The small-n research question which I aim to research is, “What explains the variances in cyber strategy utilized by the China, Iran, North Korea, Russia, and the United States?”
The dependent variable for this question is ultimate selection of a cyberstrategy as outlined by Brandon Valeriano.[1] Similarly, Valeriano’s work will be used to operationalize the variable by classifying state cyber actions as espionage, disruption, or degradation-based attacks.[2] This itself reveals the other qualitative sources in the form of past and ongoing cyber-attacks which will need to be explored in order to create an index for consultation which draws variables such as the target, type of target, immediate and lasting effects, for example.
These case studies were selected due to their relatively high rankings on the Global Cybersecurity Index (GCI) as well as the fact that they represent the origins for the vast majority of cyber events.[3] These states are constant competitors on the internet battlefield and have been recognized as such with their servers representing the naissance point for malware.[4] That being said, these cases only spread across international state actors and do not take into account hacktivist groups like Anonymous and terror organizations like Al-Qaeda, which have equally proved adept on the cyber battlefield.[5]
While the dependent variable itself may be answered with only one of the independent variables (effect), the independent variables themselves are influenced by a wide array of cyber indicators inside a state from the GCI to the ICT Development Index (IDI).[6] Similarly, the Kaspersky Lab has helped to digest the actual malware by explaining their origins, makeup, sourcing, and effects.[7] An example of this, is their detailed report on the Stuxnet worm, with whom they credited to the United States’ National Security Association, which targeted Iranian centrifuges with an information gathering and self-destructing kill-switch.
Finally, the concept of national interest comes into play when viewing the dependent variable value of the separate case studies. For example, Iran certainly has the ability to conduct extra-territorial infrastructure attacks, showing that it could be claimed they follow a disruption-based strategy [8]. However, such an attack would merit a response in which they potentially could not whether, pointing toward the fact that they might prefer an espionage-based strategy.[9]
These qualitative sources approach the dependent variable from their own case studies but reveal through their data how an international state can employ their cyber forces. What remains to be seen, through a greater collection of sources, is if the national interest of a country paired with their actual malware creates a scale or independent strategies as shown through the operationalization of the dependent variable.
[1]Brandon Valeriano and Benjamin Jensen, “How Rival States Employ Cyber Strategy,” Oxford University Press, (2018).
[2]Ibid
[3]“Global Cyber Strategies Index,” Center for Strategic and International Studies: Technology Policy Program, pp. 1-6.
[4]Aleks Gostev and Costin G. Raiu, “Unravelling Stuxnet,” Kaspersky Lab, (29 September 2010).
[5]David Bieda and Leila Halawi, “Cyberspace: A Venue for Terrorism,” Embry-Riddle Aeronautical University 16, no. 3 (2015): 33–42.
[6]ICT Data and Statistics Division, “ICT Development Index,” International Telecommunication Union Publications,” (February 2019), pp. 3-204.
[7]Aleks Gostev and Costin G. Raiu, “Unravelling Stuxnet,” Kaspersky Lab, (29 September 2010).
[8]James Lewis, “Iran and Cyber Power,”Center for Strategic and International Studies, (25 June 2019), https://www.csis.org/analysis/iran-and-cyber-power.
[9]Frank Cilluffo, “The Iranian Cyber Threat to the United States” (United States House of Representatives: The George Washington University Homeland Security Policy Institute, 2012).