P. Pijpers e-mail<EMAIL_ADDRESS>
P. Ducheine University of Amsterdam, Amsterdam, The Netherlands

© The Author(s) 2021 F. Osinga and T. Sweijs (eds.), NL ARMS Netherlands Annual Review of Military Studies 2020, NL ARMS, https://doi.org/10.1007/978-94-6265-419-8\_25 ponents is underdeveloped or not in place, (coercive) power fails. Modern technologies (e.g. ICT, AI) and strategic insights (e.g. the utility of soft and smart power) urge for a reinterpretation of the 'physical' component, and include cyber capacities as well as culture, knowledge or law(fare) as capacities (or power instruments), too. Moreover, and taking cyber capabilities as a test case, these developments put even more weight on the conceptual and moral components of power. This chapter focusses on the legal framework as a key, but underrated, conceptual element of deterrent power. Using cyber threats as a case, it offers a legal framework enabling decision-makers to effectively generate deterrent power by showing which legal bases (should) undergird the employment of the variety of responses available to States. In democratic rule-of-law States, the principles of legitimacy and legality demand that the use of power (instruments) by States must be based on a legal basis and should respect other institutional features too. Through two illustrative vignettes the generic value of the framework will be illustrated for the potential use of power instruments—diplomacy, information, military, economy, culture, legal, knowledge—in its various modalities, including cyber operations. This legal framework, though tailored to cyber capabilities, may be used as a starting point for conceptualising the legal framework for so-called cross domain and cross dimensional, or full spectrum deterrence.

Keywords Legal framework legal bases deterrence cyber operations attribution cyberspace

#### 25.1 Introduction

"The supreme art of war is to subdue the enemy without fighting." Sun Zsu, 6th century BC

#### 25.1.1 East Meets West

Western States traditionally focus on the physical military instrument when conceptualising deterrence as a strategic function. The threat of military force, or its actual use, is a preferred modus operandi in Western strategic culture.1 For Asian States such as China, force may be perceived differently in terms of instruments used, as well as in its modalities, and in concepts. Force and power may have an economic or diplomatic face, whilst the actual threat or use of military force is less

1 See Kitzen 2012a, b; Ducheine and Osinga 2017.

prominent or takes virtual or symbolic shapes. Looking at China's Belt and Road Initiative, trade relations, loans, (lease) contracts, embassies, harbours, education, culture and indeed the positioning of armed forces, play important roles. Quite early, Chinese strategic thinkers like Sun Zsu, and more recently Qiao Liang and Wang Xiangsui, have stressed the importance of the information environment in strategic issues such as deterrence.2 Although rather late, Western strategic interest —accelerated by ever growing opportunities and threats in cyberspace – in this sphere is growing fast.3

#### 25.1.2 Cyberspace as a Strategic Opportunity?

Cyberspace has been described in many ways,4 ranging from 'a consensual hallucination' 5 to a 'networked information infrastructure'. 6 In short, cyberspace covers 'all entities that are or may potentially be connected digitally'. 7 Cyberspace is central to the information environment, the sphere where information is presented, found, communicated, processed, handled and used upon which decision-making is based, followed by (in)action. The information environment entails a physical, a cognitive and a virtual dimension. To enable digital connections, cyberspace, as part of the information environment consists of three elements: (1) cyber identities, (2) cyber objects (i.e. software, data and protocols), and (3) the physical network layer entailing cyber infrastructure (i.e. hardware and (electromagnetic) connections).

Cyberspace may be used in a number of ways. First of all, it offers a medium for information and communication. Secondly, it entails capacities that may be used as instruments of power: data, applications, procedures. Thirdly, these instruments may be directed at, or can engage with other actors in cyberspace. In military terms, one may find both weapons and targets, as well as a vector to connect weapons with

2 Qiao Liang and Wang Xiangsui 1999, p. 199.

3 Smeets and Soesanto 2020.

4 Most elaborate by Kuehl 2009, p. 28, who describes cyberspace as a 'global domain within the information environment whose distinctive and unique character is framed by the use of electronics and the electromagnetic spectrum to create, store, modify, exchange, and exploit information via interdependent and interconnected networks using information-communication technologies'.

5 Gibson 2018, p. 51.

6 Koh 2012, p. 6.

7 See Netherlands Defence Cyber Strategy 2012 (UK version) "Cyberspace is understood to cover all entities that are or may potentially be connected digitally. The domain includes permanent connections as well as temporary or local connections, and in all cases relates in some way to the data (source code, information, etc.) present in this domain", (original Dutch) in: Parliamentary Papers II 2011–2012, 33 321, no. 1.

the targets. In generic terms: cyber capacities may be used as instruments to engage with other cyber capacities in or through cyberspace.8

Not surprisingly, cyberspace has become the 5th domain of operations.9 In effect, the potency of cyberspace is related to the threat or use of (military) force, but also to the deliberate undermining of the understanding and autonomous decision-making of actors, hence the informational instrument of power.10

### 25.1.3 Conceptual Considerations for Deterrence in Cyberspace

Is deterrence possible in cyberspace? Cyberspace is not an instrument of power in itself, but an engagement 'arena' similar to the land or air domain. However, unlike land, sea and air, people are absent in cyberspace11 and 'only' the virtual reflections of humans—cyber identities—engage in cyberspace. The dominant academic thinking tends to conclude that cyberspace is not fit for deterrence as a strategic function for States,12 a view that appears at odds with the actual effects of on-line activities of numerous (State sponsored) Advanced Persistent Threats (APTs),13 or the considerations of US Cyber Command.14

But maybe the question is not whether cyberspace is fit for deterrence, but whether the constituent components of deterrent capabilities are fit for contemporary engagements. Power projection in cyberspace, whether for deterrence purposes or otherwise, is no longer merely focusing on military power, but on all instruments of power, including diplomacy, informational, cultural, financial or legal instruments.

8 Whilst this generic view describes so-called hard cyber activities or operations, the present authors also recognize so-called soft cyber operations, where cyberspace is merely used a vector to communicate virtual or digitalised information (content) via cyber identities to real persons, in an effort to affect their psyche and consequently their autonomous decision-making process, individual or collective preferences and values.

9 See NATO Warsaw summit NATO 2016, Bulletin no. 70.

10Ducheine and Pijpers 2020.

11Delerue 2019.

12Borghard and Lonergan 2017; Fischerkeller and Harknett 2017, p. 393; Taddeo 2018, pp. 352– 353; Whyte 2016, pp. 100–101.

13For an overview of these APTs, see the list produced by Mitre-Attack, at https://attack.mitre.org/ groups/; Booz Allen 2020.

14US Cyber Command 2018.

Applying the instruments of power, including military power, (in deterrence contexts) requires the (demonstrated) capacity to perform, the will to act,15 but moreover a manner how to channel these capacities.16 These commonplace elements—capacities, concepts and will—are also encapsulated in military doctrine.17 Creating power presumes the existence and effectiveness of these three components. In case one of these components is underdeveloped or not in place, power fails.

For democratic States, the conceptual component includes an applicable legal framework which enables the use of these power instruments. Their common values18 dictate to respect and promote international law in their international relations,19 and respect for law in general when interacting with non-state actors.

This legal framework however, is an area that seems undervalued and less researched, at least in war studies and security studies, despite the fact that the legal framework is a crucial element of the conceptual component for (deterrence) operations in cyberspace or any physical domain. For the purpose of this treatise, the legal framework is considered an integral part of the holistic approach towards deterrence in operations as it should be when conducting research in these areas. Therefore, States will need to organise and structure their legal and institutional framework in order to deter others from engaging, threatening or attacking vital interests, in or through cyberspace.

#### 25.1.4 Aims and Structure

The primary aim is to supplement the conceptual component of power by adding a concise legal framework for the use of all power instruments, be they military or otherwise, classic or modern. The approach taken departs from the premise that when the legal framework is not in place or underdeveloped, the conceptual component of power is flawed which in turn will have deteriorating impact on power itself. E.g., when offensive cyber capabilities are in place, but actual legal bases have not been analysed, realistic decision-making procedures are lacking, or competent bodies authorising the use of capabilities in response of threats have not been designated, deterrence by punishment is illusive. For deterrence to be

15Jakobsen 1998, ch 1; Jakobsen 2007, pp. 225–247.

16Biddle 2006, pp. 190–191.

17Fighting power comprises of (1) capacities, most often the so-called physical component (i.a. manpower, means), (2) a conceptual component (strategy, doctrine, planning), and (3) a moral component (will, resilience, determination). See: NATO 2017, p. 1–16; UK Ministry of Defence 2017, p. 3–2; NL Defence Staff 2019, pp. 66 ff; applied in Ducheine and Van Haaster 2014, p. 305. 18See e.g. the Preamble to the Treaty of the European Union (6 October 2012); and the Preamble to the NATO Treaty (4 April 1949).

19See e.g. the Preamble to the Charter of the United Nations (26 June 1945); and the Netherlands' position as expressed in Parliamentary Papers II, 2006–2007, 29 521 no. 41.

effective, credibility and clear communication demonstrating the will and ability to use capabilities is essential. Hence, without a legal framework in place, a deterrence strategy, with whatever means, will not be effective.

While such a framework is essential for the employment of all instruments of power, and certainly in a context of cross domain deterrence (see Chap. 8 by Sweijs and Zilinck), this chapter focuses on the nexus of deterrence and cyberattacks. Taking deterrence against cyber threats as a case, a succinct matrix of options will be presented serving as a conceptual component to generate capabilities to dissuade opponents, offering insight in the available legal bases for each of the power instruments, recognizing the different faces or modalities that may be envisioned. Although at first glance, this approach may appear to focus on deterrence by punishment, it will become evident that deterrence by norms and/or entanglement may also be of relevance.20

In addition, to the legal basis, other institutional elements, such as governance issues, will be addressed, involving questions such as 'who has the authority to decide to make use of the instrument', who is responsible for the execution, who is accountable (for what part), how is oversight guaranteed, will be (briefly) addressed. As Jakobsen argued, effective coercion requires the demonstrated ability to quickly generate coercive power. Having thought through the appropriate governance framework is instrumental to that. To this end, the situation in the Netherlands' national legal framework will be used as a demonstration using so-called vignettes.21

Combining the international legal bases with the applicable national institutional or governance framework for the use of power instruments, also serves as a demonstration explaining the legal framework outside threats in cyberspace. In fact, it is argued, that the core of this legal framework may be used to prepare for deterrence in cross domain or full dimension situations. Hence, deterrence against opponents using military, economic or other threats, may benefit from this contribution supplementing or reinforcing the conceptual component of deterring power.

This chapter first briefly sets out the instruments of power (Sect. 25.2). Secondly, the components of power and the legal framework as a conceptual element therein are covered (Sect. 25.3). Next, the legal framework itself is analysed in two parts: the legal bases (Sect. 25.4) building on international law and other relevant elements (Sect. 25.5) building on the Netherlands' institutional arrangements, after which a matrix is presented offering legal options related to the instruments of power (Sect. 25.6).

20Nye 2016, pp. 58–62.

21As States will have different institutional and constitutional arrangements, this part of the legal framework using the Netherlands as a case in fact, serves as a demonstration.

#### 25.2 Power Instruments

Power instruments are often briefly summarized as DIME: diplomacy, information, military and economy.22 In deterrence literature the military and diplomatic instruments have been dominant in the past. However, contemporary strategic theorists increasingly make use of concepts such as hybrid threats, unrestricted warfare, grey zone activities, information warfare, financial or economic warfare, cultural, ideological, political, virtual and cyber warfare. Other instruments, such as financial, intelligence, legal,23 or culture and knowledge, might be added,24 to fully grasp the instruments used to exert power in today's geopolitical arena.

Diplomacy is linked to foreign relations, it is generally about communicating and advocating national or international interests and values. Diplomacy gets a face through the work of diplomats, international governmental organisations but also through international agreements, resolutions, cooperation, coordination, norm development, alliances, treaties, customary law and soft law.25

The military instrument, armed forces, may be used in various ways, from (treaty based or ad hoc) peaceful cooperation based on shared values and norms, to armed conflict. The modalities used, the means and methods, may range from classic physical weaponry, to non-kinetic26 (e.g. training and advisory capacity)27 and new information related capabilities, including hard and soft cyber operations.28

Economic power, as an instrument may also take various shapes, ranging from consensual (loans) to compulsory (sanctions),29 and can be enlarged with the financial instrument of power. It covers both passive elements, e.g. a State's macro-economic characteristics as well as active measures (assets freeze, investments, etc.). On the institutional side, international economic relations, such as common markets, with its mechanisms and procedures in place, would be another facet.

