Interactive & Visualization

“WannaCry” About Trump’s Nuclear Posture Review? The Global Implications of Deterring Cyber Attacks with Nuclear Weapons

Screenshot of Global Nuclear Postures interactive

About the image

“WannaCry” About Trump’s Nuclear Posture Review? The Global Implications of Deterring Cyber Attacks with Nuclear Weapons

Save to My Resources

Want to dive deeper?

Visit the Education Center

Jeffrey Lewis

Director of the East Asia Nonproliferation Program, The James Martin Center for Nonproliferation Studies

Congress is now debating whether to fund the first in a series of new nuclear weapons outlined by the Trump Administration’s Nuclear Posture Review (NPR), released in February. The debate is as much about the broader approach to nuclear weapons expressed by the NPR, as it is any specific nuclear weapons system. After all, previous NPRs have been done at the outset of a new administration, offering a first chance for a new President to shape how his administration will talk about nuclear weapons. While the NPR contains all manner of controversial recommendations, perhaps nothing in the document is more important than proposed changes to U.S. declaratory policy: what the U.S. says about the circumstances under which it would use or consider the use of nuclear weapons.

The NPR is an important signal to both allies and adversaries about U.S. thinking on the role of nuclear weapons in national and allied defense and deterrence. Other states with nuclear weapons tend to change their declaratory policies along with the United States – whether that means allies trying to mirror the American approach or adversaries feeling compelled to respond.

Screenshot of Global Nuclear Postures interactive

(To understand the Trump NPR in a global context, take our Global Nuclear Postures Quiz and view the accompanying infographic).

 

The reaction to the NPR was not positive. Trump administration officials have responded to public outcry over the document by downplaying its substantial changes. Even before its official release, the Trump Administration had already spent several weeks defending its draft NPR against the charge that the document — which leaked in mid-January — opened the possibility that the United States would seek to deter cyber attacks with nuclear weapons. “The idea that we would resort to a nuclear attack based on cyber is actually not supported by the document,” Air Force Gen. Paul J. Selva, Vice-chairman of the Joint Chiefs of Staff argued to reporters. “What the document does is it restates our pre-existing statement about use of nuclear weapons.” 1 He added that the language “is precisely what we said in 2010. All we did is add one sentence.”

But, oh, what a sentence. (Strictly speaking, it is two sentences.) 2

The two new sentences added in the 2018 Nuclear Posture Review do something unprecedented. While both the 2010 and 2018 Nuclear Posture Reviews restrict the use of nuclear weapons to “extreme circumstances,” the two documents now differ dramatically in what counts as “extreme.”

“Extreme circumstances could include significant non-nuclear strategic attacks. Significant non-nuclear strategic attacks include, but are not limited to, attacks on the U.S., allied, or partner civilian population or infrastructure, and attacks on U.S. or allies’ nuclear forces, their command and control, or warning and attack assessment capabilities.” 3

The 2010 Nuclear Posture Review, produced under Barack Obama, did not attempt to define extreme circumstances. Many observers thought that additional specificity would be unwise. The Trump Administration disagreed, and added the sentences that begin to define extreme circumstances, in the process creating a new conceptual category for our strategic lexicon — the “significant non-nuclear strategic attack.” 4

This is a conceptually important moment. The Trump Administration has created a new basket of non-nuclear contingencies that might warrant a nuclear response. I suspect I will not like what gets put in it. Over time, this basket will fill as officials elaborate on the meaning of the document or speculate about new threats. There is every possibility that the term “extreme circumstances,” now laden with non-nuclear strategic attacks, will come to include rather workaday scenarios that are not extreme at all.

The NPR defines “significant non-nuclear strategic attacks” only by example, with the document noting they include large-scale conventional aggression, attacks with chemical and biological weapons, and most notably attacks in cyber space, particularly against U.S. nuclear command-and-control capabilities.

It is that last possibility that has caused the most alarm. The NPR makes repeated references to the development of new non-nuclear technologies that may require a nuclear response, often specifying the development of “cyber” capabilities as an example. The draft NPR announced that “the President will have an expanding range of limited and graduated options to credibly deter Russian non-nuclear or nuclear strategic attacks, which could now include attacks against U.S. NC3, in space and cyber space.” 5 In response to criticism, the Trump Administration deleted that last clause — obscuring the meaning without changing it. 6

This is not the first time that U.S. officials have hinted at the idea of deterring cyber attacks with nuclear weapons, although previously the threat was issued with some euphemism about “all options” being on the table or refusing to “rule things in or out.” The Trump Administration has now made that threat more explicit, although largely for a single scenario—a cyber attack intended to cripple the command-and-control system for U.S. nuclear forces. To be sure, this would be a serious challenge. Certainly any world leader would worry that an attempt to hack into an adversary’s nuclear command-and-control network might result in a massive response. But it isn’t clear that threatening to use nuclear weapons will do much to deter such attacks, and it may well make a host of other nuclear problems worse.

