Escalation Dynamics in Cyberspace by Erica Lonergan and Shawn Lonergan joins a growing shelf of books about cybersecurity in international relations (IRs). This is among the best. The authors bring to their subject a rare combination of depth in IR theory and practitioner experience in cybersecurity. Erica Lonergan, currently an Assistant Professor at the School of International and Public Affairs at Columbia University, served as a senior director on the US Cyberspace Solarium Commission. Shawn Lonergan served in the US Army, holding leadership positions in US Cyber Command and the National Security Agency. This experience gives them a lot of credibility in a book about credibility in cyberspace.

Lonergan and Lonergan make two important contributions to the cybersecurity debate. The first is challenging the conventional wisdom that cyberattacks will provoke escalation. A prevalent worry is that hacking critical infrastructure or causing other harms in cyberspace is likely to exacerbate security dilemmas and undermine strategic stability, potentially triggering military retaliation (e.g. Chris Blattman, “Cyber Warfare Is Getting Real,” Wired, 2022). The authors make a strong case that this risk is greatly exaggerated. They find little evidence in the empirical record that cyberattacks cause spirals of escalation. On the contrary, state responses to cyberattacks, when they occur at all, tend to be delayed, measured, and nonmilitary: responses typically employ economic or legal tools instead.

The authors are in good company here. IR scholars have been generally skeptical about the whole idea of cyberwar (e.g., Thomas Rid, “Cyber War Will Not Take Place,” Journal of Strategic Studies 35(5), 2012; Erik Gartzke, “The Myth of Cyberwar: Bringing War in Cyberspace Back Down to Earth,” International Security 38(2), 2013; Brandon Valeriano and Ryan C. Maness, Cyber War versus Cyber Realities: Cyber Conflict in the International System, 2015). There is a growing consensus in the literature that cyber operations are poor substitutes for military force and ill-suited for coercive diplomacy (for a recent review see Myriam Dunn Cavelty, Tobias Pulver, and Max Smeets, “The Evolution of Cyberconflict Studies,” International Affairs 100(6), 2024): 2317–39).

Political actors mostly use cyber operations for intelligence collection, influence campaigns, and financial cybercrime. Lonergan and Lonergan provide an excellent synthesis of this emerging skeptical consensus, taking aim at popular shibboleths such as the idea that cyber conflict happens “at the speed of electrons” or that cyberspace is systemically “offense dominant.” The authors show that there are in fact many defensive measures that create barriers to offensive access and persistence, especially against highly sensitive targets, which in turn encourages threat actors to exercise discretion and restraint. Similar myth-busting arguments have been made before (e.g., Rebecca Slayton, “What Is the Cyber Offense-Defense Balance? Conceptions, Causes, and Assessment,” International Security 41(3), 2017; Lennart Maschmeyer, “The Subversive Trilemma: Why Cyber Operations Fall Short of Expectations,” International Security 46(2), 2021; Max Smeets, “Cyber Arms Transfer: Meaning, Limits and Implications,” Security Studies 31(1), 2022); but these arguments are especially convincing coming from an author with experience in the National Security Agency’s Tailored Access Operations unit.

The book’s second, and more original, contribution turns the conventional wisdom on its head. The authors argue that cyber operations, far from being a provocative escalation, are often more useful for de-escalating crises. Most of the IR literature on cyber escalation has provided a negative corrective, as discussed above, but this leaves us with the puzzle of why states even bother with cyber conflict beyond the obvious intelligence applications. Lonergan and Lonergan break new ground here by providing a more positive account of how and why cyber operations can be used to manage the tensions of international politics without resorting to war.

The same features of cyber operations that make them poor tools of coercion, the authors argue, make them attractive tools for de-escalation. Cyber operations that depend on secrecy or deniability make for poor signals. Either the threat cannot be revealed to the target or the very act of revealing it enables the target to take countermeasures against the threat. It is very hard to use complicated, secret means with typically limited, reversible effects to credibly signal a willingness to escalate to higher levels of violence. However, as the authors put it, “cyber operations have limited utility as costly signals of resolve but nevertheless have unique properties that can make them advantageous for accommodative signaling and crisis de-escalation” (91).

This works because there is a lot of room at the bottom in cyberspace. It is hard to “go big” given the nature of offensive cyber operations, but there are limitless ways to harass and inflict friction without inflicting serious damage. The discreetly observable choice to employ a cyberattack—and at the same time, importantly, the observable choice not to employ a military attack—sends a message that an actor is interested in competing at the lower end of the conflict spectrum. Precisely because cyberattacks are not credible signals of resolve (i.e., they do not communicate a willingness to run the risk and pay the price of escalation) they can credibly signal an interest in avoiding conflict or accommodating a rival. Cyber operations that do not cause any real or lasting harm also enable actors to back away from a crisis while “doing something” to save face. In this respect, cyber operations have much in common with traditional covert action that is designed specifically to avoid escalation (e.g., Austin Carson, Secret Wars: Covert Conflict in International Politics, 2018; Michael Poznansky, In the Shadow of International Law: Covert Intervention in the Postwar World, 2020).

The authors offer a major caveat, however. Cyber operations in combination with more traditional military operations may create pressures to escalate. Hacking nuclear command and control systems, for instance, may undermine mutual information about the balance of power and create windows of vulnerability (the risks are surveyed in Jon R. Lindsay, “Cyber Operations and Nuclear Escalation: A Dangerous Gamble,” in Nuclear Command, Control, and Communications: A Primer on US Systems and Future Challenges, ed. James J. Wirtz and Jeffrey A. Larsen, 2022). Importantly, the escalatory pressure stems from questions about the willingness and ability to employ conventional or nuclear forces, rather than the damage inflicted in cyberspace alone. In other words, the “cyber domain” may be surprisingly more stable than widely believed, even as “cross-domain” interactions are fraught with danger.

Escalation Dynamics in Cyberspace is a must-read for anyone interested in the increasingly prevalent role of cyber operations in international politics. It will also be of interest in more general debates about political signaling and political secrecy. The book invites future research to further clarify the causal mechanisms of accommodative signaling, conduct more systematic empirical tests, and work through the national security policy implications. If cyber threat activity is a symptom of strategic stability rather than a harbinger of disaster, then cyber strategy may be overdue for an overhaul.