The Appendix A is curious, agreed. Let’s try a counterfactual heuristic here though: what if he’d simply left it out? merely said it’s an unresolved issue and left it at that? Libicki didn’t set out to write the definitive guide to cyberwar, cyberdeterrence, or the laws of war. It’s not doctrine, operational guidance, or policy. It is what it is: an extended think-piece that I think is a valuable addition to the canon.

If you’re going to provide guidance to the DoD on the relative merits of cyber deterrance, then you need to adequately cover the domain wherein it would be applied.

Regarding your point about whether I would dismiss 60 yrs of nuclear strategic theory because it isn’t evidence-based, I don’t see that as analogous. First, there are no examples of a nuclear war to point to. Not even a nuclear “skirmish” or a non-state nuclear terrorist attack. That’s not the case with cyber.

And what about his Appendix A? Can you help me understand why he would even include that when legal experts have written hundreds of pages on the subject and its still hotly contested?

As to the USAF, they’ve sponsored other, better Rand studies but these last few years have revealed seriously and deeply embedded problems in leadership in that service. I wonder if Lord even read this report before it went out the door?

In his introduction, Libicki explictly states that operational cyberwar, i.e. ‘attacks’ designed to support/augment/choose-your-verb kinetic operations, may be of far more relevance than what he calls ’strategic cyberwar’ i.e. that conducted entirely ‘in cyberspace’. He explictly sets out his remit, and does not stray from that. Just because you might not like the fact that he hasn’t addressed all the issues – there’s definitely more scope for that, of course – is no reason not to take the report on its own terms.

As regards USAF, it actually speaks well of them that they a) appointed RAND, b) didn’t editorialise (that we know of), and c) haven’t attempted to quash the report. Whilst I agree that USAF may be a service in search of a mission, this is exactly the sort of exercise that might usher them towards the sort of acceptance of their limitations that you suggest, rightly, would be more productive.

The main thrust of your argument is that Libicki doesn’t understand and that he doesn’t support his case with deep histories of known cyberwar. His cyberwar-alone scenarios are therefore a straw man. Would you be similarly inclined to dismiss 60 years of nuclear strategic theory on the basis that it isn’t evidence-based? Of course not. Libicki’s methodology is sound, even if his theoretical stance and report structure is not to your liking.