22Mann 2013, p. 502; Schroeder 2015, p. 2; UK Ministry of Defence 2011, pp. 1–6; US Joint Chiefs of Staff 2013, p. 1–12.

23Van Haaster 2019, p. 64; Rodriguez et al. 2020.

24Nye 2013, pp. 7–10.

25See e.g. the Group of Governmental Experts on advancing responsible State behaviour in cyberspace in the context of international security (UNGGE) at https://www.un.org/disarmament/ group-of-governmental-experts; and the Open-Ended Working Group on Developments in the Field of ICTs in the Context of International Security (OEWG), at https://www.un.org/ disarmament/open-ended-working-group.

26Ducheine 2015a.

27Wiltenburg 2019.

28Ducheine et al. 2017.

29Giumelli 2017.

Next to classic DIME instruments, others come to the fore: culture as a (soft) power element is often seen in action,30 expressions of which are Radio Free Europe, China's Confucius institutes,31 Soros' Open Society Foundation.32 Lawfare, law used strategically as an alternative for the military instrument33 in conflict situations,34 is used in legal action: e.g. the US' indictments of foreign cyber operators,35 or litigation between States.36

Last but certainly not least, information as a power instrument—including intelligence—can be understood in several ways. First of all, it involves the relative value of information sources itself, whether physical, cognitive or virtual.37 These sources may be observed by men and/or machine, upon which understanding and decision-making are based.38 Large data sets containing personal information related to (large) groups, or traffic data, are also examples of power resources. This substantive facet may be used to affect other actors, e.g. through marketing.39 Secondly, it entails structures to communicate, both in terms of procedures and as a medium or vector. This could be the World Wide Web as part of cyberspace, or the internet and the dark web. (Entry) control over these structures, may be used to exert power. One may think of communication channels (old media), Great Firewalls, but also Internet Exchanges, 5G networks, the glass fibre cable network covering the globe, satellites offering mobile internet to places without physical (cable) connectivity. Thirdly, institutions overseeing, designing, contributing to the flow of information may offer a powerbase as well, e.g. the Internet Corporation for Assigned Names and Numbers (ICANN), or the Internet Engineering Task Force. Fourthly, information has a productive aspect as well: to generate debate, to reproduce and reinforce discourse or messaging, to construct and disseminate new information, whether malevolent or benevolent. Consider the (alleged) role of

30Nye 2013, pp. 10–14.

31Young 2009; Łoś 2019.

32See https://www.opensocietyfoundations.org/who-we-are.

33Sari 2020.

34Voetelink 2017.

35See i.a. US DOJ 2018b (GRU Indictment) and 2018a (IRA Indictment); New York Times 2018, 2019; Bellinger 2020.

36ICJ, Military and Paramilitary Activities in and against Nicaragua (Nicaragua v. United States of America), Judgment (Merits), [1986] ICJ Rep 14, 27 June 1986; ICJ, Legality of the Threat or Use of Nuclear Weapons, Advisory Opinion, [1996] ICJ Rep 226, 8 July 1996.

37See UK Ministry of Defence 2010, p. 2–5; and supra n 28.

38See supra n 28.

39In the terminology used by Bets and Stevens 2011: compulsory power. See the four categories by Barnett and Duvall 2005, p. 43: compulsory, structural, institutional and productive power.

Facebook, Twitter and WikiLeaks in elections, or ordinary marketing.40 As demonstrated, cyberspace is used to gather, transfer, handle and produce information, whilst virtual information (i.e. data, software, protocols) is also used as an instrument, as a vector and as a target to generate effects.

### 25.3 The Underrated Conceptual Component: Legal Framework

The commonplace understanding of power is as a capacity or attribute with which an actor is endowed, or as a resource to be exploited to achieve particular end.

David Betz & Tom Stevens

Power, described by Betz and Stevens,41 may be applied to promote and to protect the vital interests of States.42 As described in Sect. 25.1.3 and mindful of earlier academic and doctrinal work,43 power requires (1) capacities, most often the so-called physical components (i.a. manpower, means), (2) a conceptual component (strategy, doctrine, planning), and (3) a moral component (will, resilience, determination) to ensure effectiveness, and thus to be regarded a capability.44 Power requires instruments, and capacities, that may only be effective when 'unlocked' through strategy.45

One essential part of the conceptual component, embedded in strategic notions, democratic principles and procedures, is the legal framework accompanying the foreseeable use of power instruments. In democratic rule-of-law States, the principles of legality demand that the use of power (instruments) by States must be

40It is signalling that the seven largest publicly traded companies having the greatest market capitalization, are ICT companies (Microsoft, Apple, Amazon, Alphabet, Alibaba, Facebook and Tencent). As on 31 March 2020. Market capitalization is calculated from the share price (as recorded on the selected day) multiplied by the number of outstanding shares. See Van Haaster 2019, p. 78, based on the Financial Times Global 500.

41Betz and Stevens 2011, p. 42.

42See supra n 10, p. 8.

43See Jakobsen 2011; NL Defence Staff 2019.

44The difference between capacities and capabilities is essential in this contribution. See by analogy NDD 2019, p. 66: "Fighting power is the ability to conduct military operations in an optimum NDD cohesive totality of functionalities and components. It is more than just the availability of means (capacities); there must also be the willingness and ability to deploy these means (capability). If this is properly developed, it then becomes fighting power, and capacities are elevated to capabilities."

45Betz and Stevens 2011, p. 40: "strategy is the art of unlocking the power inherent in national capacities to effect outcomes in the national interest in contest with other strategists acting in their own national interests".

based on such a legal framework. A first element in this legal framework is the legal basis for the legitimate employment of power instruments.46 In addition, the legal framework, will also entail decision-making procedures describing the (legal and political) authority for the decision to use the designated assets,47 the applicable legal regimes when these assets are used (i.a. rules of engagement),48 and accountability and oversight mechanisms.49

#### 25.4 Legal Bases

Without a proper legal bases international action, law abiding, and legitimacy seeking States run the risk of producing (or threatening with) non-credible, thus non-deterrent action. Within the limits posed by international law, States are permitted to use power instruments in their international relations. When the use of these instruments falls short of the threshold on the use of force as defined in Article 2(4) of the UN Charter,50 interstate action is governed by the general principles of territorial sovereignty,51 and respect for the political independence and territorial integrity, and inviolability of States.52

Within this international law framework, various bases for non-forceful and forceful action indeed exist. The legal basis for non-forceful action (e.g. economic sanctions, or declaring diplomats persona non grata) is an essential part of the conceptual component as it offers three legitimate avenues for interaction with other States (and non-state actors). As States will generally seek to secure the (perceived) legitimacy of their acts, they will offer some form of clarification for non-consensual behaviour. Most often, these clarifications, or in other terms, legal bases, will be based on in the international law phenomena such as retorsion, countermeasures, or a plea of necessity.

Though the use of force itself is forbidden, international law relevant to interstate force, the jus ad bellum, offers another three exceptions to this rule that provide a

46Ducheine and Pouw 2009, 2012a.

47Ducheine et al. 2020.

48See e.g. Ducheine and Pouw 2009, 2012b.

49Ducheine et al. 2010.

50Article 2(4) UN Charter: "All Members shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the Purposes of the United Nations."

51On this principle in cyberspace: Ziolkowski 2013; and Pirker 2013. See also Tallinn Manual 2013, Rule 4.

52On this principle in cyberspace: Gill 2013.

legal basis for forceful (individual or collective) actions:53 consent,54 UN Security Council authorization, or self-defence (see below).55 The legitimacy of these actions strengthens the conceptual component of power as it invigorates the normative justification for the action and moreover, it enhances the will the act. The various legal bases for response action will be described below.

#### 25.4.1 Consent

Paradoxically as it may seem when considering deterrent capabilities, in some cases States might rely on a consensual basis to make use of its power instruments in international relations. This could be both non-forceful and forceful. International law enforcement cooperation might for instance provide for extraterritorial enforcement mechanisms,56 enabling States e.g. to locate or attribute threats. When this information is made public, it could contribute to the legitimacy of the use of other instruments and modalities. A consensual basis could also be envisioned through treaty-based conflict-resolution or enforcement mechanisms, for which the treaty provides. For example, through international law enforcement cooperation to obtain forensic evidence from a foreign internet service provider's cloud server. Another example could be a Status of Forces Agreement, enabling armed forces operating abroad, to act in designated ways in response of e.g. threats to its forces.57

#### 25.4.2 Retorsion

A second basis States might select is retorsion which is defined as unfriendly, but internationally lawful acts, that do not require a prior violation of international law

53Argumentum a maiore ad minus.

54See e.g. the Tallinn Manual 2013, Rule 1, para 8, following the notion of sovereignty, States 'may consent to cyber operations conducted from its territory or to remote cyber operations involving cyber infrastructure that is located on its territory'.

55See e.g. Gill and Fleck 2015, Part II.

56Ducheine 2015b, p. 469: "Cross-border law enforcement responding to illegal (cyber) activity could be undertaken with respect to the territorial sovereignty of other States with the consent of that State", with reference to Gill 2013, p. 229.

57See Boddens Hosang 2015; and Voetelink 2015.

per se.58 Unfriendly refers to the fact that retorsion is "wrongful not in the legal but only in the political or moral sense, or a simple discourtesy". 59 Retorsion may be used to enforce (international) law, in case the triggering act was indeed a violation of the law. It may also be used to enforce soft law arrangements.60 Notwithstanding its use in interstate relations, retorsion can also be used by and against qualified international organizations.61

State practice presents a great variety of measures of retorsion: each legislative, executive, administrative, etcetera measure that is permissible under international law and that "seems suitable to a State to redress the unwelcome, unfriendly, or illegal behaviour of another State". 62 Common forms can be found within various power instruments: protest; cancelling State visits; denying ships access to ports or to the exclusive economic zone; summoning ambassadors; declaring diplomats persona non grata;63 "downgrading diplomatic intercourse to the technical level; recalling ambassadors for consultations of indefinite duration; severing diplomatic relations; terminating the payment of development aid or the provision of military assistance; unilaterally imposing legally permissible economic sanctions such as an arms embargo; [..] suspending, terminating, or refusing to prolong a treaty; and withdrawing from an international organization in order to protest this organization's political activities." 64

Retorsion by using cyber capabilities would be an option in a response to unfriendly (or unlawful) acts by other States,65 e.g. by "limiting or cutting off the other state's access to servers or other digital infrastructure in its territory", 66 or by

58Max Planck Encyclopedia of Public International Law [MPEPIL]. Based on the Articles on State responsibility, chapeau to Chapter II of Part 3, para 3 of the Commentary.

59MPEPIL, para 2. As stressed by (inter alia) the Netherlands' Cabinet: "This option is therefore always available to states that wish to respond to undesirable conduct by another state, because it is a lawful exercise of a state's sovereign powers. States are free to take these kinds of measures as long they remain within the bounds of their obligations under international law." See Parliamentary Papers II (House of Representatives) 2018–2019, 33–649, no. 47 (annex), p. 7. Via https://www.government.nl/ministries/ministry-of-foreign-affairs/documents/parliamentary-

documents/2019/09/26/letter-to-the-parliament-on-the-international-legal-order-in-cyberspace.

60Soft law being non-binding international arrangements, see MPEFIL, para 37: "a complex of norms lacking binding force, but producing significant legal effects nevertheless".

61To the extent that the latter have international legal personality and the capacity to act in the international sphere, see: MPEPIL, para 1.

62MPEPIL, para 10.

63As was the case in response to Russia's meddling with the 2016 US Presidential elections, see: US White House 2016; Sanger 2016.

64MPEPIL, para 10.

65Gill 2013, p. 230 and the accompanying notes; and Gill 1992, p. 105.

