Stuxnet, a piece of malware believed to be responsible for destroying approximately 1,000 centrifuges in Iran’s Natanz nuclear facility in late 2009 and early 2010, was a game-changer. For the first time, a computer virus was used to destroy a piece of physical infrastructure and the world took notice. The power of such a capability is clear today, but what happens once a wide range of counties and actors acquire equally sophisticated and powerful capabilities and there is no longer a technological gap between the United States, its allies, and the rest of the world?……..

the threat of using nuclear weapons to respond to cyber attacks by other states against U.S. critical infrastructure is not a realistic nor an effective response to cyber attack because:

• Cyber attacks lack the destructive and existential threat of nuclear weapons;
• A nuclear response to a cyber attack is not proportional;
• Threatening to respond with a nuclear weapons lacks credibility in adversaries’ eyes;
• Cyber deterrence in general is difficult to achieve; and
• The policy would provide a new rationale for nuclear proliferators…..

…………United States is already investing and should continue to invest in defensive capabilities to build-up the resiliency of its critical infrastructure networks to cyber attack. If critical networks are more difficult to compromise, then adversaries will be less likely to target them. And, the further global integration of information networks makes it less likely that states will seek to disrupt or attack other states’ cyber networks because the economic effects would be too great for both countries.

The U.S. should also engage further the international community to establish acceptable “rules of the road” for state behavior in cyberspace. And, it is important that current international law be recognized as a guide for developing these cyber rules and adjusted in order to make sense in the new and different technological environment. http://armscontrolnow.org/2013/05/30/is-there-a-place-for-nuclear-deterrence-in-cyberspace/

Several states, including the United States, have begun to discuss the establishment of cyberspace norms. The United Kingdom has hosted two international conferences on the subject. In September 2011 Russia and China proposed a code of conduct for cyber behavior. In 2011, the UN re-established the mandate for a group of governmental expertson developments in the field of telecommunications and international security. The United States and China recently discussed the possibility of opening a dialogue on the issue.

The adoption of a policy of using, or threatening to use, nuclear weapons in response to a major cyber attack by other states against U.S. critical infrastructure is not appropriate and is not an effective deterrent. Instead, the U.S. should continue to work with the international community to establish acceptable “rules of the road” that would hold states accountable and help impose some measure of restraint on all states’ cyber behavior.