Grand Strategy

While the incoming U.S. presidential administration focuses on domestic issues that drove the presidential campaign, from health care to tax reform, U.S. relations with Southeast Asia are likely to be mostly forgotten. Southeast Asian states were not a focus of the campaign, although the presidential candidates did condemn the Trans-Pacific Partnership (TPP), which included much of Southeast Asia and is now almost surely dead. Even the South China Sea, the most critical security issue in the region, received only occasional mentions on the campaign trail. In a new era where they are likely to be largely ignored in Washington, Southeast Asian nations, which more than any others already had to balance between Washington and Beijing, are rapidly readjusting to a new reality. That new reality is likely to be Beijing’s regional ascendance, especially on trade issues, and growing worries about the United States’ long-term security relationships with Vietnam, the Philippines, Malaysia, Singapore, Indonesia, and Thailand. From 2011 to 2014, the early period of the Obama administration’s rebalance to Asia, Southeast Asian nations enjoyed a renewed prominence in foreign policy discussions in Washington, a prominence they had not enjoyed since the Cold War. Although the rebalance often mystified regional leaders with its vague promises and unclear timetable, it at least rhetorically elevated Southeast Asia in U.S. policymaking, and forced some U.S. leaders to focus on the South China Sea, on supporting multilateral institutions, and on promoting regional trade. But even before the presidential election, dissatisfaction had been growing in Southeast Asia over the perceived failures of the rebalance. Nations like Singapore and Vietnam, whose governments wanted stronger commitments from Washington on bilateral security and regional free trade, had already been disappointed by a lack of clear follow-through. They had already factored in the possibility that the United States would refocus its attention, after the presidential campaign, on domestic challenges and other areas of the world, such as the Middle East and the U.S.-Mexico relationship. In addition, they had been preparing rapidly to guarantee their own security. Indeed, Southeast Asia is already witnessing a massive arms race, with Vietnam and Singapore---two of the countries most worried about Chinese power projection---among the biggest weapons buyers. Vietnam is now one of the ten largest arms buyers of any country in the world, and Vietnam, Malaysia, Indonesia, and Singapore are upgrading their navies and air forces, in an unmistakable signal to China. Meanwhile, even before the election domestic politics in the Philippines and Thailand had begun to push Manila and Bangkok away from Washington. Philippine president Rodrigo Duterte, who seems to have long-standing and deep feelings of anti-Americanism, has long wanted Manila to distance itself from its relationship with Washington. In the past six months, he has aggressively moved to place the Philippines closer to Beijing, although he has not yet torn up the main documents underpinning the U.S.-Philippines alliance. Meanwhile, Thailand’s ruling junta has sought closer links to Beijing as leading democracies have condemned its rights abuses and questionable commitment to a return to democracy. Now, many Southeast Asian nations fear that they will have to either build closer ties to Beijing or bolster their own security, as the United States focuses its gaze internally. Some hope that a new administration will make good on the president-elect’s promises to bolster the U.S. navy, modernizing the force and stepping up the building of new ships, would have a significant impact on maintaining order in the South China Sea and preserving balance in the region. And some Southeast Asian nations see a chance that the new administration will include senior officials known for their hawkish stances on China and support for U.S. relations with treaty allies in Southeast Asia. But on economic issues, Southeast Asian nations are already moving toward a fallback plan. Several Southeast Asian nations, as well as Australia, have indicated that they will turn to the China-led Regional Comprehensive Economic Partnership (RCEP) as the TPP falters, and Beijing has already begun aggressively pushing the RCEP as the region’s best hope for trade integration. The RCEP is a far less comprehensive agreement than the TPP, but it now looks like the only game in town. Even some of the Southeast Asian nations with the least to gain from the RCEP, like Singapore---whose economy is already quite open to most other Asian nations---are likely going to sign up to the RCEP, according to several Singapore academics, since the Singapore government believes that, without the TPP, the RCEP will at least advance the broader goal of freeing regional trade. Vietnam, too, which probably had the most to gain from the TPP, according to studies by the Peterson Institute and other research organizations, is now likely to throw its weight behind the RCEP.