Conceptually, it is difficult to imagine a credible threat to retaliate with nuclear weapons against a cyber attack. First, and most obviously, in the event of a crippling cyber attack, the United States would not have its full complement of nuclear forces available. How does that factor into the decision to escalate to a nuclear war? Would the President even know with confidence which forces remained available for this escalation? And how would he respond to a failed cyber intrusion, one in which no one has been killed but a clear intent to disarm U.S. forces has been made? What if, as is often the case in hacking, the attribution to Moscow or Beijing is good but not, to borrow a phrase, a “slam dunk”? The Defense Department has been funding “cross domain deterrence” studies for years with little compelling result. (Other than the need to keep funding such studies, which I find pretty compelling.) Many of my colleagues—including those with NTI’s Cyber-Nuclear Weapons Study Group—have also done serious scholarly work on the problem. The net result is a body of literature that raises very thorny questions about deterring cyber attacks with nuclear weapons, but leaves the reader with few compelling answers.

But to hell with the experts and the hard questions. The Nuclear Posture Review complains on page after page that no one followed the Obama Administration’s lead in reducing the role of nuclear weapons. In this way, perhaps Trump will be a trend-setter, with others inspired to join an arms race. The document, however, is silent on how adversaries may choose to respond, nor does it offer a strategy to deal with what comes next.

Other countries will, of course, read the document and ask what it means for the choices they are making. Perhaps some will follow suit, choosing to deter cyber attacks with nuclear weapons of their own. Russia and China may change their nuclear postures to make U.S. nuclear threats against them in this area less credible. This is all in the future of course. Perhaps it will not come to pass. But the Nuclear Posture Review does not have a strategy to deal with this possibility. The section on arms control, for example, is thin and tepid. In the past, the emergence of a significant new threat like cyber attacks might have been met with a dual effort to respond with defense modernization and arms control. The 2018 NPR promises merely to spend more money on command-and-control, and then drop the big one if it doesn’t work out.

In this way, the document is characteristically Trumpian – even if it lacks his more colorful references to “fire and fury” or “shithole countries.” Like Trump himself, the text thrashes blindly ahead, with little respect for the experts and no consideration about the crucial details beyond a vague assurance to work them out later. But with nuclear weapons, there is no guarantee that we will live to see later.

Appendix: Comparing the 2010-2018 Nuclear Posture Review

  • The 2018 Nuclear Posture Review retains the important changes that the Obama Administration made to U.S. nuclear declaratory policy, although with some significant alterations.
  • The Obama-era language restricting the use of nuclear weapons to “extreme circumstances” remains, but the Trump Administration has now defined “extreme circumstances” to include a new category of “significant non-nuclear strategic attacks.”
  • The 2018 Nuclear Posture Review retains the “clean” negative security assurance offered by the Obama Administration, although it broadens the circumstances under which the US reserves the right to adjust this pledge in respond to new proliferation risks. The 2010 NPR specified only an evolution in the biological weapons threat, while the 2018 Nuclear Posture Review reserves the right to adjust this pledge for the entire class of “non-nuclear strategic attack technologies.”

Table Notes and Sources:

[1] United States Department of Defense, Nuclear Posture Review, 2018.
[2] United States Department of Defense, Nuclear Posture Review, 2010.

Stay Informed

Sign up for our newsletter to get the latest on nuclear and biological threats.

Sign Up


The 2023 NTI Nuclear Security Index

Report

The 2023 NTI Nuclear Security Index

“The bottom line is that the countries and areas with the greatest responsibility for protecting the world from a catastrophic act of nuclear terrorism are derelict in their duty,” the 2023 NTI Index reports.


The Cyber-Nuclear Threat

Fact Sheet

The Cyber-Nuclear Threat

Nuclear and tech experts know that all digital systems are at risk for cyberattacks—including nuclear weapons systems.


