan and Lonergan proceed to challenge assumptions about offensive advantages in cyber conflict as a military endeavor, instead pointing out the underappreciated intelligence value of cyber operations. This analysis shows both deep technical expertise and a firm grasp of IR theory, linking technical characteristics with strategic consequences to build a bulletproof case. In a nutshell, the core argument is that escalation has not occurred because “offensive cyber operations are challenging, unreliable, and limited in their decisiveness, making a decision to escalate a crisis through employing them unlikely to net the desired returns” (78). This conclusion accurately reflects observable reality in cyber conflict, as Lonergan and Lonergan later underline with an impressive array of empirical investigations. It is also congruent with conclusions other more skeptical scholars—including myself—have reached over the past years.[22]

The final point above highlights a significant trade-off when conducting thorough work in a fast-moving field: timeliness. Developing excellent social scientific research takes years, especially when empirics are involved. Meanwhile, both the practice and theory of cyber conflict continue to evolve rapidly, meaning that long-held assumptions may be disrupted. The fear of cyber escalation is one such assumption, which was almost universally held only a few years ago, and is still very much alive, as the quoted material that opens this review attests. Among academics, however, this assumption has increasingly been subsumed by a more nuanced expectation of cyber conflict as a new form of low intensity conflict.[23] Similarly, contrary to the authors’ assertion on page 3, deterrence no longer universally serves as the underpinning framework for United States cyber strategy. That was certainly true in 2018, when the strategy statement that Lonergan and Lonergan cite in support of their claim was issued.

Much has changed since, however, with deterrence now having disappeared entirely from the 2023 National Cybersecurity Strategy.[24] Similarly, the Department of Defense’s 2023 Cyber Strategy highlights that “The Department’s experiences have shown that cyber capabilities held in reserve or employed in isolation render little deterrent effect on their own.”[25] Increasingly, deterrence is being superseded by the alternative strategies of persistent engagement and “defend forward.”[26] In these regards, Lonergan and Lonergan are at risk of overstating their case regarding the established wisdom they challenge both in scholarship and in policy when setting up their argument. These issues are, however, relatively minor. To be clear, the field benefits much more from a thoroughly researched and tightly argued book that trails somewhat behind latest developments than a book that sacrifices maturity for half-baked speculation in order to be at the cutting edge.

Moreover, to their credit, Lonergan and Lonergan do address these more recent developments and the implications later in the book. The concluding chapter with policy recommendations addresses the new strategy of persistent engagement head-on, noting its underlying optimistic assumptions about the non-escalatory nature of cyber operations and criticizing the absence of any consideration of escalation dynamics. There is a clear tension here though: is the main problem with US strategy that it continues to rely on deterrence, as the authors argue at the start of the book, and that it thus overstates escalation risks? Or is it the opposite, namely that US strategy downplays or outright ignores possible escalation risks?

This tension reflects a wider consequence of the book’s focus on escalation: its core argument and theory explain what cyber operations are not, namely offense dominant military capabilities. Given the recalcitrance of cyberwar narratives and associated threat scenarios like Cyber Pearl Harbor or Cyber 9/11, that is both important and useful. Yet in making such a convincing case for what cyber operations are not, the book naturally poses the key question what, then, cyber operations are instead.

Fortunately, Lonergan and Lonergan tackle this question in chapter 4, and their second major contribution to the field emerges from this analysis. Contrary to fears of a cybersecurity dilemma and associated escalation risks, the chapter makes the fascinating case that cyber operations constitute signals of a willingness to avoid escalation. After dispensing with established notions of cyber operations as acting as signals of resolve, akin to conventional military options, the chapter develops a theory of cyber operations as accommodative signals. Because of the inherent limitations in these signals, Lonergan and Lonergan argue, an actor’s very choice in favor of cyber operations over other, more cost-imposing options, can be interpreted as a signal of restraint. Their secrecy and the resulting plausible deniability further facilitate such accommodation, enabling actors to maneuver outside the public sphere and associated escalation pressures. This argument, which partially builds on recent work that understands covert operations as fulfilling a similarly de-escalatory role,[27] is a crucial intervention in a debate mired in military analogies and associated threats. Their conclusion is particularly pertinent for the discourse on cyber norms, a core strain of which is based on the underlying assumption that cyber weapons are so destructive and destabilizing they should be banned, given that they are analogous to chemical or biological weapons.[28]

