The implications of persistent (and permanent) engagement in cyberspace

Abstract The USA is in the midst of its most resounding policy shift on cyber conflict with profound implications for national security and the future of the Internet. The US Department of Defense (DoD) cyber strategy concludes that since US cyber forces are in “persistent engagement” with adversaries, then it is an imperative for them to “defend forward” to “continuously contest” them. The implicit prediction is that adversaries will become less effective, forced to expend more resources on defense and rebuild capabilities and infrastructure. John Bolton, the national security advisor, has boasted of a new policy to use offensive cyber operations to impose costs on adversaries and create the frameworks of deterrence. Over time, proponents suggest, these policies will be stabilizing as adversaries engage over repeated engagements in “tacit bargaining” of what is and is not acceptable leading to “more stable expectations of acceptable and unacceptable behavior”. This article advances existing research by including a deeper discussion the academic and policy background on active defense and cyber deterrence, discussing the implied causal chain of “persistent- engagement stability theory,” and analyzing potential risks, especially specific feedback loops which may amplify or dampen cyber conflict. It concludes with specific policy solutions to help mitigate these risks and a suggestion for a broader theory, “stability-enhancing engagement theory.”