US Deterrence against Chinese Cyber Espionage: The Danger of Proliferating Covert Cyber Operations

In June 2015, US authorities acknowledged that attackers, widely speculated to be linked to the Chinese government, breached the US Office of Personnel Management in two separate cyber-attacks. Shortly before this acknowledgement, Secretary of Defense Ash Carter announced that the US would be “retaliating against major cyber-attacks.” In this contemporary article, authors van der Meer and van der Putten identify and analyze the various responses the Obama administration could use to react to the attack. These responses fall into both conventional and cyber means. Though this particular attack is long in the past, the authors’ framework is useful for examining future Chinese cyber-attacks.

On the conventional side, the authors identify “diplomatic protest,” “legal measures,” and military and economic retaliation. They quickly write off diplomatic protest as a “largely symbolic response” with little-to-no deterrence effect. Shared among the remaining approaches is the threat of severely diminished relations with China, a key economic partner, and a slippery slope of escalation. In the absence of stringent norms around cyber-attacks, responding in such a manner to an attack could be more costly than the original attack. To make such reactions less risky, the authors urge the US and China to develop these safeguards.

Similar problems arise with responses in the cyber realm. On the more toothless end, the US can respond to cyber-attacks by doing nothing, simply using the attack as an opportunity to develop and advertise improved cyber capacities. This poses the same issues as diplomatic protest: in the absence of an actual response, China (and any other adversary) has no real incentive not to engage in future attacks. Outright cyber-attacks carry the risk of “a cycle of escalation.” The last approach is to engage in “covert retaliation in cyberspace,” which poses less of a risk than outright acts; the authors suggest “undermining the Chinese government’s ability to censor” as a possible target. Regardless, all of these options pose significant problems and suggest that more work is required in the realm of Cyber-IR norm-building.