Because this is a key insight turning much of the established strategic thinking on cyber conflict on its head, it opens multiple questions that are worth further exploration. Most importantly, there is the question of whether cyber operations continue an existing strategic dynamic around de-escalation, whether they change it, or whether they perhaps herald a new one? Given the authors’ emphasis on the secret nature of cyber operations and their effectiveness for espionage, it is surprising they did not dive more deeply into the parallels between cyber operations and intelligence operations, as well as potential differences. To be sure, that question goes beyond the core focus on explaining the absence of escalation. Yet since the authors’ theory of cyber operations as accommodative signals offers a powerful explanation for the absence of escalation, this argument and its implications would have been worth further developing—not least in order to build a foundation for the critique of persistent engagement in the concluding chapter. The theory underlying persistent engagement assumes that cyber operations herald a new strategic dynamic in conflict short of war.[29] Lonergan and Lonergan’s theory indicates the opposite, however, namely a continuation of existing strategic dynamics around accommodative signaling. Making a stronger case for these historical continuities would thus also help strengthen the critique of persistent engagement and the refinements around signaling and bargaining that the authors suggest in the concluding chapter.

On the topic of explanatory power, another strength of this manuscript is the systematic evaluation of alternative explanations, which is still too rare in many publications. The authors consider three alternate explanations for the absence of escalation: deterrence, escalation dominance or hegemony, and subcrisis maneuvering (81-83), and then proceed to show why the latter best aligns with the empirical evidence. The analysis and supporting evidence in the empirical chapters is convincing. Yet, I missed an important potential alternative explanation for the observed outcomes: perception. A growing body of research examines the distinct and significant threat perception associated with cyber operations among the public and policy-makers.[30] Meanwhile, recent wargaming experiments have not only shown that cyber conflict is not as escalatory as expected, but also that participants refrained from using cyber operations because they perceived them as uniquely escalatory.[31]

If that is the case, there is a potential paradox here: what if cyber conflict has been non-escalatory precisely because key actors have perceived it to be escalatory? If this perception changes, say because decision-makers read this book and accept its conclusions, what if they then change their approach and take more risks? Could the expectation that cyber conflict is non-escalatory, which also underlies the persistent engagement strategy that has now been adopted by the US and an increasing number of its allies, paradoxically lead to escalation? The book’s theory suggests that the inherent limitations of cyber operations would preclude escalation in this scenario as well—and I would tend to agree given my own research into these limitations. Yet as Lonergan and Lonergan highlight, one of the key limitations of cyber operations is their unpredictability. Unpredictability produces uncertainty, and the more risks actors take, the more likely it becomes that eventually cyber operations produce (unintended) collateral damage that becomes destabilizing. I was surprised not to see a dedicated analysis of the implications of the uncertainty that results from the unpredictability of cyber effects in the otherwise excellent discussion of plausible escalatory scenarios in chapter seven.

To conclude, this book excels in its core task of explaining the absence of escalation. Perhaps because it does this job so well, the questions about the strategic implications raised above assume such perceived importance, and the relative brevity of the associated analysis leaves the reader wanting. In short, this is an excellent manuscript that will make a lasting contribution to the field thanks to its theoretical clarity, its systematic and rigorous empirical strategy, and its innovative strategic conclusions.