Glossary

Nuclear weapon
Nuclear weapon: A device that releases nuclear energy in an explosive manner as the result of nuclear chain reactions involving fission, or fission and fusion, of atomic nuclei. Such weapons are also sometimes referred to as atomic bombs (a fission-based weapon); or boosted fission weapons (a fission-based weapon deriving a slightly higher yield from a small fusion reaction); or hydrogen bombs/thermonuclear weapons (a weapon deriving a significant portion of its energy from fusion reactions).
Nuclear Posture Review
Under a mandate from the U.S. Congress, the Department of Defense regularly conducts a comprehensive Nuclear Posture Review to set forth the direction of U.S. nuclear weapons policies. To date, the United States has completed four Nuclear Posture Reviews (in 1994, 2001, 2010, and 2018).
Deterrence
The actions of a state or group of states to dissuade a potential adversary from initiating an attack or conflict through the credible threat of retaliation. To be effective, a deterrence strategy should demonstrate to an adversary that the costs of an attack would outweigh any potential gains. See entries for Extended deterrence and nuclear deterrence.
Chemical Weapon (CW)
The CW: The Organization for the Prohibition of Chemical Weapons defines a chemical weapon as any of the following: 1) a toxic chemical or its precursors; 2) a munition specifically designed to deliver a toxic chemical; or 3) any equipment specifically designed for use with toxic chemicals or munitions. Toxic chemical agents are gaseous, liquid, or solid chemical substances that use their toxic properties to cause death or severe harm to humans, animals, and/or plants. Chemical weapons include blister, nerve, choking, and blood agents, as well as non-lethal incapacitating agents and riot-control agents. Historically, chemical weapons have been the most widely used and widely proliferated weapon of mass destruction.
Biological weapon (BW)
Biological weapons use microorganisms and natural toxins to produce disease in humans, animals, or plants.  Biological weapons can be derived from: bacteria (anthrax, plague, tularemia); viruses (smallpox, viral hemorrhagic fevers); rickettsia (Q fever and epidemic typhus); biological toxins (botulinum toxin, staphylococcus enterotoxin B); and fungi (San Joaquin Valley fever, mycotoxins). These agents can be deployed as biological weapons when paired with a delivery system, such as a missile or aerosol device.
Strategic nuclear warhead
Strategic nuclear warhead: A high-yield nuclear warhead placed on a long-range delivery system, such as a land-based intercontinental ballistic missile (ICBMs), a submarine-launched ballistic missile (SLBMs), or a strategic bomber.
Arms control
Arms control: Measures, typically bilateral or multilateral, taken to control or reduce weapon systems or armed forces. Such limitations or reductions are typically taken to increase stability between countries, reducing the likelihood or intensity of an arms race. They might affect the size, type, configuration, production, or performance characteristics of a weapon system, or the size, organization, equipment, deployment, or employment of armed forces. Arms control measures typically include monitoring and verification provisions, and may also include provisions to increase transparency between the parties. Also see entry for Confidence and Security Building Measures, Transparency Measures.
Negative security assurances
A pledge by a nuclear weapon state that it will not use nuclear weapons against a non-nuclear weapon state. Some states have policies that allow for the use of nuclear weapons if attacked with other WMD by a non-nuclear weapon state. See entry for Positive security assurances

Sources

  1. Oriana Pawlyk, “Cyber Attack Wouldn’t Merit Nuclear Strike: Joint Chiefs Vice Chairmen,” Military.com, 30 January 2018.
  2. At some level, Selva has a point about the surprising continuity between the reviews conducted by the Obama and Trump Administrations. Some of the major changes to how the United States talks about nuclear weapons made by the Obama Administration were actually retained by the Trump Administration. Trump kept Obama’s 2010 formulation that the United States would only use nuclear weapons in “extreme circumstances,” as well as his pledge not to use nuclear weapons against non-nuclear weapon states that were in compliance with their nuclear nonproliferation obligations. That latter pledge came under considerable partisan criticism when Obama made it, including from Senator John McCain. Despite this, both the “extreme circumstances” formulation and the “clean” negative security assurance remain.
  3. United States Department of Defense, Nuclear Posture Review, 2018, page 21.
  4. In addition to adding this sentence, the Trump administration altered another in a significant way. The 2018 NPR repurposes very narrow language from the Obama-era document, which originally related to biological attacks, as an expansive warning to non-nuclear states that the United States might withdraw the assurance offered to them as the threat from “non-nuclear strategic attacks” evolves.
  5. United States Department of Defense, Nuclear Posture Review, 2018, page 57.
  6. United States Department of Defense, Nuclear Posture Review, 2018, page 57.

Close

My Resources