Is a cyber ceasefire between the U.S. and Russia possible, or will recent events and allegations of cyber hacking lead to greater conflict? Visiting Media Fellow Michael Moran speaks with Austin Long, associate professor and technology expert at Columbia University’s School of International and Public Affairs, and Amy Zegart, a fellow at Stanford University’s Hoover Institution.
LONG: Cyber security opens up a lot of new challenges that are in familiar territory, but in new ways. The first is in terms of intelligence collection. This is a standard thing states do and have done for centuries. Typically, those domains have been human intelligence, signals intelligence (which is the interception of enemy communications), overhead imagery intelligence, etc. Well, cyber gives you new capabilities that are far greater than standard signals intelligence. You’re not just intercepting signals, but using cyber techniques, you can get inside of adversaries’ databases, and learn enormous amounts about what the adversary is doing. So it’s not that this is entirely novel but it’s a greatly expanded way to do standard intelligence collection. I think that’s important but it’s probably the least important of the impacts on diplomatic and security issues. The second is it creates new opportunities for covert action. That is action that is below the threshold of military operations that are intended to achieve a military or political effect. Cyber offers a great many new opportunities there. I think the most dramatic we’ve seen is the allegation that hackers affiliated with the Russian government have compromised the U.S. political process to at least some degree by breaking in to the Democratic National Committee’s servers, stealing e-mails, and leaking them to the public in ways that may have been damaging to the cause. Again, this is not a new thing. States have often taken action to covertly influence political outcomes in other countries, but cyber has opened up a great many new opportunities to do that and I think that’s potentially much more troubling than the intelligence collection aspect. The final piece is that it opens up new means to conduct actual military operations. Traditionally, if you wanted to affect an enemy’s air defense system which uses radars, you would have to jam the radars by sending out an electro-magnetic signal to interfere with their ability to perceive their own signal. With cyber, you can do something similar, but in a much more sophisticated way. Rather than just trying to overpower the enemy’s radar, you can potentially get inside the computers operating the radar, and make the adversary see what you want them to see. It won’t matter how powerful their radar is, because you will be controlling the interface between the radar itself and the screen that it’s being reported on. I think this is potentially an even more important issue than either covert action or intelligence collection, because it’s a whole new world of the ability to create military effects without having to use what the military calls ‘kinetic action’. In other words, you won’t have to blow up a radar, or jam a radar, you can actually just turn it off electronically.
MORAN: Hello, and welcome to Diffusion: Russia in Focus; our deep look at the state of U.S.-Russia relations. I’m Michael Moran, Visiting Media Fellow at the Carnegie Corporation of New York, and today in episode six we’ll examine how hacks and other manifestations of digital warfare complicate ties between the U.S. and Russia. Joining me is Austin Long, associate professor and technology expert at Columbia University’s School of International and Public Affairs. And Professor Amy Zegart, senior fellow at Stanford University’s Freeman Spogli Institute for International Studies. Hello to you both.
So, Austin, I think it’s fair to say everyone is grappling with what cyber security means in the 21st century? From politics to business, from military to statecraft. So let’s deal with the latter two categories. How do you conceive of the threat and the effects it is having in the security and diplomatic realm?
MORAN: So (Amy Zegart), we’ve heard a great deal about this kind of hacking in the campaign– the Obama administration confirmed some of it, intelligence agencies confirmed some of it was emanating from Russia and had the fingerprints of a sovereign actor – but, opening up the lens a bit, how does cyber security impact strategic stability, and more broadly the U.S.-Russia relationship in terms of the major power dynamic?
ZEGART: Well, the strategic stability question is a moving target – it’s something we’re learning more about every day; and just in the past year we hosted at Stanford the first ever unclassified workshop on offensive cyber operations in partnership with U.S. cyber command, in part because we were so concerned about the lack of knowledge that the policy community and academics have with respect to escalation dynamics and the security / strategic stability with the great powers. My thinking at this point is that cyber is affecting strategic stability in at least three key ways:
- The first is that cyber threats are increasing risks of what you call the cyber security dilemma: the traditional security dilemma is where one sides defensive actions are misinterpreted by an adversary as being escalatory, so the other side actually takes defensive actions, which then prompts the first side to take more defensive actions, and then you get into a spiral, and that’s very destabilizing. That’s particularly true in cyber because it’s almost impossible to tell the difference between a cyber-attack that is purely defensive in nature, something that’s espionage, something that’s preparing the battlefield, or something that’s an attack that’s a prelude to an offensive attack. These different motivations are the distinguishing characteristic of the same cyber activities. So increasing risk of the security dilemma would be number one.
