Comparative Approach to Cyber Policy and Strategy

Full Terms & Conditions of access and use can be found at https://www.tandfonline.com/action/journalInformation?journalCode=cdan20

Defense & Security Analysis

ISSN: 1475-1798 (Print) 1475-1801 (Online) Journal homepage: https://www.tandfonline.com/loi/cdan20

Nuclear deterrence and cyber warfare: coexistence or competition?

Stephen J. Cimbala

To cite this article: Stephen J. Cimbala (2017) Nuclear deterrence and cyber warfare: coexistence or competition?, Defense & Security Analysis, 33:3, 193-208, DOI: 10.1080/14751798.2017.1351142

To link to this article: https://doi.org/10.1080/14751798.2017.1351142

Published online: 17 Jul 2017.

Submit your article to this journal

Article views: 2638

View related articles

View Crossmark data

Nuclear deterrence and cyber warfare: coexistence or competition? Stephen J. Cimbala

Department of Political Science, Penn State Brandywine, Media, PA, USA

ABSTRACT Nuclear deterrence and cyber war seem almost antithetical in their respective intellectual pedigrees. Nuclear weapons are unique in their ability to create mass destruction in a short time. Information or “cyber” weapons, at least for the most part, aim at sowing confusion or mass disruption instead of widespread physical destruction. Nevertheless, there are some intersections between cyber and nuclear matters, and these have the potential to become troublesome for the future of nuclear deterrence. For example, cyber attacks might complicate the management of a nuclear crisis. As well, information attacks on command-control and communications systems might lead to a mistaken nuclear launch based on false warnings, to erroneous interpretations of data or to panic on account of feared information blackout. It is not inconceivable that future nuclear strike planning will include a preliminary wave of cyber strikes or at least a more protracted “preparation of the battlefield” by roaming through enemy networks to plant malware or map vulnerabilities.

KEYWORDS Cyberwar; information warfare; nuclear deterrence; command-control systems; warning systems; information networks; crisis management; preemption; inadvertent nuclear war; misperception

Introduction

Nuclear deterrence “old style” is passé. The logic of nuclear strategy was developed prior to the information age. The Cold War nuclear forces of the US and the Soviet Union were justified and designed for deterrence based on the credible threat of massive retaliation, or “mutual assured destruction.” Although nuclear weapons remain among the most potentially destructive of so-called weapons of mass destruction, the twenty-first- century political and technical context for developing and deploying nuclear weapons has shifted from its Cold War precedents.

Politically, the breakdown of a bipolar international system has transformed the land- scape of nuclear danger from a Euro-centric to more multipolar system of potential threats. As well, the military-technical context of emerging cyberwar, and its possible implications for nuclear deterrence and arms control, demand more attention from scho- lars than hitherto. The present discussion considers how the emerging prospects of war in the information spectrum could intersect with, and even influence, the challenges of nuclear deterrence and nuclear strategy.

© 2017 Informa UK Limited, trading as Taylor & Francis Group

CONTACT Stephen J. Cimbala [email protected]

DEFENSE & SECURITY ANALYSIS, 2017 VOL. 33, NO. 3, 193–208 https://doi.org/10.1080/14751798.2017.1351142

The US military organization has already acknowledged the growing relationship between nuclear and cyber. The Department of Defense established USCYBERCOM as a sub-unified command of US Strategic Command (USSTRATCOM), and USCYBER- COM coordinates across the relevant military branches (US Army Cyber Command, US Fleet Cyber Command/US 10th Fleet, the 24th Air Force, the US Marine Corps Forces Cyber Command and US Coast Guard Cyber Command). Co-located with the National Security Agency (NSA), USCYBERCOM is headed by the same director.1 Yet, for the most part, nuclear deterrence and cyber warfare issues are treated as separate and distinct compartments by academic, media and many military commentators. This cyber-nuclear separatism is understandable as a matter of division of labor among experts, but it casts a shadow over the reality of nuclear deterrence or crisis management under cyber-intensive conditions. In addition, some experts argue that modernization of the US nuclear command and control system, doubtless necessary for the replacement of outdated technology, may nevertheless increase the vulnerability of the NC3 system to hacking or to digitally empowered decision-making pathologies.2

In the discussion that follows, some of the broader theoretical implications of the nuclear–cyber nexus for students of national security policy and warfare are first exam- ined. Second, how missile defenses, posing cyber challenges of their own, might compli- cate US–Russian political relations and nuclear arms reductions are considered. No implication is intended that the US–Russia deterrence relationship is illustrative of other arms control and proliferation issues: indeed, we will see below that just the opposite is true. Nevertheless, some enduring realities of nuclear force exchanges merit recall as we move further away from the pre-cyber, and into the post-cyber, nuclear age. Third, how the combination of nuclear defenses and more advanced missile defenses might play out for deterrence stability, especially within the contentious US–Russian context, are ana- lyzed. Finally, pertinent conclusions are drawn about the nuclear–cyber interface insofar as it might pertain to future arms control, nonproliferation and deterrence.

Cyber and nuclear?

What are the implications of potential overlap between concepts or practices for cyberwar and for nuclear deterrence?3 Cyberwar and nuclear weapons seem worlds apart. Cyber weapons should appeal to those who prefer a non-nuclear, or even a post-nuclear, mili- tary-technical arc of development. War in the digital domain offers, at least in theory, a possible means of crippling or disabling enemy assets without the need for kinetic attack, or while minimizing physical destruction.4 Nuclear weapons, on the other hand, are the very epitome of “mass” destruction, such that their use for deterrence, or the avoid- ance of war by the manipulation of risk, is preferred to the actual firing of same. Unfortu- nately, neither nuclear deterrence nor cyber war will be able to live in distinct policy universes for the near or distant future.

