Which country is the world’s leading cyber power?

The importance of cyberspace is ubiquitous in our present age: from its role in national economies, in trade, political debate, to its use as a tool for coercion and espionage, and its perceived centrality as one of the determinants of success in war.

With both state and non-state actors increasingly leveraging cyber capabilities to achieve their strategic aims, competition in cyberspace and over the norms that govern it is only intensifying.

Yet, despite the increasing importance of cyberspace in global politics, economics and defence, a comprehensive evaluation of national cyber power had not been carried out – until now.

London-based think tank International Institute for Strategic Studies (IISS) has filled that gap with an innovative study released earlier this week.

The result of two years of research, the IISS’s Cyber Capabilities and National Power: A Net Assessment gauges the cyber capabilities and national power of fifteen countries, as well as a new framework for understanding global state cyber capacity and how to rank them.

One of the key takeaways from the overall assessment is that the US is the overwhelming dominant global cyber power, while its closest rival China was unlikely to match it for at least the next decade.

“China has made significant progress in bolstering its capabilities since 2014, but nowhere near enough to close the gap with the US. The main reason is the relative standing of the two nations’ digital economies,” said one of study’s authors and IISS senior fellow Dr Greg Austin.

What makes the IISS report different from previous index-based measurements of nations’ cyber security capacities, is a more comprehensive qualitative analysis of a country’s wide cyber ecosystem, including how it intersects with international security, economic competition and military affairs.

Countries were judged on seven criteria: strategy and doctrine; governance, command and control; core cyber-intelligence capability; cyber empowerment and dependence; cyber security and resilience; global leadership in cyberspace affairs; and offensive cyber capability.

According to the framework, the US is the only country with world-leading strengths in all categories. An “unrivalled” partnership between business, government and universities was singled out as an important advantage that the US possesses over the rest of the field.

The second tier of cyber powers include China, Russia, UK, France, Canada, Israel and Australia, each of which have world-leading strengths in some of the categories.

Due to China’s large and growing indigenous digital-industrial capacity, the study concludes that it is currently on the fastest trajectory to graduate to the first tier. But that won’t be for at least the next decade, as poor security and weak intelligence analysis will hold it back.

In the third tier were states in the early stages of their cyber power development like India, Japan, Iran, Indonesia, Malaysia, Vietnam, and North Korea. All were defined as having strengths or potential strengths in some categories but significant weaknesses in others.

Japan, with its world-leading high-tech industry, was judged as being best placed to rise into the second tier in the long term.

Impact of politics and history on cyber power

An emphasis the study makes is that the trajectory of national cyber power development, rather than being competitive emulation, is fundamentally marked by divergence.

One important observation is that a country’s political culture and organisational relationship between parts of its government invariably shape its cyber capabilities and how they’re used on the global stage.

For example, given the nature of their political systems, Chinese and Russian cyber operations focus as much on controlling the domestic information space as they do subverting and penetrating critical information infrastructure of their geopolitical adversaries.

This has interesting implications for military cyber power, because it might imply that China and Russia are dedicating less resources in comparison to Western powers when it comes to developing the types of cyber capabilities that are used in, for example, high intensity warfare.

Another powerful indicator of whether a country is on the right path towards becoming a cyber power is governmental intent.

Those like the UK and France have been progressing for a while – particularly the UK due to the prominence of GCHQ and sustained political will. To this end, a legacy of doctrinal and organisational culture is essential.

However, for newer independent countries on the block like India, Malaysia, Indonesia, or Vietnam – who lacked the history of an intelligence apparatus that older powers like the UK and France had – it needed to be built up from scratch.

Being the home for many of the world’s leading cyber companies is one of the benefits the US enjoys from its long history of tech development.

Also emphasised was the importance of international relationships. The ‘Five Eyes’ informal intelligence alliance of the US, UK, Canada, Australia and New Zealand, was described as the most dominant cyber alliance, which allies like France, Israel and Japan also benefit from.

Alternatively, there are no such links between countries like China, Iran, Russia and North Korea – often deemed at odds with liberal democracies.

China on the cusp?

For China to graduate to tier 1, it would have to make substantial changes in domestic innovation and its organisational culture, the study declares.

Thus far, Beijing has fallen short of fostering an ecosystem that would enable it to be less dependent on US tech firms like Microsoft and IBM. Its homegrown tech giants Alibaba and Tencent are situated in e-commerce and digital service sectors, which Austin calls “easy parts of the information economy.”

“Since the Snowden leaks of 2013, the Chinese government has been trying to reduce the penetration of foreign technologies,” Austin said. “But as recently as 2018, Xi Jinping said all of China’s core technologies are controlled by foreign corporations. So it’s a long-term process.”

The US, meanwhile, has been “building its dominance in cyberspace since the mid-1990s” and “its power is amplified by highly sophisticated intelligence-sharing networks” like the Five Eyes alliance.

However, Austin concludes that the US cannot be complacent about its leading position.

One of the ways the US has maintained digital-industrial superiority has been how it’s used its leading economic and military power to advance its cyber technological capacities, while restricting China’s access to Western technologies.

By doing so, Austin said that the US and its allies “have endorsed a partial decoupling of the West and China that could potentially impede the latter’s ability to develop its own advanced technology.”

“How robustly the US continues this strategy, and how China responds, will dictate the future balance of cyber power.”