Covert or not Covert: National Strategies during Cyber Conflict

Gil Baram, Udi Sommer

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review


Anonymity is considered to be a key characteristic of cyber conflict. Indeed, existing accounts in the literature focus on the advantages of the non-disclosure of cyber attacks. Such focus inspires the expectation that countries would opt to maintain covertness. This hypothesis is rejected in an empirical investigation we conducted on victims' strategies during cyber conflict: in numerous cases, victim states choose to publicly reveal the fact that they had been attacked. These counterintuitive findings are important empirically, but even more so theoretically. They motivate an investigation into the decision to forsake covertness. What does actually motivate states to move into the international arena and publicly expose a cyber attack? The goal of this paper is to understand why and under which geopolitical circumstances countries choose to give up the advantages of anonymity. Whether they wish to Name and Shame opponents for ignoring international norms or whether they try to avoid public humiliation, victims of cyber attacks occasionally reveal the fact that they had been attacked. There is tension between such motivations and the will to protect intelligence sources and the incentives to prevent escalation if an attack is revealed, even more so if the attacker is exposed. Indeed, we find that sunk costs, counter-escalation risks and the need to signal resolve-while critical in motivating victims to keep cyber attacks secret-may not suffice under such specific circumstances. By focusing on the victim's side, we draw inspiration from data on real-world cyber attacks in order to place cyber operations in the larger context of secrecy and covert actions in the international arena. In so doing, the aim is to advance the use of empirical data for understanding the dynamics of cyber conflict and the decision-making process of states operating in this increasingly complex domain.

Original languageEnglish
Title of host publication2019 11th International Conference on Cyber Conflict
Subtitle of host publicationSilent Battle, CyCon 2019
EditorsTomas Minarik, Siim Alatalu, Stefano Biondi, Massimiliano Signoretti, Ihsan Tolga, Gabor Visky
PublisherNATO CCD COE Publications
ISBN (Electronic)9789949990443
StatePublished - May 2019
Event11th International Conference on Cyber Conflict: Silent Battle, CyCon 2019 - Tallinn, Estonia
Duration: 28 May 201931 May 2019

Publication series

NameInternational Conference on Cyber Conflict, CYCON
ISSN (Print)2325-5366
ISSN (Electronic)2325-5374


Conference11th International Conference on Cyber Conflict: Silent Battle, CyCon 2019


  • covert actions
  • cyber operations
  • national cyber strategies


Dive into the research topics of 'Covert or not Covert: National Strategies during Cyber Conflict'. Together they form a unique fingerprint.

Cite this