Nuclear weapons, whether held back for deterrence or fired in anger, must be incorpor- ated into systems for command, control, communications, computers, intelligence, sur- veillance and reconnaissance (C4ISR). The weapons and their C4ISR systems must be protected from attacks both kinetic and digital in nature. In addition, the decision- makers who have to manage nuclear forces during a crisis should ideally have the best possible information about the status of their own nuclear and cyber forces and

194 S. J. CIMBALA

command systems, about the forces and C4ISR of possible attackers, and about the prob- able intentions and risk-acceptance of possible opponents. In short, the task of managing a nuclear crisis demands clear thinking and good information. But the employment of cyber weapons in the early stages of a crisis could impede clear assessment by creating confusion in networks and the action channels that are dependent on those networks.5 The tempta- tion for early cyber preemption might “succeed” to the point at which nuclear crisis man- agement becomes weaker instead of stronger.

Ironically, the downsizing of US and post-Soviet Russian strategic nuclear arsenals since the end of the Cold War, while a positive development from the perspectives of nuclear arms control and nonproliferation, makes the concurrence of cyber and nuclear attack capabilities more alarming. The supersized deployments of missiles and bombers and expansive numbers of weapons deployed by the Cold War Americans and Soviets had at least one virtue. Those arsenals provided so much redundancy against first-strike vulnerability that relatively linear systems for nuclear attack warning, command-control and responsive launch under, or after, attack, sufficed. At the same time, Cold War tools for military cyber mischief were primitive compared to those available now. In addition, countries and their armed forces were less dependent on the fidelity of their information systems for national security. Thus, the reduction of US, Russian and possibly other forces to the size of “minimum deterrents” might compromise nuclear flexibility and resilience in the face of kinetic attacks preceded or accompanied by cyber war.6

Offensive and defensive information warfare as well as other cyber-related activities are obviously very much on the minds of US military leaders and others in the American and allied national security establishments.7 Russia has also been explicit about its cyber- related concerns. President Putin urged the Russian Security Council in early July 2013 to improve state security against cyber attacks.8 Russian security expert Vladimir Batyuk, commenting favorably on a June 2013 US–Russian agreement for protection, control and accounting of nuclear materials (a successor to the recently expired Nunn– Lugar agreement on nuclear risk reduction), warned that pledges by Presidents Putin and Obama for cooperation on cybersecurity were even more important: “Nuclear weapons are a legacy of the 20th century. The challenge of the 21st century is cybersecur- ity,” he noted.9 On the other hand, arms control for cyber is apt to run into daunting security and technical issues: even assuming a successful navigation of political trust for matters as sensitive as these. Of special significance is whether cyber arms control nego- tiators can certify that hackers within their own states are sufficiently under control for cyber verification and transparency.

The cyber domain cuts across the other geostrategic domains for warfare as well: land, sea, air and space. On the other hand, the cyber domain, compared to the others, suffers from lack of a historical perspective: the cyber domain “has been created in a short time and has not had the same level of scrutiny as other battle domains,” as one author has argued.10 What this might mean for the cyber–nuclear intersection is far from obvious. Table 1 summarizes some of the major attributes that distinguish nuclear deterrence from cyber war according to experts, but the differences between nuclear and cyber listed here do not contradict the prior observation that cyber and nuclear domains inevi- tably interact in practice.

According to research professors Panayotis A. Yannakogeorgos and Adam B. Lowther at the US Air Force Research Institute, “As airmen move toward the future, the force

DEFENSE & SECURITY ANALYSIS 195

structure – and, consequently, force-development programs – must change to emphasize the integration of manned and remotely piloted aircraft, space, and cyber-power projec- tion capabilities.”11

Cyber attacks and information wars: how significant?

The US Department of Defense and other government agencies, together with military and information technology experts, anticipate that future interstate conflict will include cyber attacks and information wars.12 But the term “cyber war” may be mislead- ing, since attacks on computers and networks are only one means of accomplishing the objective of neutralizing the enemy’s critical infrastructures.13 As Joel Brenner has noted:

The US Navy spent about $5 billion to develop a quiet electric drive for its submarines and ships so they’d be silent and hard to track. Chinese spies stole it. The navy spent billions more to develop new radar for their top-of-the-line Aegis Cruiser. Chinese spies stole that, too. The electronic intelligence services of the Chinese and the Russians are working us over – taking advantage of our porous networks and indifference to security to steal billions of dollars’ worth of military and commercial secrets. Some of our allies, such as the French and the Israelis, have tried it too.14

One purpose for activity that the Department of Defense refers to as information and infrastructure operations (I20) would not be mass destruction (although destructive sec- ondary effects are possible) but mass and/or precision disruption.15 According to Robert A. Miller, Daniel T. Kuehl and Irving Lachow, the purpose of an information and infra- structure operation would be to “disrupt, confuse, demoralize, distract, and ultimately

Table 1. Comparative attributes of cyber war and nuclear deterrence. Cyber war Nuclear deterrence

Source of attack may be ambiguous – third party intrusions masquerading as other actors are possible

Source of attack is almost certain to be identified if the attacker is a state, and even terrorist attackers’ nuclear materials may be traceable

Damage mostly to information systems, networks and their messaging contents, although these might have spillover effects to the operations of military combat systems, economy and social infrastructure

Failure of deterrence can lead to historically unprecedented and socially catastrophic damage even in the case of a “limited” nuclear war by Cold War standards

Denial of the attacker’s objectives is feasible if defenses are sufficiently robust and/or penetrations can be repaired in good time

Deterrence by means of threat to deny the attacker its objectives is less credible than the threat of punishment by assured retaliation (although improved missile defenses seek to change this)

The objective of cyber attacks is typically disruption or confusion rather than destruction per se

Nuclear deterrence has rested for the most part on the credible threat of massive, prompt destruction of physical assets and populations

Cyberwar and information attacks can continue over an extended period of time without being detected and sometimes without doing obvious or significant damage – some are not even reported after having been detected

The first use of a nuclear weapon since 1945 by a state or non-state actor for a hostile purpose (other than a test) would be a game-changing event in world politics, regardless of the size of the explosion and the immediate consequences

The price of entry to the games table for cyberwar is comparatively low – actors from individual hackers to state entities can play

Building and operating a second-strike nuclear deterrent requires a state-supported infrastructure, scientific and technical expertise on a large scale, and long-term financial commitments

Sources: Author. See also Gartzke and Lindsay, “Thermonuclear Cyberwar”; Martin C. Libicki, “The Convergence of Infor- mation Warfare,” Strategic Studies Quarterly, no. 1 (Spring 2017): 49–65; Timothy L. Thomas, Three Faces of the Cyber Dragon: Cyber Peace Activist, Spook, Attacker (Fort Leavenworth, KS: Foreign Military Studies Institute, 2012), 60–6 and Libicki, Cyberdeterrence and Cyberwar, 27–8 and passim.