In my previous blog post, I noted that the bilateral relationship between the United States and Laos remains limited, and will likely remain very limited for years to come. Sure, Laos is the chair of ASEAN this year, which gives the tiny country some influence, but Laos remains a minor destination for U.S. investment, and a country of more strategic relevance to China, Vietnam, and Thailand (among others) than to the United States. U.S. assistance to Laos is primarily focused on humanitarian areas. In addition, the United States’s history with Laos includes some of the most horrific in modern U.S. history. During the Vietnam War, successive U.S. administration authorized a secret conflict in Laos, which came to include arming a large, mostly Hmong army, heavy bombing, and the insertion of small groups of CIA trainers and other contractors into the country. There, they trained Hmong and other forces, spotted for air strikes, helped forces allied with the U.S. attack the Ho Chi Minh Trail, managed radar and other communications sites, and occasionally got into firefights directly with Pathet Lao and North Vietnamese forces in Laos. In the late 1950s and the 1960s, Laos was far from irrelevant to U.S. policy. President Dwight Eisenhower spent a considerable amount of time speaking with president-elect John F. Kennedy about Laos during the transition period between administrations after November 1960; the United States was becoming increasingly involved in Indochina at the time, and a coup in Laos in 1960 had triggered panic in Washington that the country would become dominated by a communist government. Some senior U.S. military leaders wanted the incoming president to insert a large ground force into Laos. Kennedy held the first foreign policy related press conference of his administration about Laos, where he warned that unrest in Laos, sparked by the coup and an ensuing battle for Vientiane, posed a threat to the United States. He would eventually authorize a growing covert operation in Laos in which the United States funded and armed an army comprised primarily of Hmong fighters. In addition, the Thai government would increasingly involve itself in Laos’s war; Thai commandos played an integral role quashing the coup in 1960, and fought alongside Hmong and other Laotian forces against the Pathet Lao. Laos was more heavily bombed than any other country in modern history, and at times the U.S. bombings seemed to have no strategic purpose. Obama will be confronted with the legacy of the bombing during his trip, as other senior U.S. officials have been; to visit Laos today, virtually anywhere in the country, it is impossible to avoid the legacy of the war. Bombers released payloads on Laos reportedly because they were returning from North Vietnam without hitting targets. Today, according to a comprehensive story in Mother Jones, “80 million live bomblets lurk under Laos’ soil” and more than 100 Laotians are killed each year by unexploded cluster bombs left over from the war. As I examine in my forthcoming book on the war, which will be released in January, the Laos war was important to U.S. policy in many ways, even if it is largely forgotten in Washington now. The Laos war can be seen, in some ways, as a forerunner of other, later U.S. war efforts, in which the line between the Central Intelligence Agency and Special Forces becomes blurred---and in which the United States manages a large proxy army. Many CIA leaders viewed Laos as an example of a highly successful operation. Veterans of the CIA’s Laos war effort went on to involvement in Afghanistan in the 1980s and Central America in the 1980s, and some aspects of the Laos war mirror the CIA’s tactics in the global war on terrorism. In fact, Laos was the largest covert war in U.S. history, and one that needs to be better understood today.

