Drawing inferences from cyber espionage
Martin C. Libicki · 2018
To survive a confrontation, it helps to understand other side's capabilities and intensions. Estimates of opposing capabilities rest on an empirical basis but understanding the other side's intentions is inferred from words and deeds. Therein lies a dilemma common across all military domains: acts to alter the balance of a confrontation can also shape the inferences that the other side draws about one's intentions. The dilemma also operates in cyberspace, but in unique ways. First, efforts by one side to acquire information on the other can be read by the other side as preparations for a cyber attack prefatory to a military attack. Second, others may draw inferences from the fact of cyber espionage alone, even though the basis for believing in a cyber security dilemma is weak. Third, there are ways of carrying out cyber espionage that can mitigate inferences that others draw about the imminence of cyber attack by, for example, limiting which components within a network are targeted for eavesdropping or by using penetration methods that do not leave arbitrary code behind. Fourth, defenders themselves can also modulate their reactions in ways that limit drawing unnecessary inferences. Fifth, expectations of how well modulating cyber espionage can convey peaceful intentions should be very modest. All these are complicated by difficulties in the target's ascertaining a penetration's date, characterization, and authorship. We conclude with a call for those who would penetrate military-related systems to think about the inferences that the other side may draw if such penetrations are discovered.