66Parliamentary Papers II (House of Representatives) 2018–2019, 33 649, no. 47 (Annex), p. 7, stressing: "provided the countries in question have not concluded a treaty on mutual access to digital infrastructure in each other's territory".

"misleading a prospective intervening party by providing it with bogus or useless information or otherwise diverting cyber break-ins from their intended targets". 67

#### 25.4.3 Countermeasures

A third basis for response options consists of threatening or taking countermeasures. This involves actions taken in response to another State's violation of international law.68 They may be defined as "pacific unilateral reactions which are intrinsically unlawful, which are adopted by one or more States against another State, when the former considers that the latter has committed an internationally wrongful act which could justify such a reaction". 69 Countermeasures are used to induce compliance (and enforcement) of international legal obligations.

Unlike retorsion, countermeasures interfere with the target State's international legal rights, and are therefore subject to preconditions.70 They require (1) a prior internationally wrongful act that (2) can be attributed to a State; (3) with the sole purpose to induce the wrongdoer's compliance; (4) they are limited to non-forceful and proportionate actions only; and (5) a prior demand to the wrongdoer is required.71 Finally, (6) countermeasures are not allowed once the unlawful act has ceased.72

In terms of responding to prior cyber incidents that violate international law, countermeasures could be used to actively hack back when the location of the infrastructure is known, e.g. the GRU headquarters, to stop the violation,73 or to initiate action against States that should have acted to stop their infrastructure from being to for the violation, but are not willing to do so.74

#### 25.4.4 Plea of Necessity

In addition, States facing 'grave and imminent peril' to its 'essential interests' might, when the strict conditions are met, rely on a plea of necessity in response.

67Gill 2013, p. 236.

68Schmitt 2014a.

69Geiss and Lahmann 2013, p. 629.

70Schmitt 2013b, p. 678; Tallinn Manual 2013, Rule 9; also Parliamentary Papers II, House of Representatives, 2010–2011, 32 500 V, no. 166, p. 2.

71See supra n 56, p 470.

72Geiss and Lahmann 2013, p. 638.

73Parliamentary Papers II (House of Representatives) 2018–2019, 33-649, no. 47 (annex), p. 7: "a cyber operation could be launched to shut down networks or systems that another state is using for a cyberattack". The 'GRU' is the military intelligence service of the Russian Federation.

74See the debate covered in the commentaries to Rule 20-25 in the Tallinn Manual 2.0 2017 and Schmitt 2017.

Unlike countermeasures, action based on this plea does not require a prior internationally wrongful act to which it is responding, and the author responsible for this act to could—next to States—also be a non-state or an unknown entity.75 Once again, the preconditions are very strict. The threshold is high, as it requires (1) a situation of 'grave and imminent peril' to (2) 'essential interests' of the Victim State.76 Moreover, action may (3) not involve the use of force,77 should be (4) proportional, and it (5) requires attribution to the author of the (threatening) act who should be (6) addressed first ordering him/her to desist.

The crucial notion of essential interests of States is "vague in international law". 78 What is essential, is contextual and will depend from State to State. Grave and imminent peril to a State's essential interest, refers to actual harm and to threats: "the damage does not already have to have taken place, but it must be imminent and objectively verifiable". 79 Moreover, damage caused or threatened could be physical or non-physical, e.g. "situations in which virtually the entire internet is rendered inaccessible or where there are severe shocks to the financial markets" could be viewed as cases in which necessity may be invoked.80 Alongside the strict conditions, the plea also gives leeway, as "establishing the existence of a situation of necessity does not require a State to determine the precise origin of the damage or whether another State can be held responsible for it." 81 Nevertheless, the necessity may only be invoked when "no other real possibility of taking action to address the damage caused or threatened exists, and provided there is no interference with the essential interests" of other States "or of the international community as a whole". 82

In terms of cyberspace, closing down an intrusive cyber operation (e.g. ransomware) against central medical infrastructure or key financial technology (e.g. iDeal) caused by cyber criminals operating from an unknown jurisdiction so that international law enforcement cooperation is futile, could be a scenario to be used.

#### 25.4.5 Self-Defence

Next to retorsion, countermeasures and a plea of necessity, States may in extreme situations of an armed attack, resort to yet another self-help mechanism:

75Schmitt 2014b; Geiss and Lahmann 2013. Tallinn Manual 2.0 2017, Rule 26.

76Schmitt 2013, p. 663,2014b: "In the cyber context, the plea of necessity is most likely relevant when cyber operations threaten the operation of critical cyber infrastructure."

77See supra n. 56, p 470.

78Tallinn Manual 2.0 2017, p. 135.

79Parliamentary Papers II (House of Representatives) 2018–2019, 33 649, no. 47 (annex), p. 8.

80Parliamentary Papers II (House of Representatives) 2018–2019, 33 649, no. 47 (annex), p. 8.

81Parliamentary Papers II (House of Representatives) 2018–2019, 33 649, no. 47 (annex), p. 8.

82Parliamentary Papers II (House of Representatives) 2018–2019, 33 649, no. 47 (annex), p. 8.

self-defence.83 Before the terrorist attacks of 2001, international law accepted that States that are the victim of violent activities that reach the threshold of an armed attack84 may respond with lawful measures of self-defence against the author(s) of that armed attack, "provided it does so in conformity with the other material (necessity and proportionality)85 and procedural requirements of exercising self-defence (reporting to the Security Council)." 86

Whether violent activities or operations qualify as an armed attack 'depends on its scale and effects'. Based on Article 51 UN Charter and customary law, an armed attack has been defined as "a use of force which originates from outside the target State's territory, rising above the level of a small scale isolated armed incident or criminal activity, which is directed against a State's territory, its military vessels or aircraft in international sea or airspace or lawfully present on another State's territory, or in certain situations directed against its nationals located abroad." 87

Analysing its elements, an armed attack, first of all, involves the use of force, normally understood to be military force. It might be 'produced' through conventional, nuclear or other means and methods of warfare.88 Second, it requires a significant use of force, usually measured in terms of "scale and effects", 89 as it is generally viewed as a more serious form of the use of force.90 Third is the transnational or cross-border aspect of an armed attack. Normally, armed attacks are conducted by the armed forces of a State, launching or conducting a military operation against targets in or belonging to another State.

In accordance with the principle of necessity, self-defence is a forceful measure of last resort, that is, when no consent could be reached, and collective enforcement measures under Chapter VII of the UN Chapter are in-effective, not feasible or not

83See supra n 56, p. 472, Rule 23.05. For more details on self-defence: Gill 2015, esp. pp. 214– 216; and Gill and Ducheine 2012, p. 443, 2015. See also Tallinn Manual 2013, Rules 13–17.

84See Article 51 UN Charter. See also its customary law basis in Gill 2015, pp. 214 ff (Rule 8.02). 85See Tallinn Manual 2013, Rule 14 on necessity and proportionality.

86See supra n 56, p. 472.

87Gill and Ducheine 2012, p. 443. Also: Gill 2015, p. 213, Rule 8.01.

88See: ICJ, Legality of the Threat or Use of Nuclear Weapons, Advisory Opinion, [1996] ICJ Rep 226, 8 July 1996.

89CJ, Case Concerning Military and Paramilitary Activities In and Against Nicaragua (Nicaragua vs. United States), Merits, 27 June 1986, paragraph 195. Also: Gill 2015, p. 216, Rule 8.03: "a reasonably significant use of force".

90See Article 2(4) UN Charter.

opportune. Moreover, the self-defence response should be proportional.91 In the context of this field of the jus ad bellum, proportionality has a distinct meaning.92 Contrary to common misunderstanding, proportionality in self-defence does not require a response in kind. In other words, self-defence is a proper legal basis for cross-domain deterrence, as e.g. a classic armed attack could trigger a self-defence response with cyber capabilities, and vice versa, a digital armed attack could be followed by a conventional military response.

#### 25.4.6 Self-Defence Post-2001

The classic interpretation of an armed attack however, has evolved as a result of the 9/11 terrorist attacks against the United States, and the 2015 terrorist attacks in France, including the subsequent responses that were based on self-defence. Next to States, non-states actors potentially qualify as the author of an armed attack too.93 Moreover, an armed attack could be 'produced' or generated by non-military means and alternative methods, such as hijacked airliners. In addition, an armed attack could also comprise a series of smaller attacks, launched by a single author against the same target State, when these attacks are reasonably related in geographic and temporal terms.94 These new insights, combined with current practises in cyberspace,95 have forced States to review their security strategies and stances in international relations, including international law.

Witnessing the interdependence of societies, economies, households and humans created through and with cyberspace, it is notable that States as well as non-state actors have proven to possess capabilities which can threaten or affect vital

91Gill 2015, p. 221, Rule 8.04.

92Gill and Ducheine 2012, p. 450 "Proportionality in the context of self-defense refers to the requirement that measures of self-defense must not exceed those required under the circumstances to repel the attack and prevent further attacks from the same source in the proximate future and that they must be roughly commensurate to the scale and aims of the overall attack. Hence, the scale and nature of the attack will determine what is required to repel or, if necessary, over-come it and prevent a continuation". On the various meanings of proportionality, see Van den Boogaard 2019. 93See supra n 46.

94Boddens Hosang and Ducheine 2020, pp 14–15: "This would require that the series of attacks can, firstly, be attributed at all, and, secondly, be attributed to a common author. Hence, it involves (i) the capability of detecting an attack, (ii) the capability of technical or 'forensic' attribution of the attacks, and (iii) the capability of legal attribution of the attacks to a common author (operating from abroad). Thirdly, the series of attacks should be directed against targets in or belonging to a single State. Fourthly, the series of attacks are—somehow—related in terms of time and location. And fifthly, the series of attacks, or the attack as whole, constitutes force of sufficient gravity in terms of scale and effects as to qualify as an armed attack". Also: Gill and Ducheine 2012. See i.a. UN Doc. S/2001/947 (Letter dated 7 October 2001 from the Chargé d' affaires a.i. of the Permanent Mission of the United Kingdom of Great Britain and Northern Ireland to the United Nations Addressed to the President of the Security Council), p. 1.

95See supra n 10.

interests.96 As noted by Boddens Hosang and Ducheine, "launching cyber operations that potentially equal the effects of an armed attack, as was the case on 9/11, either by State or non-state actors, is not just a theoretical chance or risk." 97 In recognition of this, the Netherlands98 and France, take the view that cyber-attacks could qualify as armed attack,99 including the option of purely non-physical consequences of the attack. France notes that a "cyberattack could be categorised as an armed attack if it caused substantial loss of life or considerable physical or economic damage. That would be the case of an operation in cyberspace that caused a failure of critical infrastructure with significant consequences or consequences liable to paralyse whole swathes of the country's activity, trigger technological or ecological disasters and claim numerous victims." 100 The Netherlands' government, based on its advisory councils, recognizes that "disruption of the state and/or society, or a sustained attempt thereto, and not merely an impediment to or delay in the normal performance of tasks" 101 could indeed qualify as an armed attack. Notably, a cyber operation targeting "the entire financial system or prevents the government from carrying out essential tasks" could well be equated with an armed attack.102

### 25.5 Other Parameters: Institutional Arrangement and Attribution

In addition to the legal basis as part of the legal framework that contributes to the conceptual component of power (instruments), two other legal elements are relevant in order to generate effective capabilities with the designated capacities: the institutional set-up and the ability to attribute. Once again, in case these elements are not in place, producing (or threatening with) action with power instruments would be non-credible and ineffective, as opponents would be (or could be) aware of the missing link to transform capacities into effective capabilities.

Related to the legal basis and to the tasking of responsible State organs, and impacting on the decision-making procedure thereto, is the paradigm governing the potential or real response. So, rules concerning the roles, mandates and responsibilities of services and State organs i.a. the Ministry of Foreign Affairs, Ministry of

96See supra n 94, p. 13, referring to WRR 2019; Algemene Rekenkamer 2019; Dutch Safety Board 2020.

97See supra n 94, p. 13.

98Parliamentary Papers II (House of Representatives) 2018–2019, 33 649, no. 47, p. 8 (see supra n 59). For the Advisory Report it follows: AIV/CAVV 2011.

99In general terms, this is also the explicit view of NATO, the United Kingdom, Estonia and Australia.

100France 2019, p. 8.