Next week, President Obama will arrive in Laos for the first visit of a U.S. president to the country. He comes to Laos for the U.S.-Association of Southeast Asian Nations (ASEAN) Summit, for the East Asia Summit, and also for bilateral meetings with several of Laos’s leaders. The tiny communist country, the current chair of ASEAN, selected new leaders---in its typically opaque way---earlier this year. According to some reports, Laos’s new leaders are eager to move the country away from its growing dependence on China for trade and aid, and are seeking to shift Laos back toward its historically closer relations with Hanoi, which was the patron of Laos’s communist party during the Indochina wars. The new leadership also may want to cultivate closer links to the United States as a balance to China. Other countries in the region---most notably, Myanmar---have had similar strategic viewpoints; their leaders have welcomed U.S., Japanese, and European investment, aid, and diplomacy in part out of fear of becoming too dependent on Beijing. So, President Obama’s trip provides some opportunity for a major step forward in U.S.-Laos relations, which have already warmed considerably since the 1990s and early 2000s. But the relationship cannot move too far forward. U.S.-Laos relations are necessarily limited. Laos is a high strategic priority for Vietnam---many of Laos’s new leaders also were educated in Vietnam and have close personal links to Vietnam’s current leadership, as do many top military officials in Laos. Vietnam is the historically dominant outside power in Laos, and Laos’s strategies for increasing its hydropower potential have potentially vast impacts on Vietnam’s portion of the Mekong River. Meanwhile, Laos is a modest strategic priority for Beijing, and for provincial governments in southern and southwestern China---modest, but significant. The country is, however, relatively unimportant to U.S. policies in Asia, even in this era of the rebalance. And the fact that Laos has refused to offer clear support for U.S. partners in the region, like the Philippines, which are involved in disputes over the South China Sea, further complicates the U.S.-Laos relationship. Meanwhile, Laos’s authoritarian and highly opaque regime makes it unlikely to be a recipient of a major boost in military-to-military ties with Washington anytime soon. Laos has no organized political opposition, and the brief period of growing government tolerance for slightly freer domestic media, a window that appeared in the early 2010s, seems to have closed. Civil society is more constrained than it was in the late 2000s or early 2010s; foreign NGO workers are more closely monitored. Social media is more closely monitored. Laos’s economy, though one of the fastest growing in Asia, remains dominated by Chinese, Thai, and Vietnamese companies; U.S. investors are minuscule players in the country right now, and that is unlikely to change any time soon. The United States government has boosted aid for programs designed to protect the environment of the Mekong River basin, improve nutrition in Laos, and address other environmental and health issues, but U.S. investors are less enthusiastic about Laos. Laos’s most important sectors, like energy, are not particularly attractive to U.S. companies that do not want to deal with the complexities of hydropower projects in Laos, and the challenges of dealing with many parts of the Laotian government. Other economic sectors, like casino gambling and tourism, are already saturated with French, Thai, Laotian, Chinese, and Malaysian companies, among others. Political instability in Laos appears to be rising as well, although it is always difficult to tell for sure what is happening in a country with many remote areas, no reliable domestic media, limited internet penetration, and a highly repressive government. Still, in the last two years Laos has witnessed a string of disturbing incidents, particularly in central-northern Laos and in Vietnam. There have been a series of attacks on vehicles traveling on the main road in central and northern Laos, in an area that was full of Hmong insurgent groups in the past. In addition, there has been a string of killings of Chinese nationals in Laos over the past two years, which has left at least four people dead. The attacks have come against people working at a logging company near Luang Prabang and against people working at a mining company, among others. Laos’s government has offered no clear answers to these tragedies, further adding to the sense of insecurity.

After a period of broken diplomatic ties following the end of the Vietnam War in 1975, the United States and Vietnam re-established formal diplomatic relations in 1995. Since then, the two nations have built increasingly close strategic and economic ties, to the point that Hanoi is now one of the United States’s closest security partners in Asia. With a professional military and a highly strategic location, Vietnam is gradually becoming as important to U.S. security interests in the region as longtime allies and partners like Thailand and Malaysia. In addition, Vietnam’s economy, which has significant room for expansion, is far more attractive to new investors than Thailand, where foreign investment dropped by roughly 90 percent year-on-year in 2015. Despite being authoritarian, Vietnam is also---for now---relatively stable, compared to countries in the region that have undergone troubled attempts at democratization, like Thailand