Fighting in Cyberspace: Internet Access and the Substitutability of Cyber and Military Operations

Complementarity

Scholars agree that COs have a limited ability to coerce. ⁶ Instead, governments have been using COs to affect the balance of military power during combat operations. COs can exploit a target’s unrecognized vulnerabilities, offering commanders the ability to quickly disrupt an opponent’s command and control, hinder communication, and create other obstacles to sustaining military operations. In the Ukrainian conflict in Donbass, for example, hackers inundated the communications of combat units and commanders by flooding their phones with text messages and phone calls, collected operational intelligence via hacked closed-circuit television cameras, intercepted drones, and obtained control of Wi-Fi access points (Kostyuk and Zhukov 2019). Yet, attacking countries must still use conventional capabilities to secure tangible gains, further suggesting that COs complement, rather than substitute for, conventional combat operations (Liff 2012). Thus, once a conventional dispute is ongoing, COs may be utilized to complement physical denial strategies on the ground.

While some COs are important during combat, others are most valuable prior to conflict onset. Cyber espionage, which can prove fruitful on an ongoing basis, is especially useful in the lead-up to an active contest. For example, many of the cyber espionage campaigns associated with the Ukrainian conflict were initiated years prior to the onset of hostilities. ⁷ While some espionage operations continued during the conflict (e.g., Armageddon), many stopped—some due to their diminishing informational value, while others had become compromised (Kostyuk and Zhukov 2019).

The above discussion highlights two distinct temporal dimensions of complementarity: co-occurrence and sequentiality. Co-occurrence involves operations in different domains happening more-or-less simultaneously. For instance, the fighting factions in the Ukrainian conflict used disruption operations during conventional combat. Sequentiality occurs when operations in one domain shape conflict in another domain, at a later time. For example, the intelligence obtained by cyber-espionage preceding military operations in Ukraine was used in later combat. When formulating our hypotheses, we consider both forms of complementarity. Specifically, Hypotheses 1A and 1B summarize existing scholarly perspectives on complementarity of cyber and military operations.

• Hypothesis 1A: Co-occurrent Complementarity—There is positive correlation between cyber operations in period t and military operations in period t.

Substitution

Rather than attempting to initiate costly conventional conflicts, states can use COs to degrade or destroy enemy capabilities in peacetime. These operations allow leaders to deny responsibility for damaging, invasive, or compromising operations and, as a result, they lower the chance of retaliation from the target, as well as limiting blowback at home, compared with traditional tools. Consequently, states that lack the motivation to act in another, costlier domain may deem cyber an attractive alternative.

States can potentially use COs meant to sabotage a target’s networks, operations, or systems instead of conventional military operations (Borghard and Lonergan 2017; Valeriano, Jensen, and Maness 2018). The Stuxnet worm, allegedly designed by the United States and Israel, was intended to slow the development of the Iranian nuclear enrichment program, is an example of such operations. Stuxnet was a part of Operation Olympic Games—a covert, unacknowledged sabotage campaign by the United States and Israel that targeted Iranian nuclear facilities using cyber means. Olympic Games came into existence as U.S. officials sought an alternative to military operations to delay progress of Iran’s nuclear enrichment program. The George W. Bush administration initiated Olympic Games in 2006, believing that the operation would prevent Israel from launching air strikes on Iranian nuclear facilities, an act that might have involved the United States in yet another major conflict in the Middle East (Sanger 2012).

As explained earlier, we consider both co-occurent and sequential manifestations of substitution when formulating our hypotheses. Hypotheses 2A and 2B summarize existing scholarly perspectives on substitution of cyber and military operations.

• Hypothesis 2A: Co-occurent Substitution—There is negative correlation between cyber operations in period t and military operations in period t.

Independence

While it is certainly plausible that COs interact with conventional conflict, it is also possible for conflict in one domain to function independently of conflict in other domains. At minimum, this prospect should be considered for logical completeness; nothing appears to obviously preclude cyber and terrestrial conflict from being occasionally, often, or even generally uncoordinated. Independence might diminish over time or vary cross-sectionally (nationally or dyadically), but complements or substitutes may be limited in an initial phase of the emergence of cyber conflict, as governments deploy capabilities that are as yet poorly integrated with other defense capabilities.

It is actually quite difficult to coordinate complex activities in different domains. Amphibious warfare has famously been considered the most difficult kind of warfare in the 20th century, precisely because it requires the careful orchestration of operations on land, sea, and air. Given the nature of social activities, and the all-too-human tendency to “keep things simple,” unless there is a compelling reason to make such a coordinated effort — or conversely, a strong case has been made to commanders not to operate independently in one or several domains — the tendency would presumably be for actions taken in different domains to tend to occur independently of one another.

