CONSEQUENCES OF CYBERPROXIES

POL370F

MIAMI UNIVERSITY

PROF. BENJAMIN BARTLETT

THE PARADOX OF CYBER PROXIES

• Something of a paradox makes cyber proxies possible:
• Cyber means are cheap enough to be acquired by privateactors/organizations
• But, because private sector (or criminal sector) pay better thangovernment, often have more skilled personnel in these sectors than ingovernment
• This location of cyber power in private or criminal organizationsraises a number of problems and issues.

ISSUES RAISED BY CYBER PROXIES

1. Proxies make cyber capabilities available to more states.
2. Proxies make attribution more difficult.
3. Proxies create oversight problems.
4. Proxies raise questions about what is a legitimate targetin cyber conflict.

PROXIES MAKE CYBER CAPABILITIES AVAILABLE TOMORE STATES

• Possibly this increases instability.
• On the other hand, weaker states may have troubleincorporating proxy forces effectively.
• Also, stronger states may “price out” weaker states.
• Definitely this increases repression.
• Even poorer states can afford to surveil dissidents.

PROXIES MAKE ATTRIBUTION MORE DIFFICULT

• Three ways:
1. Plausible deniability.
2. Multiple proxies working for single state.
3. Single proxy working for multiple states.
• This reduces stability.
• (Also makes deterrence harder; will return to this later.)

PROXIES CREATE OVERSIGHT PROBLEMS

Interests of proxies not necessarily the same as the state’s.

1. May fail to do what they are supposed to do.
2. May take actions not endorsed by the state.
3. May use resources given to work for another “employer”.
4. May sell cyber weapons, information, etc. to an adversary state.

TRADE-OFF BETWEEN OVERSIGHT ANDATTRIBUTABILITY

The more control a state has over a proxy (forexample, by careful monitoring or by exclusivity ofuse---that is, being the only state that uses thatproxy) the more obvious an action taken by thatproxy is attributable to the state.

ARE PROXIES A LEGITIMATE TARGET?

• In cyber conflict, militaries are legitimate targets, but howdo we deal with proxies?
• If proxies are carrying out end-to-end attacks, then seem likelegitimate targets.
• But what about if they are just providing cyber weapons?Doing intelligence/reconnaissance?

CONCLUSION

Proxies create a number of unresolved policy issues:

• Should we allow firms to sell these technologies, and to whom?
• What should the rules of engagement be?
• When should governments use proxies? How do governmentssuccessfully integrate them with their militaries? How do theyprovide oversight? Etc.