Persistent Engagement, Agreed Competition and Deterrence in Cyberspace

Michael P. Fischerkeller and Richard J. Harknett have recently produced excellent writing on persistent engagement, a central element of U.S. Cyber Command’s (USCYBERCOM’s)—and the nation’s—strategy for cyberspace. Fischerkeller and Harknett’s Lawfare post on persistent engagement provides an in-depth explanation of USCYBERCOM’s vision of seizing and maintaining the initiative in cyberspace by continuously engaging and contesting adversaries and causing them uncertainty wherever they maneuver. We believe that they and USCYBERCOM hit the mark conceptually—and if recent press reports that the U.S. disrupted the Russian Internet Research Agency’s (IRA’s) ability to intervene in the 2018 U.S. elections are accurate, it appears that USCYBERCOM has applied this strategy.

However, we believe Fischerkeller and Harknett missed the mark in their recent Lawfare post adapting Herman Kahn’s concept of an “agreed battle” to a cyberspace-only “agreed competition.” Here, we aim to outline the pitfalls of this approach, including that the U.S. should (and indeed did) describe actions such as Chinese cyber theft of intellectual property and Russian cyber-enabled meddling in U.S. elections as neither “agreed” nor “competition” but, rather, as unacceptable hostile acts for which the U.S. needs (and can achieve) a stronger deterrence posture. Our critique differs from the recent Lawfare commentary by Max Smeets, as does our recommendation regarding the term, which Smeets accepts while suggesting that “the space for agreed competition is very small.” Rather, we propose repurposing the term “agreed competitions” as activities by the U.S. and its competitors qua adversaries that actually fit the term: elements of competitions in the economic, diplomatic, informational and military spheres where cyber plays a role but is not the only tool of statecraft. It is at least tacitly agreed that neither side will treat a wide range of actions (inside and outside of cyberspace) as hostile acts. And we argue that operations in cyberspace should be part of an integrated national campaign to address these cross-cutting issues and bolster the U.S. competitive posture. After all, on the internet, nobody knows if you’re an economist, a diplomat, a spy or a soldier.

Persisting With Persistent Engagement

A much more active day-to-day U.S. posture in cyberspace is the essence of persistent engagement. This makes good sense and is overdue. We strongly endorse Fischerkeller and Harknett’s point that denial of the adversary’s objective should be a key operational element of persistent engagement: The U.S. should aim to inhibit an adversary’s attempts to widen, compound or intensify its cyber operations against the U.S. and allies, through a combination of “resiliency, the notion of ‘defend forward,’ and contesting cyber operations.”

The recently reported USCYBERCOM disruption of the Russian IRA is a prime example of defending forward and contesting cyber operations. By public reports, it appears that USCYBERCOM’s forward defense reduced the IRA’s and Russia’s ability to cause mischief in the 2018 U.S. elections. It is possible that this purported action will strengthen deterrence of future cyberattacks, and it is conversely possible that Russia will “up its game” and make deterrence even more challenging in the future. But the first-order issue is that risks to the U.S. in the 2018 election cycle appear to have been reduced, with no apparent blowback or other immediate downsides. As Jason Healey wrote recently about this takedown: “The debate on cyber conflict has gotten so locked into deterrence, escalation, coercion, and signaling we pundits often forget that conflict is sometimes straight forward and you just have to stop adversaries from punching you.”

The United States is on the right track with persistent engagement in cyberspace. There are risks, and there will be mistakes. There will be cases where, in retrospect, USCYBERCOM may have been overly aggressive. There will also no doubt be cases where, in retrospect, USCYBERCOM may have done too little and/or acted too late. Important to the success of this approach will be a continuous net assessment process, with active red teaming to anticipate and—where possible—block or deter adversary responses. It is not possible to get everything exactly right at the outset, and the U.S. must learn and adapt over time.

