Options for Signalling Cyber Deterrence Using Cyber Capabilities

Abstract

The possibility of demonstrating power in cyberspace to create deterrence is a controversial topic. The desire of states to hide their true cyber capabilities leads to a reluctance to reveal their existing cyber power. However, the core idea of deterrence involves demonstrating power and signalling the will to use it so that the potential aggressor would find it less tempting to carry out aggression. Several studies attempt to solve the challenges related to cyber deterrence with a holistic approach, where deterrence in cyberspace is produced as part of a comprehensive deterrence using all instruments of state power, such as diplomatic, information, military, economic and legal capabilities. In turn, some studies argue that for credibility, cyber deterrence must include measures implemented specifically in cyberspace because cyberattacks can only be responded to in real-time with cyber capabilities. This paper argues that demonstrating cyber power is both necessary and profitable for the credibility of deterrence, although the nature of cyberspace and related technologies pose some limitations. This study examines the possibilities of demonstrating cyber power in concrete ways and aims to add a new perspective to academic debate. Cyber deterrence is investigated from the perspective of classical deterrence theory, including deterrence by denial and deterrence by punishment. By examining cyber deterrence literature using content analysis, deterrents that can be produced with cyber capabilities are defined, and examples of means to produce these effects are presented. According to the central observation of the study, a state can choose whether to demonstrate cyber power by revealing the victories achieved in real-life cyber battles, by demonstrating force in another state's cyberterritory or by disclosing selected capabilities in separate simulations without a real-life connection.