Cyber Pearl Harbor: Analogy, fear, and the framing of cyber security threats in the United States, 1991-2016

Abstract

During the two and a half decades leading up to the Russian cyber attacks on the 2016 U.S. presidential election, public policy discourse about cybersecurity typically framed cybersecurity using metaphors and analogies to war and tended to focus on catastrophic doom scenarios involving cyber attacks against critical infrastructure. In this discourse, the so-called “cyber Pearl Harbor” attack was always supposedly just around the corner. Since 2016, however, many have argued that fixation on cyber Pearl Harbor-like scenarios was an inaccurate framing that left the United States looking in the wrong direction when Russia struck. This essay traces the use of the cyber Pearl Harbor analogy and metaphor over the 25-year period preceding the Russian cyber attacks of 2016. It argues that cyber Pearl Harbor has been a consistent feature of U.S. cybersecurity discourse with a largely stable meaning focused on catastrophic physical impacts. Government officials have been primarily responsible for driving these concerns with news media uncritically transmitting their claims. This is despite the fact that such claims were often ambiguous about just who might carry out such an attack and often lacked supporting evidence.

On market concentration and cybersecurity risk

“…Models of managing cyber risk at the level of an individual firm suggest that expenditure should not exceed 37 per cent of the expected costs of a security incident (Gordon and Loeb 2002;Gordon and Loeb 2006;Baryshnikov 2012;Geer 2015;Gordon et al 2015). Yet, accurately measuring cybersecurity events is hugely challenging, as measures often suffer from problems of the denominator (Jardine 2015(Jardine , 2018(Jardine , 2020, incompatible metrics (Brecht and Nowey 2013), insufficient attention to over time trends (Geer and Jardine 2017;Jardine 2020), measures distorted by political or economic incentives (Anderson et al 2008;Anderson et al 2013;Lawson and Middleton 2019), a lack of data transparency necessitating clever measurement techniques (Woods, Moore, and Simpson 2019), reporting biases (Florêncio and Herley 2011) and data aggregation problems (Jardine 2017b; Jardine 2020). Issues of technological flux likewise present a challenge where past data might supremely fail to predict future events.…”

Military Operations in Cyberspace

“…As networks of interlinked computers increasingly pervaded the public and the private sectors of nearly all countries on earth, fears that vulnerabilities within these networks constituted existential threats increasingly rose to prominence both within academia and beyond. These fears culminated in a term coined by John Markoff, a New York Times reporter, who wrote of a "electronic Pearl Harbor" (Lawson and Middleton 2019). The term stuck and became enmeshed within general scholarly vernacular as the potential for a "Cyber Pearl Harbor."…”

Effects of ‘Digital’ Country’s Information Security on Political Stability

“…For example, cyber-intervention in the 2016 US presidential election resulted in mainstream Pearl Harbor references. The 'cyber Pearl Harbor' analogy was used to define massive cyberattacks against the US infrastructure that could lead to catastrophic doom scenarios [17]. Therefore, cyber threats and information security vulnerabilities are at the forefront of Americans' attention.…”