A Small State’s Cyber Posture: Deterrence by Punishment and Beyond

This study explores a small-state’s offensive cyber capabilities as a deterrent against great-power cyber hostilities. More specifically, it poses the question: Could Norway successfully deter hostile cyber operations of greater powers, notably China and Russia, by signaling a resolve to retaliate within the same domain? The study reviews literature on the small state’s prospects of acquiring relevant offensive cyber capabilities; successfully signaling a deterrence-by-punishment posture; and, more generally, on the intricacies of retaliating against a greater power. The study concludes that most small states would enter the cyber battlefield with non-strategic and surreptitious capabilities, be inclined to signal their resolve with considerable ambiguity, and be compelled to respond with deniable means. It finds that such obscure features – the hallmarks of murky clandestine operations rather than a strategic posture – do not provide efficacious deterrence. Hence, to Norway and similar small states, deterrence by punishment may be an elusive, if not altogether vain, cyber posture.