196 S. J. CIMBALA

diminish the capability of the other side.”16 This concept lends itself to consideration for a deterrent mission based on the credible threat of conventional or nuclear response. One must always remember, however, that the unique prompt lethality of nuclear weapons creates a separate grammar for the conduct of nuclear war even if such a war would remain within the boundaries of strategic logic.17 As Colin Gray has warned:

First, except for highly unusual cases, cyber power is confined in its damaging effects to cyberspace. This is not to understate the problems that can be caused by cyber attack, but it is to claim firmly that the kind of damage and disruption that cyber might affect cannot compare with the immediate and more lasting harm that nuclear weapons certainly would cause.18

Missile defenses: prophecy or problem?

Technical uncertainties

The cyber aspects of nuclear deterrence intersect with those pertinent to missile defense. Missile defenses if successful offer the possibility that deterrence by threat of unacceptable retaliation could be supported by deterrence based on denial of the attacker’s objectives.19

Today, missile defenses remain technologically and politically contentious. Russian objec- tions to the US and NATO proposed European Phased Adaptive Approach (EPAA) to missile defenses remained emphatic even as reportedly secret US Department of Defense studies cast doubt on the technical proficiency of the proposed components for the European BMD (ballistic missile defense) systems.20 A study by the US National Academy of Sciences (NAS) on missile defense technologies called into question some of the thinking of the Obama administration and the US Missile Defense Agency about the priority of certain missions and technologies for BMD.21

On the other hand, other expert scientists criticized the aforementioned NAS study as containing “numerous flawed assumptions, analytical oversights, and internal inconsisten- cies” leading to “fundamental errors in many of the report’s most important findings and recommendations” and as undermining its scientific credibility.22 Future technology chal- lenges to the development and deployment of missile defenses will have more to do with the “arbitrary complexity” of software engineering for multiple contingencies and players, compared to the bipolar and physics-centric context of the High Cold War.23 Suffice it to say that the academic and policy arguments continue as to the feasibility and the desirabil- ity of building missile defenses, alongside the inertial pull of research and development funding in this direction since the Reagan administration’s Strategic Defense Initiative.24

Political pitfalls

If the linkage between US and NATO plans for European missile defenses and further pro- gress in US–Russian strategic nuclear arms reductions was not yet a hostage relationship, it was clearly a problematical connection.25 The New START agreement does not preclude the US from deploying future missile defenses, despite Russian efforts during the negotiat- ing process to restrict American degrees of freedom in this regard.26 But then Russian pre- sident Dmitri Medvedev and his predecessor–successor Vladimir Putin have made it clear that Russia’s geostrategic perspective links US and NATO missile defenses to cooperation

DEFENSE & SECURITY ANALYSIS 197

on other arms control issues. Meanwhile, the US and NATO in 2011 moved forward with the first phase of a four-phase deployment of the European Phased Adaptive Approach (EPAA) for missile defenses.27

In March, 2013 US Secretary of Defense Chuck Hagel announced plans to modify the original plan for EPAA by abandoning the originally planned deployments of SM-3 IIB interceptor missiles in Poland by 2022. But this step failed to reassure Russian doubters about the US and NATO claims that their regional and global missile defenses were not oriented against Russia. Russian officials frequently reiterate demands for a legally binding guarantee from the US and NATO that Russian strategic nuclear forces would not be targeted or affected by the system.28 Table 2 summarizes the status of the EPAA BMD as of autumn 2013.

Although the prospects for US–Russian or NATO–Russian agreement on European missile defenses might seem challenging at this writing, the prospects for US cooperation with allies and partners outside of Europe on regional missile defenses are more favorable. The potential bull market for missile defenses lies in Asia, including prompts from Sino- Japanese rivalry, North Korean threats and missile tests, and deterrence challenges between India and Pakistan. Missile defenses might appeal to states in Asia as supports for deterrence by denial of enemy attack objectives and as means of damage limitation, should deterrence fail. Missile defenses for some US allies and partners might also

Table 2. EPAA to missile defense.a

Phase I Phase II Phase III Phase IV (canceled

March 2013)

Timeframe 2011 2015 2018 2020 Capability Deploying today’s

capability Enhancing medium- range missile defense

Enhancing intermediate- range missile defense

Early intercept of MRBMs, IRBMs and ICBMs

Threat/ mission

Address regional ballistic missile threats to Europe and deployed US personnel

Expand defended area against short- and medium-range missile threats to Southern Europe

Counter short-, medium- and intermediate-range missile threats to include all of Europe

Cope with MRBMs, IRBMs and potential future ICBM threats to the US

Components AN/TPY-2 (FBM) in Kurecik, Turkey; C2BMC in Ramstein, Germany; Aegis BMD ships with SM-3 IA off the coast of Spain

AN/TPY-2 (FBM) in Kurecik, Turkey; C2BMC in Ramstein, Germany; Aegis BMD ships with SM-3 IB off the coast of Spain; Aegis Ashore with SM-3 1B in Romania

AN/TPY-2 (FBM) in Kurecik, Turkey; C2BMC in Ramstein, Germany; Aegis BMD ships with SM-3 IIA off the coast of Spain; Aegis Ashore with SM-3 IB/IIA in Romania and Poland

AN/TPY-2 (FBM) in Kurecik, Turkey; C2BMC in Ramstein, Germany; Aegis BMD ships with SM-3 IIA off the coast of Spain; Aegis Ashore with SM- 3 IIB in Romania and Poland

Technology Exists In testing Under development In conceptual stage when canceled

Locations Turkey, Germany, ships off the coast of Spain

Turkey, Germany, ships off the coast of Spain, ashore in Romania

Turkey, Germany, ships off the coast of Spain, ashore in Romania and Poland

Turkey, Germany, ships off the coast of Spain, ashore in Romania and Poland

Notes: Aegis Ashore: land-based component of the Aegis BMD system; AN/TPY-2 (FBM): Army Navy/Transportable Radar Surveillance, Model 2 (Forward-based Mode); C2BMC: Command, Control, Battle Management and Communications; ICBM: intercontinental ballistic missile; IRBM: intermediate-range ballistic missile; MRBM: medium-range ballistic missile.