101See AIV/CAVV 2011, p. 21.

102See AIV/CAVV 2011, p. 21.

Trade and Development Aid, Economic Affairs, Police, Public Prosecutors, armed forces etc., ought to be in place. It also entails decision-making procedures describing the (legal and political) authority to order the use of the designated assets.103 Moreover, it involves the legal regimes applicable when these assets are to be used, i.a. rules of engagement, should be clear.104 Likewise, accountability and oversight mechanisms will have to be in place.105

Next, a four-tiered attribution framework, is required.106 First, threats or harmful cyber incidents need to be detected. Without adequate detection, States are unaware of threats or actual damaging situations in cyberspace, and therefore unable to respond or deter at all. Detection capacities also require conceptual (i.a. legal) backing, before capabilities emanate. Hence, it should be clear who is tasked with what kind of detection or surveillance responsibilities, as well as how detection is handled and communicated to what authorities. For that reason, surveillance and/or investigative powers should be available to the relevant services. Second, technical attribution is needed: a technical forensic inquiry is required to assess e.g. what malware was used, how it operates, from which IP-address or cyber identity it came from, what path it followed and who authored it and has sent it. Obviously, this will require investigative powers. Third, through legal attribution the actors who bear responsibility for the incident may be designated. This relates to the burden of proof and affiliating the perpetrator e.g. an APT to a State or subject to State control. The so-called Articles on States Responsibility are the key legal concept in this realm. The final part is political attribution in which a State may choose to use political communication to address the responsible State (and author)107 and if necessary, seek (legal) retribution.108 But this 'naming and shaming' will not always follow suit;109 it will often be conducted discreetly and not in public especially if the relation with the perpetrator is sensitive or if it is a friend rather than a foe. It should be noted however, that political attribution is not required to stem from digital forensics and/or legal attribution. Often the political attribution is a solitary and unilateral act.110

The concepts (and rules) for these three forms of attribution should be available, clear and ready to be used, exercised if possible. In case essential parts of this framework are lacking, outdated, not well known or badly rehearsed, the conceptual

103See supra n 47.

104See supra n 48.

105See supra n 49.

106Rid and Buchanan 2015; Bijleveld 2018.

107See e.g. The Netherlands considers Russia's GRU responsible for cyber-attacks against Georgia, at https://www.government.nl/ministries/ministry-of-foreign-affairs/documents/diplomaticstatements/2020/02/20/the-netherlands-considers-russia%E2%80%99s-gru-responsible-for-cyberattacks-against-georgia.

108See e.g. the indictments against the Internet Research Agency by the US Department of Justice: US DOJ 2018a.

109Finnemore and Hollis 2019.

110US White House 2016; UK Foreign and Commonwealth Office 2020.

component is suboptimal, and credibility, hence also effectiveness, of the deterrent instrument could be at stake. For example, with its Defence Cyber Command, cyber capacities in the Netherlands are available. Moreover, the ambition to use these capacities in a deterrent posture had been expressed publicly. However, when the meaning of what an armed attack entails, is unclear, or when political111 or operational112 decision-making procedures to actually use these capacities in self-defence would be missing, no credible, hence no effective capability is around. As that would be the same when the political will to actually use the capacities of the Defence's Cyber Command, is lacking.

#### 25.6 Instruments—Legal Bases Matrix

While the analysis of the legal framework above was presented in the context of cyber capabilities and threats, this framework is generic and essential to all democratic rule-of-law States. The matrix in Table 25.1 is composed of the various power instruments as previously described. It conveys how states can resort to specific legal bases when considering employing instruments of power. The numbered boxes offer realistic combinations of instruments/modalities and legal basis. The numbering refers to a vignette below. While space restriction precludes covering each of the available options,113 a few fictitious examples for the

Table 25.1 Legal bases matrix

The \* stand for: non-violent/non-forceful action only (Source Ducheine and Pijpers)

111See supra n 47.

112See e.g. Smeets and Work 2020.

113Fictitiously ranging from 1 to 22 in the matrix (Table 25.1).

(Source Ducheine and Pijpers)

Table 25.3 Vignette for option 5—Counter-Intelligence operation (countermeasures)

Netherlands' institutional and constitutional setting, including the EU framework, will serve to demonstrate the logic and value of the matrix.114

In scenario one, based on the Cabinet's decision, the Minister of Foreign Affairs has ordered a negotiation team on bilateral trade cooperation with State B to pause consultations (see option 2 and Table 25.2).115 The decision came after the annual report by one of the Intelligence Services revealed that B was caught in an attempt to exfiltrate stolen intellectual property. The Minister just announced this in Parliament, who have formulated questions to learn more details. Using the matrix, this example can be expressed as the following (see Table 25.2).

Another vignette involves a counter-intelligence operation (see option 5, and Table 25.3). Based on authorisation by the Minster of Home Affairs, the General Intelligence and Security Service (AIVD), has taken control over a command and control server located in State B that was used by one of B's proxies, to steer a large botnet threatening to overload C2000 communications. The Minister has informed the Parliamentary Intelligence Committee (CIVD), and the Review Committee on the Intelligence and Security Services (CTIVD) is aware of the operation and will evaluate the legitimacy of the operation in the coming year.

114As States will have different institutional and constitutional settings, these vignettes based on the Dutch background serve as an example only.

115See e.g. Van der Meer 2018.

#### 25.7 Conclusion

Contemporary conflicts are no longer exclusively fought in the military domain, if they ever were. Other arenas and instruments of power have come to the fore. Next to military power, economic, diplomatic, cultural, legal and especially informational means are important in today's world in which physical confrontation is often absent or less relevant, inter alia due to the emergence of cyberspace as an omnipresent domain of engagement.

In order to effectively apply State power, through whatever instrument, the capacities need to be in place as well as the will to apply them. An often-overlooked factor however is the conceptual component: a clear idea on how to apply the instruments, the relevance of which only increases with the widening set of instruments of power States may consider, or be forced to employ, such as cyber operations.

For democratic States the conceptual component fundamentally includes the legal framework and proper and well established institutional arrangements. The legal framework, often undervalued, generates the conceptual legitimate basis for executing operations, including deterrence operations. It includes the legal basis in terms of proper authority and decision-making procedures, legal regimes, accountability and oversight mechanisms. Moreover, the framework must not merely exist, it must be trained in a cross-domain setting, because in case essential parts of the legal framework are lacking, outdated, not well known or badly rehearsed, the conceptual component is suboptimal, and credibility, hence also effectiveness, of the deterrent instrument could be at stake.

Although this framework was set up within cyberspace and with cyber threats as a starting point, the argument is that in its generic shape, this legal framework is relevant outside cyberspace in expressing the State's will and for countering outside threats. The framework itself, composed of international legal bases and other national legal elements, is presented here in a matrix, combining all instruments of powers, and applicable legal bases enabling the actual or potential use of those instruments in their various modalities.

The matrix also demonstrates that other strategic functions could benefit from the idea that power entails capacities, concepts to use it, and the actual will to do so. The examples demonstrated that threats from one domain could be countered by responses in another domain. The legal framework thus may empower the ambition to effectuate so-called cross domain deterrence.

#### References

AIV/CAVV (2011) Advisory Council on International Affairs/Advisory Committee on Issues of Public International Law. Cyber Warfare. Advisory Report no. 77/22. Online at: www.aivadvice.nl or www.advisorycouncilinternationalaffairs.nl/documents/publications/2011/12/16/ cyber-warfare. Accessed 1 May 2020

Paul Ducheine (Ph.D.) is an active serving general officer of the Netherlands Army and Professor of Cyber Operations at the Netherlands Defence Academy (NLDA), as well as Endowed Professor of Military Law of Cyber Operations and Cyber Security at the University of Amsterdam.

Peter Pijpers is Associate Professor for Cyber Operations at the Netherlands Defence Academy and Ph.D. Candidate at the University of Amsterdam.

Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

# Conclusion: Insights from Theory and Practice

Tim Sweijs and Frans Osinga

Strategists are fond of saying that the nature of war is immutable, but its character is not.1 Even Von Clausewitz, whose very objective was to develop a general theory of war, held that every age has "its own kind of war, its own limiting conditions, and its own peculiar preconceptions." 2 The same can be said for strategy. History offers ample examples of strategic concepts that guide how means are to be connected to political ends in order to defeat adversaries in particular historical contexts. Warfighting concepts have included dislocation and exhaustion to target the adversary's will, and attrition and annihilation to deal with its capabilities.3 In times of relative peace such concepts have included containment, assurance and most famously deterrence. The use and utility as well as the practical application—the character—of such concepts are context bound as they are determined by a range of social, economic, (geo-)political and technological factors.4 Some strategic concepts wither away and are consigned to the dustbin of history; other concepts persist and are updated to address the challenges of today's world. Deterrence belongs to that latter category. It continues to feature as a prominent concept in contemporary strategic thinking and practice.

1 Gray 2016. 2

Von Clausewitz 1989, p. 593. 3

© The Editor(s) (if applicable) and The Author(s) 2021 F. Osinga and T. Sweijs (eds.), NL ARMS Netherlands Annual Review of Military Studies 2020, NL ARMS, https://doi.org/10.1007/978-94-6265-419-8

Echevarria 2017, p. 9. 4

Murray et al. 1994.

#### Deterrence Rediscovered

Although deterrence was neglected in military doctrines and real world campaign designs for about two decades following the Cold War, in practice it was never absent (and that disconnect might well have been one of the major factors hampering achieving operational success). In the first part of the book Lawrence Freedman elegantly lays out this recent history of deterrence in theory, policy and practice to remind us of its enduring presence and utility as well as its complexity. The Cold War flattered deterrence, he dryly observes, suggesting deterrence is easy. It is not. While in some cases general deterrence might have transformed into an established norm guiding international behaviour, in many cases deterrence was problematic and failed because it revolved around deterring specific unwanted behaviour in a crisis where a state or non-state aggressor thought his interests were better served with challenging the status quo. As Freedman concludes, "deterrence works best with unambiguous red lines, established over time, linked with vital interests, formulated in clear and credible messages, backed by actual capabilities, about what will happen if they are crossed. It will work less well as more uncertainties are introduced—about where the lines actually are, how much any transgressions will matter, whether there will be much of a response if they are crossed, and what difference that will actually make." Freedman therefore warns us in Chap. 1 that deterrence's efficacy should not be taken for granted, especially not in unique situations when deterrent threats are formulated under time pressure and their credibility is in doubt.

#### Deterrence—A Fresh Perspective

Michael Mazarr, in Chap. 2, a wonderfully concise primer on deterrence, captures the various familiar conceptual distinctions—general versus immediate, direct versus extended, narrow versus broad, denial versus punishment—but importantly adds that, in contrast to the classical works on deterrence that harped on (nuclear) capabilities, the most important conclusion of his chapter is that "deterrence and dissuasion must be conceived primarily as an effort to shape the thinking of a potential aggressor". Mazarr argues that in designing a deterrent posture a deterring state should first and foremost understand the "interests, motives, and imperatives of the potential aggressor, including its theory of deterrence (taking into account what it values and why)." This is necessary because the behaviour of potential transgressors is not necessarily the exclusive product of belligerent expansionism. Effective deterrence therefore involves more than mere threats and requires "the nuanced shaping of perceptions so that an adversary sees the alternatives to aggression as more attractive than war".

#### Conventional Deterrence

Karl Mueller agrees with that admonition in his discussion on conventional deterrence in Chap. 4. Deterrence is not dependent on war appearing costly or risky in the eyes of the target: it requires that the prospect of war appears worse than the other options, which is certainly not always the case. The potential transgressor's cost benefit assessment of war is fundamentally shaped by its beliefs about the consequences of it actions, or, in other words, by its subjective expectations. History is rife with cases of misperception and mistaken prediction and decision-makers pursuing courses of action that in hindsight they had been better off not pursuing.

