joint work with Sandeep Baliga (Northwestern University) and Alexander Wolitzky (MIT)
Abstract: Motivated by recent developments in cyberwarfare, we study deterrence in a world where attacks cannot be perfectly attributed to attackers. In the model, each of n attackers may attack the defender. The defender observes an imperfect signal that probabilistically attributes the attack. The defender may retaliate against one or more attackers, and wants to retaliate against the guilty attacker only. We uncover an endogenous strategic complementarity among the attackers: if one attacker becomes more aggressive, that attacker becomes more “suspect” and the other attackers become less suspect, which leads the other attackers to become more aggressive as well. Improving the defender’s ability to detect attacks or identify the source of attacks can hinder deterrence and lead to more attacks, but simultaneously improving both detection and identification—in that some attacks which previously went undetected are now both detected and unambiguously attributed—always reduces attacks. Deterrence is improved if the defender can commit to a retaliatory strategy in advance, but the defender should not always commit to retaliate more after every signal.