Sources: Kaya, “NATO Missile Defense,” 84–9, citation page 86. For pertinent technical challenges relative to target acqui- sition, discrimination, interception and data networking, see Whitmore and Deni, European Phased Adaptive Approach, 11–17.

aSeparate national contributions to the mission of European BMD have been announced by the Netherlands and France.

198 S. J. CIMBALA

reinforce US security guarantees based on the American nuclear umbrella and conse- quently reduce the incentives for those states to develop their own nuclear arsenals.29

How might the advent of cyberwar affect the prospects for the deployment of US, Russian or other antimissile defenses, or the performance of such systems once having been deployed? Since the exact architecture of future missile defense systems is a moveable feast, not to mention the uncertainty of their performances relative to offenses, we can only speculate. Cyber war against missile defenses might be one component of a defense suppression campaign prior to, or in conjunction with, preemptive strikes against opposed military forces. Cyber defense suppression attacks might be intended to disrupt network communications, to distract operators from focal tasks with digital fogging, or to interfere with launch commands and software performance of intercep- tors.30 This might be done in such a way that the victim actually realized what was hap- pening in real time – as a means of exercising coercion via intrawar deterrence.

On the other hand, the defense suppression could be conducted in such a way that the party being attacked was unaware or uncertain as to what was happening, and who was at fault, until it was too late to patch the vulnerability. In either case, planning for or against discovery by the victim, the attacker’s program would be prepared in advance, well before the eruption of an actual crisis and military confrontation. Peacetime computer network exploitation could map the sinews of the BMC3 (battle management, command, control and communications) system that ties together commanders, systems operators and responsive forces. In addition, attacks on computers and networks could be accompanied by electromagnetic pulse from nuclear detonations intended to nullify the performances of components of enemy NC3 systems without the need for physical destruction of launch- ers. Attackers using defense suppression would have to estimate how long the victim would wait, after having discovered the nature of the attack and the identity of the perpe- trator, before responding, and how the state might react. For example, would a state treat an enemy cyber-electronic defense suppression attack as tantamount to a nuclear first strike and retaliate accordingly, or would a more nuanced (and, perhaps, more believable) response by appropriate? This brief discussion leads naturally into the next section provid- ing analysis of possible arms control outcomes, with and without defenses, for the US– Russian post-New START environment.

Arms control: options and risks

Force exchange models

The New START agreement of 2010 mandates modest reductions in the numbers of deployed strategic weapons and launchers, building on the Strategic Offensive Reductions Treaty reached earlier between the US and Russia during the George W. Bush adminis- tration. In his Berlin speech of 19 June 2013, President Obama indicated US interest in post-New START reductions in the numbers of Russian and American deployed intercon- tinental weapons of about one-third.31

Could the US and Russia safely take the step, from the New START maximum limit of 1550 to roughly 1000 operationally deployed nuclear warheads on intercontinental mis- siles and heavy bombers, while preserving deterrence and arms control stability? The analysis that follows uses summary charts to interrogate that issue. New START and

DEFENSE & SECURITY ANALYSIS 199

lower limit force structures are projected based on various expert assessments and are tested by our model for their nuclear exchange outcomes.32

Figures 1 and 2 summarize the outcomes of US–Russian strategic nuclear exchanges, assuming a New START-compliant limit of 1550 or 1000 operationally deployed warheads on intercontinental launchers for each state. Figure 1 displays the numbers of second- strike surviving and retaliating warheads for each state under a deployment ceiling of 1550 weapons, and Figure 2 provides similar information for the case of 1000 deployed weapons. In Figures 3 and 4, respectively, we introduce antimissile and air defenses (com- bined) into the equation for each state, providing a variable range of possible performances against second-strike retaliating weapons: Phase I defenses successfully intercept at least 20% of the second-strike retaliating warheads; Phase II defenses, at least 40%; Phase III defenses, at least 60% and Phase IV defenses, at least 80%.

Results and implications

The preceding figures appear to show that each state has numbers of surviving and reta- liating weapons sufficient to satisfy the criterion of “unacceptable damage” in a second strike so long as unacceptable damage is defined by traditional US political and military standards.33 On the other hand, the assumptions about rationality or reasonableness on which traditional models of deterrence have rested may be misleading. As Keith B. Payne has noted in arguing for a more empirical approach to deterrence:

Figure 1. US–Russia surviving and retaliating warheads – 1550 deployment limit. Source: Author, based on model originally developed by Dr James J. Tritten. Dr Tritten is not responsible for its use here, nor for any arguments or opinions in this essay.

200 S. J. CIMBALA

Figure 2. US–Russia surviving and retaliating warheads – 1000 deployment limit. Source: Author, based on model originally developed by Dr James J. Tritten. Dr Tritten is not responsible for its use here, nor for any arguments or opinions in this essay.

Figure 3. US–Russia surviving and retaliating warheads vs. defenses – 1550 deployment limit. Source: Author, based on model originally developed by Dr James J. Tritten. Dr Tritten is not responsible for its use here, nor for any arguments or opinions in this essay.

