Intelligence, Policy, and the War in Iraq

Traditional conceptions of state-sponsored cyber economic espionage suggest that countries with different product profiles should experience high levels of espionage between them. However, this is not what we observe empirically. Incidence of economic espionage tends to be prevalent between countries with similar product and manufacturing profiles. This suggests that we may be missing critical parts of what drives state-sponsored cyber economic espionage. To help unravel this puzzle, I develop a novel theoretical framework that proposes that because attackers seek to maximize the expected utility of stolen information, they target countries that possess similar productive capabilities as themselves. Consequently, countries with dissimilar product profiles should avoid targeting each other for espionage. I test this argument using data on states’ product complexities and cyber economic espionage for a global sample of countries in a dyadic analytical framework. The results robustly show that for any pair of countries, as the complexities of their products diverge, they become significantly less likely to aim espionage attempts at each other. This study thus contributes new insights to explain why cyber economic espionage appears restricted to only a small number of advanced economies. It also illustrates the utility of large-N dyadic approaches in studying state-sponsored cyber espionage.

Section: Discussionmentioning

confidence: 99%

Who spies on whom? Unravelling the puzzle of state-sponsored cyber economic espionage

Akoto

2024

“…In my case, I have been following the IR cybersecurity debate for several years, which has made me sceptical about ‘cyberwar’ and other military analogies (Branch, 2021; Dunn Cavelty, 2008; Gartzke, 2013; Hansen and Nissenbaum, 2009; Lonergan and Lonergan, 2023). I prefer an alternate interpretation of cyber conflict as an intelligence contest (Chesney and Smeets, 2023; Gartzke and Lindsay, 2015; Rovner, 2019). This implies that to explain cyber performance, I first need to come up with a general theory of intelligence performance.…”

Section: The First Cyber Campaignmentioning

confidence: 99%

“…Most threat activity in cyberspace is more like intelligence than warfare (Lindsay, 2021; Rid, 2012; Rovner, 2019). But what is intelligence?…”

Section: Introductionmentioning

confidence: 99%

Abducted by hackers: Using the case of Bletchley Park to construct a theory of intelligence performance that generalizes to cybersecurity

Lindsay

2024

Most cyber intrusions are a form of intelligence rather than warfare, but intelligence remains undertheorized in international relations (IR). This article develops a theory of intelligence performance at the operational level, which is where technology is most likely to affect broader political and military outcomes. It uses the pragmatic method of abduction to bootstrap general theory from the historical case of Bletchley Park in World War II. This critical case of computationally enabled signals intelligence anticipates important later developments in cybersecurity. Bletchley Park was uncommonly successful due to four conditions drawn from contemporary practice of cryptography: radio networks provided connectivity; German targets created vulnerability; Britain invested in bureaucratic organization; and British personnel exercised discretion. The method of abduction is used to ground these particular conditions in IR theory, revisit the evaluation of the case, and consider historical disanalogies. The result is a more generalizable theory that can be applied to modern cybersecurity as well as traditional espionage. The overarching theme is that intelligence performance in any era depends on institutional context more than technological sophistication. The political distinctiveness of intelligence practice, in contrast to war or coercive diplomacy, is deceptive competition between rival institutions in a cooperatively constituted institutional environment. Because cyberspace is highly institutionalized, furthermore, intelligence contests become pervasive in cyberspace.

“…Rather than decisive weapons of war, cyberspace more often tends to support long-term competition beneath the threshold of armed conflict (Fischerkeller et al, 2022; Valeriano et al, 2018). Cyber operations thus function as a disruptive technology, altering but not transforming the dynamics of strategic exchange (Brantly, 2016; Gartzke and Lindsay, 2015; Maschmeyer, 2021; Rid, 2012; Rovner, 2019). 2…”

Section: Cyber Triggers and Cyber Responses In Crisis Escalationmentioning

confidence: 99%

How cyber operations can reduce escalation pressures: Evidence from an experimental wargame study

Jensen,

Valeriano,

Whitt

2024

Cyber operations ranging from deception and espionage to disruption and high-end degradation have become a central feature of modern statecraft in the digital age, yet we lack a clear understanding of how decision-makers employ and respond to cyber operations in times of crisis. Our research provides theoretical mechanisms and empirical evidence for understanding how decision-makers react to cyber triggers and utilize cyber responses during crises. Specifically, we argue that the availability of cyber response creates off-ramps for non-escalatory engagement. Based on experimental wargames involving rival states with power parity in militarized disputes and randomized cyber triggers and response options, we find the availability of cyber response options reduces escalatory behavior via a substitution mechanism. In the absence of cyber response options, however, participants pursue more conventional, escalatory actions, regardless of the triggering mechanism. Our findings underscore how enhancing the availability of cyber response options might reduce strategic escalation risks and offer the space to bargain during periods of conflict.