In order to understand the importance of Erica D. Lonergan and Shawn W. Lonergan’s book, Escalation Dynamics in Cyberspace, you have to know what came before. In 2012, Secretary of Defense Leon Panetta warned of a “cyber Pearl Harbor.”[32] The warning reflected a widespread concern about cyber attacks and escalation that defined the first decade of US cyber strategy.[33] These concerns weren’t simply a policy-maker’s predilection. The first books and articles on cyber and international relations, the ones that became foundational to knowledge on this topic, overwhelmingly warned of the escalatory effects of cyber operations to international stability.[34] In 2011, John Arquilla wrote that, “now, cyberattacks have the potential to serve as preemptive weapons that could cripple a massing force preparing to attack.”[35] In 2018, journalist David Sanger warned in his book, The Perfect Weapon, of a potential violent escalation if the United States used offensive cyber operations.[36] Works on cyber, nuclear escalation, and modern warfare warned of the dangers of cyber vulnerabilities to both conventional and nuclear warfare—citing the “emergence of a cyber-nuclear security dilemma that must be factored into future crisis management and strategic stability.”[37] A decade after Arquilla first warned of cyber escalation, his 2021 book Bitskrieg: The New Challenge of Cyberwarfare continued to ring the bell of alarm about the dangers of cyber vulnerabilities to both conventional and nuclear warfare.[38] Meanwhile, US cyber strategy for much of its first decade focused on escalation management and the risks of cyber operations, leaning heavily on the assumption that cyber operations would likely lead to violence and conflict.[39]

These cyber escalation warnings draw heavily from theories of uncertainty and escalation that dominate realist international relations and much of American Cold War nuclear policy.[40] Cyber escalation scholars often look at the characteristics of cyber: it is difficult to differentiate between offense and defense, there is an offensive advantage, operations are covert and difficult to attribute—and conclude that these are all characteristics that can lead to windows of opportunity for early and escalatory strikes. The natural conclusion from this line of reasoning is that cyber operations create the kind of uncertainty that leads to both inadvertent and deliberate escalation.[41] Most of these works leaned heavily on hypothesis generation and theory development, relying on hypotheticals to provide evidence (often from analogies with nuclear weapons, airplanes, or other technologies) for their arguments.[42] In this way, these early cyber works were clear descendants—both in logic and form—of the type of nuclear escalation literature written by Herman Kahn, Bernard Brodie, and other Cold War scholars and practitioners that formed US nuclear canon.[43]

The problem for these foundational cyber works is that, unlike in nuclear politics, there are a lot of cyber operations occurring and while these cyber operations have increased in complexity and volume, escalation to violence has not. Empirical evaluations of cyber operations and escalation—whether large n-datasets,[44] experiments,[45] wargames,[46] or case studies—found no relationship between cyber operations and escalation. In fact, the enduring puzzle that emerged from the empirical work on cyber and escalation was not the ways in which cyber operations created escalation but instead whether cyber operations could in fact work in the opposite direction and actually de-escalate otherwise contentious crises and conflicts.[47]

Despite this empirical literature on cyber escalation, skeptics of the new wave of cyber literature continued to argue that these data explorations were flawed, and were either missing data, containing substantive bias, or too narrowly scoped to comprehend the danger of cyber escalation.[48] Leading into the Russian invasion in Ukraine these critics continued to argue that cyber de-escalation research had not fully anticipated the potentially escalatory effect of cyber operations in a large-scale war or crisis. As warning alarms of a Russian invasion into Ukraine grew increasingly loud, they predicted that Russian cyber operations would play a pivotal role in the onset and conduct of a Russian invasion. As Jason Healey wrote in March of 2022, “With the world worried about the risk of nuclear escalation between Russia and the West, now might also be a good time to worry about the risk of cyber conflict escalating to war as well.”[49]

But this was not what occurred. Russian cyber operations largely fizzled in the early days of the war and subsequent cyber activity by both Ukraine and Russia fell below the violence of missile and artillery barrages, drone attacks, and tank warfare. Cyber may have increased the uncertainty and fog of that war, but there has been no evidence that cyber operations on their own or in concert with other means of conventional warfare changed the onset, duration, or violence of the war in Ukraine. This stunning repudiation of cyber alarmism left academia with a different set of questions than it began with. Whereas the cyber literature began with a puzzle about how to de-escalate necessarily escalatory cyber means, instead the puzzle after Ukraine and, indeed the puzzle suggested by the empirical work before Ukraine, is why cyber operations had so little impact on the violence or propensity of war. Were they too technically difficult? Did the Russians or Ukrainians hold back for fear of reprisals? Were they holding on to good cyber weapons and accesses for later in the conflict? Were the effects of cyber operations too uncertain, too limited when compared to other conventional means of warfare? Were cyber signals poor tools to convince the other side to back down?

