Variation in the Cyber Commitment Problem: A Lab Experiment

• In Event: Empirical Approaches to Cyber Conflict

Abstract

Evaluating the coercive potential of cyber weapons is important for understanding how emerging technologies shape state behavior and the balance of power among states. One existing theory argues that cyber coercion is difficult due to the “cyber commitment problem.” The theory argues that because a cyber operation often relies on deception and surprise to successfully compromise a target, it is difficult to simultaneously demonstrate capability and communicate a coercive threat ex ante. However, the severity of this tradeoff is not constant within cyberspace. Depending on the ability of the defender to detect and mitigate the vulnerability and the type of system targeted, the attacker’s open communication of a threat and capability may not undermine the possibility that the attack will succeed. In fact, threatening an invasion via other domains have faced similar dilemmas. This paper presents a lab experiment that shows that the severity of the “cyber commitment problem” varies from conflict to conflict. When the defender is less able to mitigate the vulnerability in time despite knowing it had been compromised, and less certain that all other vulnerabilities have been mitigated, the attacker’s tradeoff is not as severe. The experiment shows that coercion in cyberspace depends on such situational variables, rather than the uniqueness of the cyber domain as a whole. This paper provides a refinement on the theory of cyber coercion by explaining the conditions under which some coercive cyber operations are more likely to succeed than others.

Author

• Jenny Jun, Columbia University