There is some evidence already of a lack of coordination between cyber and terrestrial domains. Using daily accounts of disruptive cyber attacks and military operations from the Syrian and Ukrainian conflicts, Kostyuk and Zhukov (2019, 319) find that while there is a tit-for-tat response for military operations, COs seem to operate in their own “bubble.” The authors explain this result in terms of force synchronization: “the lead time required to plan and implement a successful attack—studying the target system, collecting intelligence on its vulnerabilities, and writing code that exploits them—can make these efforts difficult to synchronize with conventional operations” (Kostyuk and Zhukov 2019, 322).

Another reason for the possible lack of coordination between conventional conflict and cyberspace is that the logic and objectives of contests differ across different domains (Gartzke and Lindsay 2019). If cyberspace and physical space do different things, it is perhaps not that surprising that they are engaged differently, at different times, and in different ways. As an informational domain, cyberspace is primarily useful for conveying and containing, facts. Data is easy to move through the Internet; that is what the cyber domain does. Indeed, a key problem in cyberspace is limiting the diffusion of information. Organizations, including governments, seek to limit who knows what, when, and where. This implies that critical objectives in cyber conflict involve the control of information, as opposed to territory, tangible goods (such as airports or equipment) or institutions (like government offices or a leader).

Based on these perspectives, we argue that states are likely to use conventional military operations and COs largely independently, at least for now. Thus, we are unlikely to find significant complementarity or substitution across cyber and military operations.

• Hypothesis 3A: Co-occurent Independence—Cyber operations in period t and military operations in period t operate independently of each other.

Internet Access and Modes of Conflict

If cyber conflict does not interact with conventional conflict directly, is there a mechanism that could potentially connect the two indirectly, given at least the coincidental rise in cyber conflicts (Karatzogianni 2015) and a corresponding decrease in conventional conflicts (Holsti 2016)? Previous research suggests a number of mechanisms capable of explaining the decline in interstate conflicts since 1945, including norms development, changing power distributions, and the spread of knowledge of how to avoid the use of armed force (Holsti 2016). In the section on substitution, we explained the benefits of using cyber operations over conventional operations, leading to a potential rise of the former. But there are no studies that explicitly consider a mechanism that could link the two phenomena, simultaneously explaining changes in both cyber and conventional fronts.

The spread of the Internet is one such mechanism, as the advent of cyberspace affects both virtual and terrestrial modes of fighting, indirectly causing substitution between them. ⁸ Two conditions must be met for this indirect relationship to hold. First, cyberspace as a domain must facilitate “useful” forms of international conflict. Second, traditional domains for conflict must no longer be adequate or functional to achieve competitors’ aims. We discuss each necessary condition in turn.

Cyberspace facilitates “useful” forms of international conflict. Internet or cyberspace is an artificial domain, created entirely by human artifice. The processes that led to cyberspace are at least trivially responsible for COs, as clearly there can be no cyber conflict without cyberspace. But, the mere presence of a venue for conflict does not mean that (much) conflict will occur if actors have no reason to disagree in a specific manner, or if the domain does not lend itself to both prosecuting and practical resolution of differences. Space, for example, was initially thought to be an important emerging domain for political violence. Yet, it quickly became clear that this ultimate “high ground” was much more useful as an observation post than as a firing platform. Space was hard to get to and difficult to operate or maintain equipment and weapons in, while occupation was problematic and “control” offered only limited types of advantages to a competitor.

Like space, cyberspace can be considered more an observation post than a weapons platform, but this distinction quickly becomes blurred due to ambiguities about the nature of cyber “weapons.” In space, observation is free and open, provided one can get there. Surveillance satellites peer down on earth with only limited natural or artificial obstruction. Because spying from space cannot be prevented, there is no need for nations to keep their espionage efforts secret. Since everyone knows about “eyes in the sky,” the effect of space surveillance is disproportionately deterrence. Nations are discouraged from actions that would be degraded by revelation because they cannot conceal them. ⁹

Cyber espionage, in contrast, is preventable (at least potentially). Because of this, spying must be pursued in secret, even as penetrating other actors’ networks involves actions and measures that look much more like warfare than does deploying cameras in the sky. Revelation of cyber-espionage activities typically degrades future access to sources of information. The secrecy that must be maintained to operate clandestinely in cyberspace means that COs are more like traditional espionage than space surveillance. Indeed, the penetration of enemy systems required for cyber-spying may be indistinguishable to targets from efforts designed to degrade or destroy these same systems. Access is essential and contested, whether one is preparing an attack or just listening.

Information has been a valuable currency and a concern in warfare for centuries (Fearon 1995). But information has become an even more attractive commodity in the information age. Knowledge has been an ascendant component of wealth and power for millennia, but it has arguably never been more important than it is today. While there are multiple ways to access insights about the world (e.g., human and signals intelligence sources), cyberspace is an attractive environment in which to manage, distribute, and obtain information.

