At the dawn of the digital age, cybersecurity was a major concern with many predicting catastrophic outcomes. In 2010, The Economist featured a scenario likening cyber threats to a 9/11 style attack. Similarly, US Defense Secretary Leon Panetta warned of a "Cyber Pearl Harbor." Despite numerous damaging events over the years, these predictions have not materialized.
Professor Ciaran Martin from the Blavatnik School of Government explains why these catastrophic predictions have not come to pass. He cites three main reasons:
First, human safety is not entirely dependent on computers. For example, in aviation and railway systems, security breaches can cause disruptions but not mass casualties. An incident in August 2023 saw Britain's Air Traffic Control system fail comprehensively, leading to cancellations and diversions but no injuries.
Second, only a few highly capable actors possess access to devastating tools. While countries like China have the capability for significant cyber attacks on US infrastructure, such actions are deemed unlikely without serious escalation between nations.
"Carrying out high-impact cyber operations is extremely complicated," says Professor Martin. "Young criminals acting alone can – and have – undertaken data and cash theft... But highly sophisticated operations take years of preparation."
Thirdly, the same tools used for malicious purposes can also be developed for security improvements. This ongoing struggle between offensive and defensive capabilities has maintained an equilibrium.
"There are plenty of occasions where defences have ‘lost’. But there has never been a comprehensive superiority of offence over defence," states Professor Martin.
The emergence of AI poses new challenges to this equilibrium. AI enhances some malicious capabilities while reducing costs and difficulty for attackers. However, Professor Martin notes that it is crucial for defenders to keep pace with or surpass those who misuse technology.
"The geopolitical calculation that the likes of China, Iran and Russia will make before being overtly aggressive... is unlikely to extend to newer actors," he warns.
In conclusion, maintaining this digital security equilibrium requires sustained effort and smart policymaking as cyberspace remains contested but not catastrophic.