and Malaysia. However, despite this gradual process of economic and strategic normalization, the end of the arms embargo on Vietnam, which President Obama announced this week he would lift, marks the final step in restoring full relations. As I noted last week, despite my concerns about Southeast Asia’s democratic regression, and my general belief that the United States partners most effectively around the world with other democracies, I thought that fully lifting the embargo was the right move. The lifting of the embargo should not be done under false pretenses: Vietnam has not improved its record on human rights significantly in recent years (although it released some writers and civil society activists last year), and there is little evidence that lifting the embargo is going to convince Hanoi to open up the political environment either. Vietnam has no prominent opposition leader, like Malaysia or Cambodia, and a weak and battered civil society. In addition, lifting the embargo will not mean that U.S. defense manufacturers are suddenly going to win a flood of contracts in Hanoi. Although Vietnam is now one of the ten largest buyers of arms in the world, according to the Stockholm Peace Research Institute, its military equipment relies on Russian arms and armor, for historical reasons, and Russian arms are much cheaper as well. Although Vietnamese officials are interested in U.S.-made patrol aircraft and coast guard helicopters, it may be some time before Hanoi buys U.S.-manufactured fighter planes. Russia also tends to offer valuable offsets for its arms sales that can drastically reduce the price paid; Moscow is now pitching itself to Thailand too in part through its valuable offsets. However, the increasingly tense situation in the South China Sea, and Vietnam’s growing strategic and economic importance, outweigh U.S. concerns about Hanoi’s admittedly terrible human rights record. In addition, there is little evidence that U.S. strategic and economic relations with Vietnam are viewed, by most Vietnamese, as a fillip to the Communist Party, the way that many Malaysians see U.S. ties with Kuala Lumpur as strengthening the power of Prime Minister Najib tun Razak and the ruling coalition. Most importantly, the lifting of the embargo, and Vietnam’s increasing willingness to be seen, regionally, as a close partner of the United States, is a sign that Hanoi is abandoning its decades-old strategy of balancing relations between Beijing and Washington. Hanoi is embracing closer strategic relations with U.S. Asian partners like the Philippines, Japan, Singapore, and India, while doing little to mend strained relations with Beijing. On the heels of Party leader Nguyen Phu Trong’s visit to Washington last year, the end of the arms embargo, and a stepped-up U.S.-Vietnam defense relationship, suggest that even Nguyen Phu Trong, believed to be relatively wary of U.S. ties, has embraced a shift toward Washington. It was Nguyen Phu Trong, after all, who tried to reach Chinese leaders in May 2014, after protests broke out in Vietnam over the movement of a Chinese oil rig into disputed waters in the South China Sea. For weeks, no one in Beijing answered his call---or the calls of other top Vietnamese leaders.

In most open source writings, Chinese analysts tend to discount the possibility of deterrence in cyberspace. Attribution, detection, and monitoring are hard. Attacks can come from state and non-state actors. Retaliatory cyber attacks have no certainty of outcome. All of these conditions combine to make it difficult to deter cyber attacks on national networks. Given this skepticism, it was interesting to find a long, Sun Tzu-quote-filled discussion of cyber deterrence published on a website affiliated with People’s Daily. Like many other open source writers, Yuan Yi, a researcher at the Academy of Military Sciences, takes a very expansive view of deterrence in cyberspace. According to Dean Cheng, China traditionally views deterrence, or weishe (威慑), as both deterrence in the Western sense--threats intended to raise the costs high enough so a potential adversary does not act in the first place--and compellence--displays of military power or threats to use military power in order to compel an opponent to take an action or submit. In the vast majority of cases where Yuan’s article refers to deterrence, it appears to be talking about offensive cyber operations and compellence. So the strengths of cyber deterrence, in Yuan’s view, include the fact that cyberattacks are more humane than nuclear, chemical, or biological attacks; deterrence is cost effective because cyber weapons are cheap; deterrence methods are diverse because cyber weapons can target multiple types of systems; and deterrence uses are repeatable and flexible because, unlike nukes, cyber weapons can be used multiple times. Western analysts tend to associate all of these characteristics with cyber offense not deterrence. The list of negatives that characterize cyber deterrence also mirrors what Western strategists have traditionally associated with the weaknesses of cyber weapons. Cyber deterrence, for Yuan, lacks credibility because cyber weapons have not yet been used in real warfare; the defense is dynamic and may eliminate vulnerabilities and thus make a weapon useless; the effects of a weapon may spread to connected networks and may even boomerang back to the attackers; states with low levels of connectivity provide few targets and are not easily deterred; and the distributed