Accountability and cyber conflict: examining institutional constraints on the use of cyber proxies

Abstract

As state-sponsored cyber operations have proliferated, some states are outsourcing these operations to non-state cyber proxies. However, given the relative ease of outsourcing cyber operations, it is puzzling why more states are not engaged in this practice. I examine how domestic accountability institutions potentially explain this restraint in the use of cyber proxies. I argue that in cases where the incumbent is likely to be held to account for cyber operations, there is restraint in the use of proxies. Moreover, I distinguish vertical from horizontal accountability and argue that because vertical accountability mechanisms directly threaten the tenure of the incumbent if outsourced cyber operations go wrong, it has a greater constraining effect relative to horizontal accountability. I test these propositions with new data on the activities of several hacker groups and robustly confirm that accountability institutions do place significant constraints on the use of cyber proxies.

Exploring Team Competencies in Cybersecurity

“…While most cybersecurity professionals work on their tasks independently, due to complicated organizational stovepipes and information sharing constraints, protecting information and ensuring cyber safety remain the team's mutual accountability. When individuals engage in team-oriented environments, mutual accountability holds the team, rather than specific individuals, accountable for both success and failure (Akoto, 2021;Knox & Simpson, 2004).…”

Until consensus: Introducing the International Cyber Expression dataset

“…Theoretical predictions are ubiquitous, but testing and adjudicating between those predictions are challenging owing to the unique features of cyberspace (Gorwa and Smeets, 2019; Shore, 2022; Whyte, 2018). As Shandler and Canetti (2024) describe, ‘the [cyber] domain is complex, quality data is sparse, [and] affairs are shrouded in secrecy.’ To that end, recent work has attempted to quantify patterns in a number of important issue areas: cyber conflict and escalation (Kostyuk and Zhukov, 2019; Valeriano and Maness, 2015); strategy and capacity (Kostyuk, 2021; Valeriano et al, 2018); proxy warfare (Akoto, 2022; Borghard and Lonergan, 2016; Canfil, 2022; Herzog, 2011; Leal and Musgrave, 2022; Maurer, 2018a); psychology and decisionmaking (Gomez, 2019; Gomez and Whyte, 2022; Gomez and Villar, 2018; Hedgecock and Sukin, 2023; Kostyuk and Wayne, 2021; Shandler et al, 2021, 2022) and more. Despite this trend, the study of cyber norms has not received similar treatment.…”