The front page of today's New York Times carries a fascinating article by David Sanger (with reporting from Eric Schmitt) on considerations being raised within the Obama administration regarding the possible use of cyber weapons against the Assad regime in Syria. It is not clear whether a cyberattack against Syria "would be seen as a justified humanitarian intervention, less likely to cause civilian casualties than airstrikes, or whether it would only embolden American adversaries who have themselves been debating how to use the new weapons."
There are some very significant--and obvious--differences between cyber weapons and nuclear weapons, but it is entirely possible that certain restraints on their use may operate in much the same way. Consider this passage from Thomas C. Schelling's 1966 classic, Arms and Influence, in which he discusses the possible impact of the first (post-1945) use of nuclear weapons:
This is not an event to be squandered on an unworthy military objective. The first nuclear detonation can convey a message of utmost seriousness; it may be a unique means of communication in a moment of unusual gravity. To degrade the signal in advance, to depreciate the currency, to erode gradually a tradition that might someday be shattered with diplomatic effect, to vulgarize weapons that have acquired a transcendent status, and to demote nuclear weapons to the status of merely efficient artillery, may be to waste an enormous asset of last resort.
Or, as others noted, it may be best not to let the genie out of the bottle.
Even though cyber weapons have certainly been used before--think Stuxnet and its progeny against Iran (as well as Iranian retaliatory attacks against the U.S.), the Russian denial-of-service attack against Georgia in the 2008 South Ossetia War, Israel's combined cyber/kinetic strike against a Syrian nuclear facility, and more--there may still be some wisdom in thinking of the carefully designed cyber weapon as Schelling suggested, as "an enormous asset of last resort." Or as a genie not to be let out of the bottle. In any event, it seems essential to avoid the temptation to treat cyber weapons as weapons of first resort. While they may provide the United States and other countries an unusually effective and precise means of weakening the military capacities of states such as Syria, retaliation--even with cyber weapons--is likely to be much more indiscriminate.
As we already know, military dominance in any domain commonly produces asymmetric responses that target the weaknesses of the dominant power. At present, America's Achilles' heel in cyberspace is its commercial sector thanks to businesses that, time and again, have demonstrated an unwillingness or an inability to address Internet security problems.