nature of networks makes the creation of a unified military force difficult. After laying out these strength and weaknesses, Yuan describes four types of deterrence, three by appearance, the fourth by actual combat. Deterrence by appearance includes technical tests with widespread publicity about the results as well as the displays of cyber equipment. Displays can happen through doctrine, white papers, diplomatic pronouncements, newspapers, or other official channels. It can also occur through social media and may involve misinformation in an attempt to confuse the enemy and create a psychology of fear and restraint. Combat exercises are also a form of deterrence by appearance and may involve real or virtual troops. Yuan mentions Cyber Storm, the biennial exercise run by the Department of Homeland Security, as an example of deterrence by exercise. Yuan argues that there are two opportunities for deterrence by combat operations. First, when one side believes the other is on the verge of initiating war, it may launch cyberattacks on critical defensive networks, thus conducting "preventive, restraining deterrence." The second is when the enemy is conducting cyberattacks on your side in a deterrent effort, then you must immediately launch "retaliatory, reprimanding deterrence." The types of attacks Yuan believes could be launched include disseminating propaganda on cell phones and interrupting television broadcasts as well as damaging telecommunication networks and power grids. According to Yuan, a successful deterrence strategy requires preparation. Cyber forces must conduct comprehensive network reconnaissance and install backdoors and logic bombs to launch future attacks. Decision makers need to find the right intensity of the fight in cyberspace to achieve combat deterrence. Attacks that are too restrained will do little to dismay the enemy. Attacks that cause too much damage may provoke a conventional military response or bring international criticism. There should be a clear and controlled progression. Warnings should be issued, and attacks should move up a ladder of difficulty and impact, with scheduled breaks and resumptions when necessary. In addition, a clear deterrence strategy demands centralized command and unified planning. All military cyber forces must form a joint force, and Yuan argues that decision makers "must organize and coordinate amateur civilian cyberwar forces, particularly patriotic hackers." While Yuan’s call for unified forces, centralized political control, and a clear escalatory ladder could provide for greater predictability in cyberspace, most of the article’s suggestions are highly destabilizing, especially the belief that cyberattacks are relatively low risk and the call for network reconnaissance and prepping the battlefield. The article is almost definitely not an authoritative overview of what the People’s Liberation Army thinks about deterrence but at the same time it is equally unlikely to be completely outside the mainstream. One of the outcomes of the Xi-Obama was supposed to be the creation of a cyber "senior experts group." It would be good if that group could meet soon, and start the discussion on the meaning of deterrence and other basic concepts.

When officials in China announced they would open an Asian Infrastructure Investment Bank (AIIB) to primarily fund big construction projects across the Pacific, they launched a slow-motion freak-out in Washington. As they went around the world inviting governments to join, Obama administration officials pressured their allies in Asia, Europe, and other parts of the world not to. The AIIB, headquartered in Beijing, would allow China to expand its influence throughout Asia, the White House fretted. “We are wary about a trend toward constant accommodation of China,” one Obama aide complained to the Financial Times after the United Kingdom joined 56 other nations in signing up to fund power plants, roads, telecommunications infrastructure, and other ventures. It was a rare public critique of an ally. The campaign against China’s bank is hardly unique. Since coming into office, the Obama administration’s Asia strategy has been to fear and combat nearly every attempt by Beijing to flex its muscles---through aid grants, trade deals, energy exploration, new diplomatic initiatives, and military relations with other nations. This strategy might be one of the only remaining areas of agreement between the president and congressional Republicans. In some places, such as the South China Sea, the nation’s expanding power poses a real threat. And it is frightening to see a xenophobic autocracy---one that cracks down ferociously on its domestic critics and fosters a growing cult of personality around President Xi Jinping---gain power in Beijing. But wariness toward Beijing has morphed into a muddled, obsessive, and often mindless U.S. policy. It holds that any new Chinese action must be stopped; any new ally must be won back; any new ambition must be contained. The administration has become so obsessed about countering China that it fails to realize some of the Chinese actions it is fighting do not imperil the United States’ interests. Meanwhile, the (largely futile) battle doesn’t just alienate allies. It also takes American diplomats, money, and arms away from places that truly matter to the United States. In some ways, America would do best to let China win. For more on my analysis of the administration’s current China policy, read my new Washington Post piece.

