Weaving Tangled Webs: Offense, Defense, and Deception in Cyberspace

“Overall, states seemed to exercise a fair amount of restraint in cyberspace (Gartzke, 2013; Gartzke & Lindsay, 2015; Valeriano & Maness, 2015).”

“Attackers depend on deception to obfuscate their identity, but they are more likely to make mistakes against complex targets while defenders are more likely to use deception themselves to protect the targets they most value [16].”

“E.g., Gartzke and Lindsay 2015 on deception in communication networks, or Demchak and Dombrowski (2011, 35) on the Internet as a “ substrate.”

“More generally, advances in attribution limit the deception advantages for cyber attackers, while defenders can also use deception to try to entrap attackers—both defeating an attack and identifying the attacker (Gartzke & Lindsay 2015).”

“…studies as Kello (2013), who mention supply chain risks and vulnerabilities due to information systems and offshore manufacturers and additional forms of attacks using information (i.e. Line X) and the disruptive potential of counterintelligence on material supply chains (Gartzke & Lindsay, 2015).”

“…we acknowledge that several theorists have recently advanced a contrary assessment according to which cyberspace is defense dominant since defenders ’ in fl uence over the cyber-terrain on their “ home turf ” o ff ers substantial advantages (Gartzke & Lindsay, 2015; Matania & Tal-Shir, 2020).”

“…believe that AI, used as force multipliers for both defensive and offensive cyber weapons, will have a transformative impact on cybersecurity (Gartzke and Lindsay 2015; Wyatt 2019; Slayton 2017; Rid 2012).16 Director of US National Intelligence, Daniel Coats, recently warned that AI could…”

“52 Snyder, Deterrence and Defense , 12–13.”

“…contributes to existing scholarship on the role of emerging technology and defense innovation in world politics, and in particular, where civilian investments and initiatives are indistinguishable from military enterprises (Garfinkel & Dafoe, 2019, pp.736–763; Gartzke & Lindsay, 2015, pp. 316–348).”

“Finally, Gartzke and Lindsay (2015) highlight the prevalence of deception on both sides, because while attacks imitate benign communications to gain entry and avoid detection, defenders also exploit technical characteristics of cyberspace to set up realistic digital “ honeypots, ” luring attackers…”

“Some have debated the unique implications of cyber technology for the offense-defense balance (Saltzman, 2013; Shaheen, 2013; but see Gartzke & Lindsay, 2015, pp. 322-326; Garfinkel & Dafoe, 2019, pp. 750–751; Slayton, 2017).”

“See, for example, Bruce (1984), Buzan (1993), Christoff (2005), Gartzke and Lindsay (2015), Guzzini (2000), Haglund (1997), Hall (1994/1995), Hill (2003), Lieven and Hulsman (2006), Jacobsen (1995), Johnston (2001), Kalyvas (2001), Kinsella (2002), Kratochwil (1984), Laffey and Weldes (2004),…”

“…may be justified as a form of protection against harmful others, as serving some greater good, or by placing responsibility on others (Barsky, 2011; Gartzke & Lindsay, 2015), additional research will be helpful to better determine why diffusion of responsibility was negatively related to deception…”

“Gartzke and Lindsay [47] note that differentiating the values of offensive and defensive capabilities in cyberspace is difficult and has led to a presumption that offense is dominant.”

“93 Gartzke and Lindsay 2015, 328.”

“Honeypots are a method of providing data on fake targets to either distract the opposition from the real targets or to deter an aggressor from at-tacking in the first place (Gartzke & Lindsay, 2015).”

“This theory faces significant theoretical and empirical challenges, however (Gartzke and Lindsay, 2015; Libicki, 2009; Slayton, 2017).”

“…offensively advantageous (Slayton, 2016; Valeriano, 2022a); a new strategic domain or a furtherance of age-old intelligence contests (Brantly, 2016; Gartzke and Lindsay, 2015; Maschmeyer, 2021, Rovner, 2019); a complement or a substitute to conventional warfare (Egloff and Shires, 2023; Kostyuk…”

“This has led scholars to conclude that cyber competition is primarily an intelligence contest (Gartzke and Lindsay 2015, Rover 2019, 2020, Lindsay 2021).”

“Erik Gartzke and Jon Lindsay highlight the fact that deception, noted above as an effect of OCO, can be used by a clever defender to cripple offensive activity [32].”

“Yet, as Gartzke and Lindsay (2015) observe, the essential element of cyber weapons ’ success is deception, with its basic tactics of dissimilation (hiding what is there) and simulation (showing what it is not).”

“Many researchers argue that cyberattacks are restrained (Baez-ner, 2018; Gartzke, 2013; Gartzke and Lindsay, 2015; Valeriano and Maness, 2015) or ‘limited to mostly defa-cements or denial of service’ (Valeriano and Maness, 2014: 357).”

“This feature of CEIOs allows researchers to study elements of cyber conflict that are otherwise inherently clandestine (Gartzke and Lindsay, 2015).”