The world’s governments are increasingly turning to the Internet or cellular technology to obtain secrets or access compromising information about foreign governments or important individuals. China, notably, has made extensive use of COs to acquire military and civilian industrial technology from the West. Western nations have also increasingly relied on cyberspace as a domain of espionage. For example, the US National Security Agency (NSA) partnered with Danish intelligence officials to monitor the Internet traffic of European leaders (Henley 2021). While German leaders like Angela Merkel expressed outrage, Germany has its own tradition of spying on friends and neighbors (Dobson 2020). There are of course many other examples, only some of which are known to the general public, given the covert nature of a high proportion of COs.

As these examples suggest, cyberspace is an extremely attractive domain for both aggressors and targets, given their respective objectives. Chinese spies could, and have, sought to obtain sensitive technologies through physical means, but these operations are costly, risky, and difficult to conceal. The theft of intellectual property through cyberspace can be conducted by operators that are physically remote from a given target. At the same time, targets continue to house sensitive data in the virtual domain, due to the benefits of managing and disseminating information in cyberspace.

The examples above suggest the nature or contexts where COs are more attractive as a mode of conflict. Governments appear to prefer acting in cyberspace when their costs are low and their objectives are readily obtainable. Obviously, this is not always the case. The increasing value and availability of knowledge and information make COs more useful tools for states that also have economies that are, or seek to be, structured around informational technologies. A high level of Internet access both reflects and effects the value of information in a nation’s economy, even as using conventional tools of conflict to obtain information is much less effective.

The second necessary condition is that traditional domains for conflict must no longer be adequate or functional to achieve competitors’ aims. For much of history, the foundations of civilization rested on control and exploitation of physical territory. More land meant more wealth. Today, prosperity is no longer derived primarily from agriculture, or from extracting minerals from the soil. Much more of the productive (and destructive) capacity of states rests with human and financial capital. Unlike empires of the past, modern nations seldom seek conquest and plunder to sustain and enrich themselves. ¹⁰ Instead, they use or threaten force to extract political concessions—to tell others how they must behave, not what property they can possess—rather than taking territory or other tangible goods.

This transition in the motives of states has begun to transform international conflict. Long the focus of military aggression, territorial conquest holds less appeal it once did (Gartzke and Rohner 2011). Modern armies largely refrain from the venerable tactics of raid and pillage, not due to superior morals, but because there is little profit in using extremely expensive organizations to steal relatively cheap stuff. With the decline in the value of territory as a means of achieving wealth and power, the utility of conventional conflict has also declined, at least in its most traditional forms. Military violence remains, but it is much more focused on the projection of influence or the acquisition of strategic territory, than on physical conquest. Force is used to punish, coerce or deny, not to take. ¹¹

The global spread of the Internet increased the need to acquire and control information. Cyberspace is a great medium of ideas, those that owners wish to share as well as those they do not. If information is power, then increasingly contestation is over the control of information, raising the value of the stakes over information as a commodity. While COs are not limited to espionage, the need to gain access, regardless of one’s motives for doing so, and the range of actions that are possible, once access has been achieved, mean that a high proportion of COs will look like espionage. Indeed, most COs contain elements of spying, regardless of what other objectives may be planned or contemplated. Put more simply, spying is where conflict is at in cyberspace.

By the same token, it is not always clear that conventional military force is likely to advantage actors seeking to acquire or control information. Airstrikes, fishing disputes or border clashes seldom penetrate or compromise a target’s command-and-control apparatus, the industrial secrets of leading firms, or a party headquarters. Similarly, while airstrikes can damage an opponent’s capabilities such as, for example, nuclear enrichment facilities, they are not subtle. Kinetic attacks often cause collateral or environmental damage and leave an attacker open to international condemnation and possible retribution. In contrast, COs can allow an attacker to rebalance power anonymously, further demonstrating why using COs is cheaper than conventional tools.

COs possess several drawbacks in pursuing the traditional goals of military force. These drawbacks include problems like limited destructiveness, a minimum of psychological shock, the temporal boundedness of damage, and a lack of credibility. At the same time, their strengths play to exactly the needs of a growing list of nations in the 21st century, while also offering a contrasting set of advantages from conventional modes of conflict. COs allow actors to benefit at a target’s expense (shifting the balance of power) at relatively low cost and risk of escalation. They are particularly practical when the stakes in a contest involve intangibles (information, control, and actors’ beliefs).

