Deterrence in cyberspace is possible — and ‘urgent’ — amid ‘alarming’ hybrid attacks, State cyber ambassador says

A narrative once took root in part of the security community that deterrence doesn’t apply in cyberspace, Nate Fick, America’s first cyber ambassador, said in an interview Tuesday. “I have to disagree with that pretty fundamentally,” he told CyberScoop.

Deterrence is a subject Fick has been talking about ever since he was nominated to serve as the State Department’s ambassador at large for cyberspace and digital policy more than two years ago. But he said it’s all the more “urgent” to answer now, as the pace of hybrid activity — cyberattacks mixed with other types of attacks, from foreign influence operations to physical warfare — is “alarming,” something he’s learned from visits to nations along the Eastern flank of NATO, places like Estonia, Moldova, Poland and Ukraine.

“They’re pushing and prodding, they’re testing, and we need to ensure that we enforce the norms and don’t allow them to expand the box of what is tolerated,” Fick said. China is stealing intellectual property and Russia is doing things “using digital means that they would never do using kinetic means.”

The key is that “at the end of the day, it’s not actually computer-to-computer, right?” he said. “The technology is a vector for human beings. Behind the connection is a person. That person has national interests or economic interests, and human beings … we have cost-benefit calculus that we make in everything we do, all the time, in human interactions.”

Policies toward escalation and deescalation for the physical world, relying on elements of national power from the diplomatic to the military, need to be extended to the digital world if cyberspace isn’t going to be the “Wild West,” Fick said.

Countering foreign influence operations will require more public education, he said, the same way public education has had an influence on smoking, seat belts or helmets. If you can show someone a deepfake video, it can help them demonstrate how they can be fooled, Fick said. He recently said that the American public doesn’t grasp just how much of the social media they consume is a foreign influence operation.

The long term and the short term

Congress got it right when they decided to create the bureau he leads, Fick said. It was vital not to get hung up on making it perfect, but to create it and then later refine it. One such refining move was the establishment of S/TECH, formally known as the Office of the Special Envoy for Critical and Emerging Technology, to focus on things like quantum, artificial intelligence and biotechnology.

“Now that we’ve solidified that,” Fick said, “we have the opportunity to survey the landscape and say, OK, what else should be more closely coupled with this organization?”

That’s probably going to be up to whoever takes the White House after November, but Fick said “we will have a set of well-considered recommendations ready.” A recommendation he expects to be included is expansion of a $50 million foreign aid fund for things like shoring up allied nations’ cyber defenses. That pot of money was a meaningful amount, but he said he’d like to see not 10% or 20% more in future budgets, but “a multiple increase.”

“I think we can generate outsized foreign policy returns for the United States in this area, frankly, as opposed to some other areas,” Fick said.

He pointed to successes thus far for his bureau that included not only that fund but the training of more than 200 cyber and digital officers placed around the world.

“If I had been given the opportunity to sign up two-and-a-half years ago to be right where we are today, with no hope of doing better, but no risk of doing worse — if you think about it in those terms — I would’ve signed that piece of paper in a heartbeat,” Fick said.

Some of Fick’s more near-term priorities are on specific parts of the world, namely Costa Rica and Moldova — both because of things Russia has been doing there.

Costa Rica approached the United States for help after it suffered a damaging ransomware attack at the hands of the Russian-affiliated Conti gang in 2022. It has since become “a really interesting test case,” Fick said.

The administration there has responded by taking a “pretty hard stand on trusted vendors in Costa Rica, which was provocative in some ways,” he said. Costa Rica then hosted its own conference where “they were speaking to regional peers about the importance of trusted digital infrastructure, not only for cybersecurity, but for attracting foreign digital investment,” he said.

“Their profile is now increasing as part of the global realignment of tech supply chains, because companies have conviction in the steadfastness of the Costa Rican government on these points,” he said.

Moldova is important because of a presidential election and European Union referendum membership vote scheduled on the same day, Fick said. Someone in Moldova is closer to the front lines of the Ukraine war than someone in Kyiv right now, he said.

“And it really matters, because Moldova is at a fork in the road, and popular sentiment in Moldova seems to be very strongly in support of taking kind of a Western pathway to European integration and freedom and prosperity,” Fick said. “And the Russians would prefer Moldova to take a different course, and they’re using every tool in their arsenal to try to influence that outcome.”

Fick’s philosophy behind focusing on certain areas is that the world is a big place, and “I’m a believer in the notion that the essence of strategy is the allocation of finite resources against infinite priorities,” he said. “You have to make choices, and that’s hard. That means saying yes to the essential things and saying no to the merely important things.”