The West Is Surprisingly Well-Equipped for Gray-Zone Deterrence

When former Russian spy Sergey Skripal and his daughter Yulia were found poisoned in the UK two years ago, London faced the delicate task of responding to the attack in a way that hurt the attack’s sponsor – subsequently found to be the Russian government – without needlessly escalating the situation. In a recent interview, the UK’s recently departed national security advisor Mark Sedwill revealed that Britain’s response included covert measures in addition to the very public expulsion of Russian diplomats. The news demonstrates the perhaps unorthodox ways available to Western countries targeted by gray-zone aggression.

“After the Salisbury attack, first use of chemical weapons against a country in Europe in a century, we retaliated in visible ways. We expelled the entire Russian intelligence network in the UK. But we also took a series of other discreet measures,” Sedwill told the British newspaper The Times. The Salisbury attack posed a dilemma that will become increasingly common as gray zone aggression – unaccompanied by kinetic violence – grows: how to respond to a relatively minor incident that can be traced to a hostile government? In the South China Sea, China has illegally constructed artificial islands in contested waters, but it has done so in steps that individually seemed so small that any muscular response could have been decried as disproportionate. Today the country has de facto territory in a strategic location where previously it had none. When NotPetya, a malware subsequently traced to Russia’s military intelligence agency the GRU, brought down not just its intended targets in Ukraine but a string of Western multinationals as well, governments struggled to respond. Perhaps most famously, when Russia poisoned the 2016 U.S. election campaign with disinformation, the Obama administration failed to identify a suitable form of punishment. 

Ethics presents another dilemma. A liberal democracy is bound by more rules than authoritarian countries. Western governments can’t respond to a poison attack by poisoning someone in the perpetrator country, and it can’t stand up a fake news operation in response to a Russian or Chinese one. And today’s perpetrators of gray zone attacks don’t just have the tactical advantage of being authoritarian: they also enjoy the additional advantage of being immune to naming-and-shaming by targeted countries and the international community. So what if a Western government condemns attacks “in the strongest possible terms,” as the UK government recently did in announcing that the Russia government was behind cyber attacks on the 2018 Winter Olympics and Paralympics?

Indicting the individual perpetrators, as the U.S. government and now the EU increasingly do, presents one promising strategy. So does the U.S. Cyber Command’s signaling to would-be cyber attackers that they’ve been identified; what I refer to as the horse’s-head-in-the-bed approach. Both approaches can be called personalized deterrence; their promise lies in the tendency of hackers to be more loyal to themselves than to a government. 

In fact, Western governments can punish both perpetrators and their sponsors in a range of creative ways while still adhering to the principles of liberal democracy. As with all deterrence, the aim should be to convince the adversary that an attack is not worth the price. “We will use different techniques. We need to play to our strengths and focus our attention on their vulnerabilities. We are not going to conduct illegal operations, but there are things we can do. There are some vulnerabilities that we can exploit too,” Sedwill told The Times. And what are those vulnerabilities? He would say only that they included “tackling some of the illicit money flows out of Russia, and covert measures as well.” 

Western countries also have a phenomenal advantage: the fact that nearly everyone wants to visit their cities, perhaps live in them, own property and bank accounts there. For those enjoying the West’s hospitality, that reality can also be a vulnerability, as that information can be used against them. Adapting the nuclear second-strike strategy to gray-zone scenarios, Western countries could, for example, respond to disinformation campaigns with massive information campaigns revealing the details of, say, properties owned by that country’s leaders in the targeted country. Though such information is publicly accessible, it’s usually not known to the wider public. The same goes for dubious business deals in which the other country’s government or companies linked to it may be involved: the targeted country can highlight such transactions to a global public, or work with partners to thwart them.

The advantage in gray-zone warfare is that the attacker can strike in a time and manner of its choosing. But, unlike traditional conflicts featuring troops that attack and counter-attack in relatively set pattern, a gray-zone defender has the very same advantage as an attacker: it can deliver punishment in a time and manner of its choosing. 

In its cost-benefit calculation, the attacker must thus count in the cost of a surprise response whose nature it can’t predict. That asymmetric potential leaves us, the West, surprisingly well-equipped to punish gray-zone attacks. What we need now is a great deal of creativity.