- Number two is that cyber-attacks create an unclear threshold for war. We’ve seen the Pentagon really struggle with creating a more clear threshold for war, and it’s a very challenging problem. You will remember the Sony hack of a couple of years ago, was called cyber-vandalism by the President, and called an ‘act of war’ by Senator John McCain. So there’s a lot of effort to grapple with where exactly is the threshold that constitutes an act of war, or an act of national significance. When you have unclear red lines in any area, that’s inherently destabilizing, and the red lines when it comes to cyber-attacks are very, very blurry.
- The third destabilizing element of cyber is that cyber poses real risk of undermining nuclear deterrent. There is a lot of concern about what the Pentagon likes to call ‘cross-domain deterrence issues’ so if you think about just two examples, nuclear stability hinges on the mutual recognition of all sides that each can inflict unacceptable damage on the other. But, what if we’re in a world where one side knows that it’s disabled the other side’s command and control through cyber-attacks. So one side knows it has an advantage, but it can’t reveal it to the adversary, because if it does then the advantage will be lost. That is inherently destabilizing for nuclear deterrence. A second example is there are some states that have nuclear command and control facilities that are essentially co-located on the same networks as their non-nuclear command and control facilities. They’re intermingled. So a cyber-espionage, or cyber-attack on non-nuclear weapons could be misperceived as a preemptive move against nuclear weapons. So there are a number of reasons to be very concerned about great power dynamics between the U.S., Russia, and China and the strategic instability that cyber threats create.
MORAN: Well, there has been some success during the Obama administration in putting some lines around what the U.S. and China regard as sovereign hacking acceptable actions and unacceptable actions. One assumes the U.S. is giving as good as it’s gets here or even better; and the Trump administration is seeking to reset Russian relations, as many administrations do when they first come in. So what are the arguments and the prospects for some kind of cyber ceasefire between the U.S. and Russia?
LONG: I think that a cyber ceasefire between the U.S. and Russia, kind of what happened with the U.S. and China, will be substantially more complicated for a few reasons. The first reason is that the U.S. and China have an oddly confrontational but symbiotic relationship. The economic ties between the two are enormous, so both have an incentive to try to cooperate and find reasons not to fight. With Russia and the United States it’s a bit different. China knows it’s a rising power. There’s no real question about that, whereas Russia in many ways, apart from the price of oil going up, doesn’t have a lot going for it. They feel much less secure than China, not just in the cyber realm but in every realm from their nuclear forces to their conventional forces to the stability of their regime. I think that it is going to be much harder to convince the Russians of the U.S. potential benign intent. A lot of the Russian leadership believes the United States is absolutely working to undermine the stability of their regime, and it’s hard to build ceasefires with people who you think are trying to overthrow your government on an ongoing basis. So I think if there’s going to be a ceasefire, it will have to be part of a broader effort to bring strategic stability back into the U.S. Russia relationship. I don’t think it’s impossible, I just think that, apart from working out many issues, the appropriate delineation of Russian and western influence, what’s the future of the U.S. and NATO missile defense that the Russians are quite concerned about etc. So I think it’s possible to have this kind of ceasefire, but only as part of a much greater rapprochement or détente.
ZEGART: The premise of the question raises a lot of other questions that are important for us to explore. Getting to the question of what are the prospects for a ceasefire between the U.S. and Russia in cyber, we don’t know what the U.S. has been doing on offense. One of the reasons we had this conference a few months ago was that so much about cyber offense is in the classified world. Rightly so, but we need to have much more, at a high level, strategic discussion be in the unclassified world. I would say, and I feel pretty comfortable in saying, that I doubt the U.S. has been sowing discord in democratic elections in countries like the United States via cyber means, which is something of course that the Russians did in our elections in 2016. Given the recent history of Russia’s cyber-attacks on the United States, I think a cyber ceasefire between the United States and Russia is naïve in the extreme. This is an area where the Russians have been far more active, far more nefarious than any other state actor on the globe. I think there are real concerns, rightly so, both about Russia’s physical incursions at the heart of Europe, their cyber aggressive activities against the United States as well as many other countries, and I think it’s foolishly naive to think that we could have a ceasefire that would be meaningful.
MORAN: Well, professors, thank you and thank our listeners as well. Join us next week for episode seven in a focus on how of U.S.-Russia relations have evolved in the twenty-five years since the collapse of the USSR. That will feature Andrew Kuchins of the Center for Strategic and International Studies in Washington, and Columbia’s (University) Kimberly Joy Marten. For now, on behalf of my colleagues here at the Carnegie Corporation of New York, this is Michael Moran. Goodbye.
Diffusion is the podcast of Carnegie Corporation of New York, promoting the advancement and diffusion of knowledge and understanding around issues of peace, education and democracy.
- Press Releases