Persistent engagement has the major upside of encouraging adaptive learning by U.S. adversaries in cyberspace. As the USCYBERCOM vision statement notes, “Through persistent action and competing more effectively below the level of armed conflict, we can influence the calculations of our adversaries, deter aggression, and clarify the distinction between acceptable and unacceptable behavior in cyberspace.” U.S. adversaries will also make mistakes—overreacting to U.S. actions, underestimating U.S. resolve or simply being slow to learn from experience. However, this learning process can help mitigate the larger risk in cyber conflict of escalation to armed conflict via a fundamental lack of understanding among adversaries about what targets and attacks are acceptable in cyberspace. Miscalculation—for example, underestimating how highly an adversary values a target that is attacked via cyberspace—will remain a risk and could lead to unintended escalation. However, the process of adaptive learning, explicit communication of limited intent, and effective signaling through military actions and inaction in other domains (e.g., avoiding contemporaneous large-scale military exercises near the adversary’s border, or increased nuclear alert levels) should ultimately reduce the risk for dangerous escalation.

Fischerkeller and Harknett’s explanation of persistent engagement not only accounts for learning by the U.S. and others, but it also explicitly aims to promote such learning through tacit bargaining, supplemented where advantageous with explicit communications. As the authors note, this approach has value for the U.S. as well as for other nations that support a free, open, secure and stable internet: “An intentional adoption of a tacit bargaining approach to guide the type and timing of U.S. cyber operations should be pursued to enhance the prospect of a more stable and secure cyberspace.”

Disagreement on a Cyberspace-Only “Agreed Competition”

In their more recent Lawfare piece, which proposes that there is an agreed competition in cyberspace, Fischerkeller and Harknett aim to “repurpose and operationalize” Herman Kahn’s concept of an agreed battle into an agreed competition conducted wholly within cyberspace. The gist of Kahn’s agreed battle is that, at any given level of escalation, both adversaries may have strategic rationales not to escalate further. As each side demurs from further escalation and sees the other side do the same, there may be an implicit agreement to avoid further escalation; if so, an agreed battle has been (at least for a time) established. Fair enough. Fischerkeller and Harknett’s repurposing to a cyberspace-only arena of agreed competition suggests that each side can undertake “continuous action for seeking strategic advantage short of armed conflict,” without much if any risk of escalation given that “cyber actors appear to have tacitly agreed on lower and upper bounds of the cyber strategic competitive space short of armed conflict.” This concept of an agreed competition within cyberspace, however, has four fundamental flaws.

First, by focusing exclusively on cyberspace, this concept provides only a very limited description of the actual dynamics of competition and conflict in cyberspace, and the extent to which they are functions of a geopolitical context. Real-world instances of cyberattacks or cyber-enabled attacks on the United States are best understood in the broader context of international relations: Most activities in a cyber competition, as with most other kinds of strategic competition, are driven by broader geopolitical imperatives within contests and politics among nations. China’s ongoing cyber-enabled theft of intellectual property, for example, is part of a broader Chinese campaign to bolster economic growth through legitimate and illegitimate tools ranging from front companies, research partnerships, coercive trade practices and human agents, most times necessarily at the expense of their nation-state competitors. Russia’s continued cyber-enabled social media campaign is part of a broader disinformation campaign, involving Russian state-owned media and Russian diplomacy, to sow division within and between the United States and its NATO allies. Iran’s 2012-2013 attacks on Saudi Aramco, Qatar’s RasGas, the International Atomic Energy Agency and various Western banks were part of broader foreign policy responses to a range of geopolitical issues, from Stuxnet’s attack on their nuclear program, to sanctions levied against their oil trade, to Saudi decisions to increase oil production in order to offset the impact of Iranian sanctions on oil price volatility. North Korea’s 2014 cyber attack on Sony Entertainment was a response to a U.S.-made film portraying an assassination attempt on North Korean leader Kim Jong Un and was accompanied by threats of physical violence against theater operators and patrons. And so on.

