title: Strategic aspects of cyberattack, attribution, and blame.
abstract: Cyber conflict is now a common and potentially dangerous occurrence. The target typically faces a strategic choice based on its ability to attribute the attack to a specific perpetrator and whether it has a viable punishment at its disposal. We present a game-theoretic model, in which the best strategic choice for the victim depends on the vulnerability of the attacker, the knowledge level of the victim, payoffs for different outcomes, and the beliefs of each player about their opponent. The resulting blame game allows analysis of four policy-relevant questions: the conditions under which peace (i.e., no attacks) is stable, when attacks should be tolerated, the consequences of asymmetric technical attribution capabilities, and when a mischievous third party or an accident can undermine peace. Numerous historical examples illustrate how the theory applies to cases of cyber or kinetic conflict involving the United States, Russia, China, Japan, North Korea, Estonia, Israel, Iran, and Syria.
authors.affiliation: Information Security Group, IBM Research, Yorktown Heights, NY 10598; benjamin.edwards@ibm.com axe@umich.edu.
authors.forename: Benjamin
authors.initials: B
authors.lastname: Edwards
authors.affiliation: Department of Political Science, University of Michigan, Ann Arbor, MI 48109.
authors.forename: Alexander
authors.initials: A
authors.lastname: Furnas
authors.affiliation: Department of Computer Science, University of New Mexico, Albuquerque, NM 87131.|Santa Fe Institute, Santa Fe, NM 87501.
authors.forename: Stephanie
authors.initials: S
authors.lastname: Forrest
authors.affiliation: Gerald R. Ford School of Public Policy, University of Michigan, Ann Arbor, MI 48109 benjamin.edwards@ibm.com axe@umich.edu.
authors.forename: Robert
authors.identifier: 0000-0003-4758-6590
authors.initials: R
authors.lastname: Axelrod
keywords: Bayesian game theory; attribution; blame; cyber conflict; strategy