Thus, cyberspace is unlikely to yield an indirect complementarity between different domains of conflict. If a country can use cyber to obtain sensitive information to shift the balance of power, it has few incentives to also execute a more costly military action. ¹² Instead, we expect cyberspace to produce an indirect substitution between different conflict domains. Given the growing value of information, nations are mostly interested in using cyberspace to achieve these new objectives. But not all nations can. Increasing a country’s Internet access is likely to lead to an increase in that country’s propensity to engage in cyber conflict, and to reduce the nation’s likelihood of engaging in conventional conflict. Hypotheses 4A and 4B summarize these views below. ¹³

• Hypothesis 4A: Attacker’s Internet Access & Indirect Substitution—With an increase in a country’s Internet access, it is likely to participate in more cyber conflicts and in fewer conventional conflicts.

Since the critical objectives in cyber conflict involve the control of information, the “main event” in cyber conflict is espionage, as well as valence activities designed to facilitate or interrupt spying. Other things happen in cyber conflict, such as denial of service attacks and attempts to undermine or obstruct control systems (e.g. Stuxnet), but a large portion of cyber activities are related to the control of information, rather than places or things. ¹⁴ This point aligns with the recent scholarship which views actors’ behavior in cyberspace primarily as an “intelligence contest” (Chesney et al. 2020).

If the Internet is largely a place for stealing information from others or alternately protecting one’s own information, then we are more likely to observe the indirect substitution of cyber espionage operations with conventional operations than such substitution of disruption and degradation operations with conventional operations. This is because the main goal of cyber espionage is to “steal critical information or manipulate information asymmetries in a manner that produces bargaining benefits between rival states engaged in long-term competition,” whereas disruption and degradation COs that target networks or systems are less useful in obtaining information (Valeriano, Jensen, and Maness 2018, 11-12). As a result, we hypothesize that increasing a country’s Internet access is likely to lead to an increase in that country’s propensity to engage in, and defend against, cyber espionage, and to reduce (somewhat) a nation’s utility for engaging in conventional operations. Hypotheses 5A and 5B summarize these views below. ¹⁵

• Hypothesis 5A: Attacker’s Internet Access, Cyber Espionage & Indirect Substitution—With an increase in a country’s Internet access, it is likely to participate in more cyber-espionage operations and in fewer conventional operations.

Identifying the Population of Rivalries

This study seeks to determine why nations choose particular domains in which to fight. Rivalries are ideal for this purpose, since they involve pairs of nations with demonstrated hostility, but that may or may not fight in a given time period. Samples of rivalries generally capture around 80 percent of interstate conflict over the past two hundred years (Thompson and Dreyer 2011). To identify conventional rivalries, we use Thompson and Dreyer (2011)’s “diplomatic history” approach, according to which states are rivalries if they view one another as “(a) competitors, (b) the source of actual or latent threats that pose some possibility of becoming militarized, and (c) enemies” (Thompson 2001, 560). Since we are interested in explaining when states use cyber, conventional, or both types of operations, we combine the dyads identified as conventional rivalries in Thompson and Dreyer (2011) with the dyads identified as cyber rivals in Valeriano and Maness (2014) to create the population of rivalries that we use in our analysis.

A focus on rivalries also allows us to favorably assess the complement/substitution arguments (Hypotheses 1 and 2), while likely biasing against our theory (Hypotheses 3— 5). Nations that experience few conventional disputes do not qualify as rivals. As such, the predictions of our indirect argument, if fulfilled, will lead more states with a high Internet access and dyads to be under-counted as conventional rivals, compared to states that have a low Internet access; though, states with a high Internet access may continue to exhibit a significant number of cyber conflicts than states with a low Internet access. More generally, it is difficult to assess how countries might behave differently in terms of their conflict behavior if they exhibit little or no conflict. Another reason why we focus on rivalries is a practical limitation that we face—the dataset of COs that we utilize relies on rivalries for its sampling approach (Valeriano and Maness 2014).

Cyber Conflict Data

Valeriano, Jensen, and Maness (2018)’s Dyadic Cyber Incident Dataset (DCID) (v1.5) defines a cyberincident as an accumulation of individual COs to achieve a strategically important goal. For example, these data code cyberattacks against Estonia that lasted for about 3 weeks in 2007 as one incident. Cyber takes the value of 1 when an attacker initiated a cyberincident against a target and 0 when the attacker did not initiate a cyberincident against the target during the period under study.

We use DCID for the following reasons. First, a cyberattack rarely occurs in isolation; generally a series of attacks occur together. Second, by focusing on incidents instead of individual attacks, we can assess the importance of the overall cyber effort to larger national objectives. Third, DCID is one of (only) two available data sources of COs. ¹⁷ Fourth, we follow existing political science scholarship that uses DCID to examine the dynamics of non-cyber international trends (i.e., interstate trade in Akoto (2021)).

