Fighting Shadows in the Dark Understanding and Countering Coercion in Cyberspace

What is cyber coercion and what can states do to counter it? Based on unclassified, open-source material, this report explores recent cases of potential cyber coercion to identify what distinguishes cyber operations used to coerce another nation state from other forms of cyber activity. It finds that, contrary to what coercion theory would predict, states often do not make distinct threats with unambiguous demands for changes in behavior. Rather, states use cyber capabilities to coerce their neighbors while denying responsibility, often hiding behind proxies and without issuing clear demands. Despite the low probability that these kinds of operations will successfully coerce another actor, states continue to pursue coercive campaigns in cyberspace. Responding to these campaigns will require developing the capacity to recognize they are underway. States will then need to develop strategies to counter cyber coercion that leverage combinations of cost imposition, deterrence by denial, increasing the potential secondary impacts on the aggressor through entanglement and promoting the development of norms of behavior.