Since the start of President Barack Obama’s first term, the United States has pursued a policy of rebuilding ties with Southeast Asia. By 2011 this regional focus had become part of a broader strategy toward Asia called the “pivot,” or rebalance. This approach includes shifting economic, diplomatic, and military resources to the region. In Southeast Asia, a central part of the pivot involves building relations with countries once shunned by Washington because of their autocratic governments, like Cambodia, Myanmar, and Vietnam, and reviving close U.S. links to Thailand and Malaysia. The Obama administration has also upgraded defense partnerships throughout the region, followed through on promises to send high-level officials to Southeast Asian regional meetings, and increased port calls to and basing of combat ships in Southeast Asia. Yet despite this attention, the pivot has been badly misguided. The policy has been wrong in two important ways. First, the White House has focused too much on the countries of mainland Southeast Asia, which—with the exception of Vietnam—have provided minimal strategic benefits in return. This focus on mainland Southeast Asia has distracted attention from the countries of peninsular Southeast Asia—Indonesia, the Philippines, and Singapore—that are of greater value strategically and economically. For more on how the United States should revamp the pivot in Southeast Asia, go to my new piece in Democracy: A Journal of Ideas.

Mihoko Matsubara is a cyber security policy director at Intel K.K. In September 2015, the Japanese Cabinet approved the second Japanese Cybersecurity Strategy, which outlines the country’s approach to cybersecurity for the next three years. Unlike the previous strategy, this new one was approved by Japan’s cabinet. This additional step highlights the importance of cybersecurity to senior Japanese leaders. It also comes a year after the Japanese parliament passed a law formalizing the role of the National Center of Incident Readiness and Strategy for Cybersecurity (NISC). The Japanese Prime Minister had originally established the NISC ten years ago but the lack of legal authorization meant that it held little sway over other ministries and agencies. Thanks to the new law, NISC is responsible for developing national strategy and policy, ensuring the cybersecurity of ministries and agencies, and serving as a focal point for international cooperation. There are four important takeaways in the 2015 strategy. First, it highlights the positive and negative aspects of cyberspace—it’s both the source of innovation and threats—unlike the 2013 strategy, which only focused on risks and mitigation measures. By focusing on innovation, the 2015 strategy recognizes that the Japanese government won’t have all of the answers to cybersecurity challenges and that all stakeholders—users, civil society, critical infrastructure companies, and business—should contribute to the safety and security of cyberspace, through measures like two-way and real-time information sharing. It also makes clear that security measures shouldn’t hamper Japan’s ability to innovate given the important role that cyber-enabled technologies will play in driving economic growth. Second, the Internet of things is described as an enabler to create new business opportunities and improve existing ones. The strategy, however, doesn’t provide any insight into how the Japanese government and industry will approach the security challenges associated with the Internet of things or set milestones as it becomes integrated in business operations. We are at the beginning of the Internet of things era, and government regulation or guidance would be somewhat premature. Now is the time for industry—both in Japan and around the world—to work with the government to begin addressing the security of Internet of things devices in a scalable and globally harmonized manner. Third, the 2015 strategy reiterates the Japanese government’s concern over the recent series of massive personal information leaks, such as the Japan Pension Service (JPS) incident of May 2015. The NISC plans to revise Japan’s basic cybersecurity law, first passed in 2014, allowing it to monitor and audit special government-affiliated organizations such as the JPS, similar to its existing authorities with respect to government ministries and agencies. The change is expected to improve the cybersecurity practices of state organizations as they would have government auditors looking over their shoulders. This is particularly important as Japan rolls out My Number, a twelve-digit identification number for Japanese residents to access the country’s social security and tax systems, akin to the U.S. Social Security number. To alleviate worries over potential massive leaks of personal information tied to My Number, industry needs to engage customers and the government to explain the security mechanisms that already exist to keep My Number data safe. Japan will struggle to grow and innovate if its population doesn’t trust new technology designed to improve access to government and private sector services. Finally, the strategy provides an overview of Japan’s international cyber efforts to date, noting its capacity building contributions in the Association of Southeast Asian Nations, South America and Africa and bilateral dialogues, including with the United States and the European Union. The strategy makes clear that Japan is keen to deepen existing dialogues, expand confidence building activities, and participate in the ever-increasing number of cyber-related conferences to convey its interests and cyber security posture to international audiences. Details as to how Japan would actually achieve this, however, are sparse. Overall, the new strategy strikes the right balance in emphasizing the government’s role in Japan’s cybersecurity without limiting the growth of the technology market—especially Internet of things—that will drive innovation.