Variations in reporting can be a serious problem for conflict event data (Weidmann 2016), especially for COs, due to their novelty, secrecy surrounding their execution and the difficulty of attributing origin. These factors might be valid concerns even though DCID follows a well-established practice in conflict studies by using multiple sources to record an event (Gohdes and Carey 2017). Yet, bias may not present as serious an issue here as one might assume. While individual attacks might be unreported or undiscovered, it is much more difficult not to notice a full-scale cyberincident. ¹⁸ At the same time, it much easier to use multiple sources to mistakenly record an individual cyberattack, which often lacks specific details, than to over-report large-scale cyberincidents. Misattribution or inattention is thus least likely in the context of the rivalry sample used by the DCID data, given that private cyber security firms seek to unearth and publicize large-scale COs since doing so brings them publicity, new clients, and increased revenue. ¹⁹

Military Conflict Data

We use the presence of a militarized interstate dispute (MID) between two states to measure conventional military conflict (Maoz 2005). Gochman and Maoz (1984, 587) define MIDs as “a set of interactions between or among states involving threats to use military force, displays of military force, or actual uses of military force.” Military is coded 1 when an attacker initiated an MID against a target and 0 otherwise. ²⁰ The MIDs data is the most suitable data (yet available) to study the subject of our inquiry for the following reasons. First, since we are interested in understanding how cyber is being used along conventional military operations, it makes sense to look at the cases that include “display…of military force” recorded in the MIDs data (Jones, Bremer, and Singer 1996, 163). Second, COs are often viewed as instances “short of war” (e.g., Liebetrau 2022). The MIDs data includes such instances as well (i.e., “use of military force short of war”) (Jones, Bremer, and Singer 1996, 163). ²¹

Independent Variables

We consider a number of variables that might affect a nation’s willingness to fight. Our key independent variable is Internet access, measured by Internet users per capita, ²² taken from the World Bank. ²³

To address the possibility that substituting cyber-capabilities may be more attractive than other types of conflict for weak (or unresolved) actors, relative to their opponents, we account for the level of national capabilities taken from Singer, Bremer, and Stuckey (1972)’s Composite Index of National Capability score (v5.0). To address the possibility that states that share borders are more likely to use conventional weapons whereas those that are further away resort to cyber means, we control for the distance between states, using the inverse distance between their capitals. Lastly, the stability-instability paradox argues that nuclear weapons deter high-intensity contests but encourage lower-intensity disputes (George and Smoke 1974). States might similarly substitute COs for conventional operations as the former are less disruptive. We therefore control for whether a target possesses or shares nuclear weapons. ²⁴

Complementarity versus Substitutability

While notions of complementarity and substitutability are widely applied in political science, differences exist in how these two concepts relate temporally. Assuming a sequential interpretation prioritizes the dynamic development of paired phenomena. Applying this definition in our context, complementarity is a positive correlation between cyber operations in period t − 1 and military operations in period t; and substitutability is a negative correlation between cyber operations at t − 1 and military operations at t.

The second assumption one can make about ties is the co-occurrence of paired phenomena. Using this interpretation, complementarity is a positive correlation between cyber operations in period t and military operations in period t; and substitutability is a similar negative correlation. Studying such co-occurrences empirically is difficult, however. If we condition on the variable from the same time period, we risk conditioning on the future since we do not know the ordering of events; this could lead to reverse causality and biased estimates of the model parameters.

To determine whether digital and conventional conflict domains shape each other sequentially or concurrently (or not), we introduce a new approach that estimates both versions of complementarity and substitutability. A logistic regression with lagged dependent variables approximates sequential effects of cyber and conventional conflict. We allow for concurrent substitution or complementarity by jointly estimating factors associated with cyber and conventional operations while using a random slope for operation “type” to model dependence among conflict outcomes in a given dyad and time period. Joint estimation also constrains associations between covariates with cyber and conventional outcomes to be equal (or not) through interactions with operation type. Online Appendix Section 2 provides a detailed explanation of our empirical strategy that accounts for both concurrent substitution and complementarity of cyber and military operations.

Results

Tables 1 and 2 present our results. Table 1 includes a number of models, starting with the base model with no covariates to the model that accounts for the effect of each covariate on the likelihood of different types of conflict—cyber, conventional, or any (cyber and conventional). Table 2 displays the results for different types of cyber-operations. Our main findings are that a rival’s Internet access explains its propensity towards cyber versus conventional conflict. This is especially the case for cyber-espionage operations.

OPEN IN VIEWER

Table 1.

The Likelihood of Using Cyber and Conventional, Military Operations, by Rivalries (Odd Ratios and Confidence Intervals).