Deterrence by conventional military force has its limitations; it is contestable. The challenger can take defensive measures so that the deterrer will not be able to inflict the damage that it threatens with. It requires substantial force to ensure that costs can be inflicted to translate into coercive pressure. Conventional deterrence is nonetheless selected because often deterrence by nuclear or unconventional instruments is too costly, or deploying such instruments is seen as 'incredible, unpalatable, or simply inconceivable'. Mueller analytically distinguishes between four conventional deterrence strategies: battlefield defeat, punitive resistance, strategic retaliation, strategic defeat (threatening the opponent with defeat after a prolonged war). In addition to substantial military force, effective conventional deterrence requires robust political will and endurance on the side of the deterrer, to convince the potential transgressor that the threat will materialise in the end. Finally, deterrence may also require making "not going to war look more attractive though reassurance measures or promises of rewards".

#### NATO and the Shock of the Old

For the West, the rise of China and the resurgence of Russia has heralded a new era of strategic competition, in which nuclear deterrence has returned to the political, military and academic agenda. The markedly different geopolitical context poses a new set of distinct conceptual, strategic and political dilemmas to Western states and their security organisations, as Sten Rynning argues in Chap. 3. For the North Atlantic Treaty Organization (NATO), deterrence of Russian aggression has made tackling challenges related to power projection, force modernization, and burden-sharing more paramount. According to Rynning, "in addition to its limited muscle, it lacks institutional memory when it comes to joint high-intensity warfare, and faces a political geography that favours Russian interior lines and confounds NATO plans of reinforcement, and discomfort with a new interface between conventional and nuclear deterrence." It is not good at understanding either Russia's political intentions or its military capabilities. The rise in nationalism in NATO member states undermines the cohesion of an alliance founded on liberal values. Meanwhile, NATO is still trying to articulate a vision and a concomitant long term strategy for engaging its decidedly non-liberal neighbour. The combination of NATO's conventional military shortcomings, Europe's geographical makeup, and Russia's anti-access area-denial capabilities means that NATO is almost forced to rely on a deterrence by punishment posture by default. The military plan underpinning that posture is prepared but, as we know from traditional deterrence theory, robust capabilities need to be accompanied by clear political will in order for deterrent threats to be credible.

#### High Expectations: NATO Deterrence and the Baltic States

NATO's challenges, and its search for a coherent deterrence strategy, are explored in the context of the Baltic states where they become tangible by Jörg Noll et al. in Chap. 7. Using a strategic cultural perspective, they explore how the three Baltic states perceive the underlying strategic logic of NATO's Enhanced Forward Presence (EFP) in the Baltics as a deterrent instrument. In Estonia, government documents reflect the official NATO narrative of deterrence by punishment, even if other sources stress the illusion, expectation or aspiration of deterrence by denial. In Lithuania, both documents, officials and experts emphasise deterrence by denial as opposed to deterrence by punishment. Latvia considers the strategy behind EFP as one of deterrence by punishment. The strategic cultures, the history and threat perceptions of the Baltic states explain these differences to a large extent, so the authors argue. In particular, the presence of Russophone minorities in Estonia and Latvia may account for some of the reluctance of these countries to fully embrace NATO's strategy, even though both countries prepare to counter Russia's threat with their allies. If for the US and Western European states NATO's deterrence strategy and its challenges at times remain rather abstract, for the Baltic states, clarity concerning the nature and credibility of the deterrence strategy is an acutely felt requirement and differences in interpretation may undermine rather than reinforce that strategy.

#### Extended Deterrence

Several other challenges to deterrence stability are discussed in this volume, each a manifestation in its own right of the significant differences between the contemporary geopolitical context in comparison to the Cold War. Paul van Hooft puts the spotlight back again on the political drivers shaping the present and future of the US' extended deterrence posture in Chap. 6. He assesses not only technical and doctrinal developments but also points towards the critical role of economic and political interests, warning that the US nuclear umbrella for its European allies will not necessarily endure into perpetuity given the vastly different strategic circumstances of the 21st century. Van Hooft therefore considers U.S. extended deterrence guarantee to be "precarious"; extended nuclear deterrence has always been "inherently dubious" but increasing uncertainty about the ability of the US to win a conventional conflict at limited costs, and asymmetric interests is likely to further exacerbate that dubiousness. It also suggests that nuclear weapons will be playing a more important role in the US extended deterrence posture.

#### Nuclear Deterrence, Stability and Arms Control

Alexey Arbatov also looks at extended deterrence in Chap. 5. He complements van Hooft's analysis with an examination of recent trends in Russian nuclear strategy and policy. Arbatov notes that over the past thirty years, the nuclear capabilities of Russia and the US have been significantly reduced both in terms of warheads and in terms of kilotons but the risk of nuclear war is higher than it was at the end of the Cold War. Recent adaptations of the nuclear postures of these two nuclear giants collide with a period of substantial military-technological change. Arbatov describes how the introduction of new effectors and enablers such as hypersonic missiles, space-weapons, cyber instruments, and the integration of AI in nuclear command and control systems poses a formidable challenge to strategic stability. Early warning systems can be either be attacked or fooled by new space and cyber capabilities. The use of sea based missiles can shield the identity of the attacker. Hypersonic missiles make earth based radars irrelevant and significantly shorten the time to respond after detection by satellite systems which are not one hundred percent flawless. This takes place in the context of a polarised US-Russia relationship in which there is little interest from either side to collaborate through confidence building measures and arms reduction treaties. His ominous analysis concludes with a set of concrete policy recommendations for the foundations of a new generation of arms control initiatives to promote strategic stability. Perhaps the most important take away from his chapter is the vivid reminder, coupled with the important warning, that nuclear stability presumes a shared understanding of the meaning of strategic stability and a willingness to invest not only in deterrence capabilities, but also in a stability enhancing mutually agreed upon political framework.

#### Cross-Domain Deterrence

The emerging era of strategic competition has spawned a stream of literature propagating labels such as hybrid warfare, grey zone competition, new total war, and liminal war. If anything, they are reflective of a growing awareness that actors such as China and Russia, but also Iran and others utilise a wide array of military and non-military activities for coercive purposes. These include economic pressure, disinformation campaigns, inciting political corruption, espionage, providing weapons to opposition groups, polarising domestic debates in target countries, and cyberattacks. Partly in response to this development, and partly in response to the emergence of cross domain war fighting strategies in strict military domains, Western analysists have coined the notion of cross domain deterrence.

Tim Sweijs and Samuel Zilincik assess a recent body of literature on cross domain deterrence in Chap. 8 and argue that it offers plenty of practical insights on how to effectuate measures to deal with challenges related to attribution, threat credibility and proportionality, signalling and escalation management both in and across domains, but has also engendered innovation on the conceptual front. Their review reveals significant continuities but also significant changes in the insights offered by the cross domain deterrence literature in comparison with the classical literature. They relate that deterrence has been cross domain in character since its inception and observe that the continuities with traditional deterrence literature are indeed considerable. Traditional concepts of deterrence by punishment and denial still feature in the strategic lexicon, while favouring conditions of successful deterrence including the communication of credible threats of cost imposition rooted in robust capabilities and strong political will is also extensively discussed. Yet, the cross-domain deterrence literature also provides a range of new theoretical insights both by reinterpreting and by expanding traditional concepts of deterrence. It employs a more sophisticated understanding of the cost-benefit calculus of deterrence actors that considers identity and social belief systems. It includes both traditional and new military domains as well as non-military domains such as the economic and the information domains. It calls attention to the role of social costs in deterrence by punishment arguing for the important role of norms in deterrence by delegitimisation because transgressors will be disinclined from engaging in certain behaviour out of moral conviction or fear that it will result in widespread condemnation. It finally expands the scope from negative to positive incentives through deterrence by entanglement in which transgressors hurt themselves if they harm the deterring actor.

On this basis, they assert that the discussion in the cross-domain deterrence scholarship is more than old wine being served in new bottles. Finally, they conclude that this conceptual expansion of deterrence that involves a wide array of military and non-military instruments which can be used "both as a stick and a carrot, both to compel and to deter, both to persuade and to dissuade", may well be necessary to deal with today's strategic challenges, but they suggest that the use of dissuasion as the umbrella term for the wider deterrence by denial and punishment, norms, entanglement, resilience and assurance may be more appropriate.

#### Non-Western Concepts of Deterrence

#### Russia and China

In comparison to traditionally much more straitjacketed and dichotomous understandings of deterrence that prevailed in the West, official Chinese and Russian concepts of deterrence are rooted in much more holistic understandings. These holistic understandings encapsulate elements of both deterrence and compellence, can take place before, during and after war, and cross military and civil domains, as highlighted by Dean Cheng in Chap. 10 and Dmitry Adamsky in Chap. 9.

Starting with an insightful exploration of the etymological Russian roots of deterrence related concepts, Adamsky explains that Deterrence à la Ruse stands for "the use of threats, sometimes accompanied by limited use of force, to preserve the status quo ("to deter" in Western parlance), to change it ("to compel" in Western parlance), to shape the strategic environment within which the interaction occurs, to prevent escalation and to de-escalate during actual fighting". This is different from the Western conceptualisation in which deterrence suggests a reactive approach while compellence a more proactive approach. Strategy is being wrought as part of a permanent engagement, with no distinction between peacetime and wartime. Adamsky uses the term struggle to denote the Russian notion of strategic interaction in its totality. The common dichotomy of war versus peace has meaning only in the sense that it signifies the level of intensity of the competition, which is regarded as continuous and takes place before, during and after armed conflict. This logic informs the Russian understanding of deterrence throughout the entire spectrum of strategic interaction including preventing a threat from emerging in the first place whether or not in peacetime, using force in crisis or war, or shaping the strategic environment afterwards.

The Chinese conceptualisation is closer to the Russian than to Western concepts of deterrence, allowing for substantial differences. Referring to official Chinese literature and scholarly analysis, Dean Cheng suggests that the Chinese do not necessarily think in terms of deterrence, as that term is employed in Western strategic literature, but in terms of coercion. Whether an adversary agrees to do something they would prefer not to do, or avoids doing something they would prefer to do, both fit within the Chinese term weishe. This term incorporates both compellence and dissuasive aspects. Moreover, instead of regarding deterrence as a goal, in the Chinese conceptualisation deterrence is seen as an instrument. For Chinese decision-makers, Cheng explains, successful deterrence is ultimately a form of political activity and psychological warfare, whereby an adversary is constrained in its actions, allowing China to achieve its objectives. The concept is used to describe signalling and activities both towards and during military conflict, and spans all phases of war. As such, Cheng concludes, the Chinese interpretation of deterrence is closer to the Western conceptualisation of 'coercion' in its pre-war and intra-war forms.

In the Russian and Chines conceptualisations of deterrence, power accrues from the employment of both military and non-military instruments. In that sense, theirs is a multi-domain concept of deterrence that includes nuclear, space, and information means. Moreover, both share the idea that coercive efforts are closely tied to their war-fighting concepts. As Cheng notes, Chinese deterrence capability is "based on the ability to wage real war", and the structure of deterrent strength is indistinguishable from combat strength, including mounting nuclear strikes. Adamsky in Chap. 9 also explains that in Russian strategic thinking the notion of military victory has not disappeared from nuclear strategy. The linkage itself, by raising issues of crisis stability, enhances deterrent effects. Applying the Western terminological framework to explain Russian and Chinese concepts may thus lead to misperceptions, and mirror imaging invites strategic mistakes.

#### Iran

The Iranian concept of deterrence present another fascinating case that illustrates the limits of classical Western conceptualisations of deterrence and the importance of strategic context and strategic culture. Hassan Ahmadian and Payam Mohseni rightfully highlight a dearth of theoretical work on deterrence in non-western settings in Chap. 13. They explain that the difficulty of understanding Iranian behaviour stems from the fact that the country's strategy is built on a combination of conventional and asymmetric deterrence that incorporates the support of other state and non-state actors. The logic stems from the strategic history of Iran and Syria. Their threat perceptions, the authors explain, have been shaped by a shared sense of regional isolation and a shared antiimperialist ideology. The two countries forged a partnership with the practical objective of deterring regional threats from their main adversaries primarily the United States, Israel, and Iraq under the regime of Saddam Hussein.

