“WannaCry” About Trump’s Nuclear Posture Review? The Global Implications of Deterring Cyber Attacks with Nuclear Weapons

Congress is now debating whether to fund the first in a series of new nuclear weapons outlined by the Trump Administration’s Nuclear Posture Review (NPR), released in February. The debate is as much about the broader approach to nuclear weapons expressed by the NPR, as it is any specific nuclear weapons system. After all, previous NPRs have been done at the outset of a new administration, offering a first chance for a new President to shape how his administration will talk about nuclear weapons. While the NPR contains all manner of controversial recommendations, perhaps nothing in the document is more important than proposed changes to U.S. declaratory policy: what the U.S. says about the circumstances under which it would use or consider the use of nuclear weapons.

The NPR is an important signal to both allies and adversaries about U.S. thinking on the role of nuclear weapons in national and allied defense and deterrence. Other states with nuclear weapons tend to change their declaratory policies along with the United States – whether that means allies trying to mirror the American approach or adversaries feeling compelled to respond.

(To understand the Trump NPR in a global context, take our Global Nuclear Postures Quiz and view the accompanying infographic).

The reaction to the NPR was not positive. Trump administration officials have responded to public outcry over the document by downplaying its substantial changes. Even before its official release, the Trump Administration had already spent several weeks defending its draft NPR against the charge that the document — which leaked in mid-January — opened the possibility that the United States would seek to deter cyber attacks with nuclear weapons. “The idea that we would resort to a nuclear attack based on cyber is actually not supported by the document,” Air Force Gen. Paul J. Selva, Vice-chairman of the Joint Chiefs of Staff argued to reporters. “What the document does is it restates our pre-existing statement about use of nuclear weapons.” ¹ He added that the language “is precisely what we said in 2010. All we did is add one sentence.”

But, oh, what a sentence. (Strictly speaking, it is two sentences.) ²

The two new sentences added in the 2018 Nuclear Posture Review do something unprecedented. While both the 2010 and 2018 Nuclear Posture Reviews restrict the use of nuclear weapons to “extreme circumstances,” the two documents now differ dramatically in what counts as “extreme.”

“Extreme circumstances could include significant non-nuclear strategic attacks. Significant non-nuclear strategic attacks include, but are not limited to, attacks on the U.S., allied, or partner civilian population or infrastructure, and attacks on U.S. or allies’ nuclear forces, their command and control, or warning and attack assessment capabilities.” ³

The 2010 Nuclear Posture Review, produced under Barack Obama, did not attempt to define extreme circumstances. Many observers thought that additional specificity would be unwise. The Trump Administration disagreed, and added the sentences that begin to define extreme circumstances, in the process creating a new conceptual category for our strategic lexicon — the “significant non-nuclear strategic attack.” ⁴

This is a conceptually important moment. The Trump Administration has created a new basket of non-nuclear contingencies that might warrant a nuclear response. I suspect I will not like what gets put in it. Over time, this basket will fill as officials elaborate on the meaning of the document or speculate about new threats. There is every possibility that the term “extreme circumstances,” now laden with non-nuclear strategic attacks, will come to include rather workaday scenarios that are not extreme at all.

The NPR defines “significant non-nuclear strategic attacks” only by example, with the document noting they include large-scale conventional aggression, attacks with chemical and biological weapons, and most notably attacks in cyber space, particularly against U.S. nuclear command-and-control capabilities.

