Content area
Full Text
Whenever boldness encounters timidity, it is likely to be the winner, because timidity in itself implies a loss of equilibrium}
Over the last two decades, Russia's use of cyber proxies has expanded on a global scale and impacted nearly all aspects of international relations. From effectively shutting down a neighboring government and its financial sector in response to moving a World War II era statue,2 to disrupting communication platforms in Eastern Europe in concert with kinetic operations,3 to gaining access to American critical infrastructure,4 Russia is actively pursuing its strategic objectives through cyber proxies. To date, the United States has tried a variety of methods to hold Russia accountable for its cyber activities including: indicting Russian intelligence officers;5 sanctioning the assets of individual Russian officials; and implementing broader economic sanctions.6 However, the United States implemented these actions months-if not years-after the incidents first became known and, therefore, had little utility in dissuading future Russian aggression.7
Much of the United States' delay and ambiguity in response seems, at least in part, due to a burdensome attribution process that imposes unrealistic legal standards to effectively react to cyber activities.8 The speed with which cyber incidents occur, the obfuscation of actors, and plausible deniability through cyber proxies make current legal regimes untenable. As stated in the National Defense Strategy of 2018, adversaries are "using other areas of competition short of open warfare to achieve their ends (e.g., information warfare, ambiguous or denied proxy operations, and subversion). These trends, if unaddressed, will challenge our ability to deter aggression."9 This assessment is especially relevant to Russia as one of the most sophisticated cyber actors known to use cyber proxies to challenge the United States.
The United States should move away from the current international legal standards of proxy attribution to confront Russia and its use of cyber proxies. Instead, a new policy-one grounded in a strategy of rapid attribution and coercive diplomacy-should be used to supplement the current void of applicable international law. The National Cyber Strategy of 2018 identified the United States' need to build a cyber-deterrence initiative, but failed to give concrete policy prescriptions for dealing with cyber aggression.10 New standards of rapid attribution and coercive diplomacy would complement international law and induce Russia to adhere to...