	Model 1	Model 2	Model 3	Model 4	Model 5
Fixed effects
Dependent Variable: Probability of cyber conflict in period t
Cyber conflict in period t-1	28.99***(13.68; 61.44)	15.30***(7.09; 33.03)	14.53***(6.62; 31.88)	14.58***(6.64; 32.02)	14.57***(6.63; 32.01)
Conventional conflict in period t-1	0.57(0.26, 1.25)	0.69(0.31; 1.54)	0.55(0.24; 1.23)	0.54(0.24; 1.23)	0.54(0.24; 1.22)
Attacker’s internet users per capita (log, sc)	—	2.15**(1.33; 3.46)	1.79*(1.12; 2.87)	1.78*(1.11; 2.86)	1.79*(1.11; 2.86)
Target’s internet users per capita (log, sc)	—	2.00**(1.23; 3.24)	2.26**(1.37; 3.72)	2.27**(1.37; 3.75)	2.27**(1.37; 3.75)
Attacker’s CINC score (sc)	—	—	2.77***(1.88; 4.09)	2.83***(1.88; 4.25)	2.83***(1.88; 4.25)
Distance between two states (sc)	—	—	—	1.12(0.71; 1.79)	1.13(0.71; 1.80)
Nuclear-armed target (dummy)	—	—	—	—	2.81*(1.07; 7.41)
Dependent Variable: Probability of conventional conflict in period t
Cyber conflict in period t-1	1.01(0.48, 2.13)	1.25(0.58; 2.67)	1.42(0.67; 3.02)	1.42(0.67; 3.02)	1.41(0.66; 3.01)
Conventional conflict in period t-1	5.96***(3.92, 9.07)	5.62***(3.70; 8.52)	5.79***(3.82; 8.79)	5.79***(3.82; 8.79)	5.80***(3.82; 8.80)
Attacker’s internet users per capita (log, sc)	—	0.68*(0.50; 0.93)	0.77ˆ(0.57; 1.05)	0.78(0.57; 1.05)	0.78(0.57; 1.05)
Target’s internet users per capita (log, sc)	—	0.73*(0.54; 0.98)	0.71*(0.53; 0.96)	0.71*(0.53; 0.96)	0.72*(0.53; 0.97)
Attacker’s CINC score (sc)	—	—	1.10(0.79; 1.53)	1.09(0.78; 1.53)	1.10(0.78; 1.53)
Distance between two states (sc)	—	—	—	1.04(0.72; 1.49)	1.04(0.72; 1.49)
Nuclear-armed target (dummy)	—	—	—	—	2.62*(1.20; 5.71)
Dependent Variable: Probability of any conflict in period t
Attacker’s internet uses per capita (log, sc)	0.91(0.70, 1.18)	1.21(0.89; 1.63)	1.18(0.87; 1.60)	1.18(0.87; 1.60)	1.18(0.87; 1.60)
Target’s internet uses per capita (log, sc)	0.93(0.72, 1.19)	1.20(0.89; 1.62)	1.27(0.93; 1.73)	1.27(0.93; 1.74)	1.27(0.93; 1.74)
Attacker’s CINC score (sc)	1.65***(1.26, 2.16)	1.67***(1.25; 2.22)	1.75***(1.30; 2.36)	1.76***(1.30; 2.38)	1.76***(1.30; 2.38)
Distance between two states (sc)	1.04(0.77, 1.40)	1.05(0.77; 1.44)	1.07(0.77; 1.47)	1.08(0.78; 1.51)	1.08(0.78; 1.51)
Nuclear-armed target (dummy)	2.19*(1.15, 4.15)	2.47**(1.25; 4.88)	2.67**(1.32; 5.39)	2.68**(1.33; 5.42)	2.71**(1.32; 5.59)
Random Effects
Dyad (intercept)	✓	✓	✓	✓	✓
Variance	1.02	1.22	1.36	1.36	1.36
Dyad (slope for Type)	✓	✓	✓	✓	✓
Variance	0.30	0.61	0.31	0.31	0.30
Akaike Inf. Crit.	1389.2	1348.6	1328.5	1330.5	1332.4

OPEN IN VIEWER

Table 2.

The Likelihood of Using Cyber and Conventional, Military Operations, by Rivalries and Types of Cyber Operations (Odd Ratios and Confidence Intervals).

