Cybersecurity and Military Strategy: The Effectiveness of Attribution as a Deterrence

Abstract: The increasing frequency of cyber attacks and technological change have amplified the potential adverse effects of successful, large-scale cyber attacks. While detecting the source of cyber threats is difficult, technological capabilities are making it easier. Along with my co-author, Kevin Risser, I argue that the ability to identify cybersecurity threats provides a mechanism for deterrence since prospective hackers take into account the expected costs of punishment—that is, penalties upon being caught by either their government or international authorities. In particular, we discuss the extent to which cyber threat attribution technologies and security infrastructures affect military strategies. First, we contextualize our argument through a lens of standard mutual assured destruction and deterrence theory. While there are parallels between the two, cybersecurity threats are fundamentally different because of their diffuse and mobile nature. Second, we build a game-theoretic model to illustrate our insight that attribution provides a deterrent. Our model provides a closed-form relationship between the prospective hacker’s beliefs of evading attribution and the expected benefits/costs of an attack. We close our paper with considerations of future research.

About the Speaker: Christos Makridis is a Ph.D. candidate at Stanford University’s Management Science & Engineering department researching macro and public economics. He is also the Editor of the UNESCO-sponsored Global Water Forum’s economics section, and a Non-Resident Fellow at the North American Research Partnership. Christos studies the quantitative effects of a wide range of public policy interventions, such as tax policy on productivity and environmental policy on pollution abatement, in stochastic dynamic general equilibrium models. Christos holds a B.S. in Economics and Minor in Mathematics from Arizona State University.