Offense-defense theory, state size and posturing in the cyber domain: the case of the United Kingdom and the Republic of Estonia

Abstract

The increasing relevance of the cyber domain has an impact on the national security of states. At current stage, states are in a phase of introducing the cyber approach that best coincides with their security needs. While all states share the same threat of becoming victim to devastating cyber-attacks, they need to consider whether they take an offensive or defensive cyber posture in order to increase security in the virtual domain. This thesis addresses the question of whether state size have an effect on the cyber posture of state. First, in an attempt to theorize cyber posturing, the study modifies traditional assumptions of the offense-defense balance theory and applies the logic of the balance to the cyber domain. In addition, this thesis elaborates state size as a specific element that could explain an offensive or defensive cyber posture. It analysis whether cyber posture of small and large states differs and examines the sensitivity of small and large states to the offense-defense balance. In an empirical analysis of the cyber posture of Estonia and the United Kingdom, the research examines theoretical assumptions in a comparative analysis. The thesis demonstrates that state size has an impact on the cyber posture of states. While the UK adopts an offensive cyber posture, Estonia’s strategic documents do not indicate the development of offensive cyber capabilities at present the time. Finally, the thesis points out that small states are more sensitive to the offense-defense balance in cyberspace and adjust their cyber posture according to the offensive or defensive advantage.