In his book, Aaron Franklin Brantly presents a timely study of cyber security in international relations. While the literature on the topic is sparse, it has seen some increased growth in recent years. However, this increase in quantity has not been directly correlated with quality. Many authors, though talented political scientists and IR theorists, have offered discipline-specific, siloed analyses that contribute little to our understanding of cyber in the broader context of international relations scholarship. This is not the case with The Decision to Attack. Brantly, while trained primarily as an IR theorist, has a respectable working understanding of information and communications technology (ICT). He uses his rare intersectional aptitude to present a quality book that is a must-read for IR scholars, political scientists, policymakers, and anyone interested in gaining informed insights into the reasons that leaders ultimately decide to launch offensive cyber operations against one another.
Motivated by the question of how leaders “rationally decide to employ offensive cyber operations for political gain” (p. 162), the author does an excellent job of walking the reader through the logic of rational choice modeling, ultimately proposing the need to develop a new decision-making model for state-to-state engagements in cyber space (Chapter 8). His theory challenges the conventional binary choice faced by states in the modeling of dyadic conflicts: whether to use diplomacy to negotiate a bargain or declare all-out war on an adversary. He offers a novel intermediate rational option within the bargaining range: covert action.
In building his case for a new formal model that parsimoniously reflects the unique characteristics offered by cyber space, Brantly asserts the salience of cyber as a foundation into national security, specifically permeating into the security of states’ political/social, economic, military, and environmental well-being (Chapter 2). He contextualizes covert action in cyber space and sets it up for his formal model (Chapter 3), and thoughtfully provides a novel take on the omnipresent problem of positive attribution in cyber space (Chapter 5), while at the same time reinforcing how cyber operations are a necessary tool of the military and intelligence communities alike (Chapter 6 and 7).
Brantly uses James D. Fearon’s canonical bargaining range model (“Rationalist Explanaitons for War” International Organization 49.3 [1995]: 379–414), coupled with Bruce Bueno de Mesquita’s conception of rational utility (“The Contribution of Expected-Utility Theory to the Study of International Conflict” in Handbook of War Studies, Routledge, 1988) as the impetus for his own logic on cyber issues. However, whereas Fearon’s model establishes a range in which it is more rational for actors to negotiate an ex ante bargain than to engage in costly conflict, Brantly introduces a third intermediate option in the bargaining range, covert action. He theorizes that if there exists a reasonable expectation of anonymity, a leader will decide to approve and launch an offensive cyber operation when there is a divergence on policy issues (p. 149).
As informative and well thought out as this book is, there are some substantive theoretical issues that need to be addressed. These issues are so integral to the fundamental understanding of cyber space and its relevant actors that they warrant mentioning, and they raise macro tensions in Brantly’s theory.
First, the author does not differentiate cyber space from the Internet. This is not to say that he does not define cyber space; indeed, there is an entire section in Chapter 1 dedicated to such a definition (p. 2). But he does not explicitly state that the rationality component integral to his model comes from people using the Internet, as opposed to the hardware and software itself. It is the people and the Internet together that constitute cyber space. The Internet and cyber space are not synonymous. Furthermore, the author says that “a computer is incapable of irrationality” (p. 3), implying that the rationality of the people is paramount in his calculus. The person Brantly is most concerned with is the state-level decision maker (pp. 150–56). This by itself is not theoretically controversial. However, what is potentially problematic is that the author imports the preferences of the individual people upward to be preferences of the state (and by extension its chief executive) as a unitary actor (p. 20).
This theoretical step is troublesome when we consider the prominence and importance of individual nonstate actors (“substate,” as he calls them) in offensive cyber operations against the state (oftentimes not sanctioned by their respective chief executive) and the possible disconnect between their preferences and costs and those of the state. Nonstate actors’ preferences will not necessarily fall in line with that of the state as a whole. Theoretically speaking, what is rational behavior for a nonstate actor could be completely irrational at the state level, and vice versa. This introduces a third group of preferences and costs for consideration in the author’s model. The need to create a preference ordering that is complete and transitive is challenged with the introduction of the third group of preferences. Brantly acknowledges this. He says that “a group of three or more individuals given a set of three or more alternatives cannot rationally order the alternative” (p. 18). However, when the people and the executive (as representative of the state) are assumed to be one and the same, the restraints and deterrent effects on the executive are imported down to the people, something we clearly know not to be true, thereby producing preferences that cannot remain ordered and transitive. I understand why the author excludes nonstate actors in the theory and subsequent quantitative model for the sake of parsimony, but there should be a theoretical discussion of their significance in disrupting the equilibrium in his model when the preference of the executive and the people diverge.
The next theoretical issue that needs to be addressed is the differentiation between offensive and defensive postures of a state in cyber space. Brantly masterfully establishes the differences in Chapter 5 when he makes the astute distinction between anonymity as a requirement for offensive operation and an attribution for defensive. However, in Chapter 7, he says that “it is difficult, if not impossible to defend against an unknown attack” (p. 106). He also says that “the adage ‘the best defense is a good offense’ offers a novel way of considering action and intelligence within cyber” (pp. 102–3; my emphasis). Yet the reality is that in cyber space, offense and defense look identical in the first two actionable phases of all attacks. If offense and defense are initially indistinguishable, then the theory needs to account for both signaling as a means to address information asymmetries and if there exists a first-mover advantage.
In sum, The Decision to Attack advances the conversation on cyber space theorizing in the IR field. It is a fine effort worthy of a thorough read, and it can even be used as a conceptual and theoretical primer to modern Internet and communication technology with the discipline. I would have liked to see the author both reconcile his Chapter 6 with Erik Gartzke’s “myth of cyber war” theory (“The Myth of Cyberwar: Bringing War in Cyberspace Back Down to Earth,” International Security 38.2 [2013]: 41–73), and discuss how the fact the Internet and its 7-seven layer TCP/IP structure was from the beginning built without any consideration of the security of the information being passed through it affects his theory as more states move toward a dangerous level of Internet dependence and subsequent vulnerability.