“…Russia established information warfare units (Reuters, 2017) and has committed between $200 million and $250 million USD per year to signi cantly strengthen its cyber-o ensive capabilities and to create a cyber-deterrent that will equate to the role played by nuclear weapons (Gerden, 2016).”

“In cyberspace, o ff ense is often di ffi cult and expensive whereas defense can be more e ff ective (Gartzke & Lindsay, 2015).”

“…itself to two distinct technical problems: one posed by the degree of certainty associated with attributing the perpetrator ’ s identity and another posed by delays caused by dif fi culties in detection and attribution (Brantly 2016; Gartzke and Lindsay 2015; Lindsay 2015; Rid and Buchanan 2015).”

“First, considering that cyber operations strive for secrecy and deception and often require these characteristics to succeed (Gartzke and Lindsay, 2015), discovery and attribution can be understood to constitute failure.”

“…focus, from global cyber-security governance (Choucri, Madnick, & Ferwerda, 2014) and cyber conflict mechanisms (see among others, Buchanan, 2017; Gartzke & Lindsay, 2015; Valeriano & Maness, 2015) to the organization of social movements in virtual spaces (for in- Politics and Governance, 2018,…”

“Cyber operations thus function as a disruptive technology, altering but not 122 journal of Peace Research 61(1) transforming the dynamics of strategic exchange (Brantly, 2016; Gartzke and Lindsay, 2015; Masch-meyer, 2021; Rid, 2012; Rovner, 2019).”

“ving reconnaissance, surveillance, and intelligence gathering; however, in Cyber-space the line between distinct aspects of offensive and defensive operations remains vague.(62) Furthermore, as a new domain of warfare that is highly clandestine – with little public oversight or even knowledge of the basic types of ope…”

“Conversely, deception can also provoke the perception that the whole information system contains traps motivating the adversary to be overly cautious and slow (Gartzke & Lindsay, 2015, pp. 338 – 339).”

“If at least some cyber incidents remain secret, then data collection may suffer from bias (Gartzke and Lindsay 2015; Baram 2023b).”

“…cyberespionage to acquire western technology and expertise to surpass the west are difficult to estimate with the leading growth of china (Gartzke & lindsay, 2015). china’s growth rate indicates that it is leading in patents and innovations in strategic technology, such as ai. statistics…”

“Recent research has relaxed this dichotomy, recognizing that crisis actors in practice face a vast array of policy options between a completely efficient peace and a decisive, destructive war.”

“33 For symmetric encryption, Alice and Bob share a secret, prior agreed-upon, private key that is used to both encrypt and decrypt the messages.”

“Although the strategic implications of cyber intrusions and algorithm manipulations are debatable (Gartzke & Lindsay, 2015), the capacity of adversaries to infiltrate critical infrastructures and institutions undetected is sufficiently worrisome to national security decision‐makers.”

“This complexity amplifies attribution difficulties and constrains the feasibility of traditional defensive countermeasures, necessitating innovative passive hack-back vectors that operate stealthily across diverse technological contexts [11].”

“However, attributing malicious acts is difficult (Gartzke and Lindsay 2015).”

“Applied to a cyber context, practitioners have long perceived cyberspace to be o ff ense dominant, despite the fact that many scholars are skeptical that cyberspace favors the o ff ense (Gartzke & Lindsay, 2015; Lonergan & Lonergan, 2023; Slayton, 2017).”

“This situation is compounded by the possibilities for the deception that are intrinsic to cybersecurity (Gartzke and Lindsay 2015, 2017), as attackers may hide their presence by subvert-ing information systems (e.g., to maintain ongoing capabilities to exfiltrate sensitive data), rather than making…”

“Other authors, however, point out that the use of these tools in the imminent future is limited (Gartzke, 2013; Gartzke & Lindsay, 2015; Rid 2012; 2013; Valeriano & Maness 2014; 2015).”

“The common theme is the use of deception to subvert cooperative institutions for competitive advantage (Gartzke and Lindsay, 2015; Lindsay, 2017, 2021; Maschmeyer, 2022).”

“Digital tools make hiding these actions easier through private messages, hidden accounts, and fake names, creating many layers of secrecy that can be hard to uncover (Gartzke & Lindsay, 2015; Hancock, 2012).”

“…1983; Harknett 1996; Wirtz 2018; Gerson 2009; Goodman 2010; Morgan 2010; Crosston 2011; Fischerkeller and Harknett 2017; Harknett and Nye 2017; Brantly 2018; Tor 2017; Lupovici 2016; Wilner 2020; Libicki 2018; Gartzke and Lindsay 2015; Gomez and Winger 2024; Vićić, Baram, and Gartzke 2025).”

“Several realist theoretical frameworks have informed the intricate dynamics of state-to-state cyberse-curity relations over the last few decades (Choucri 2012; Gartzke and Lindsay 2015, 316; Saltzman 2013).”

“38 Therefore, even if NATO policy seeks to draw a clear distinction between offensive cyber operations during conflict and defensive operations in routine competition, it will need to consider how to define a role for some forms of defensive activities that are more proactive in nature (and may be…”