Iran maintains a two-pronged deterrence strategy. Its conventional deterrence capabilities are largely rooted in its domestic ballistic missile programme and its capacity to use missiles to hit regional targets (such as strikes in Iraqi Kurdistan and on ISIS positions in Syria). Iran also has asymmetrical deterrence capabilities largely through its support of regional non-state actors, such as Hezbollah in Lebanon, and also through the operational activities of the external branch of the Islamic Revolutionary Guards Corps (IRGC), the Quds Force. The Iranian strategy within the Levant, Ahmadian and Mohseni argue, should be understood as "forward deterrence", defined as the "deployment or possession of deterrent capacity beyond one's own national borders that abut on the adversary's frontier". This strategy does not rely on direct forward deployment of armed forces. Instead deterrence capacity is predominantly provided by partners and allies. For Iran, the strategic function of Syria is to provide it with strategic depth in the Levant and access to Hezbollah. Syria also maintains a combined conventional and asymmetric deterrence strategy against Israel. Combined, the authors conclude, these elements constitute Iran's comprehensive deterrence doctrine in which it uses a diverse and multi-layered assortment of means to defend itself from any form of potential aggression.

#### Japan

The Japanese deterrence strategy is similarly deeply influenced by its history, as Nori Katagiri explains in Chap. 11. Japan's national security resources and institutions are not suited to deter foreign attackers because limitations on Japan's ability to offensive military operations—a necessary factor for deterrence relying on threats to impose costs. Existing restrictions on the use and threat of force stem from post-war constitutional and normative constraints. As a result, Japan's default strategy is one of deterrence-by-denial which is hampered in its implementation by the inherent limit on its practical ability to deter foreign attacks.

#### India and Pakistan

In Chap. 12 Sander Ruben Aarten demonstrates how deterrence dynamics between two nuclear powers—India and Pakistan—may play out very differently than what classical deterrence theory suggests, once again underlining the notion that deterrence in practice is context specific. Classical deterrence theory argues that the risk of conventional war will diminish when both actors possess nuclear weapons and have a declared nuclear deterrence strategy, out of fear of inadvertently exceeding the nuclear threshold of the other actor. Since both countries openly declared themselves nuclear weapon powers in 1998, India faced the daunting challenge of formulating an effective counterterrorism strategy—deterring Pakistani incursions on the Kashmir region—while remaining under Pakistan's nuclear threshold. India's response was the 'cold start doctrine'. This doctrine involves limited retaliatory advances inside Pakistan by rapidly mobilising infantry and armour before Pakistan's defensive positions can be occupied. In reaction, Pakistan developed its doctrine of full spectrum deterrence. As Aarten contends, the idea behind full spectrum deterrence is to provide Pakistan with retaliatory options that are commensurate with the intensity of the aggression it faces by linking conventional means with nuclear options on all levels—from tactical to strategic. Strong cross domain dynamics are key features of the subcontinental deterrence landscape as a result. The risk is considerable as Pakistan keeps open the option of a nuclear first-use and India adheres to a doctrine of massive retaliation. Thus, an all-out nuclear exchange may result from a Pakistan-supported militant attack on Indian soil, if both states abide by their doctrines. Yet this has not occurred, as Aarten observes, due to a shared reluctance by both sides to escalate to the nuclear realm. These findings all indicate that nuclear deterrence is less unstable than is assumed by many analysts and scholars, but also that nuclear deterrence can invite circumventing strategies which may result in occasional probes and responses in the conventional domain. The stabilising effect of nuclear weapons may thus not percolate into the conventional domain.

#### Deterring Non-state Actors in Non-traditional Contexts

Today's deterrence literature also exhibits a keen appreciation for the specific requirements for the effective application of deterrence in internationalised intra-state conflict that is so prevalent today against state and non-state actors. These contexts call for tailored deterrence, as Morgan discussed in 2012. Already during the peacekeeping operations of 1990s deterrence dynamics were at play at the local tactical level, which was again confirmed by counterinsurgency (COIN) operations in Iraq and Afghanistan. Counter-terrorism studies following the Al Qaeda attacks of 9/11 2001 focused on the question whether non-state actors could be deterred. A massive stream of studies dissected terrorist groups, suggesting that tailored deterrence might require specific approaches towards states sponsoring terrorist groups and towards leaders of terrorist groups while other influence methods might be more useful in preventing individuals from assisting or joining a terrorist group. The COIN literature emphasised the importance of mapping the socio-political structure of societies so as to identify those who might actively support the insurgents, who were politically supportive of them, and who might work with COIN units in suppressing them. These literatures—on peacekeeping, counter-terrorism, and counter-insurgency—often remained unconnected and unrelated to deterrence research.

Four studies in this volume address and remedy this disconnect. Eitan Shamir offers a thorough synthesis of research on the deterrence-violent non-state actor nexus in Chap. 14. In an innovative analysis in Chap. 15, Martijn Kitzen and Christina van Kuijck apply it to the COIN context where both insurgents and counter-insurgents vie for control over and support of the population. In Chap. 17, Peter Viggo Jakobsen applies deterrence theory to the context of peace operations where deterrence needs to focus on both state level actors and local non-state actors. Finally, in an imaginative contribution in Chap. 16, Maarten Rothman explores Russia's application of deterrence concepts in the context of preventing separatist or democratic movements to succeed in countries bordering Russia.

#### Deterring the Threat of Terrorism

In Chap. 14 Eitan Shamir builds on and synthesises a growing body of work on the nexus of deterrence and violent non-state actors. He details how Israel has developed a portfolio of tailored deterrence concepts against violent non-state actors that includes aspects of restrictive and cumulative deterrence aimed at curbing the opponent's ability but also at educating it in a process based approach that envisages a continuous deterrent relationship between the deterrer and the deterred. The consensus opinion held that terrorist groups, in particular those that are religiously motivated, are very hard to deter due to the fact that they present few tangible targets one can threaten, are often not monolithic organizations but consist of a covert network of relatively autonomous cells; there is not necessarily leadership with whom a state can communicate; while their fundamentalist ideologies preclude normal diplomatic negotiations; and the group will see the confrontation as a zero-sum game. The Israeli approach exemplifies a de facto reconceptualization of the meaning of deterrence, which once again corroborates the idea that strategic experience and culture has an important effect on concepts of deterrence.

Instead of conceiving of deterrence in absolute terms, which fails if one terrorist attack succeeds, Israel adheres to a restrictive deterrence approach. First, defensive infrastructure functions as part of deterrence, limiting the chance a terrorist attack will reach its target and achieve the destructive effect it seeks. Second, triadic deterrence involves threatening interests of those states that sponsor the terrorist group. Third, the mere fact that Israel uses force against groups such as Hamas or Hezbollah should not necessarily be considered a failure of deterrence, but as a reminder of Israel's ability to hurt such groups at will. It thereby serves to communicate that certain offensive actions have crossed the limit of violence Israel is willing to accept, thereby re-establishing the norm of what is considered acceptable. Moreover, a deterrent effect is not expected to accrue from symbolic attacks but from repeated strikes, whenever the norm has been violated. This so-called 'mowing the grass' approach also serves to degrade the capabilities and the will of the violent non-state actor. Restrictive and cumulative deterrence against violent non-state actors is therefore inspired more by criminological understandings of the notion than Cold War concepts of absolute deterrence.

#### Insurgents and Localised Deterrence

In Chap. 15 Kitzen and van Kuijck look at tactical and operational level challenges of deterring insurgents and ensuring support from the local population. They propose an influence continuum in combination with an audience typology and outline different methods to target different audiences that specifically includes non-kinetic instruments, all at the local level where troops must deal with local power brokers legitimate or otherwise—and the local population. They argue that the popular western heart-and-minds approach overemphasises persuasive methods to influence the population which often fail against the more intimidating authoritarian approach employed by insurgents. Acknowledging that a social environment is made up of people which are friendly, neutral or hostile to the counter-insurgent force, localized deterrence, based on a solid socio-cultural understanding of the environment, flows from a fluid application of influence operations designed to deter undesired behaviour—support the insurgent—and convince the population and local power brokers that the counterinsurgent contingent represents a legitimate and effective presence which will succeed in establishing a lasting secure environment. That array of influence instruments includes soft tools (information), economic incentives, and rewarding cooperation (or the withdrawal thereof), but must also include, more than is generally admitted in Western doctrines, coercive tools, such as empowering rivals of local power brokers and, the use of force against so called irreconcilables.

#### Deterrence and Peace Operations

In Chap. 17 Peter Viggo Jakobsen considers deterrence in another important context that features both state and non-state actors: peace operations. The attacks on Western peacekeeping units in the Balkan in the 1990s prompted scholarly interest in how threats and use of limited force could help deter such attacks and/or compel transgressors to stop them. Peace forces operate in a fluid context in which strict demarcations between deterrence and compellence break down. Jakobsen's ideal policy framework lays out the minimum requirements for success to deter and compel transgressors in such an environment. First, a credible threat which is strengthened if the coercer can demonstrate a capability to defeat the adversary swiftly at little cost. Second, a deadline for compliance in order to convince an opponent to refrain or stop attacks or engage in other forms of hostile behaviour in order to create a sense of urgency. Third, assurance that there will be no additional demands following compliance. Fourth and finally, and in line with Mueller's advice, inclusion of positive inducements to reduce the costs of compliance. An important notion, in line with the analysis of Shamir, Kitzen and van Kuijck, is Jakobsen's emphasis that deterrence in peacekeeping operations involves multiple means targeting multiple actors. As he relates, a key lesson from the Balkan conflict was that the international coalition had to deter and to compel "a variety actors on and beyond the battlefield simultaneously". This required coercion tailored to the different actors at multiple levels. In his contribution Jakobsen expands on that lesson and distinguishes four groups of actors that facilitate or frustrate deterrence in peace operations: (1) combatants that use force on the battlefield; (2) combatant allies that material support to combatants; (3) combatant supporters that block action in regional or global institutions; and finally, (4) bystanders, from the battlefield to the global level, that fail to act. To succeed, Jakobsen concludes, deterring actors cannot rely solely on threats and use of force but must supplement their use of coercion with persuasion and inducement and devise and implement influence strategies that draw on all three components.

#### Deterring Revolts

Finally, in Chap. 16, Maarten Rothman examines the use of deterrence by president Putin of the Russian Federation against potential democratic revolts. While conceptually perhaps akin to the deterrence challenges explored by Shamir, Kitzen and van Kuijck, Rothman adds to their analyses by looking at the potential for a powerful state to use military threats to discourage popular movements against its puppets and allies. Combining insights from the literatures on democratic revolutions and social movements on the one hand, and deterrence and coercion on the other, Rothman hypothesises that from Putin's perspective two strategies present themselves to discourage or deter democratic revolts: suppression by the authorities of the affected country and the threat of intervention against the pro-democracy protesters or prospective protesters, either in support of allied regimes during the uprising or as punishment after their overthrow. The target of deterrence experiences both a domestic and an outside threat simultaneously.

This outside threat is a safe guard for Putin for there is a limit to what extent he can rely on domestic repression for this is under the control of the local authorities, Putin's allies, who might take guidance or direction from him but for the most part rely on local resources and personnel. The effectiveness of domestic repression depends on local restraints and sympathies, including those of security services personnel. Their loyalty, Rothman suggests, might waver when they are asked to use violence against the protesters. Russian punishment therefore makes use of local strongmen but also employs Russian operators and usually a sizeable contingent of soldiers. Russia's ability to inflict punishment therefore does not suffer from the same constraints: those enforcing the repression are not compatriots, they are not sensitive to local sympathies, and any defections will not challenge Moscow's authority.

The drawback, as Rothman argues, for this type of deterrence is that democratic revolts are not conducted by a unitary actor but by an emergent collective which only emerges as a collective during the event. Backchannel negotiations and communicating threats is not an option and targeting the population at large might backfire. The deterrent effect however may be retained nevertheless because Russia can hurt democratic protesters in the sense that it can threaten to undermine the revolt's chances to make good on its promise of a better life after the revolt. Moreover, it can sustain the pain by propping up separatist governments, sustaining an environment rife with low-level violence with continued risk of escalation. Such punishment also ensures continued media attention which can be exploited to convey the message that the revolt will fail like previous revolts. As Rothman concludes, it serves Russia's interest, then, to periodically feed the media stories to fuel this narrative by manufacturing an incident. This chapter thus nicely complements Adamsky analysis of Russia's unique conceptualization of deterrence.

