"Cyber MAD" is a Bad Idea. Really Bad.
I don't know how many times I have to say this, but nothing screams "legacy future" like trying to shoe-horn cold-war thinking into "cyber." This latest attempt doesn't disappoint (or maybe it does, depending on how you look at it) because it completely miss two key points:
- Cyberspace is not meat-space;
- Digital weapons are nothing like atomic ones.
Yes, like the nuclear arms race, it is in fact more expensive to defend yourself than it is to attack someone. Generally speaking. Its OK to paint with a broad brush on this point because so many entities online are so woefully inadequate when it comes to defense that we forget that there are actually some who are quite hard and expensive to attack. Any serious colored-hat who is being honest will tell you that they deal with more than their fair share of unknowns and 'unknown unknowns' when going after any given target.
But unlike malicious actions in cyberspace, there is no parsing nuclear war. You're nuked, or you're not. Cyber-espionage, cyber-crime, cyber-attack...all indistinguishable in all technically meaningful ways. Each has a different intent, which we are left to speculate about after-the-fact. In the other scenario, no one is around to speculate why a battalion of Reds turned their keys and pushed their buttons.
Attacker identity is indeed important whether you're viewing a potential conflict through nuclear or digital lenses, but you know what excuse doesn't work in the nuclear scenario? "It wasn't me."
Um, IR burn says it was...
There is no such equivalent in cyberspace. You can get close - real close - given sufficient data and time, but there will be no Colin Powell-at-the-UN-moment in response to a cyber threat because "it wasn't me" is a perfectly acceptable excuse.
But we have data.
You see what I want you to see.
You know what you can't argue about? Fallout.
All of this, ALL OF THIS, is completely pointless because if some adversary had both the will and the wherewithal to attack and destroy our and just our critical infrastructure and national security/defense capabilities via cyber means...what are we meant to strike back with? Who are those who happen to be left unscathed supposed to determine who struck first? I was not a Missileer, but I'm fairly certain you can't conduct granular digital attribution from the bottom of an ICBM silo.
What is the point of worrying about destruction anyway? Who wants that? The criminals? No, there is too much money to be made keeping systems up and careless people online. The spies? No, there is too much data to harvest and destruction might actually make collection hard. Crazy-bent-on-global-domination types? This is where I invoke the "Movie Plot Threat" clause. If the scenario you need to make your theory work in cyberspace is indistinguishable from a James Bond script, you can't be taken seriously.
MAD for cyberspace is a bad idea because its completely academic and does nothing to advance the cause of safety or security online (the countdown to someone calling me "anti-intellectual" for pointing out this imperial nudity starts in 5, 4, 3....). MAD, cyber deterrence, all this old think is completely useless in any practical sense. You know why MAD and all those related ideas worked in the 60s? Because they dealt with the world and the problem in front of them as it was, not how they wished it to be.
I wholeheartedly agree that we need to do more and do more differently in order to make cyberspace a safer and more secure environment. I don't know anyone who argues otherwise. I'm even willing to bet there is a period of history that would provide a meaningful analog to the problems we face today, but the Cold War isn't it.
