To Retaliate or Not: A Matter of Cyber Risk Perception

This thesis investigates variation in state responses to hostile cyber operations. The central argument is that states' strategic cultures and historical experiences shape their risk attitudes in cyber attack scenarios, with important consequences for their willingness (or not) to carry out meaningful punishment. To guide the empirical investigation, the thesis develops a conceptual framework drawing from and adapting the "risk society" theory in Sociology - an approach that has not yet been applied in cyber studies. The thesis explains weak state responses as a result of cultural and historical forces that produce sensitivities to the inherent risks and uncertainties of the operational environment of cyberspace. It explains strong state responses as the result of a different sensitivity: preoccupation with an existential threat, which produces a willingness to accept operational risks. Conceptually, the thesis contributes to domestic-level constructivism in International Relations by elaborating upon the historical and cultural roots of national risk profiles in cyber conflict scenarios. Empirically, it applies the risk framework to three case studies. It argues that as a risk society, the United States failed to punish cyber attacks meaningfully due to concerns about risks arising from the operational environment - particularly the risk of conflict escalation. By contrast, Israel - a threat society - carried out strong punishment because of its preoccupation with the existential threat posed by Iran, which prompted Israel to tolerate operational risks. Although Estonia was also a threat society, it moderated its response to cyber attacks because of its membership within NATO, a risk community whose sensitivities Estonian officials decided to appease because of their desire to retain alliance support in face of the perceived existential threat posed by Russia.

This research comes under the EPSRC Cyber Security research theme and social sciences

It is part of the nature of Cyber Security - and a key reason for the urgency in developing new research approaches - that it now is a concern of every section of society, and so the successful CDT will have a very broad impact indeed. We will ensure impact for:

* The IT industry; vendors of hardware and software, and within this the IT Security industry;

* High value/high assurance sectors such as banking, bio-medical domains, and critical infrastructure, and more generally the CISO community across many industries;

* The mobile systems community, mobile service providers, handset and platform manufacturers, those developing the technologies of the internet of things, and smart cities;

* Defence sector, MoD/DSTL in particular, defence contractors, and the intelligence community;

* The public sector more generally, in its own activities and in increasingly important electronic engagement with the citizen;

* The not-for-profit sector, education, charities, and NGOs - many of whom work in highly contended contexts, but do not always have access to high-grade cyber defensive skills.

Impact in each of these will be achieved in fresh elaborations of threat and risk models; by developing new fundamental design approaches; through new methods of evaluation, incorporating usability criteria, privacy, and other societal concerns; and by developing prototype and proof-of-concept solutions exhibiting these characteristics. These impacts will retain focus through the way that the educational and research programme is structured - so that the academic and theoretical components are directed towards practical and anticipated problems motivated by the sectors listed here.