The Bureaucratic Politics of Cyber Strategy

Abstract Why do states implement certain cyber strategies, and why might they change over time? We argue that an important but overlooked factor is bureaucratic politics. Specifically, intelligence and military agencies each prefer different cyber strategies owing to their unique organizational cultures. As bureaucracies commonly do, they compete to influence strategies in their favor. When intelligence agencies prevail, we expect more risk-averse cyber strategies: states view cyberspace as an area of intelligence contest, use cyber capabilities to conduct primarily espionage operations, and are reluctant to take credit for their actions. When military agencies prevail, we expect more risk-acceptant cyber strategies: states view cyberspace as an arena of warfare, use cyber capabilities to disrupt and deter, and are likely to take credit for their actions. Drawing upon primary and secondary sources, we examine the evolution of the US and French cyber strategies and find strong support for our intuition specifically, and for the role of bureaucratic politics in cyberspace more generally. Our findings have implications for ongoing debates on coercion, escalation, and competition in cyberspace, as well as for bureaucratic politics and secrecy in international relations.