In a world in which services and assets of importance to society and the state are ever more dependent on digital technologies, it has become opportune for political actors to attempt to reach strategic goals through cyberoperations. Until around 2010, the cybersecurity discourse was dominated by attempts to mobilize political and economic resources mainly through imagined “what if” scenarios. Since then, it has taken an interesting new turn due to a mounting number of actual cyberincidents that are orchestrated by states. On this basis, security studies scholars have started to focus on the ways that state actors are using these tools for political or military gains and to analyze the effects this has on various aspects of international relations and security.

Tim Maurer’s insightful and often entertaining book focuses on one such aspect: how—and to a lesser degree why—state actors use so-called “cyber proxies,” defined as “intermediaries that conduct or directly contribute to an offensive cyber action that is enabled knowingly, whether actively or passively, by a beneficiary” (p. xi). The book has three parts. In the first (“Of Brokers and Proxies”), Maurer introduces the most important concepts with which he later works. He spends time on cyberpower, which he links to the necessary condition of “unauthorized access” (p. 7), the attribution problem, and different conceptions of cybersecurity, highlighting the difference in view between the states he later studies: the United States, Russia, China, and Iran. He also outlines what he thinks cyberproxies are theoretically capable of and what they are (likely) used for. Most importantly, he introduces a broad framework for thinking about proxies. From the four relationships that are possible between state and nonstate actors, he is interested only in the one between the state as the beneficiary and nonstate actors as proxies.

The author further outlines three possible types of such a relationship: Delegation, orchestration and sanctioning, differentiated by the amount of direct control the state has over its proxies. As he points out, in all three there is a need for state actors to balance the benefits with the costs and the potential risks of escalation.

In the second part of the book (“Cyber Proxies Up Close”), Maurer explores these three state–proxy relationships by conducting four case studies: the Unites States (a case for delegation), Iran and Syria (cases of orchestration), Russia (typical for sanctioning), and China, which shows a transformation from sanctioning to delegation over the years. In the third part (“Implications”), Maurer links his findings to debates in international law and in counterterrorism and discusses the challenges associated with shaping proxy relationships both internally (the state overseeing its own proxies) and externally (states shaping the relationship other states have with their proxies). In the concluding section, he suggests many issues for further research.

Overall, Maurer’s choice of topics is very timely, and he shows considerable empirical knowledge, which includes great awareness of how technical and political questions are interlinked. Through his detailed account of state–nonstate actor relationships in the conduct of cyberoperations—based on information he gained from, inter alia, interviews with individuals directly involved in cyberproxy activities—he sheds light on a murky area of some concern to the international community. Without resorting to alarmism, he further highlights the harm that these modern-day mercenaries and privateers can theoretically cause at relatively low cost, and how their activities can undermine security, stability, and, in some cases, human rights.

As Maurer himself points out (pp. xiii and 25), however, reliable data on many aspects of cyberoperations is too limited at this point in time to allow for more than anecdotal storytelling and empirical conjecture. But even though he makes sufficiently clear that he uses his “case studies” as prototypes, mere illustrations of the relationships he is interested in (p. 21), they leave us with many questions. Since Maurer asserts that a country’s particular take on cybersecurity explains its choice of proxy relationship, selects his cases on that basis, and only writes about this type of relationship, he fails to explain when and under what conditions these three types of relationships form, when they change, and whether they are exhaustive. In addition, the book’s use of previous theoretical work is somewhat erratic, and due to its engagement with a wide, multidisciplinary set of literatures, it fails to make sufficiently clear where it aims to make its main scholarly contribution.

Overall, the book would have benefited from an even clearer focus and from a tighter argument. Most glaringly, the concept of cyberpower, important in setting the stage in the beginning, disappears almost completely from the discussion on international law, due diligence, and other legal concepts at the end. Although Maurer takes considerable care to highlight the perspectives of non-Western states that guide their actions in the first and second parts of the book, Part III is influenced too strongly by a Western-dominated way of structuring and viewing the problem. The clear-cut separation between state/nonstate and public/private that informs the analysis and, more so, the conclusion of the book, becomes problematic when it does not consider how other states, being intelligent actors, deliberately use these categories that restrict Western thought and action to their benefit exactly because they do not travel to their context.

If the recent literature on cyberoperations has taught us anything, it is how much context and politics matters in understanding their use and effects. Most importantly, powerful states like the United States are actively shaping the norms pertaining to cyberoperations through political practices. Whereas the issues of “attribution” and “plausible deniability” used to be considered both a reason for the use of cyberproxies and a main difficulty restricting the victim’s ability to react, that is changing. The United States and some of its allies have shown that they are ready to attribute cyberoperations, even those conducted by cyberproxies like in the case of the “Sony Hack” or the meddling with U.S. elections, and to follow up with retaliatory action from the toolbox of international politics if they consider it necessary. The types of proxy relationships that Maurer focuses on may be of secondary importance in this game; how emergent social norms structure what is acceptable and what is unacceptable in cyberoperations is the bigger—and I would argue more important—question. Cyberpower, in this view, is not so much related to “unauthorized access” as it is more broadly to the ability to shape this space in order to minimize harm and maximize benefits.

These points notwithstanding, and considering the serious need for expertise in cybersecurity, Cyber Mercenaries is a valuable contribution that structures the debate in useful ways. Its theoretical concepts and empirical detail will prove useful for researchers addressing the relationship between state and nonstate actors in the future.