	Model 6	Model 7	Model 8	Model 9
	Espionage w/o controls	Espionage w/ controls	Disruption & Degradation w/o controls	Disruption & Degradation w/ controls
Fixed effects
Dependent Variable: Probability of cyber conflict in period t
Cyber conflict in period t-1⋄	220.5***(57.0, 852.1)	187.1***(45.1, 776.1)	3.91*(1.30, 11.72)	3.28*(1.12, 9.63)
Conventional conflict in period t-1	0.58(0.17, 2.02)	0.56(0.16, 1.90)	0.63(0.24, 1.68)	0.66(0.25, 1.72)
Attacker’s internet uses per capita (log, sc)	3.21***(1.65, 6.24)	2.49**(1.25, 4.93)	1.14(0.68, 1.90)	0.89(0.51, 1.53)
Target’s internet uses per capita (log, sc)	3.21***(1.65, 6.24)	2.49**(1.25, 4.93)	1.14(0.68, 1.90)	0.89(0.51, 1.53)
Attacker’s CINC score (sc)	—	2.56***(1.68, 3.88)	—	1.88**(1.22, 2.88)
Dependent Variable: Probability of conventional conflict in period t
Cyber conflict in period t-1⋄	1.00(0.38, 2.65)	1.01(0.39, 2.63)	1.88(0.66, 5.38)	1.84(0.65, 5.25)
Conventional conflict in period t-1	6.06***(3.93, 9.36)	6.31***(4.10, 9.70)	5.59***(3.67, 8.52)	5.77***(3.80, 8.78)
Attacker’s internet uses per capita (log, sc)	0.82(0.61, 1.09)	0.79(0.59, 1.06)	0.77(0.57, 1.05)	0.77∧(0.57, 1.04)
Target’s internet uses per capita (log, sc)	0.82(0.61, 1.09)	0.79(0.59, 1.06)	0.77(0.57, 1.05)	0.77∧(0.57, 1.04)
Attacker’s CINC score (sc)	—	1.16(0.85, 1.58)	—	1.08(0.78, 1.50)
Dependent Variable: Probability of any conflict in period t
Attacker’s internet uses per capita (log, sc)	1.62*(1.11, 2.37)	1.40∧(0.95, 2.07)	0.94(0.68, 1.30)	0.82(0.59, 1.15)
Target’s internet uses per capita (log, sc)	1.62*(1.11, 2.37)	1.40∧(0.95, 2.07)	0.94(0.68, 1.30)	0.82(0.59, 1.15)
Attacker’s CINC score (sc)	—	1.72***(1.27, 2.33)	—	1.42*(1.05, 1.93)
Distance between two states (sc)	—	1.08(0.79, 1.48)	—	1.02(0.73, 1.42)
Nuclear-armed target (dummy)	—	2.12*(1.06, 4.22)	—	3.28***(1.62, 6.65)
Random Effects
Dyad (intercept)	✓	✓	✓	✓
Variance	1.34	1.16	1.21	1.09
Dyad (slope for Type)	✓	✓	✓	✓
Variance	0.37	0.21	0.82	0.73
Akaike Inf. Crit.	1186.2	1165.2	—	1213.4
Number of obs-ns	2,300	2,300	2,300	2,300

Note: Results are from a logistic regression model. The reported values are the odds ratios and confidence intervals. Odds ratio larger than 1 identify positive correlation and those smaller than 1 identify negative correlation. There are 2,300 observations. All results are based on two-tailed tests. Variables: log—logarithmized; sc—standardized; ^⋄ identifies similar types of operations as models DVs (e.g., in the model where cyber espionage is a DV (Model 6), the independent variable is lagged cyber espionage). ^∧p < 0.1; *p < 0.05; **p < 0.01; ***p < 0.001.

We start with testing our primary hypotheses of indirect substitution (Hypotheses 4A and 4B) and find support for them. Specifically, with an increase in its Internet access, a state is more likely to use cyber means, and less likely to use conventional means, to engage in conflict (Hypothesis 4A). The expected odds ²⁵ of a cyber conflict are 1.78 (Model 4 in Table 1)–2.15 (Model 1 in Table 1) times greater and the expected odds of a conventional conflict are 0.68 (Model 2 in Table 1)–0.78 (Models 4 & 5 in Table 1) times lower for each unit standard deviation increase of the attacker’s (log) Internet users per capita. Moreover, with an increase in its Internet access, a state is more likely to become a target of cyber conflict and less likely to become a target of conventional conflict (Hypothesis 4B). The expected odds of a cyber conflict are 2.00 (Model 2 in Table 1)–2.27 (Models 4 & 5 in Table 1) times greater and the expected odds of a conventional conflict are 0.71 (Models 3 & 4 in Table 1)–0.73 (Model 2 in Table 1) times lower for each unit standard deviation increase of the target’s (log) Internet users per capita.

We further confirm this indirect substitution effect of a rival’s Internet access on its propensity towards different modes of conflict by showing that rivals do not use cyber and conventional military operations as concurrent complements or substitutes. While rivals are likely to sequentially use cyber and conventional operations against the same targets, they use these two types of operations independently from each other. This evidence provides support for Hypothesis 3 and refutes Hypotheses 1 and 2. Specifically, the expected odds of a CO are 14.53 (Model 3 in Table 1)–28.99 (Model 1 in Table 1) times greater if a CO took place in a previous period than if no CO took place in a previous period. The expected odds of a MID are 5.62 (Model 2 in Table 1)–5.96 (Model 1 in Table 1) times greater if a MID took place in a previous period than if no MID took place in a previous period.