#### New Instruments and Domains

#### Cyber-Deterrence

In Chap. 20 Stefan Soesanto and Max Smeets, in a very rich synthesis of the debate on cyber deterrence, consider how different scholars evaluate the possibility of deterrence in cyber-space. According to Smeets and Soesanto, as a military concept, cyber-deterrence has at least three different meanings. It can refer to "the use of (military) cyber means to deter a (military) attack [..]; the use of (military) means to deter a (military) cyber-attack [..]; [and] the use of (military) cyber means to deter a (military) cyber-attack". Scholars currently disagree to what degree it is generally possible to deter an adversarial cyber-attack. One group argues that cyber deterrence functions akin to conventional deterrence. Others believe cyber deterrence features unique issues because cyberspace is markedly different from the traditional domains (air, land, sea). A better understanding of the specifics of cyberspace and the dynamics of deterrence therein is required to explain when deterrence works or fails. According to the third group cyber deterrence is impossible; cyberspace features an abundance of actors all with access to offensive cyber weapons. Moreover, the threshold for offensive actions is low, the number of attacks high and the chance of retaliation slim. Finally, some hold that the strategic value of damage inflicted by cyber-attacks is generally limited and easy to contain and repair. Threats of a cyberattack therefore lack the punch required for effective deterrence.

Proponents of cyber deterrence, Soesanto and Smeets observe, tend to discuss one of the following four deterrence logics, which also appear in the cross domain deterrence literature discussed by Sweijs and Zilincik in Chap. 8: deterrence by denial (which is synonymous to cybersecurity); deterrence by punishment (costs will outweigh the benefits); deterrence by entanglement (interdependence may disincentivise states to launch cyber attacks); and deterrence by de-legitimisation (to "raise the reputational costs of bad behaviour, and shrink the battlespace to only encompass military combatants").

There is no consensus among scholars and strategists in this debate. While cyberspace may have been recognised as a new warfighting domain and constitutes an essential venue for single and cross domain operations, beyond the military utility of cyberattacks and cyber defence at tactical and operational levels, their strategic utility in support of deterrence is as of yet uncertain. One way out was adopted in the US strategy: in an environment of constant contact, a strategy grounded in persistent engagement is considered to be more appropriate than one of operational restraint and reaction for shaping the parameters of acceptable behaviour. This involves a high level of cyber activity to identify and track perpetrators and includes if necessary aggressive cyber operations. This stretches the notion of deterrence beyond the common understanding of the concept. Unsurprisingly, Soesanto and Smeets observe, European policymakers are not inclined to discuss, let alone consider, a strategy of persistent engagement, which is considered to be too aggressive. Moreover, they lack the operational capabilities to operate "seamlessly, globally, and continuously", which is required by persistent engagement. Theory development meanwhile remains a challenge since politically motivated cyberattacks with strategic impact are few in number, most of the documents are highly classified, there is little access to cyber operators, and existing military cyber organisations are in the embryonic stage. Going forward, Soesanto and Smeets outline four future avenues of research for cyber deterrence: further integration of cyber deterrence in more comprehensive deterrence postures in the context of multi-domain competition; greater focus on technical aspects at the operational and tactical levels; greater emphasis on compellence; and the exploration of novel strategic concepts "to contain and blunt adversarial aggression in cyberspace" outside of traditional deterrence thinking.

#### Artificial Intelligence

Embryonic is also an apt word to describe the development of Artificial Intelligence (AI) capabilities as well as the debate on their potential relevance for security policy, military strategy and deterrence theory and practice, as Alex Wilner and Casey Babb explain in Chap. 21. The limited knowledge base is reason for concern given the high expectations concerning a wide range of fruitful military AI applications including autonomous weapon systems (AWS). But also beyond AWS, they contend, AI will influence defence and security in several important ways. AI will alter the way states plan and conduct military engagements, collect and use intelligence, and protect their domestic national security. Traditional notions of state power are also increasingly intertwined with national expertise and investment in AI. An arms race is thought to be developing between the United States and China as a result.

Wilner and Babb explain the various ways AI is likely to affect coercion: AI may alter cost-benefit calculations by removing the fog of war, by superficially imposing rationality on political decisions, and by diminishing the human cost of military engagement. It may recalibrate the balance between offensive and defensive measures, tipping the scales in favour of pre-emption, and undermine existing assumptions embedded in both conventional and nuclear deterrence. AI might altogether remove human reasoning and emotions from the practice of coercion. It may provide users the ability to collect, synthesis, and act upon real-time intelligence from several disparate sources, augmenting the certainty and severity of punishment strategies, both in theatre and online, thereby compressing the distance between intelligence, political decisions, and coercive action. AI enhanced drones may be employed to swarm and overwhelm the defences of opponents, or, alternatively, offer a fail-safe automatic response option during escalation.

As a result, AI may quicken the overall pace of action across all domains of coercion, in conflict, crisis, and war. These factors may lead to 'hyperwar', they conclude, in which data will be filtered and analysed in near or real-time providing decision-makers with a greater awareness and more options far more quickly, but also result in higher risks for inadvertent escalation and—lured by the illusion of certainty and superiority—in risk-seeking behaviour. Currently this topic still belongs to the realm of speculation. The actual study of AI and deterrence and coercion has only just begun. Military AI enabled technologies are immature yet their consequences for deterrence can be expected to be significant. As military AI applications will materialise and be more fully integrated by defence organisations, AI deterrence theory will be informed by empirical analysis.

#### Sanctions

Sanctions are another instrument of direct relevance to deterrence strategy yet they have often been discussed in a different body of literature, despite the fact that threatening with and/or imposing a sanctions regime often has deliberate coercive purposes (signalling, constraining, compelling) and such sanctions regimes precede and surround subsequent steps to boost the deterrent signal with military threats. Sanctions, as Francesco Giumelli explains in Chap. 18, are supposed to inflict pain on the receiver, and the logic goes that such economic pain would translate into political gain, such as deterring the repetition of certain behaviours and the escalation of conflict. In addition, sanctioning a target shapes the expectations of other actors (or potential targets in the future) of the implications of certain activities.

During the Balkan crisis of the 1990s and Western campaigns against Libya and Iraq, comprehensive sanctions targeted entire economic sectors with disastrous humanitarian consequences. Moreover, sanctions were counterproductive as the real targets managed to either avoid the impact of sanctions or were, occasionally, even strengthened by them. Serbia for instance benefited from the arms embargo as they had control over a sizeable military arsenal. In Iraq, the population suffered the brunt of the embargo while Saddam Hussein continued to live in affluence. Subsequent research has indicated that different types of regimes—democratic or authoritarian—have different vulnerabilities and display different responses with authoritarian regimes at least in theory being more vulnerable to sanctions that hurt specific personal interests of the leadership. These insights coupled with detrimental effects of previous sanctions prompted scholars and practitioners to envisage targeted sanctions. Targeted sanctions include restrictions on freedoms for individuals and non-state entities as well as asset freezes and financial restrictions.

While potentially more effective than comprehensive sanctions and less prone to produce counterproductive side effects, Francesco argues that targeted sanctions also present new features complicating deterrence efforts. First, targeted sanctions frequently target individuals, and individuals behave according to different logics in comparison to complex organizations such as states. Moreover, individuals have human rights, which constrains the feasibility of targeted sanctions because sanctioning individuals requires evidence to be presented, indicted individuals need to be brought to court, and procedures to rectify mistakes made by listing authorities need to be in place. Second, while classical deterrence is based on the promise of serious damage to be inflicted, targeted sanctions are designed not to inflict lethal pain on their targets. Third, according to Giumelli, targeted sanctions can increase the likelihood of the behaviours that they intend to discourage as they present a problem of moral hazard; one party to the conflict might be incentivized to provoke a conflict if it expects that targeted sanctions would be imposed on the other side. Finally, sanctions today are used for a very long list of objectives in a variety of crises, from international terrorism, to non-proliferation, conflict management, post-conflict reconstruction, but also asset recovery as well as combating organized crime and human trafficking. "The over-utilization of sanctions", he concludes, "and their apparent light impact could undermine, rather than strengthen, an international criminal deterrence doctrine".

#### Resilience

In Chap. 19 Cees van Doorn and Theo Brinkel explore another instrument for boosting deterrence: resilience. Resilience has gained increasing attention following awareness of the potency of hybrid threats to disrupt the integrity of economic, social and political structures in Western democracies. Hybrid warfare opens the possibility to use all instruments short of actual war. Disinformation campaigns, that exploit social media, have been salient instruments. Spreading fake news as well as fuelling alternative narratives are part and parcel of attempts to dislodge Western democratic societies and undermine the morale of the population.

Resilience—the ability of individuals, communities, or organizations to prepare for disruptions, to recover from shocks and stresses, and to adapt and grow from disruptive experiences—has come to be considered a key pillar of deterrence against hybrid activities for multiple reasons. First, because it is impossible to defend against all threats societal resilience negates the benefits to be derived from any attacks. Second, acknowledging that effective deterrence typically depends on strong defence capabilities matched with equally credible political resolve, in the context of information warfare, credibility is also a decisive denial capability weapon. As Brinkel and van Doorn assert, veracity, consistency and respect for the truth are the exact opposite of disinformation campaigns and contribute to what has been described as deterrence by delegitimization. Resilience usually concerns technical solutions and infrastructure but resilience can also be found in attitudes, declarations, and images. It manifests itself in common values and objectives. Resilience is therefore a quintessential part of the social capital and trust in society and results from good governance, human rights and freedoms, as well as the rule of law.

Van Doorn and Brinkel use the aftermath of the downing of flight MH17 to explore how resilience has functioned as a deterrent to subversive Russian disinformation activities. They examine counter-measures (creating credible narratives, nuanced messaging, careful fact finding) implemented by the Netherlands government and analyse how these affected societal trust in reaction to disinformation activities. The Dutch government's narrative has consistently focused on three courses of action: bringing the victims home, establishing the facts about the circumstances in which the plane went down, and holding to account those responsible in the court of law while respecting the independent position of others, such as the Public Prosecution Service and the free press, in their search for the truth. Other sources of information, such as free independent news networks and digital forensic networks have been paramount in discrediting disinformation and allowing the public to reach its own conclusions. During the prosecution process, civic journalists played an important role in disclosing the exact route of the BUK missile system entering and leaving Eastern Ukraine. As a result, Russian alternative narratives explaining the cause of the downing and deflecting the blame for it have not been able to gain any real foothold in Dutch society.

#### Decisions, Decisions

#### Game Theory, a Re-appraisal

The cool and perhaps even cold-hearted idea that game theoretical calculus should be the basis of deterrence strategy and inform decision making processes during a nuclear crisis has inspired much critique and resulted in a wave of research exploring how decision making works in reality. In Chap. 22 Roy Lindelauf nevertheless fruitfully reminds us of the utility of game theory, and argues for continued attention to it, also in light of the emergence of AI. Commonly used game and decision theoretic models fail to explain the empirics of deterrence and, as Lindelauf asserts, this has unjustly led many theorists to criticize the (rationality and other) assumptions underpinning of such models. Game theorists readily admit these models do not represent an accurate model of complex and varied decision making situations but merely describe what a decision maker ought to do in a given situation. As Lindelauf reminds us, "all models are wrong, but some are useful". Game theory can help to lay an axiomatic foundation under the theory of deterrence. Moreover, algorithms are entering each and every aspect of our lives including the command and control of weapon systems. Lindelauf expects that these systems will deploy game- and decision theory based algorithms to coordinate and control. Such AI and autonomous systems have the potential to dramatically affect nuclear deterrence and escalation and the fact that the nuclear deterrent decision-cycle will also be based on algorithmic analysis makes it paramount that we need to further develop game theory in the context of both the theory and the practice of nuclear deterrence.

#### How the Mind Plays Games with Rationality

Our understanding of targets' perceptions of deterrence and their reception of deterrent signals is deepened by the contributions by Tom Bijlsma (Chap. 23) and Samuel Zilincik and Isabelle Duyvesteyn (Chap. 24). Their contributions explore terra largely incognita by opening up the black box of the human psyche and concentrating on the role of emotions in deterrence, both on the part of the deterrer and on the part of the deterred. As Tom Bijlsma notes, research in the third wave, capitalising on new insights from the psychological, economics, and decision-making literature, indicated that decision making in reality deviated substantially from the assumptions of the rational actor model. Apart from organisational and political interests, processes, routines, and group think, deterrence may fail because of misperception on either or both sides of the crisis. Bijlsma takes us on a tour along the causes of such misperceptions; the heuristics (rules of thumb) and biases (systemic errors such as inclinations or prejudices) that the human mind most often unconsciously employs as short-cuts to rationality, which colour the incoming stream of information and the processes to digest it and come to a decision.

