What Do We Know about Cyber Operations During Crises?

This essay focuses on how cyber operations employed in militarized crises are likely to impact escalation management. Policymakers may be attracted to the idea that cyber operations could serve as de-escalatory offramps to manage escalation in a crisis. Such expectations should be tempered for two reasons. First, we have no experience with cyber operations employed during a militarized crisis between two nuclear-armed peers. Absent direct experience, all we can rely on is academic research. Yet, secondly, existing empirical and deductive academic research provides no basis for confidence that cyber operations are either de-escalatory or non-escalatory in the context of crises. In fact, employing cyber operations intended as offramps in a crisis could have the opposite intended outcome—reversibility, for example, is a vice and not a virtue in crises. Given the absence of direct experience, policymakers must critically examine research claims that cyber operations can serve as crisis offramps. Prudent policy and resource allocation requires rigor in assessing the effectiveness of cyber capabilities in competition, crises, and war.