In principle, the term “agreed competition” could be used to describe jockeying for tactical advantage in the daily noise of cyber espionage and engagement, including activities such as reconnaissance and gaining access to targets for potential later attack. However, although this activity might be considered “agreed,” it does not constitute much of the overall competition. (On this point, we agree with Smeets’s recent critique that, when reviewing major cyber intrusions and attacks against the U.S. and allies, “it is hard to see what exactly would be deemed as acceptable behavior.”) In order to consider the competition that matters most—which involves the pursuit of strategic gains and dynamic interactions carrying vertical and horizontal escalation risks—one must consider the broader context. In the end, if “agreed competition” in cyberspace meant only those areas where both (or all) sides agree (or may soon agree) that there is no possibility of horizontal or vertical escalation, it would be a very limited space that does not provide any insight into actual competitive and conflict dynamics. It is perhaps of note that the 44-rung escalation ladder in Herman Kahn’s seminal 1965 On Escalation work includes “political, economic, and diplomatic gestures” (rung 2), “legal harassment” (rung 7) and “provocative breaking off of diplomatic relations” (rung 10).

Second, and related, Fischerkeller and Harknett’s conception of cyberspace-only agreed competition would serve as a poor guide for policymakers. Treating cyberspace apart from other dimensions of international competition and conflict (economic, diplomatic, informational, legal and military) would inappropriately focus U.S. policymakers on cyber-only responses to cyber-related actions by adversaries, resulting in artificially constrained and inadequate actions. Plausible responses to cyberattacks include diplomatic demarches, economic sanctions, information campaigns, criminal indictments and civil suits, and where necessary military actions outside of cyberspace (which could range from signaling via movement of forces or conduct of exercises, to subtle actions by special forces, and in extreme cases to selective military strikes). Moreover, U.S. policymakers should not be surprised if and when adversaries respond to U.S. offensive cyber actions outside of cyberspace.

In attempting to distinguish cyberspace from other domains (air, sea, land and space), Fischerkeller and Harknett emphasize the interconnectedness of cyberspace; to wit: “due to interconnectedness, the core structural feature of cyberspace, strategic targets are accessible in, through and from cyberspace via cyber operations or campaigns short of armed conflict.” This point is debatable—both in terms of whether it is technically correct and in terms of whether it is truly a distinguishing feature of the domain. For example, there are areas of cyberspace that already see significant segmentation (e.g., classified networks, operational technology vs. information technology, the Great Firewall of China, evolving efforts to Balkanize national segments of the internet or even normative segmentation such as electoral systems). And if anything, the air, sea and space domains are more clearly continuous than is cyberspace. But the more important point is that one should not falsely ascribe to cyberspace a materially novel characteristic that is neither material nor novel, a common pitfall in some strategists’ descriptions of cyberspace as a domain. Cyberspace is as interconnected as other competitive domains, integral to global diplomacy, economics and information flows. If actions within cyberspace stayed within cyberspace—and so did not have economic/financial, political, perceptual, legal or military operational impacts—they would largely be irrelevant.

Third, the concept of a cyber-only agreed competition will confuse U.S. allies and adversaries alike, to the detriment of U.S. national security. Fischerkeller and Harknett acknowledge explicitly that the U.S. has by no means agreed that cyber-enabled theft of intellectual property, or cyber-enabled manipulation of social media to undermine democracies, or other cyberattacks, are acceptable. It is far from helpful to describe something as “agreed” behavior when a more accurate term would be “egregious.” Nor is it helpful, as Fischerkeller and Harknett do, to describe such actions as competition, which implicitly validates them as being part of an acceptable game. Such cyber-enabled attacks are hostile acts, and the U.S. will be better able to win the argument that they are unacceptable by avoiding a moral equivalence of all cyber actions and, instead, making absolutely clear that hostile acts are neither “agreed” nor (implicitly acceptable) “competition.” The U.S. Justice Department has played an important supporting role by issuing indictments of Chinese, Russian and Iranian state-affiliated parties, irrespective of any realistic chances of extradition from those countries—such indictments are another tool to draw normative lines in the sand and build coalitions in cyberspace. If the concept of a cyberspace-only agreed competition were adopted in the U.S. lexicon, it would undermine the ability of the U.S. to lead coalitions in cyberspace and to deter untoward actions by adversaries in cyberspace. To that point, Fischerkeller and Harknett acknowledge that their agreed competition is not actually agreed. They confront the dilemma by “proposing that we are in the early stages of an agreed competition: The structural boundaries are already tacitly understood, but mutual understandings of acceptable and unacceptable behaviors are still being developed through competitive interaction.”

