How to Stop a Cyberwar

The escalating conflict with Russia has added urgency to a debate over U.S. policy

- Joshua Brustein

A common explanation for why the Soviet Union never used nuclear weapons during the Cold War was the expectation that any attack would likely prompt a devastating nuclear response. The fear of mutually assured destruction was enough to keep both the USSR and the U.S. from launching a nuclear attack, even as they spent decades building huge stockpiles of weapons.

Cyberweapons are different. Cyberattacks by both governments and private hackers have exploded in recent years. Many of these are financially motivated, but others involve espionage or, in several high-profile cases, the sabotage of physical infrastructure. There’s broad agreement that at some point a cyberattack would be considered an act of war. Yet no one knows quite where the line is.

The situation is more dangerous than ever. Russia’s bloody invasion of Ukraine raises the specter of cyberattacks starting an escalatory spiral that results in an all-out war with the U.S. The Biden administration has already warned Russian President Vladimir Putin against targeting 16 sectors at the heart of U.S. economic and national security, including energy and finance. “We will respond with cyber,” Joe Biden told reporters last summer after meeting Putin face to face in Geneva. The president didn’t lay out exactly what that would entail but added, darkly, “he knows.”