It is that last possibility that has caused the most alarm. The NPR makes repeated references to the development of new non-nuclear technologies that may require a nuclear response, often specifying the development of “cyber” capabilities as an example. The draft NPR announced that “the President will have an expanding range of limited and graduated options to credibly deter Russian non-nuclear or nuclear strategic attacks, which could now include attacks against U.S. NC3, in space and cyber space.” ⁵ In response to criticism, the Trump Administration deleted that last clause — obscuring the meaning without changing it. ⁶

This is not the first time that U.S. officials have hinted at the idea of deterring cyber attacks with nuclear weapons, although previously the threat was issued with some euphemism about “all options” being on the table or refusing to “rule things in or out.” The Trump Administration has now made that threat more explicit, although largely for a single scenario—a cyber attack intended to cripple the command-and-control system for U.S. nuclear forces. To be sure, this would be a serious challenge. Certainly any world leader would worry that an attempt to hack into an adversary’s nuclear command-and-control network might result in a massive response. But it isn’t clear that threatening to use nuclear weapons will do much to deter such attacks, and it may well make a host of other nuclear problems worse.

Conceptually, it is difficult to imagine a credible threat to retaliate with nuclear weapons against a cyber attack. First, and most obviously, in the event of a crippling cyber attack, the United States would not have its full complement of nuclear forces available. How does that factor into the decision to escalate to a nuclear war? Would the President even know with confidence which forces remained available for this escalation? And how would he respond to a failed cyber intrusion, one in which no one has been killed but a clear intent to disarm U.S. forces has been made? What if, as is often the case in hacking, the attribution to Moscow or Beijing is good but not, to borrow a phrase, a “slam dunk”? The Defense Department has been funding “cross domain deterrence” studies for years with little compelling result. (Other than the need to keep funding such studies, which I find pretty compelling.) Many of my colleagues—including those with NTI’s Cyber-Nuclear Weapons Study Group—have also done serious scholarly work on the problem. The net result is a body of literature that raises very thorny questions about deterring cyber attacks with nuclear weapons, but leaves the reader with few compelling answers.

But to hell with the experts and the hard questions. The Nuclear Posture Review complains on page after page that no one followed the Obama Administration’s lead in reducing the role of nuclear weapons. In this way, perhaps Trump will be a trend-setter, with others inspired to join an arms race. The document, however, is silent on how adversaries may choose to respond, nor does it offer a strategy to deal with what comes next.

Other countries will, of course, read the document and ask what it means for the choices they are making. Perhaps some will follow suit, choosing to deter cyber attacks with nuclear weapons of their own. Russia and China may change their nuclear postures to make U.S. nuclear threats against them in this area less credible. This is all in the future of course. Perhaps it will not come to pass. But the Nuclear Posture Review does not have a strategy to deal with this possibility. The section on arms control, for example, is thin and tepid. In the past, the emergence of a significant new threat like cyber attacks might have been met with a dual effort to respond with defense modernization and arms control. The 2018 NPR promises merely to spend more money on command-and-control, and then drop the big one if it doesn’t work out.

In this way, the document is characteristically Trumpian – even if it lacks his more colorful references to “fire and fury” or “shithole countries.” Like Trump himself, the text thrashes blindly ahead, with little respect for the experts and no consideration about the crucial details beyond a vague assurance to work them out later. But with nuclear weapons, there is no guarantee that we will live to see later.

Appendix: Comparing the 2010-2018 Nuclear Posture Review

• The 2018 Nuclear Posture Review retains the important changes that the Obama Administration made to U.S. nuclear declaratory policy, although with some significant alterations.
• The Obama-era language restricting the use of nuclear weapons to “extreme circumstances” remains, but the Trump Administration has now defined “extreme circumstances” to include a new category of “significant non-nuclear strategic attacks.”
• The 2018 Nuclear Posture Review retains the “clean” negative security assurance offered by the Obama Administration, although it broadens the circumstances under which the US reserves the right to adjust this pledge in respond to new proliferation risks. The 2010 NPR specified only an evolution in the biological weapons threat, while the 2018 Nuclear Posture Review reserves the right to adjust this pledge for the entire class of “non-nuclear strategic attack technologies.”

Table Notes and Sources:

[1] United States Department of Defense, Nuclear Posture Review, 2018.
[2] United States Department of Defense, Nuclear Posture Review, 2010.