Ben Buchanan’s timely and relevant book is the most complete appraisal of the dynamics of cyber conflict and strategy within the realist paradigm. In the spirit of legendary theorists such as Thomas Schelling, Robert Jervis, Charles Glaser, and John Herz, among others, Buchanan takes the underpinnings of the security dilemma logic and applies it to the cyber domain of international conflict. The security dilemma is the idea that in an anarchic international system of self-help, states will have to provide for their own security, and the resulting buildup of military power will inevitably make other states feel less secure, and these states will also build up their strength, leading to misperceptions and conflict spirals, which increase the chances of armed conflict.

Buchanan argues that the cybersecurity dilemma has the potential to be more destabilizing and escalatory than the traditional domains of conflict, in that in the cyber domain, offense is perceived to be dominant, clarity between the offense and defense is difficult and murky, strong states will appear greedy in terms of the usage and hoarding of weapons, and when credible information is sparse and no status quo exists for normative behavior in the cyber conflict domain (pp. 187–190). Because of these inherent traits in the cyber domain, the cybersecurity dilemma concept is something that leaders and policymakers should take seriously with the hopes of mitigating conflict as the domain becomes increasingly important and utilized in the years to come.

At the heart of the dilemma is fear and escalation. Chapter 2 gives an account of the cybersecurity dilemma from the intruder’s point of view. Using the Stuxnet worm as a guide, Buchanan takes us through what he calls the first pillar of the dilemma. Intruders who are inclined to launch cyber operations in the future need to act now for such operations to be successful. Therefore, states will invest in cyber capabilities, build cyber forces, and even launch limited network breaches to collect intelligence to increase the chances of future successful cyber operations (pp. 40–42). These actions are also launched with the intention of not getting caught by the target, which further increase the fear and escalatory probability between states investing in such operations. When an intruding state is blamed by its target for a network breach on a critical system, the chances of conflict spirals increase even further. Therefore, the offense dominance perception reigns in the cyber domain, according to Buchanan.

The second pillar of Buchanan’s cybersecurity dilemma is discussed in Chapter 3 and considers the point of view of the defender. It is here Buchanan argues that the line between defense and offense can be blurred. Using the Byzantine series as an example, which was a series of Chinese espionage campaigns on several countries’ defense contractor networks, including the United States, Buchanan describes how active defense operations can be useful to potential target states, and how this can further instill fear and raise the chances of escalation as a result (p. 64). Adversaries who find each other’s malware in their critical systems and networks will likely see it as an offensive affront on their sovereignty, not a defensive operation, even if the initiating state admits it. This blurring of the lines between offense and defense, therefore, makes the cybersecurity dilemma potentially more dangerous than the dilemma in traditional domains.

Buchanan’s third pillar of the cybersecurity dilemma is the subject of Chapter 4, which explains in detail why network intrusions threaten. Almost all network breaches will be a threat by the target state and therefore raise the probability of fear, misperceptions, and escalation between adversaries. First, even if relatively benign, intrusions doing reconnaissance or intelligence gathering can lead to more severe and destructive attacks, and target states will therefore feel less safe as a result (p. 77). For example, the cyber espionage attacks on Iranian networks that preceded the Stuxnet worm allowed for the latter to do so much damage at the Natanz plant between 2007 and 2010. Second, Buchanan argues, intrusions can provide a beachhead for further operations (p. 81). The success of one operation can lead to more successes down the road for an intruder, and this will ultimately be viewed as a greater threat by a target state, which feeds into the cybersecurity dilemma. Third, intrusions can lead to perceptions of the conditions of conflict and competition being changed, and decision makers will see these as increased threats, where escalation via fear can further antagonize the dilemma (p. 85). Finally, if successful, intrusions can pose major counterintelligence challenges to target states, further changing its decision-making calculus, and therefore increasing the chances of conflict spirals and spillage into other conflict domains. The cyber domain, therefore, due to its clandestine nature and ability to penetrate some of the most secretive networks seemingly with ease, is the perfect domain for the security dilemma to thrive, making the future of relations between adversaries very bleak if cyber tools are increasingly used.

Buchanan reiterates why the cybersecurity dilemma can be more dangerous in subsequent chapters: the domain is perceived as offense dominant, defensive measures can be seen as offensive and threatening, and greed from states with adequate protection still wanting to disrupt the status quo by offensive posturing (Chapter 5). For example, even though Russia is a very cyber-capable state and has adequate defenses and international recognition as a cyber power, it has still sought to disrupt the status quo to achieve its own national interest. Its cyber and information operations against the United States and other Western countries’ elections is a prime example of this. Russia can now further pursue its interest in Syria and post-Soviet space as the West remains internally divided due in part to Russian cyber measures. This has arguably raised the stakes in the cyber domain, and the fear and possibility of escalation is now more apparent than ever. The seemingly easier disruption of information distribution, and therefore the status quo, is always at play. This makes the cyber domain inherently more dangerous than traditional ones (Chapter 6). Through network intrusions, information can be more timely, and the quality of the information will be better, and therefore actions taken on behalf of this information will be more readily expediated, which can make conflict between nations more likely.

Buchanan’s book should be read by any scholar of cyber conflict studies, is a great theoretical tool for instructors in the field of study, and is also a great primer for students interested in knowing more about how the domain could operate within the tenets of IR theory. However, as with most theoretical works within the realist paradigm, the book lacks solid empirical evidence of what it claims to be happening in the cyber domain. Case studies and anecdotes, as well as historical examples, are utilized throughout the book to lend support to Buchanan’s three pillars of the cybersecurity dilemma. However, this cherry-picking of supporting case studies is the book’s main weakness. There is data available for a more holistic and macro picture to be created, and the cases Buchanan uses (the Olympic Games, the Byzantine Series, Russian actions against Ukrainian critical infrastructure, among others) are actually exceptions rather than the rule. Furthermore, even with these cases, there is little evidence other than that relations escalated between the parties involved.

One could argue that states are relatively restrained from using more dangerous cyber actions because of fear of a different kind than Buchanan discusses in the book: fear of blowback, retaliation, civilian harm, and norm violation. No state wants to be the first to launch an attack that causes death, especially death among civilian populations. Malware found in critical infrastructure (with a few exceptions) can be seen as a tool of ambiguous signaling between adversaries, which in the cyber domain does not lead to escalatory action. Empirical studies have found that the cyber battlefield is non-escalatory, remains in the “grey zone” of state actions where military action is unwarranted, and that nobody has crossed the “red line” where escalation could present itself, apart from maybe a few cases such as Stuxnet, Shamoon, and the Ukrainian power plant breaches.

Regardless of these shortcomings, Buchanan’s book is highly recommended for classes covering cyber conflict, IR theory, and for practitioners wanting to learn more about the geopolitical implications of cyber operations. Firmly placed within the realist paradigm, Buchanan’s book is a great read that explains in detail how fear and escalation can happen more often in the cyber domain than in others, and it is written clearly enough that the novice reader can understand it, while at the same time specialists will still benefit from it.