On October 26, Indonesian President Joko Widodo will arrive in Washington for his first U.S. visit as leader of the largest country in Southeast Asia. In advance of and during the visit, Obama administration officials probably will stress the increasingly close ties between Indonesia and the United States, building on the comprehensive partnership signed by the two nations. But in reality, the U.S.-Indonesia relationship has been more of a disappointment than a triumph over the past seven years. In a CFR working paper I released earlier this year, I examine the failures of the pivot in Southeast Asia, and particularly the struggles to build ties with Indonesia. I also offer recommendations for revitalizing U.S. ties with Indonesia and the rest of peninsular Southeast Asia. You can see the entire paper here: The Pivot in Southeast Asia: Balancing Interests and Values.

Brandon Valeriano is a Senior Lecturer at the University of Glasgow and Ryan C. Maness is a Postdoctoral Researcher at Northeastern University. They have recently published Cyber War versus Cyber Realities on Oxford University Press. Restraint is the strategic underpinning of how many states confront cyber actions. Despite calls for a response to cyber aggression, the U.S. government still has not decided on a viable reaction given limited options. As David Sanger recounts in the New York Times, “in a series of classified meetings, officials have struggled to choose among options that range from largely symbolic responses … to more significant actions that some officials fear could lead to an escalation of the hacking conflict between the two countries.” Strategic restraint tends to defy a form of conventional wisdom that sees the future of cyberspace as a lawless wild west where anything goes and offensive capabilities need to be built up in order to deter an adversary. This defines the tone of the New York Times story. In fact, some of the most cantankerous states in cyberspace tend to behave in a responsible manner because to act otherwise would invite terrible consequences. Why do governments tend to not respond to cyber actions? According to our research, despite the massive influx of cyber operations that we are aware of we find little evidence of the escalation processes inherent in typical conflicts. In fact, we might be witnessing an era of cyberpeace. States operating in cyberspace react differently than in most strategic domains, a reality that drastically differs from perception given the way the news media reports the latest cyber violation as if it is the spark of a new onslaught and validation of the concept of cyberwar. There are two reasons for this: the dynamics of restraint and the development of cyber norms. Restraint Dynamics It’s easy to assume that the United States and other nations would “hack back” when their systems are targeted by adversaries. In fact, many private companies are moving towards this position after their networks are compromised. Yet government officials tend to understand something that private individuals do not: the inner workings of a bureaucracy are complex and dangerous. Needlessly provoking an escalatory response in a domain where both sides are wholly unprotected and borderline incompetent would be strategic suicide. For this simple reason we often see restraint. There is also the reality states will spy on each other, and sometimes even admire their adversaries’ work. The U.S. government has so far refrained from responding to the OPM hack. If there is a response, we predict it will likely come through criminal charges on individuals, not the Chinese state. In fact, the great majority of cyber incidents in our data go without a response in the cyber or the conventional domains. A total of seventy-eight percent of cyber actions we code go without a counterstrike. Of those with responses, seventeen (fifteen percent) come in the form of a cyber response—with only two cases of escalation in severity—and seven conventional responses (six percent). The non-response is the typical response, by an overwhelming margin. Building a System of Norms The lack of escalatory activity can also be explained by a system of norms the United States and others seek to enforce in cyberspace. Like traffic laws, a basic understanding of how things work and what limitations exist benefit everyone. Of course there will be violators, but everyone needs to understand the rules of the road first. Even China and Russia appear to be willing to work within some system of norms, though they disagree with the United States on what the norms should be. Nevertheless, Russia and China are engaging in norms-setting institutions and process, such as the devolution of the Internet Corporation for Assigned Names and Numbers, recognizing that a rules-based framework is important to manage the growth of global connectivity. While many may scoff at the idea of norms, they can be effective means to control the basic behaviors of the majority of actors. Of course there will always be deviants, but as long as we have clear systems of norms, deviancy will be seen as just that—out of the norm. What Does the Future Hold? This all bodes very well for our cyber future. While there is fear that the Internet will be primary threat vector for future societies, this alarmism is a bit premature and primarily based on the lack of understanding of how cyberspace works. We fear what we do not understand. Cyberspace can be controlled and made safe, but this requires us to understand it, to be aware of the possible escalation dynamics at hand in each conflict, and to be take in all available sources of information instead of relying on a few. Given the convergence of the basics of restraint and norms, even the most aggressive of states can be shown to be peaceful actors in cyberspace, even when being poked.