DEFENSE & SECURITY ANALYSIS 201

Attempting to become familiar with the decision-making dynamics of foreign leaders, for the purpose of establishing an informed basis for deterring and coercing them, is not a trivial undertaking. And, it must be acknowledged that even extensive efforts at acquiring infor- mation concerning the factors underlying a challenger’s decision-making will not preclude surprising, unpredictable behavior based on unfamiliar or wholly obscure motives, goals, and values.34

For example, some expert analysts have suggested that improving accuracies for deli- vering nuclear and conventional weapons may make counterforce strategies attractive to some states, including nuclear weapons’ states other than the US and Russia.35 In con- trast, other researchers have warned that even nuclear wars smaller than those involving the US and Russia, such as a future nuclear conflict between Israel and Iran, could result in historically unprecedented and socially unmanageable consequences for both sides (in addition to uncertain side effects for the rest of the region).36

Thus, the appeal of non-nuclear systems, including cyber weapons, for prospective attackers, rests in part on their putative capacity for calculated deception combined with precise lethality. On this very point, Russian deputy prime minister Dmitri Rogozin has warned that information weapons are becoming first-strike weapons against enemy pol- itical, military and industrial centers. Rogozin also claimed that Pentagon computer games showed that strikes by some 3000–4000 precision-guided munitions could destroy as much as 80–90% of Russia’s nuclear potential.37 Of course, a US attack of this scale on Russia and Russia’s probable responses would destroy political stability and economic viability in much of Europe and Central Eurasia, in addition to whatever

Figure 4. US–Russia surviving and retaliating warheads vs. defenses – 1000 deployment limit. Source: Author, based on model originally developed by Dr James J. Tritten. Dr Tritten is not responsible for its use here, nor for any arguments or opinions in this essay.

202 S. J. CIMBALA

damage was caused to their respective state territories. Deterrence failure remains a dead end to be avoided: relative advantage is a cruel hoax.

Another challenge for the Trump administration is the need to manage the balance between modernization of advanced conventional weapons (including missile defenses and offensive weapons for precision global strike (PGS)), on one hand, and nuclear modern- ization, on the other. For example, China’s apparent migration to a strategy of assured reta- liation/assured destruction instead of minimum deterrence, with respect to its numbers of deployed strategic weapons, assumes a minimum second-strike capability relative to the US that might be threatened by enhanced missile defenses and/or PGS weapons.38 And, as previously noted, Russia has also warned that US missile defenses nominally aimed at Iran might eventually pose a threat to Russia’s strategic nuclear deterrent.39

Conclusions

Nuclear modernization and nuclear deterrence are not entirely hostage to the develop- ment of cyber weapons or cyber warfare – but neither are they totally immune from the cyber-ization of defense technologies. The environment for strategy making and policy-relevant nuclear deterrence, arms control and disarmament analysis has already changed profoundly: and more changes are ahead. Changes in technology are the most visible, but their impact extends beyond nuts and bolts. The diversification of offensive strike platforms, the development of improved antimissile and antiair defenses, and the increasing importance of cyber, including offensive and defensive information warfare, could combine to create a paradigm shift in the thinking about major war and nuclear deterrence in advanced countries. The preceding discussion at best scratches the surface of this potentially tectonic change.

One paradox of the nuclear-cyber age is that the ability of the nuclear great powers to deter one another might encourage an undeserved complacency, as to the substructure of regional nuclear deterrence, especially among existing and nuclear-aspirational powers in the Middle East and South and East Asia.40 A multipolar nuclear power system outside of Europe creates potential instabilities that will challenge existing notions of deterrence rationality as well as the endurance of the nonproliferation regime. US and allied planning for nuclear crises will have to take into account the possibility of scenarios with plot lines unscripted in past war games: including cases of ambiguity about whether “nuclear” use had actually occurred.41 For these reasons, the two-dimensional analysis offered here, rela- tive to US–Russian nuclear dynamics, overlaps inescapably and inevitably with the emer- ging multipolar nuclear power system of which it is a part. But now, the US and Russia have the incentives and opportunities, unlike the Cold War Americans and Soviets, to pursue multi-level system crisis management and shared nonproliferation objectives, without a presumption of ideological hostility. The system “default” is to more nuclear initiative from the regions, and (hopefully) to multilateral arms reductions beyond the pre- cedents set by New START and any follow-ons.

The relationship between offensive nuclear force reductions and missile defenses (with or without cyber in the mix) is a complicated one. Missile defenses are more promising technologies than they were in the previous century. But expert studies suggest that anti-BMDs are much more viable prospects against small attacks by regional foes than they are strategic counterweights to massive long-range missile attacks.42 There is room

DEFENSE & SECURITY ANALYSIS 203

for security cooperation in missile defense by NATO and Russia against possible threats posed by Middle Eastern or other nuclear capabilities. But the effects of nuclear weapons spread in the Middle East or additional proliferation in Asia cannot be precluded only by missile defenses or even by solely military responses. Smart diplomacy combined with limited regional missile defenses might buy time for more ambitious nonproliferation and counter-proliferation initiatives to work.43

Notes

1. Thomas M. Chen, An Assessment of the Department of Defense Strategy for Operating in Cyberspace (Carlisle, PA: Strategic Studies Institute, U.S. Army War College, September 2013), 9–10 and passim.

2. On this point, see Erik Gartzke and Jon R. Lindsay, ‘Thermonuclear Cyberwar’, Journal of Cybersecurity (2017): 1–12, doi:10.1093/cybsec/tyw017, and Andrew Futter, ‘The Double- Edged Sword: US Nuclear Command and Control Modernization’, Bulletin of the Atomic Scientists (June 29, 2016), http://thebulletin.org/double-edged-sword-us-nuclear-command- and-control-modernization.html. See also Futter, Cyber Threats and Nuclear Weapons: New Questions for Command and Control, Security and Strategy (London: Royal United Service Institute for Defence and Security Studies, RUSI Occasional Paper, July 2016), www.rusi.org; and Futter, ‘War Games Redux? Cyberthreats, U.S.-Russian Strategic Stability, and New Chal- lenges for Nuclear Security and Arms Control’, European Security (December 2015), doi:10. 1080/09662839.2015.1112276.

