Nuclear posture and cyber threats: Why deterrence by punishment is not credible - and what to do about it

Eva-Nour Repussard

Source Link

The United Kingdom’s latest nuclear doctrine suggests that severe cyber-attacks on their national or critical infrastructure could provoke a nuclear response. Despite this, cyber-attacks against the UK have surged over the past decade. This increase can be partly attributed to the perceived lack of credibility in the UK’s nuclear retaliation threat towards cyber-attacks. With regard to cyber-attacks, the strategy of deterrence by punishment is ineffective for two main reasons: i) the threshold for transitioning from a cyber to a kinetic response remains hard to meet in times of relative peace between two countries, and ii) the inherent challenges in attributing cyber-attacks to specific state actors. Instead of deterrence by punishment, the UK should seek to increase its resilience to cyber-attacks and focus on a strategy of deterrence by denial regarding cyber threats.

Nuclear postures are increasingly explicit about the conditions under which nuclear weapon states might use nuclear weapons in response to non-nuclear threats, particularly from emerging technologies or emerging threats. This is evident in the United Kingdom’s 2021 Integrated Review, which states that they “will not use, or threaten to use, nuclear weapons against any non-nuclear weapon state party to the Treaty on the Non-Proliferation of Nuclear Weapons 1968 (NPT)”, but then continues by stating that they “reserve the right to review this assurance if the future threat of weapons of mass destruction, such as chemical and biological capabilities, or emerging technologies that could have a comparable impact, makes it necessary”. Arguably, the French posture on “core interests”, Russia’s Principle on Deterrence, and the United States’ 2022 Nuclear Posture Review, all hint at a similar posture in regard to nuclear weapons and “emerging threats”.