What Is an Act of Cyberwar? It's a Decision, Not a Conclusion



Globe and computer keyboard

by Martin C. Libicki

March 4, 2013

The oft-asked question—What is an act of war in cyberspace?—presupposes that war is something that can be defined and distinguished (for example, is this a tree?). In physical combat, such a question makes sense: if your neighbor's tanks are in your backyard heading for the capital, then war has probably already started. But such a question is usually the wrong one to ask about cyberwar (war carried out by attacking information systems). Cyberwar can disrupt life even on a mass scale. Cyberwarfare can enhance conventional military power. But it cannot be used to occupy another nation's capital. It cannot force regime change. No one has yet died from it. And, Stuxnet notwithstanding, breaking things with ones and zeroes requires very particular circumstances. Cyberwar does not demand an immediate response to safeguard national security.

Instead, a country that has suffered in cyberspace has the scope to ask: What would be its most cost-effective way to minimize such future suffering? If war fits the bill (and other nations understand as much) it could declare that the relevant cyber-attack was, itself, an act of war and go forth and fight. Perhaps making war can persuade the attacker to stop. Yet, war also risks further disruption, great cost, as well as possible destruction and death—especially if matters escalate beyond cyberspace.

Or a country may look at policies that reduce the pain without so much risk—such as by fixing or forgoing software whose vulnerabilities permit cyber-attacks in the first place (one whose reach for features exceeds its grasp of security). And that's just one of many prophylactic options.

The point is that calling something an act of war is not a conclusion; it is a decision.

This op-ed was part of a NYT Room for Debate discussion: "What Is an Act of Cyberwar?"

Martin Libicki is a senior management scientist at RAND Corporation and a professor at the United States Naval Academy.

This commentary originally appeared on NYTimes.com on February 28, 2013. Commentary gives RAND researchers a platform to convey insights based on their professional expertise and often on their peer-reviewed research and analysis.