3. Insightful analyses pertinent to this topic include: Colin S. Gray, Making Strategic Sense of Cyber Power: Why the Sky Is Not Falling (Carlisle, PA: Strategic Studies Institute, U.S. Army War College, April 2013); Kamaal T. Jabbour and E. Paul Ratazzi, ‘Does the United States Need a New Model for Cyber Deterrence?’, in Deterrence: Rising Powers, Rogue Regimes, and Terrorism in the Twenty-First Century, ed. Adam B. Lowther (New York: Pal- grave Macmillan, 2012), chap. 3, 33–45; and Martin C. Libicki, Cyberdeterrence and Cyber- war (Santa Monica, CA: RAND, 2009). Other references on this topic appear in later notes. The chronology of key government documents pertinent to cyberspace and US national security strategy is nicely summarized in Chen, An Assessment of the Department of Defense Strategy, Appendix, 45–6.

4. On the information operations concepts of major powers, see Timothy L. Thomas, Cyber Sil- houettes: Shadows over Information Operations (Fort Leavenworth, KS: Foreign Military Studies Office, 2005), chaps. 5–6, 10, 14 and passim. See also Pavel Koshkin, ‘Are Cyberwars Between Major Powers Possible? A Group of Russian Cybersecurity Experts Debate the Like- lihood of a Cyberwar Involving the U.S., Russia or China’, Russia Direct, http://russia-direct. org, August 1, 2013, in Johnson’s Russia List 2013 – #143, August 6, 2013, davidjohnson@ starpower.net.

5. Cyber weapons are not necessarily easy to use effectively as enabling instruments for oper- ational-tactical or strategic effect. See Martin C. Libicki, Conquest in Cyberspace: National Secur- ity and Information Warfare (Cambridge: Cambridge University Press, 2007), esp. chaps. 4–5.

6. An expert critique of proposals for minimum deterrence for US nuclear forces appears in: Dr Keith B. Payne, Study Director, and Hon. James Schlesinger, Chairman, Senior Review Group, Minimum Deterrence: Examining the Evidence (Fairfax, VA: National Institute for Public Policy, National Institute Press, 2013). For a favorable expert assessment of the pro- spects for minimum deterrence, see James Wood Forsyth Jr., B. Chance Saltzman, and Gary Schaub Jr., ‘Remembrance of Things Past: The Enduring Value of Nuclear Weapons’, Stra- tegic Studies Quarterly, no. 1 (Spring 2010): 74–90.

7. US Cyber Command plans for the equivalent of a “Star Wars” cyber defense, against attacks on computer networks and other targets, might be delayed or diverted by political contro- versy over NSA surveillance. See David E. Sanger, ‘N.S.A. Leaks Make Plan for Cyberdefense

204 S. J. CIMBALA

Unlikely’, New York Times, August 12, 2013, http://www.nytimes.com/2013/08/13/us/nsa- leaks-make-plan-for-cyberdefense-unlikely.html (accessed August 13, 2013).

8. ‘Putin Calls to Strengthen Protection Against Cyber Attacks’, Itar-Tass, July 5, 2013, in John- son’s Russia List 2013 – #122, July 5, 2013, [email protected].

9. Batyuk, cited in Jonathan Earle, ‘U.S. and Russia Sign New Anti-proliferation Deal’, Moscow Times, June 19, 2013, in Johnson’s Russia List 2013 – #111, June 19, 2013, davidjohnson@ starpower.net.

10. Major Clifford S. Magee, USMC, ‘Awaiting Cyber 9/11’, Joint Force Quarterly, Issue 70 (3rd quarter 2013): 76–82, citation page 76.

11. Dr Panayotis A. Yannakogeorgos and Dr Adam B. Lowther, ‘Saving NATO with Airpower’, Royal Canadian Air Force Journal, no. 1 (Winter 2013): 66–77, citation page 70.

12. See, for example, Chen, An Assessment of the Department of Defense Strategy, 10–11 and passim; Joel Brenner, Glass Houses: Privacy, Secrecy, and Cyber Insecurity in a Transparent World (New York: Penguin Books, 2013), esp. chaps. 6–7; Thomas, Three Faces of the Dragon, and Thomas, Recasting the Red Star: Russia Forges Tradition and Technology Through Toughness (Fort Leavenworth, KS: Foreign Military Studies Office, 2011). See also U.S. Department of Defense, Department of Defense Strategy for Operating in Cyberspace (Washington, DC: U.S. Department of Defense, July 2011), http://www.defense.gov/news/ d20110714cyber.pdf (accessed August 14, 2012), and The White House, International Strat- egy for Cyberspace: Prosperity, Security and Openness in a Networked World (Washington, DC: The White House, May 2011), http://www.whitehouse.gov/sites/default/files/rss_ viewer/international_strategy_for_cyberspace.pdf (accessed August 14, 2012). See also Colin S. Gray, Making Strategic Sense of Cyberpower: Why the Sky Is Not Falling (Woking- ham, UK, September 2012), 8, [email protected]; Robert A. Miller, Daniel T. Kuehl, and Irving Lachow, ‘Cyber War: Issues in Attack and Defense’, Joint Force Quarterly, no. 61 (2nd quarter 2011): 18–23; Libicki, Cyberdeterrence and Cyberwar; P.W. Singer, Wired for War: The Robotics Revolution and Conflict in the Twenty-First Century (New York: Penguin Books, 2009); John Arquilla, Worst Enemy: The Reluctant Transformation of the American Military (Chicago: Ivan R. Dee, 2008), esp. chaps. 6–7; and Libicki, Conquest in Cyberspace, esp. 15–31.

13. Miller, Kuehl, and Lachow, ‘Cyber War’. 14. Brenner, Privacy, Secrecy, and Cyber Insecurity, 3. 15. An example of such an attack was provided by the Stuxnet “worm” used to attack Iran’s cen-

trifuges as part of its nuclear program. Some 1000 of 5000 centrifuges were reportedly tem- porarily disabled by the US and Israel as part of a US program called Olympic Games that began under George W. Bush and continued into the Obama administration. See David E. Sanger, ‘Obama Order Sped Up Wave of Cyberattacks Against Iran’, New York Times, June 1, 2012, http://global.factiva.com/hp/printsavews.aspx?pp (accessed June 1, 2012).

16. Miller, Kuehl, and Lachow, ‘Cyber War’, 19. Some of these objectives might also be accom- plished by “friendly conquest” as opposed to “hostile conquest” in cyberspace: see Libicki, Conquest in Cyberspace, 125–6 for contrasting definitions and the remainder of chap. 6 for pertinent discussion.