However, we believe this is a flawed assumption, and this points to a fourth flaw that we believe lies in their arguments. One might agree with our critique of agreed competition so far but argue that we are being short-sighted because a steady and safe state of “agreed competition” might be achieved over time. It is indeed possible that nations will move beyond today’s apparent understanding that hacking to gain intelligence and to prepare for possible future attack does not warrant an escalatory response within or outside of cyberspace. For example, an agreement between the U.S. and Russia not to interfere in the other side’s domestic politics, or an(other) agreement between the U.S. and China not to steal intellectual property, is possible in principle.

But these examples highlight two key points. First, such agreements (or an agreement not to attack critical infrastructure, as some have proposed) will need to extend beyond cyberspace in order to be effective; such agreements are no good if Russian operatives or paid insiders sabotage U.S. elections through physical means, or if China steals intellectual property by coercing companies. Second (and the reader should now brace for a statement of the obvious), Russia, China and other states may cheat; thus, even when they agree on paper, they may not agree in practice. Consider how Chinese cyber-enabled theft of intellectual property continues apace years after President Xi Jinping agreed to stop. Taking an example from other domains, Russian ships and aircraft have undertaken unsafe maneuvers at sea and in the air, despite Russia’s continued participation in the bilateral 1972 Incidents at Sea agreement, which explicitly prohibits such actions.

The U.S. needs to bolster deterrence of such actions, not accept them as inevitable, and all tools of national power must be on the table to do so. Fischerkeller and Harknett claim that “deterrence does not align either empirically or logically with the structural features of the cyber strategic competitive space short of armed conflict.” But effectively removing noncyber tools from the U.S. declaratory and response toolkit for hostile acts in cyberspace, and potentially by reducing the role of cyber tools to deter and respond to hostile acts outside of cyberspace, adoption of “agreed competition” as the framework for U.S. cyber policy would make this claim a self-fulfilling prophecy.

Fischerkeller and Harknett reject the role of deterrence in cyber competition short of armed conflict, suggesting instead that a coercive approach toward deterrence, using threats of retaliation and escalation, does not align well with competition in cyberspace short of armed conflict. However, the reality is that strong cyber responses (which carry risk of vertical escalation) and noncyber responses (which constitute horizontal escalation) will affect the other side’s perception of costs and risks. The result may be a dampening of tensions or a spiral of escalation, and it would be wildly imprudent of policymakers not to consider these possibilities in formulating declaratory policy, developing cyber and noncyber capabilities, working with allies and partners, and actually responding to hostile acts below the level of armed aggression. The game is on, and it would be a-strategic, and indeed reckless, to pretend otherwise.

Moreover, deterrence strategy should seek to influence a competitor’s decision-making by denying it the gains of its actions, irrespective of any retaliation or escalation (and USCYBERCOM’s vision statement notes the importance of increased cyber resilience in bolstering the U.S. deterrence posture). Deterrence strategy thus calibrated can be effective, not just in preventing escalation but also in influencing adversaries’ decisions on targeting and operational choices. It is important to formulate this fact in both strategy and actions to shape adversarial decision-making.

