Public Cyberinstitutions: Signaling State Cybercapacity

Even though there has been a rapid increase in state cybercapacity over the last two decades, researchers have paid little attention to this phenomenon. In my dissertation Public Cyberinstitutions: Signaling State Cybercapacity, I employ a combination of formal theory, event history analysis, and interviews to shed light on what drives a state’s decision to develop this capacity in the form of public cyberinstitutions (PCIs)—publicly observable efforts meant to signal the state offensive and defensive cybercapacity—and the effects these PCIs have on its adversaries’ decision-making. Unlike existing scholarship which emphasizes the cyberthreat environment as the main driver of PCIs, I empirically model the international proliferation of PCIs as a diffusion process and argue that it happens through different types of networks. The distinct pathways behind different types of PCIs reflect the different types of signals each is intended to send. National cybersecurity strategies diffuse through networks of “like-minded” states, with similar preferences on cybersovereignty. The development of a military cyberapparatus diffuses through military alliance networks, following the logic of complementarity. National strategies are among the less costly PCIs a country could adopt, but—because their purpose is to articulate a country’s main goals, threats and priorities in the cyber domain—governments cannot adopt them without first considering the role the Internet plays within their polity and how heavily they wish to regulate it. Military cybersecurity units, meanwhile, have higher startup and maintenance costs, and the willingness to pay these costs sends a potentially informative signal to a country’s allies and adversaries. Rather than “free ride” off the cybercapabilities of one’s allies, however, countries tend to complement the activities of their allies (e.g., invest more if their allies invest less). I test these theoretical explanations with newly collected data sets on national cybersecurity strategies and on state cybersecurity organizations between 1999 and 2018, and find robust empirical support. Using an incomplete-information model I also demonstrate that PCIs meant to demonstrate an increase in cybercapacity only deter adversaries that are susceptible to the costs created by this increased cybercapacity. Despite this, states tend to over-invest in PCIs. In particular, weak cyber states tend to over-invest to convince adversaries that they are strong, whereas strong cyber states over-invest so that adversaries do not believe that they are weak states pretending to be strong. In doing so, these states reduce their overall cybercapacity. Through my interviews with cybersecurity experts, intelligence reports, and examples of attempted election interference campaigns, I establish the empirical plausibility of this theoretical result. These findings, which focus on a fundamentally new domain of warfare and statecraft, have important implications for national security policy.PHDPublic Policy & Political ScienceUniversity of Michigan, Horace H. Rackham School of Graduate Studieshttp://deepblue.lib.umich.edu/bitstream/2027.42/163168/1/nadiya_1.pd