In this lecture, we will address the growing problem of mistrust between states regarding the use of cyberspace. The tensions and anxieties that exists between nations related to the nature and origin of cyber-attacks and espionage have the potential to escalate quickly into major cyber conflict and cyber warfare. The key to stopping the escalation of conflict to warfare is mutual trust.
My previous lecture identified key elements of interpersonal trust. In this lecture, we will shift our focus to trust between nations and ask the questions, how can nations trust each other and cooperate in order to prevent cyber attacks? We will examine the aspects of interpersonal trusts that are relevant to this discussion and what needs to be added to our analysis to ensure international cooperation in the cyber arena. If you remember from last lecture, we saw that humans are remarkably able to limit their self-interests, even in interactions with strangers, particularly because of the strength of reciprocity and fairness norms. We also saw that norms are particularly effective when there are repeated interactions between individuals that have long-term implications and when sanctions for non-cooperative behavior exist. We also saw the attributions of self-interest and low-expectations for reciprocity underminded trust.
These same principles are relevant when examining trust between nations.
In addition, we identified two important cognitive processes in trust relevant situations. First, feelings of vulnerability. And second, expectations of how the other party is likely to behave across time.
People will lack trust with others when they feel vulnerable and they do not feel confident in how the other individuals will behave.
These same cognitions apply, whether we are discussing trust between two people, or between nation states. In the case of two people entering a marriage or long-term relationships, partners feel vulnerable. They are committing their lives to the other person and they expect the other person to do the same. Over time, they can observe each other's behavior for signs of commitment and fidelity. They can't observe all that other person's behavior, obviously, but they can form expectations on what they do observe.
Now think of the same cognitive processes occurring between nation-states in the realm of cyberspace.
First, nations certainly feel very vulnerable when it comes to cyberspace. We live in a highly connected society, and any disruption of services can cause economic and financial damage. There is even significant psychological damage on nations from attacks, such as the 2004 hacks into Sony's studios. Think of the effect that that had on the psyche of Americans.
There are also new forms of espionage emerging constantly and increased sophistication of cyber attacks and probes. Third, nations have grave concerns about attacks on their country's infrastructure. An attack on a nation's power grid, for example, would have devastating consequences.
In addition, most nations perceive, quite accurately, that their defensive capabilities are not as strong as their offensive capabilities in cyberspace. Right now, offense has tremendous advantage over defense in cyber conflicts. Now, let's face it, the internet was built for convenience rather than security. And so, nations are always scrambling when it comes to defending their information.
Finally, the anonymity of attacks elevates feelings of vulnerability. Not knowing where attacks come from makes you suspicious of everyone.
So for these many reasons, nations feel very vulnerable to attacks from their adversaries.
Let's move to the second important cognition in trust relevant situations. Expectations for the behaviors of others.
The unique aspects of cyberspace make it difficult for nations to form clear and confident expectations about how their partners will behave.
The anonymity of the internet makes it difficult to determine who is responsible for malicious actions. An attack on a nation's institutions could be from the state actors, such as intelligence or defense agencies, or from non-state actors, criminal or a terrorist. It is difficult to tell, and thus nations often have plausible deniability, even if they were behind an attack.
It's also difficult to judge the intent of suspicious actions or attacks. For example, is an attack on a nation's financial institutions an attempt to steal money, or is it an act of espionage?
Another key point is that the barriers of entry are low when it comes to cyber-conflict. Small states and non-state actors can enter into the fray for relatively minimal costs. So the number of actors is much larger than in traditional conflicts. As is the number of possible strategic alliances.
Thus, the state of affairs in cyberspace seems slanted towards mistrust. Nations feel highly vulnerable and do not have confident expectations about the behavior of other nations, particularly their adversaries.
However, it is absolutely critical to establish trust between nations. Societies and economies depend on network communications provided by the internet. We are so interconnected that, if these networks are disrupted, the consequences would be disastrous. With low barriers to entry and ability to attack anyone from any place in the world, tracking down criminals and terrorists will take a coordinated effort between nations, which is only possible if mutual trust exists. So the problem, then, is how do we increase trust between nations when it comes to the use of cyberspace?
To start, let's return to our previous discussions of interpersonal trust. We saw that trust is likely to be higher in a relationship when each member's self-interested outcomes match those of their partner. In other words, what is best for me is also best for you.
And when both partners expect that the actions of the others
will be in terms of what is best for both people, for the relationship, rather than for personal self-interest. This is the ideal state we should strive for. Nations recognize the same end-goals, and expect that each other will act to obtain what is best for both parties, rather than what may be immediate best for one party.
Well, how is this done? Well, with individuals we saw that this is done through the process of positive reciprocity. Partners are exposed, themselves, to small amounts of risks, and observe how the other person responds. If the other person gives up something in order to reciprocate the partners initial trust, then there is mutual gain and heightened trust occurs. The importance of initial experiences and incremental steps cannot be overstated. Repeated experiences of mutually beneficial outcomes leads partners to perceive situations as positive sum, as opposed to zero sum situations.
These repeated outcomes may encourage the partner to engage in further relationship building and relationship sustaining acts.
Let's return briefly to the Prisoner's Dilemma game. What you saw is part of a exercise for the previous module.
The Prisoner's Dilemma sets up a situation where partners decide whether to cooperate or compete with each other. It establishes a positive-sum scenario. But to achieve that, outcome partners have to trust each other and overcome the tendency to see situations as competitive or zero-sum scenarios.
A zero-sum scenario is one in which one party's gains are balanced by another party's losses. It's a win-lose situation. One person wins, the other person loses. A positive-sum situation is one where all parties may gain or lose together. It potentially is a win-win situation.
The Prisoners Dilemma's payoff grid shows that both parties gain from a cooperative response.
However, if one party chooses a non-cooperative or competitive response, a defect response in this diagram, they stand the chance to gain more points and the partner comes away with nothing. That's the competitive win-lose response. So, parties may feel the urge to maximize their self-interests, at any single trial of the Prisoners Dilemma game. But if interactions occur over time, which is the case with nation-states, then an initial competitive response by one actor is going to elicit a competitive response in the other. And as a result, mutual gains are eroded. If one actor takes a risk and offers cooperation, and the partner responds by competing, the defect response here, then the chances of future cooperation are diminished. However, if an initial cooperative act is responded to in-kind, then mutually beneficial outcomes are experienced and trust builds. So the goal is to build positive-sum situations related to cyber security and conflict.
There have been several attempts to do this, primarily in the area of what are called confidence building measures.
No comments:
Post a Comment