There have been many books written on cybersecurity over the last several years—this is by far the best. People will disagree with it—there are claims and arguments that I certainly do not agree with—but everyone who is interested in these questions will have to engage with it.
There are two big reasons why cybersecurity debates are terrible: cybersecurity is highly technical across multiple dimensions, but it is also a topic that inspires high passions. The first problem means that different kinds of expertise—computer science, legal reasoning, strategic thinking, civil liberties activism—regularly collide with each other, and the crashes can be ugly. The second leads to clashes over ethical positions. There are few more politically charged questions than the conflict between national security and civil liberties, and cybersecurity remakes this conflict in new and complicated ways. The result is that few people understand cybersecurity comprehensively (most understand one or two dimensions better than the others), but many people have strong opinions. This leads to vexing and fruitless debates, where prominent pundits are able to get away with technically illiterate and excitable nonsense.
Segal’s book is not a complete overview of everything to do with cybersecurity—I do not know that anyone could possibly write one. It does cover an enormous amount of ground, and even better, it stakes out a clear and interesting position. Segal argues that power politics are crucial—the states that are able to use or threaten offensive actions in cyberspace are the states that count. However, these power politics are enormously complicated by the growth of interdependence and the crucial importance of the private sector. As the US has found out to its dismay, cyber-enabled espionage and covert action is having unexpected ramifications. Large scale surveillance is leading to counter-reactions in Europe and other friendly parts of the world. Building domestic defenses against spying and covert action is hard when the crucial resources reside in private, rather than public, hands. Finally, US firms’ dominance of e-commerce and the Internet can be a weapon when it allows for easier surveillance, but a weakness when these firms’ international business interests lead them to split from the US security state.
For sure, this position has clear political implications. Segal is a Senior Fellow at the Council on Foreign Relations, and his book reflects the Council’s brief to help US policy actors and citizens “better understand the world and the foreign policy choices facing the United States and other countries.” Yet even if it is clearly written from a US-centric perspective, it takes a quite dispassionate view of US interests, and explicitly describes US mistakes as well as successes. Both NSA officials and civil liberties activists will recognize the world it portrays (while chafing at the parts with which they disagree).
The argument is straightforward, but touches on many questions that are poorly understood. Segal agrees with many elements of what might be called the Pentagon View of cybersecurity, arguing that cyber threats are real, that the really problematic ones tend to emanate from nation states, and that power politics dominate. Yet he also emphasizes how the US is itself perceived by other countries as an exceptionally aggressive adversary in cyberspace, and correctly so—the NSA is believed to be the biggest customer on the semi-clandestine market for zero day exploits, and has been the most ambitious state using cyber-espionage. Most interesting of all, Segal provides a novel and provocative argument about how great power politics has become intertwined with commercial relations such that the private sector is important, as well as the public sector.