Nuclear deterrence was one of the most thoroughly studied doctrines of the 20th Century and went through decades of refinement. Policymakers today face an even more daunting challenge and far less time to perfect it, as they seek to craft cyber deterrence policy. Unlike the nuclear arms race, cyber policy inevitably will have to deter both state actors and aggressive nonstate actors, while coordinating efforts between the public and private sectors.
The 2018 National Defense Authorization Act — differing versions of which have passed each chamber—finally takes the important step of pushing for a real cyber-deterrence policy. The House version of the bill includes a provision, Section 1658, that calls on the Defense Department to establish a definition of deterrence for cyber operations. An amendment to the Senate version sponsored by Sen. John McCain, R-Ariz., similarly calls upon the DOD to report on the various approaches to cyber deterrence in Section 1630A.
