• That accolade goes to the US which is 10 years ahead of the PRC
• International Institute of Strategic Studies paper ranks 15 counties according to seven criteria
• Iran and North Korea may want to be global leaders in cyberspace but are third rate

General opinion in the democratic West, stoked by endless scare stories about attacks by "state-sponsored actors, has it that myriad teams of hackers across many countries are dedicated to instigating endless and ever-more powerful and debilitating cyber attacks against us to bring us to our knees without the need to fire a shot, so it's interesting today, if not necessarily over-comforting, to read a new report claiming that the usual cyber villains of China, Russia, Iran and North Korea aren't as all-powerful in cyber space as they would like to have us think they are.

Yesterday, the UK's International Institute of Strategic Studies (IISS) published "Cyber Capabilities and National Power: A Net Assessment" a report that is the fruit of two years of highly detailed analysis. It examines the cyber capabilities of 15 countries and ranks them according to seven criteria to determine their actual cyber capabilities and competence as opposed to popular perceptions of their strength and offensive power and proficiencies.

The 15 countries in question are  Australia, Canada, China, France, India, Indonesia, Iran, Israel, Japan, Malaysia, North Korea, Russia, the UK, the US and Vietnam.

The paper concludes that the US is the world's one and only Tier-One Nation and cyber superpower in that it possesses "world-leading strengths in all the categories in the methodology" and is thus "the  world’s most powerful nation when measured on cyber capabilities that make the greatest difference to national power." It adds that "US capability for offensive cyber operations is probably more developed than that of any other country, although its full potential remains largely undemonstrated." Perhaps the caveat to that should be "as far as we know."

The IISS further observes that although the US recognises that defending itself against cyber attacks is an endless war of attrition calling for eternal vigilance, America has been more effective "than any other country to defend its critical national infrastructure in cyberspace" even though major weak points in that defence need reinforcing.

The report concludes that the US is at least a decade ahead of China in its defensive and offensive cyber-capabilities. Other nations including Australia, Canada, China, France, Israel, Russia and the UK, whilst very capable and possessing "world-leading strengths in some of the categories", are Second Tier tier also-rans behind the US whilst likes of Iran and North Korea are unpredictable and dangerous they are also third rate and thus Third Tier.

The IISS, headquartered in London and founded in 1958 during one of the chilliest periods of the Cold War, is a world-renowned research house dedicated to the areas of international affairs, global security, political risk and military conflict. The new report is based on a detailed analysis and assessment of seven criteria to determine the relative cyber capabilities, strengths and weaknesses of the 15 nations under scrutiny. They are: Strategy and doctrine; Governance, command and control; Core cyber intelligence capability; Cyber empowerment and dependence; Cyber security and resilience; Global leadership in cyberspace affairs and last but not least, Offensive cyber capability.

Tiers before bedtime

The IISS report can be accessed at https://www.iiss.org/blogs/research-paper/2021/06/cyber-power, but here's a quick Tier by Tier run through some of the salient points relating to the countries covered. The US is the world's only Tier One cyber-power and attacks perpetrated against it by China, Iran, North Korea, Russia have spurred the US into massively increasing its cyber capabilities and that drive continues.

In Tier Two, Australia has a strong presence as a direct result of its membership of the Five Eyes intelligence alliance but is judged to need to invest a lot more in cyber R&D and define more focused national cyber capabilities and strategies.

Canada has its own excellent technology sector but is heavily reliant on allies in the US, the UK and Europe to supply it with cutting edge cyber-security hardware. However, it is known to be growing its offensive cyber-capabilities.

And now for China. In 2015, the PRC declared that "outer space and cyber space have become new commanding heights of strategic competition" between countries. Since then it has conducted many cyber attacks against designated 'enemies' and economic rivals and operates a massive and pervasive national surveillance system to control its own population. It also attacks for pure espionage purposes and also to gain access to western intellectual property which it appropriates to reverse-engineer and then produce its own 'home-grown' equipment. However, as the IISS report makes clear, China whilst offensively strong is defensively weak but is working to remedy that. It's now a race between the PRC and the US and China is determined to become a Tier One cyber-power in due course.

France, as usual, tends to do its own thing, is strong in cyber security and devotes considerable money to enhancing its cyber capabilities every year. It is known to have advanced offensive cyber capabilities but determination to defend its national autonomy means it lags behind some other countries. The upside of that is considerable national independence and reduced reliance on cyber solutions from elsewhere.

Israel has been at the forefront of both defensive and offensive cyber capabilities for many years having long ago realised that weakness in the field could impact mightily on its national security perhaps to the point of being an existential threat. It has a well-established national cyber security policy that includes co-operation between the armed forces, government, private business, academia and international allies. Defensively strong, Israel also has a great capacity to undertake highly effective offensive cyber operations and is known to deploy its offensive abilities as and when it sees fit.

Meanwhile, it is an established fact that Russia almost routinely carries out cyber warfare as it confronts the West but because of international sanctions has a weak economy and struggles for money to beef up its technology industry and enhance its cyber capabilities. Cyber governance is the personal remit of President Putin. Russia  is trying to create its own national Internet that would do away with any need to rely on the world wide web. Despite some well-publicised successful attacks on western targets Russia remains a long way behind the US, China and the UK in cyber-capability - and probably several other countries too.

The United Kingdom is a strong and capable cyber state, with clear strategic oversight and cyber-security capabilities. The National Cyber Security Centre and Government Communications Headquarters provide a world-class ecosystem bolstered by heavy investment in R&D. The UK is also part of an interlocking series of international alliances including the US, Canada and Australia and New Zealand .The country has developed, and used, offensive cyber capabilities for at least a quarter of a century and it continues to do so.

In Tier Three sit two nations regarded as international pariahs dedicated to promulgating offensive cyber incursions not only against the West but any other countries that might incur Iranian or North Korean governmental displeasure. Both countries keep having a pop at perceived enemies but are only partially successful because sanctions and tottering economies mean there is no hard currency and sourcing modern cyber-security tools are internationally illegal sanctions-busting operations fraught with difficulty and danger. Both Iran and North Korea are judged to be opportunistic attackers on weak targets but also defensively weak. themselves.

India is a huge country of enormous economic potential with a vibrant technology start-up sector but is seemingly without coherent cyber policies or strategies while the government tackles cyber issues with all the speed of a geriatric tortoise. Offensive cyber action is regional and India's main target is Pakistan.

Indonesia has signed some  alliances and is building cyber capacity as is Malaysia, which is also forming alliances and increasing capabilities and is expected to become a Tier Two cyber-power in the future. Vietnam is ambitious and is known to have demonstrated effective offensive cyber capabilities in the past but is isolated having few allies.

Finally, it might seem surprising that Japan is consigned to Tier Three but the government has been slow to take on the problems associated with cyberspace and as a result the nation is perceived as being weak in both defensive and offensive cyber capabilities.