17. Patrick M. Morgan discusses the relationship between reexamination of deterrence theory and practice and cyber security in his article, ‘The State of Deterrence in International Politics Today’, Contemporary Security Policy, no. 1 (April 2012): 85–107, esp. 101–3.

18. Gray, Making Strategic Sense of Cyberpower, 36. 19. According to Adam B. Lowther, deterrence can be conceptualized as a continuous spectrum

with three components: deterrence by dissuasion, deterrence by denial and deterrence by threat. Moving across the spectrum, from dissuasion through denial to threat, increases the level of action by the state attempting to deter. See Lowther, ‘How Can the United States Deter Nonstate Actors?’ in Deterrence: Rising Powers, Rogue Regimes, and Terrorism in the Twenty-First Century, ed. Lowther (New York: Palgrave Macmillan, 2012), chap. 9, 163–82, esp. 166–7.

DEFENSE & SECURITY ANALYSIS 205

20. Desmond Butler, Associated Press, ‘Flaws Found in U.S. Missile Shield for Europe’, Army Times, February 9, 2013, http://www.armytimes.com/mobile/news/2013/02/ap-flaws- missile-shield-020913 (accessed February 11, 2013). See also ‘U.S. Missile Defense Shield Flawed – Classified Studies’, Russia Today (RT), February 11, 2013, http://rt.com/usa/ news/us-missile-defense-flaws-811/print/ (accessed February 11, 2013).

21. Committee on an Assessment of Concepts and Systems for U.S. Boost-Phase Missile Defense in Comparison to Other Alternatives, Making Sense of Ballistic Missile Defense: An Assess- ment of Concepts and Systems for U.S. Boost-Phase Missile Defense in Comparison to Other Alternatives (Washington, DC: National Research Council, National Academy of Sciences, National Academies Press, 2012), prepublication copy, www.nap.edu (accessed September 17, 2012).

22. George N. Lewis and Theodore A. Postol, ‘The Astonishing National Academy of Sciences Missile Defense Report’, Bulletin of the Atomic Scientists, September 20, 2013, http://www. thebulletin.org/print/web-edition/op-eds/the-astonishing-national-academy-of-sciences- missile-defense-report.html (accessed February 11, 2013).

23. Rebecca Slayton, Arguments That Count: Physics, Computing, and Missile Defense, 1949– 2012 (Cambridge: MIT Press, 2013).

24. Superior treatment of technical, political and economic challenges to US and NATO plans for European missile defenses is provided in Steven J. Whitmore and John R. Deni, NATO Missile Defense and the European Phased Adaptive Approach: The Implications of Burden Sharing and the Underappreciated Role of the U.S. Army (Carlisle, PA: U.S. Army War College, October 2013).

25. For US and NATO missile defense plans, see LTG Patrick J. O’Reilly, USA, Director, Missile Defense Agency, Ballistic Missile Defense Overview, presented to 10th Annual Missile Defense Conference (Washington, DC: U.S. Department of Defense, March 26, 2012, 12- MDA-6631), http://www.mda.mil/news/downloadable_resources.html (accessed May 23, 2012).

26. Treaty Between the United States of America and the Russian Federation on Measures for the Further Reduction and Limitation of Strategic Offensive Arms (Washington, DC: U.S. Depart- ment of State, April 8, 2010), http://www.state.gov/documents/organization/140035.pdf.

27. See Karen Kaya, ‘NATO Missile Defense and the View from the Front Line’, Joint Force Quarterly, no. 71 (4th Quarter 2013): 84–9; John F. Morton and George Galdorisi, ‘Any Sensor: Any Shooter: Toward an Aegis BMD Global Enterprise’, Joint Force Quarterly, no. 67 (4th Quarter 2012): 85–90; and Frank A. Rose, Deputy Assistant Secretary, Bureau of Arms Control, Verification and Compliance, Growing Global Cooperation on Ballistic Missile Defense, Remarks as Prepared, Berlin, Germany, September 10, 2012, http://www. state.gov/t/avc/rls/197547.htm (accessed September 13, 2012).

28. For example, see “Moscow Needs More ‘Predictability’ in NATO Missile Defense Plans,” RIA Novosti, October 23, 2013, in Johnson’s Russia List 2013 – #191, October 24, 2013, [email protected].

29. See Kevin Ayers, ‘Expanding Zeus’ Shield: A New Approach for Theater Ballistic Missile Defense in the Asia-Pacific Region’, Joint Force Quarterly 84 (1st Quarter 2017): 24–31 for a discussion of challenges and opportunities. See also essays in Dr Adam Lowther, ed., The Asia-Pacific Century: Challenges and Opportunities (Maxwell Air Force Base, Alabama: Air University Press, April 2013).

30. Increased interest in “left of launch” techniques (attacking before missiles reach the launch pad and/or interfering with the launch itself)is noted in David E. Sanger and William J. Broad, ‘Trump Inherits a Secret Cyberwar Against North Korean Missiles’, New York Times, March 4, 2017, https://www.nytimes.com/2017/03/04/world/asia/north-korea- missile-program-sabotage.html. See also Jesse T. Wasson and Christopher E. Bluesteen, ‘Taking the Archers for Granted: Emerging Threats to Nuclear Weapon Delivery Systems’ (working paper presented at International Studies Association, Annual Meeting, 2017, Bal- timore, MD).

206 S. J. CIMBALA

31. Peter Baker and David E. Sanger, ‘Obama Has Plans to Cut U.S. Nuclear Arsenal, If Russia Reciprocates’, New York Times, June 18, 2013, http://www.nytimes.com/2013/06/19/world/ (accessed June 19, 2013). See also Roberts Rampton and Stephen Brown, ‘Obama Challenges Russia to Agree to Deeper Nuclear Weapon Cuts’, Reuters, June 20, 2013, in Johnson’s Russia List 2013 – #212, June 20, 2013, [email protected].