This isn’t to say deterrence will put an end to cyberattacks, whether in peacetime, “gray zone” competition or the run-up to armed conflict. Rather, deterrence can shape the other side’s conduct during a period of persistent engagement by imposing costs (and threatening to impose more costs if unacceptable actions are taken) at key strategic points in the contest. As Fischerkeller and Harknett argue, denial of the adversary’s objective is a key element of persistent engagement, empowered by resilience among other elements. Indeed, recent developments in the private sector are positive, with new emphases on resilience as an element at least as important as prevention and compliance. Incorporated into persistent engagement, resilience also increases the probability that an attacker’s aims in a cyberattack will be frustrated. For example, financial regulators in the U.S. and U.K. have recently began emphasizing resilience as critical in minimizing effects of cyberattacks on stability in industry and in cyberspace, in recognition that 100 percent prevention is neither a possible nor a cost-effective objective.

Repurposing Agreed Competition

Fischerkeller and Harknett seek to “repurpose” Herman Kahn’s “agreed battle” to define what they perceive as an existing safe space for actions short of armed conflict in cyberspace. Their repurposing to agreed competition implies that because “cyber actors appear to have tacitly agreed on lower and upper bounds of the cyber strategic competitive space short of armed conflict,” a U.S. strategy of persistent engagement would not pose significant risks of escalation, irrespective of the details of U.S. actions—as long as they remain within cyberspace.

However, restraining escalation within cyberspace is untenable. U.S. responses to hostile acts in cyberspace often escalate “horizontally” in going beyond that realm, including diplomatic measures, indictments of government officers and economic sanctions. There has also been “vertical” escalation in and through cyberspace. Indeed, China’s ongoing cyber theft of intellectual property, North Korea’s 2014 Sony Entertainment hack and Russia’s ongoing cyber-enabled social media campaign are all escalations in cyberspace.

We suggest a different “repurposing” of “agreed battle,” which recognizes that there are multiple simultaneous agreed competitions, each of which involves cyberspace but also involves many other domains and/or instruments of national power. The U.S. and China are engaged in an agreed economic competition, with the agreed aspects memorialized in international law under the heading of free and fair trade. What is not agreed in this economic competition is cheating, whether by cyber theft of intellectual property or other means, which can fairly be described as a hostile act.

Similarly, the U.S. needs to recognize that it is in an agreed geopolitical competition with China and Russia, in which each vies for power and influence. Russia and China each have worked to weaken long-standing U.S. alliances in Europe and the Asia-Pacific and to achieve influence over their neighbors. What is not agreed is coercion and manipulation of other states, whether through cyber-enabled social media campaigns, use of energy as a coercive tool or other means; such measures can be considered hostile acts.

There is an extensive body of international law on this topic, not specific to cyberspace. In lay terms, we can think of a class of actions that go beyond competition (agreed or not) and that show hostile intent and intervention in a nation’s sovereignty or political, territorial or economic integrity, but that fall short of armed aggression proscribed by international law. In our view, most cyberattacks fall into this category of “hostile act.” This includes Iran’s 2012-2013 DDoS (distributed denial of service) attacks on Wall Street and its destructive cyberattacks on Saudi Aramco and Qatar’s RasGas. It also includes North Korea’s 2014 Sony Entertainment hack and China’s long-standing cyber-enabled theft of intellectual property, along with Russia’s cyber-enabled disinformation campaign. Well beyond U.S. efforts to establish norms, these hostile acts are also addressed, and normatively proscribed, by the experts who contributed to the Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. To be sure, there is significantly less clarity and consensus on the legality of these hostile acts under international law vis-a-vis consensus on cyber acts that rise to the level of armed aggression (which is itself still subject to debate).

