Cyber-enabled influence operations as a ‘center of gravity’ in cyberconflict: The example of Russian foreign interference in the 2016 US federal election

Social scientists do not directly study cyberattacks; they draw inferences from attack reports that are public and visible. Like human rights violations or war casualties, there are missing cyberattacks that researchers have not observed. The existing approach is to either ignore missing data and assume they do not exist or argue that reported attacks accurately represent the missing events. This article is the first to detail the steps between attack, discovery and public report to identify sources of bias in cyber data. Visibility bias presents significant inferential challenges for cybersecurity – some attacks are easy to observe or claimed by attackers, while others take a long time to surface or are carried out by actors seeking to hide their actions. The article argues that missing attacks in public reporting likely share features of reported attacks that take the longest to surface. It builds on datasets of cyberattacks by or against Five Eyes (an intelligence alliance composed of Australia, Canada, New Zealand, the United Kingdom and the United States) governments and adds new data on when attacks occurred, when the media first reported them, and the characteristics of attackers and techniques. Leveraging survival models, it demonstrates how the delay between attack and disclosure depends on both the attacker’s identity (state or non-state) and the technical characteristics of the attack (whether it targets information confidentiality, integrity, or availability). The article argues that missing cybersecurity events are least likely to be carried out by non-state actors or target information availability. Our understanding of ‘persistent engagement,’ relative capabilities, ‘intelligence contests’ and cyber coercion rely on accurately measuring restraint. This article’s findings cast significant doubt on whether researchers have accurately measured and observed restraint, and informs how others should consider external validity. This article has implications for our understanding of data bias, empirical cybersecurity research and secrecy in international relations.

How the process of discovering cyberattacks biases our understanding of cybersecurity

Oppenheimer

2024

How cyber operations can reduce escalation pressures: Evidence from an experimental wargame study

Jensen,

Valeriano,

Whitt

2024

Cyber operations ranging from deception and espionage to disruption and high-end degradation have become a central feature of modern statecraft in the digital age, yet we lack a clear understanding of how decision-makers employ and respond to cyber operations in times of crisis. Our research provides theoretical mechanisms and empirical evidence for understanding how decision-makers react to cyber triggers and utilize cyber responses during crises. Specifically, we argue that the availability of cyber response creates off-ramps for non-escalatory engagement. Based on experimental wargames involving rival states with power parity in militarized disputes and randomized cyber triggers and response options, we find the availability of cyber response options reduces escalatory behavior via a substitution mechanism. In the absence of cyber response options, however, participants pursue more conventional, escalatory actions, regardless of the triggering mechanism. Our findings underscore how enhancing the availability of cyber response options might reduce strategic escalation risks and offer the space to bargain during periods of conflict.

Introduction: Cyber-conflict – Moving from speculation to investigation

Shandler,

Canetti

2024

Investigating cyber conflict is enormously difficult. The domain is complex, quality data are sparse, international affairs are shrouded in secrecy, and despite its seeming ubiquity, cyber power has only recently entered the battlefield. In the face of these challenges, we must rise to meet the challenges of cybersecurity research by deploying creative methods that collect verifiable and probatory data, and which allow for predictive models of cyber behavior. Against this backdrop, our special issue offers a vision of cybersecurity research that embraces a culture of rigorous inquiry based on theoretically robust, and policy relevant investigation. We highlight two key features. First, research at the intersection of cybersecurity and political science must incorporate the human dimension of cyber conflict. A human security approach to cybersecurity places people as the primary objects of security and recognizes that individual-level analyses can shed light on macro-level trends. Second, cyber research must adopt rigorous, empirical methods. We embrace a broad tent of empirical data collection techniques – spanning qualitative and quantitative, experimental, and observational research. What is integral is that all scholarship abides by the highest standards of replicability and falsifiability. The articles contained in this special issue collectively form a proof of concept that expands the horizons of cybersecurity research from a substantive viewpoint (adding a human dimension to the prevalent military/strategic analyses), and from a methodological perspective (propounding the importance of empirical scrutiny). Together, these 10 pieces of scholarship collectively affirm that there is now a critical mass of substantively diverse and empirically rigorous research in the field of cybersecurity, and that we as a community are capable of making bold, theoretically grounded, and empirically tested claims that verify how cyber power is or is not altering the nature of peace, conflict and international relations.