Cyberspace has been recognized as a new arena for competition among states ever since it came into existence. In the United States, there have long been warnings of a “cyber–Pearl Harbor”—a massive digital attack that could cripple the country’s critical infrastructure without a single shot being fired. Presidential commissions, military task force reports, and congressional investigations have been calling attention to such a risk for decades. In 1984, the Reagan administration warned of the “significant security challenges” of the coming information age. And just this year, Dan Coats, the director of national intelligence, said of such threats, “the lights are blinking red.”
Yet the Internet has always been much more than a venue for conflict and competition; it is the backbone of global commerce and communication. That said, cyberspace is not, as is often thought, simply part of the global commons in the way that the air or the sea is. States assert jurisdiction over, and companies claim ownership of, the physical infrastructure that composes the Internet and the data that traverses it. States and companies built the Internet, and both are responsible for maintaining it. Actions taken in the public sector affect the private sector, and vice versa. In this way, the Internet has always been hybrid in nature.
So, accordingly, is the real cyberwar threat. It turns out that for all the increasingly vehement warnings about a cyber–Pearl Harbor, states have shown little appetite for using cyberattacks for large-scale destruction. The immediate threat is more corrosive than explosive. States are using the tools of cyberwarfare to undermine the very foundation of the Internet: trust. They are hacking into banks, meddling in elections, stealing intellectual property, and bringing private companies to a standstill. The result is that an arena that the world relies on for economic and informational exchange has turned into an active battlefield.
To reverse this development, the United States and its allies will have to recognize what China, Iran, North Korea, and Russia already