Cyber Arms Transfer: Meaning, Limits, and Implications

Abstract What are the motivations and opportunities for arms transfer in the cyber realm? Although scholarship has failed to systematically address this question, having an accurate answer is crucial for understanding the operationalization of cyber commands and intelligence alliances, the functioning of the North Atlantic Treaty Organization in the twenty-first century, and the viability of cyber arms controls. First, this article introduces a new conceptual framework—the people-exploits-tools-infrastructure-organization (PETIO) framework—to understand the elements of an offensive cyber capability. Second, I explain how the incentives of cyber arms transfer differ across the different elements of the PETIO framework. Though exploits and tools can be effortlessly replicated, their transitory nature and potential for operational tracking means there is little incentive to actually transfer these assets. If any incentives exist for state-to-state transfer, it would be in facilitating other state actors to develop their own offensive capabilities—that is, by providing expertise, infrastructure, and organizational capacity to adapt and innovate—as this does not reduce the effectiveness of one’s own arsenal. Third, I argue that the incentives for transferring cyber effect capabilities are weaker compared to cyber espionage capabilities, and attribution dynamics add an additional layer of complexity to these transfer dynamics.