Because of anchoring humans rely heavily on the first piece of information offered when making a decision. The confirmation heuristic reflects the human tendency to seek information that supports one's existing point of view and neglect or ignore signs that can lead to contrary evidence. The availability heuristic refers to the mental shortcut in judgments about the probability of events based on the ease with which examples come to mind. Improbable events are excluded from decision making processes. The representativeness heuristic compares a situation with mental models in our minds. Stereotyping and profiling are forms of this heuristic. The affect heuristic represents the fact that humans tend to be more positively inclined to what they like. The related fluency heuristic explains the fact that the human mind tends to give preference to an option if it is processed faster or more fluently than an alternative option. In other words, the more elegantly an idea is presented, the more likely it is to be considered seriously, irrespective of whether or not it is logical.

An important issue for deterrence research and strategy concerns the question how leaders deal with risk. Prospect theory explains that humans evaluate the potential value of losses and gains differently. In contrast to rational choice theory, prospect theory finds that decision makers are apt to overweight losses with respect to comparable gains, and tend to be risk averse when confronted with choices between gains while risk acceptant when confronted with losses. That explains perhaps why it is easier to deter an actor from starting an invasion than to compel him to retreat from territory it gained. In short, applied to deterrence dynamics, the result is that leaders are inclined to take more risks to maintain their positions, reputations etc., than they are to enhance their positions. The higher the stakes, the higher the risk of being caught in a psychological trap as Bijlsma concludes.

#### The Emotional Turn in Deterrence Theory

In Chap. 24 Samuel Zilincik and Isabelle Duyvesteyn continue further down this path by surveying recent insights concerning the role of emotions in decision making processes and assessing their relevance for deterrence theory. Their findings suggest that emotions give new meaning to deterrence by changing the nature of deterrence theory and by highlighting problems of practice. Emotions are not only the consequences of the defender's actions; they emerge through the challenger's interpretation of the situation and, once triggered, specific emotions affect cognitive processes and action (or inaction) in far more sophisticated ways than has been assumed. Emotions are responsible for different kinds of biases that affect decision-making and judgments. They affect perceptions and, therefore, change how individuals perceive the world. Similarly, emotions and stress interact in dynamic ways. Anger, for example, is a negative emotion, similar to fear. However, while fear tends to make people more risk-averse and pessimistic, anger tends to make people feel risk-prone and optimistic. Furthermore, the behavioural influence of emotions varies from one context to another. Fear, for example, can motivate freezing, fleeing, or fighting. Happiness can motivate both the relaxation of efforts and their pursuit, depending on whether the emotion is experienced or merely anticipated in the future. Relating these insights to deterrence, they assert that emotions in different configurations shape decision making processes. Emotions are, in fact, essential for any decision, rational or not, as emotions make decision-makers care about the consequences of their actions, which in turn enables them to choose from competing objectives in any given context. However, the varied and sometimes contradictory influence of specific emotions makes deterrence without a better grasp of their impact an uncertain endeavour. Zilincik and Duyvesteyn therefore argue that emotions need to be taken seriously in future deterrence research because it will allow for a more nuanced understanding of the micro-level causal mechanisms that explain how deterrent threats are perceived and interpreted by targets of deterrence of different strategic cultures and different psychological makeups. They thus conclude that deterrence is "the continuation of emotional life with the admixture of violent means".

#### The Legal and Governance Side of Effective Deterrence

Finally, in Chap. 25, Paul Ducheine and Peter Pijpers address two related and relatively neglected issues in deterrence research: first, the legal framework applying to the use of deterrence instruments and, second, the intragovernmental arrangements which facilitate coordinated deterrence strategy. Effective deterrence by Western democracies, especially in the context of deterring hybrid threats, requires that robust capabilities and political resolve, which are clearly communicated, are complemented with a legal framework that is a prerequisite for deterrent power because it provides a variety of responses with a firm legal basis. The effective orchestration of actions during a crisis, as Ducheine and Pijpers argue, requires prior identification of the roles and responsibilities of different governmental departments (e.g., the ministry of foreign affairs, defence, finance) and a shared understanding of the potential effects associated with various potential instruments. Moreover, as they illustrate in a description of the legal prerequisites, such intergovernmental arrangements require clear demarcation of legal authority of each of the departments, and clarity of the appropriate international and national legal frameworks. Deterrence against hybrid threats will be ineffective absent the clear allocation of responsibilities and legal frameworks because governments will simply be unable to carry out credible counteractions in time. Considering that the Cuban Missile Crisis is the landmark case study that highlighted the ways in which organisational interests and politics can influence deterrence strategy in practice, the relative lack of research into the governance of security these days seems strangely at odds with the demands of cross domain deterrence.

#### A Renaissance of Deterrence Theory and Practice

This volume took Patrick Morgan´s 2012 analysis concerning the 'State of Deterrence in International Politics Today' as a point of departure starting from the premise that recent geopolitical and technological developments may have moved deterrence research beyond Jeffrey Knopf´s fourth wave. As has become evident from the state of the art overviews of recent insights contained in the twenty-five chapters in this volume, contemporary deterrence theorising and practice is experiencing a true renaissance. New theoretical and practical concepts on how to effectively deter different actors within and across domains are being put forward. In the context of considerable military-strategic change these insights are put to test, exhibiting a fruitful but also relatively swift accelerated interaction between theory and practice, akin to other historical periods that featured similar paces of military-strategic change such as for instance the late 1950s.

Contemporary deterrence researchers seem also to finally heed the oft-repeated calls in the deterrence literature, including those by Michael Mazarr in his stocktaking of contemporary deterrence research in this volume, to take context and actor perceptions seriously. As such, there is a growing body of literature that really does differentiate between specific context related challenges while paying ample attention to tailor made solutions.

It is also increasingly acknowledged that contemporary threats may well require strategic concepts that exceed the analytical scope of strict deterrence. In our digitally wired world instruments to inflict harm have proliferated to a greater number of (state and non-state) actors. Today's threat universe features novel opportunities to project power as well as new vulnerabilities to tools of power projection. The multiplicity of actors and the sometimes opaque nature of threats further complicates deterrence. This, in combination with new insights from psychological and decision-making research into how the human psyche operates, leads many authors to observe that deterrence should be complemented by other approaches that include compellence and suasion.

At times, there is conceptual creep with the meaning of deterrence stretched far beyond its limits. At other times, it is plainly pointed out that deterrence should constitute one strategy in a broader portfolio of strategies and that the neat theoretical categorisation of strategies is absent in practice where strategies can flow into each other. The demarcation of categories—when does deterrence stop of fail, when does a symbolic demonstration of force to boost one's credibility start to resemble a brute force approach—is fluid. As Byman and Waxman noted in light of the experience of coercive diplomacy in the 1990s, and confirmed here by Mazarr, Jakobsen and Shamir, compelling a halt can be described as deterring to advance further.5 Moreover, symbolic uses of force should not necessarily be considered a sign of deterrence failure, but as a method to bolster deterrence.

In addition to the elaboration of new concepts of deterrence, existing concepts are scrutinised more closely and refined accordingly. It is increasingly acknowledged that there are other non-Western approaches to deterrence, that in some respects may be fundamentally different. The contributions to our volume demonstrate that there is a real appreciation for the fact that strategic actors conceptualise deterrence differently, and, as Dmitry Adamsky amongst others relates, perhaps do not recognise deterrence as a distinct strategic concept with its own logic at all.

Taking stock of the body of insights that have emerged over the past, we submit that the considerable pace of military-strategic innovation of the past two decades has been accompanied by the blossoming of deterrence theory and practice building on the approaches to the study of deterrence that emerged during previous waves. It has shed its predominantly state based nuclear and conventional deterrence focus characterised by deductive reasoning encapsulated in game theoretic models (1st wave). It continues to feature plenty of case work and some, albeit far fewer, large-N approaches (2nd wave). It fruitfully incorporates insights from other academic disciplines (3rd wave) including psychology, communication and signalling theory, which are applied in the context of asymmetric deterrence against non-state actors (4th wave), but also against state actors, in and across new and old domains, and before, after but also during war. The current deterrence literature is less concerned with large-N hypothesis testing shedding some of its political science aspirations. Instead it relies on more general theorising based on the examination of the dynamics of particular cases in line with a disciplinary approach more prevalent in strategic studies. We therefore submit that a fifth wave of deterrence theory is in fact emerging even if it is in its early stages (see Table A.1).

The nascent fifth wave is characterised by relatively short feedback loops between theory and practice in a reciprocal relationship that runs in both directions: theoretical ideas about how to deter are transferred and tried out in the real world at the same time as deterrent practices from a specific context and domain are studied, generalised, and theorised to also be useful in other contexts. In addition, there is ample attention to the practical prerequisites for favouring conditions of effective deterrence that go beyond more generic precepts and address more context specific elements. This is thus one particular area in which there are actual attempts to bridge that famous gap between theory and practice.

In addition to these strengths there are certainly also gaps, weaknesses and potential pitfalls with the fifth wave. First, similar to previous waves, today's deterrence literature continues to grapple with how to conceptualise and examine decision making by deterrence target actors. The literature typically fails to properly

5 Byman et al. 1999.

Table A.1 Five Waves of Deterrence Theory (Source The authors)

delineate the deterring and deterred agents—in the person of the individual political leader, in a larger group of decision makers surrounding him, or in a hypothetical unitary state construct. As a result, there are few attempts to subsequently empirically study agents' decision making processes and the perceptions that inform them. In many cases the agent is largely left unspecified with authors paying lip service to the issue but implicitly relying on a hypothetical unitary state construct. In a similar vein, there are few in depth process tracing studies that scrutinise the decision making of both the deterrer and the deterred and establish whether deterrent signals were both sent and understood.6 This is a key issue in determining the actual efficacy of deterrence because it is both unclear whether there is a deterrent relationship in the first place,7 and, should there be one, there is no recorded empirical evidence to corroborate the causal mechanisms through which deterrence works. The empirical base underlying the purported efficacy of deterrence in particular domains is therefore thin.

Second, and related to this point, from a research perspective, the situation is certainly not helped along by the emerging fifth wave's tendency to conceptually expand understandings of deterrence to encompass a wider variety of functions, including compellence and suasion, because the use and utility of concepts that lack strict delineations of their scope are even harder to ascertain empirically. Meeting the full spectrum of today's strategic challenges certainly requires more than threats that rely on the denial of direct benefits or the prospect of unacceptable imposition of costs. Fundamental features of today's strategic environment which include a greater number of actors and effectors, larger attack surfaces and vulnerabilities, ambiguity and opaqueness, and complex relationships, necessitate comprehensive responses that utilise a broad portfolio of strategic ways and means. The empirical examination of the efficacy of these responses, however, benefits from conceptual clarity about what is being analysed in the first place.

Third, deterrence in newer domains including cyber, space but also where it concerns information or economic pressure campaigns, requires a solid grasp of the finer technical details of the possibilities as well as the limitations in order to be able to make sensible judgments about the feasibility of deterrent concepts that are being proposed. If the disconnect between the knowledge possessed by strategists and specific domain technological subject matter experts grows, deterrence theorising risks becoming not only hollow but also meaningless. Deterrence scholars therefore need to combine strategic expertise with in depth understanding of the intricacies of particular domains in order to continue to make meaningful contributions to the study of deterrence in the future.

Overall, from a philosophy of science perspective, the deterrence research programme in its current incarnation seems to be a blossoming field that continues to expand and grow. At the same time, it is—in Lakatosian terms—neither progressive nor degenerative,8 but does risk to remain on the surface if it continues to ideate and explore but does not start specifying the deterrent mechanisms and examining how these work empirically. Even if it is a healthy sign that, in times of considerable military-strategic change, deterrence research is evolving along with it both in terms of its focus and content, it will need to move beyond the ideation and