Answering these questions is where Lonergan and Lonergan’s volume makes its significant contribution to the understanding of cyber and escalation. In Escalation Dynamics in Cyberspace, Lonergan and Lonergan explain why cyber operations do not escalate conflicts and present a supplementary explanation of how cyber operations could actually de-escalate conflict. Lonergan and Lonergan argue that previous scholars mischaracterized the impact of the technical attributes of cyber operations. While they agree with many previous works that cyber operations are secret and deniable, they disagree that these characteristics create incentives for escalation. Instead, they explain that “attribution requirements place a pause on response times, they inject a break into a potential escalatory cycle. Crises are defined by temporal pressure . . . the extension of time, therefore, creates breathing room for parties to ratchet down potential escalatory tensions” (76).

But while they may agree with others about the inherent secrecy of cyber operations, they disagree about other key assumptions of cyber escalation arguments. In particular, they disagree that there is an offensive advantage in cyberspace. Instead, they explain that in order for states to create and use offensive cyber operations with strategic effects they must overcome significant challenges, including “endeavoring to gain access to these types of networks, maintain that access over time, achieve the intended effect against a specific target set, and at the desired time of employment” (38). Lonergan and Lonergan further push back against previous work, which claimed that cyberspace operations could be accomplished via keystroke and that it therefore increased the speed of conflict and escalation. Instead, they demonstrate that cyber operations take extensive planning and time and yet are vulnerable to adversary network changes and defensive measures—all of which induce caution, restraint, and sustained cyber tit-for-tat campaigns instead of preemptive strike and offensive onslaughts.

Finally, Lonergan and Lonergan argue that cyber operations’ tight relationship with intelligence creates incentives for restraint that were too often overlooked in previous work. They note that extensive intelligence is required for gaining cyber accesses and quite often the use of cyber operations for military operations “burns” those accesses with their associated intelligence value. Further, while offensive cyber operations struggle to create costly effects, they often provide significant intelligence that can be used to target adversaries with conventional weapons, provide situational awareness in crises and military campaigns, and reveal adversary intentions and will. This incentivizes states to use cyber accesses for intelligence instead of attack.

Lonergan and Lonergan do a fantastic job of explaining not only how cyber works and the technical logic behind their argument, but also demonstrating how these technical characteristics and logics play out in real-world cases. Part of why this is so successful is because they start the project by presenting important definitions. In particular, they define escalation as “a meaningful increase in the nature or intensity of a conflict or crisis situation,” including a breach of a perceived threshold, a qualitative change in an effect or a means, or a quantitative expansion of conflict (10). By looking at US-China or US-North Korea cyber exchanges they are able to explain why it can be true that cyber exploitation (spying), cyber intellectual property theft, and cybercrime are all increasing and yet that this increase in cyber activity does not translate to the escalation they define at the beginning of the book.

Lonergan and Lonergan’s work is explicitly structural, logically sitting next to other realist explanations for technology and conflict. However, there also compelling bureaucratic reasons to explain why cyber operations may not escalate. For example, in states like the US with powerful intelligence organizations, the utility of cyber operations for intelligence may lead these powerful intelligence organizations to exert influence to limit the offensive use of cyber accesses. Further, Lonergan and Lonergan’s explanation for cyber (de)escalation may underemphasize the role of American presidential administrations’ risk proclivities; the Obama administration, for example, was famously risk averse[50] and created extensive bureaucratic processes to decrease the risk of escalation from US cyber operations.

Healey’s March 2022 essay concluded, “With luck, escalation will not happen, and I will be written off as a ‘cyber catastrophist.’ ‘Cyber doesn’t work like that,’ we will tell ourselves.”[51] What Lonergan and Lonergan have done in this book is explain how cyber works, giving cyber catastrophists a clear and compelling explanation of the mechanisms behind how cyber operations affect escalation. This is a significant maturation of our understanding of when and why cyber operations impact international stability. This volume, therefore, represents the first of a new era in work on cyber and international security, and will be the new foundation of future explorations about cyber and other emerging technologies and international stability.

Response by Erica D. Lonergan, Columbia University and Shawn W. Lonergan, 75th Innovation Command[52]

---