32. Force structures in the analysis are notional and are not necessarily predictive of actual deployments. For expert appraisal, see Hans M. Kristensen, Trimming Nuclear Excess: Options for Further Reductions of U.S. and Russian Nuclear Forces, Special Report No. 5 (Washington, DC: Federation of American Scientists, December 2012), www.FAS.org (accessed January 23, 2013); Gen. (Ret.) James Cartwright, Chair, Global Zero Nuclear Policy Commission, Report: Modernizing U.S. Nuclear Strategy, Force Structure and Posture (Washington, DC: Global Zero, May 2012), www.globalzero.org; Pavel Podvig, ‘New START Treaty in Numbers’, from his blog, Russian strategic nuclear forces, April 9, 2010, http://russianforces.org/blog/2010/03/new_start_treaty_in_numbers.shtml. See also Joseph Cirincione, ‘Strategic Turn: New U.S. and Russian Views on Nuclear Weapons’, New America Foundation, June 29, 2011, http://newamerica.net/publications/policy/ strategic_turn; and Arms Control Association, ‘U.S. Strategic Nuclear Forces under New START’, http://www.armscontrol.org/factsheets/USStratNukeForceNewSTART (accessed July 18, 2011).

33. According to some experts, the US could conceivably satisfy its requirements for strategic nuclear deterrence with fewer than 400 deployed warheads on intercontinental launchers. See James Wood Forsyth, Jr., B. Chance Saltzman, and Gary Schaub, Jr., ‘Minimum Deter- rence and Its Critics’, Strategic Studies Quarterly, no. 4 (Winter 2010): 3–12. Counterargu- ments appear in Payne and Schlesinger, Minimum Deterrence: Examining the Evidence, passim, esp. 65–70.

34. Payne, The Fallacies of Cold War Deterrence and a New Direction, 101. 35. For example, see Keir A. Lieber and Daryl G. Press, ‘The New Era of Nuclear Weapons,

Deterrence and Conflict’, Strategic Studies Quarterly, no. 1 (Spring 2013): 3–14. 36. Cham E. Dallas, et al., ‘Nuclear War Between Israel and Iran: Lethality Beyond the Pale’, Con-

flict and Health, May 10, 2013, via BioMed Central, http://www.conflictandhealth.com/ content/7/1/10 (accessed May 15, 2013). See also Anthony H. Cordesman, Iran, Israel, and Nuclear War (Washington, DC: Arleigh A. Burke Chair in Strategy, Center for Strategic and International Studies, Revised November 19, 2007); and U.S. Congress, Office of Tech- nology Assessment, The Effects of Nuclear War (Washington, DC: U.S. Government Printing Office, May 1979), esp. 27–44 for case studies of attacks on a single city. Office of Technology Assessment cautions that the effects of even a small or limited nuclear attack would be “enor- mous” (4).

37. Rogozin, cited in Ilya Maksimov and Sergey Kuksin, ‘Russia Will Not Be a Bystander in the Arms Race’, Rossiyskaya Gazeta, June 28, 2013, in Johnson’s Russia List 2013 – #122, July 5, 2013, [email protected].

38. Lora Saalman, ‘How Chinese Analysts View Arms Control, Disarmament, and Nuclear Deterrence after the Cold War’, in Engaging China and Russia on Nuclear Disarmament, ed. Cristina Hansell and William C. Potter (Monterey, CA: James Martin Center for Nonpro- liferation Studies, Occasional Paper No. 15, April 2009), 47–71.

39. For an expansion of the point about the possible conflict between Obama nuclear disarma- ment and advanced conventional weapons modernization goals, see Andrew Futter and Ben- jamin Zala, ‘Advanced US Conventional Weapons and Nuclear Disarmament: Why the Obama Plan Won’t Work’, Nonproliferation Review, no. 1 (2013): 107–22, doi:10.1080/ 10736700.2012.761790.

40. Paul Bracken, The Second Nuclear Age: Strategy, Danger, and the New Power Politics (New York: Henry Holt – Times Books, 2012), esp. 215–20 and 267–70. For additional perspective on the second nuclear age, see Lowther, Rising Powers, Rogue Regimes; Paul K. Davis, Struc- turing Analysis to Support Future Decisions about Nuclear Forces and Postures (Santa Monica, CA: RAND National Defense Research Institute, Working Paper, September 2011, WR-878-

DEFENSE & SECURITY ANALYSIS 207

OSD); Michael Krepon, Better Safe Than Sorry: The Ironies of Living with the Bomb (Stan- ford, CA: Stanford University Press, 2009), esp. 94–132; and Colin S. Gray, The Second Nuclear Age (Boulder, CO: Lynne Rienner, 1999).

41. For some interesting possibilities in this regard, see George H. Quester, Nuclear First Strike: Consequences of a Broken Taboo (Baltimore: Johns Hopkins University Press, 2006), 24–52, esp. 25–30. This author road tests some models for multipolar nuclear power systems in his working paper in progress, “Anticipatory Attack,” available upon request.

42. Committee on an Assessment of Concepts and Systems for U.S. Boost-Phase Missile Defense in Comparison to Other Alternatives, Making Sense of Ballistic Missile Defense: An Assess- ment of Concepts and Systems for U.S. Boost-Phase Missile Defense in Comparison to Other Alternatives.

43. Sources of instability in the second nuclear age will include major powers, secondary powers and groups, sometimes making creative political uses of nuclear weapons short of war, over- laid by great power competition within a multipolar nuclear system. See Bracken, The Second Nuclear Age, esp. 93–126; James E. Goodby, ‘The End of a Nuclear Era’, New York Times, August 15, 2013, in Johnson’s Russia List 2013 – #148, August 14, 2013, davidjohnson@ starpower.net; and C. Dale Walton and Colin S. Gray, ‘The Geopolitics of Strategic Stability: Looking Beyond Cold Warriors and Nuclear Weapons’, chap. 3 in Strategic Stability: Con- tending Interpretations, ed. Elbridge A. Colby and Michael S. Gerson (Carlisle, PA: Strategic Studies Institute and U.S. Army War College Press, February 2013), 85–115.

Disclosure statement

No potential conflict of interest was reported by the author.

208 S. J. CIMBALA