These findings point to two interesting phenomena. First, a higher odds ratio for the target’s (log) Internet users per capita than for the attacker’s (log) Internet users per capita implies that the target’s Internet access plays a slightly more important role. Second, a country’s reliance on the Internet is slightly pacifying in conventional terms. The positive association between the country’s Internet access and its probability of getting involved in cyber conflict, combined with the negative relationship between the country’s Internet access and its probability of getting involved in conventional disputes suggests a modest basis for the claims of Cyber Revolutionists.

Next we test our theoretical expectations for different types of cyber-operations. To remind, we expect cyber espionage as well as combined disruption-degradation operations to operate independently from conventional operations (Hypothesis 3). But we expect to find a more likely indirect substitution effect for cyber-espionage operations (Hypotheses 5A and 5B) than for combined disruption-degradation operations. Table 2 displays the results. We find that rivals do not use different types of COs and conventional military operations as concurrent complements or substitutions. But they are likely to sequentially use these operations against the same targets but independently from each other. This evidence supports Hypothesis 3 and refutes Hypotheses 1 and 2. Importantly, we find evidence for the indirect substitution effect of cyber-espionage operations, supporting Hypotheses 5A and 5B (Models 6 and 7 in Table 2). ²⁶ But there are no real evidence of association between disruption-degradation attacks and the Internet users (Models 8 and 9 in Table 2), as suggested by our theory.

In addition to our main results explained above, we also investigate how additional covariates help explain how different features of a given dyad affect whether countries engage in cyber and/or conventional conflict, and why. Specifically, we show that there is a positive, statistically significant association between an attacker’s CINC score and its likelihood of cyber conflict: the expected odds of a cyber conflict are 2.77 (Model 3 in Table 1)–2.83 (Models 4 & 5 in Table 1) times greater for each standard deviation increase of the attacker’s CINC score. But the association between attacker’s CINC score and its likelihood of conventional conflict is not statistically significant. National capability measures are often statistically insignificant (De Mesquita and Lalman 1988). But it is likely, perhaps that strategic interaction plays a critical role. Because everyone knows that power matters in winning wars, the effects of power on conflict onset are largely absorbed in expectations about relative military performance, and thus manifest through bargaining and diplomacy (a subject international relations too typically ignores), rather than through more easily observable warfare (Powell 1999).

Moreover, there is no association between distance and conflict, perhaps because the Internet allows countries to wage wars far from home. But there is a positive, statistically significant relationship between a target possessing (sharing) nuclear weapons and the probability of any dispute. The expected odds of cyber conflict are 2.81 (Model 5 in Table 1) times greater and the expected odds of conventional conflict are 2.62 (Model 5 in Table 1) times greater if the target possesses (shares) nuclear weapons than if the target does not possess such weapons. This result can be explained by a widespread perception that COs are non-escalatory, and the fact that most MIDs involve disputes short of wars.

To further assess the influence of the country’s Internet access on its likelihood of engaging in either form of conflict, Figure 1 presents an interaction plot that visualizes the results from Model 3 in Table 1. ²⁷ The x-axis displays the logarithmized and re-scaled country’s Internet users per capita and the y-axis displays its probability of engaging in any conflict. Figure 1a, which displays the results for the attacker, shows that as the attacker’s Internet users per capita increases, its likelihood of engaging in conventional disputes decreases and its likelihood of engaging in cyber conflict increases. Figure 1b, which displays the results for the target, shows that as the target’s Internet users per capita increases, its likelihood of engaging in conventional disputes decreases and its likelihood of engaging in cyber conflict increases.OPEN IN VIEWER

Robustness Checks

Variations in reporting can be a serious problem for conflict event data (Weidmann 2016), especially for COs, due to their novelty, secrecy surrounding their execution, and the difficulty of attributing origin. As explained earlier, even though bias may not present as serious of an issue for our analysis as one might assume, we run additional tests that consider the two types of biases that can result in latent events—events that happened but are not recorded in the dataset. First is non-systematic under-reporting that occurs if variables in the model are not related to the probability that a CO is reported (e.g., COs are under-reported at random or according to the model predictions), conditional on the cyber conflict occurring. Second is systematic under- or over-reporting that occurs if variables in the model are related to the probability that a COs is reported (e.g., due to COs’s transparent nature, democracies tend to report more COs that they suffered than autocracies). The obtained results presented in Online Appendix Section 4.1 confirm that our main finding—indirect substitutability of a country’s Internet dependency and its likelihood of experiencing cyber and conventional conflict—is robust to the situations that account for different types of reporting biases typical for COs.

Moreover, our findings are also robust to (an) alternative (1) model specification—instead of dyad REs, we also use dyad-year REs; (2) time dimension—instead of the yearly data we use monthly data; ²⁸ (3) measures of covariates; (4) behavior, investigating whether cyber can be a tool used mostly by major powers; and (5) measure of lags. Online Appendix Sections 4.2-4.6 present a detailed explanation of all these results.