Cybersecurity: the application of deterrence theory in cyberspace

The main question of this research is, what are the conditions that make cyber-deterrence successful? To answer such a question, this thesis rests on the assumption that deterrence in cyberspace is feasible despite certain issues present in this domain. The main tasks in this thesis were: • Define, how deterrence strategy works and what are its‘ essential features. • After conducting a case study answer the question, how was cyber-deterrence applied in the United States from 2009 up to 2018 and how the strategy evolved? • Define, what features are required for cyber-deterrence to work, and make suggestion on how to improve the implementation of said features. The case study method was used for the analysis and the case that was chosen was U.S. and North Korea‘s cyber incidents during the period from 2009 until 2018. This method was selected due to a lack of similar case studies in the field of cyber-deterrence as most of the research is purely theoretical. The method of a case study was also used because of its‘ advantages to research, that is at the exploratory stage. This thesis looks at the relationship between universal conditions of deterrence (capacity, credibility and communication) and the effectiveness of real cyber-deterrence cases. The results of the case analysis of cyber incidents between the U.S. and North Korea show several insights to the logic of cyber-deterrence. Firstly, when analyzing capabilities, it was noticed that in cases, where the U.S. implemented retaliatory measures, they usually were in the form of public denouncement or economic sanctions. This shows that cross-domain deterrence doesn‘t always lead to the escalation of a conflict as some scientists suggest. Such a tendency not to use cyberattacks or conventional attacks as retaliatory measures also shows that it might be useful to ask, whether these more severe measures would make cyber-deterrence more effective. Secondly, it is important to note the evolution of the credibility aspect. This means that if a potential adversary would decide to attack the U.S. today, it would have to take into account the fact that in cases where the attribution problem was solved, the country was inclined to retaliate. This of course makes a positive impact on cyber-deterrence. Thirdly, the case analysis revealed that the U.S. applied the communication aspect only in part. In situations where the country was aware of who their opponent was, its‘ communication was applied to that particular rival and it usually threatened to retaliate. Despite the fact that the U.S. had never explicitly established, where its‘ “red lines“ were, if attention is paid to cases of cyberattacks in the U.S. in general, the implication of these boundaries can be understood. Lastly, it must be emphasized that the attribution issue isn‘t as severe as it is made out to be in theoretical academic literature. The case analysis proves that with time enough evidence can be gathered to pinpoint, who conducted at least some cyberattacks. The main point here is that cyber-deterrence doesn‘t have to be perfect to be useful. Also, this research demonstrates that collaboration between states and private companies can speed up the process of attribution. These insights show, what the U.S. cyber-deterrence strategy lacks in order to deter future North Korean attacks. It also indicates, which universal deterrence conditions are fulfilled and add to the success of the strategy. Observations, made in this thesis can offer ideas for further research. When analyzing cyber-deterrence in the future, more attention could be paid to the way actors cooperate in cyberspace and how it affects the attribution problem. It would also be useful to conduct a large scale quantitative study, which could show if there is some correlation between the improvement of cyber-deterrence and the number of cyberattacks