In a more recent Lawfare post, Fischerkeller and Harknett argue that “sustained advantage in persistent engagement should induce restraint on the part of the state with such advantage,” because otherwise the disadvantaged state may escalate within or outside of cyberspace. First, it is notable that this statement implies, contrary to the core of their argument, that deterrence is operative and indeed centrally important within their proposed space of agreed competition, after all. Second, and more fundamentally, the impact of any advantage also depends on many factors largely outside cyberspace, including the nature of the activity, the relative power of the states and the relative stakes involved. For example, it would be folly (and unprecedented) for the U.S. to unilaterally limit its cyber espionage against a potential adversary because it was less capable of cyber espionage against the U.S. Regarding relative power, the U.S. may lean into coercive actions inside and outside of cyberspace more aggressively against a lesser power than against a near-peer, because the lesser power is likely to have fewer escalatory options and the U.S. is likely to have escalation dominance. At the same time, a smaller state facing existential stakes may escalate even against a much stronger power. This is, after all, the primary use case of lesser powers for nuclear weapons—for use against existential threats. These points serve as a reminder that effective statecraft in cyberspace requires considering factors outside of cyberspace.

In dealing with hostile acts in and through cyberspace, the U.S. must see the bigger picture. including all domains and all tools of national power. The United States, working with allies and partners, needs a coherent campaign that cuts across domains and governmental authorities, preferably one that can garner international support and be sustained over time. U.S. competitors and adversaries don’t see cyberspace as an area carved off from all others—nor should the United States.

Conclusion

The strategy of persistent engagement as developed by Fischerkeller and Harknett, and articulated in USCYBERCOM’s vision statement, is a call to a much more active U.S. posture in cyberspace. Such change is overdue, and well-timed, focused steps such as the reported takedown of the Russian IRA troll farm should be applauded. However, the risk of escalation within and beyond cyberspace cannot be waved away by assuming that a cyberspace-only agreed competition exists or will soon exist, in which the U.S. and competitor-qua-adversary states stretch to the boundaries but no further. (Or as Fischerkeller and Harknett state, that “cyber actors appear to have tacitly agreed on lower and upper bounds of the cyber strategic competitive space short of armed conflict.”) It is in the nature of international politics for states to test, and sometimes cross, boundaries—whether physical, virtual or normative.

“Agreed competition” can be a helpful term—if it is itself repurposed to fit the natural meaning of both words. It involves international competition in the economic, diplomatic, informational and military spheres that is explicitly or tacitly agreed between the relevant parties. This agreed competition includes actions in cyberspace and in other domains, as well as across all levers of national power.

It is fundamentally important not to suggest inadvertently to adversaries or allies that hostile acts such as Iran’s 2012-2013 DDoS attacks on Wall Street, North Korea’s 2014 Sony Entertainment hack, China’s ongoing cyber-enabled theft of intellectual property, and Russia’s cyber-enabled disinformation campaigns are part of an agreed competition. To do so would undermine any prospect of establishing effective deterrence of such unacceptable actions.

Deterring such hostile acts will require the United States to plan and implement sustained campaigns involving all tools of national power, in order to both decrease the benefits and increase the costs of hostile acts in cyberspace against the United States and our allies and partners. In this regard, there is a vital role for deterrence strategy in persistent engagement— one that relies on denial of objectives as well as cost imposition to shape adversarial intentions and actions—and we side strongly with the USCYBERCOM vision assessment that “[t]hrough persistent action and competing more effectively below the level of armed conflict, we can influence the calculations of our adversaries, deter aggression, and clarify the distinction between acceptable and unacceptable behavior in cyberspace.”

To be sure, there is still work to be done in developing and implementing a manageable strategy of persistent engagement. There are significant challenges in developing viable measures of performance and measures of effectiveness. The adage “if you can’t measure it, you can’t manage it” applies here and makes assessing the impact of actions (and inactions) challenging. USCYBERCOM should continue to develop mechanisms to support adversary anticipation and assessment, including improving understanding of which relative advantages are likely to be enduring, rather than episodic or transactional. Familiar concepts such as red teaming (adversary emulation) and operational net assessment are relevant here, and they offer great potential as strategists tailor them to persistent engagement in cyberspace. This will affect competition and potential conflict involving all domains and all elements of national power.