Cybersecurity and Digital Warfare: Is Cybersecurity the New Arms Race?

Cybersecurity has become one of the defining arms races of the twenty-first century. Nations are investing in offensive cyber units, defensive technologies, artificial intelligence, surveillance systems, encryption, quantum research, satellite security, information warfare, and the protection of critical infrastructure. At the same time, criminal organizations, private contractors, technology companies, proxy groups, and individual hackers are acquiring capabilities once associated mainly with intelligence agencies.

However, describing cybersecurity as the “new arms race” requires qualification. Cyber competition resembles a traditional arms race because rivals continually develop capabilities to penetrate, disrupt, deter, and defend against one another. Yet cyber capabilities do not behave like tanks, missiles, or nuclear warheads. They are often invisible, difficult to count, rapidly replaceable, and sometimes rendered useless as soon as the target fixes the vulnerability being exploited.

Cybersecurity is therefore not merely a new version of an old military competition. It is a different strategic environment in which nations compete continuously—during peace, crisis, and war.

Why cyber competition resembles an arms race

An arms race begins when rival powers believe they must increase their capabilities because their security depends on keeping pace with competitors. One country develops a new weapon or defence; its rivals respond; the first country then invests further. The cycle becomes self-reinforcing.

This dynamic is increasingly visible in cyberspace.

Governments are creating military cyber commands, recruiting specialized personnel, developing offensive tools, protecting military networks, securing intelligence systems, and conducting large multinational exercises. NATO formally recognizes cyberspace as an operational domain and treats cyber defence as part of collective deterrence and defence. The alliance states that a significant cyberattack could, depending on the circumstances, lead to consideration of collective-defence mechanisms. 

The United States Department of Defense similarly describes cyberspace as an environment through which military power must be exercised. Its public Cyber Strategy emphasizes operating in and through cyberspace, defending military networks, strengthening the defence industrial base, disrupting malicious activity, and building the capabilities of allies and partners. 

These policies reveal a recognizable arms-race logic. States are not developing cyber capabilities only because attacks are occurring today. They are preparing for the capabilities adversaries may possess tomorrow.

Offensive and defensive capabilities develop together

Every major cybersecurity investment has an offensive and defensive dimension.

Encryption protects military, government, financial, and commercial communications. At the same time, intelligence agencies seek methods to defeat or bypass encryption.

Artificial intelligence can identify abnormal network behaviour and accelerate incident response. It can also automate reconnaissance, identify vulnerable systems, produce persuasive deceptive content, assist social engineering, and increase the scale of malicious operations.

Quantum computing could eventually threaten widely used forms of public-key cryptography. Consequently, governments and companies are beginning transitions toward post-quantum cryptographic standards before sufficiently capable quantum machines become operational.

Satellite systems enable communications, navigation, weather monitoring, financial timing, intelligence collection, and military coordination. Their growing importance creates incentives to develop both satellite-protection measures and capabilities for disrupting space-based services. NATO treats cyber, space, data, and other emerging technologies as components of a broader multi-domain security environment. 

This produces a permanent cycle:

1. Attackers discover a vulnerability.

2. Defenders create a patch or detection method.

3. Attackers modify their tools or find another route.

4. Defenders adopt new architectures and controls.

5. Attackers target suppliers, employees, contractors, or trusted software instead.

Unlike conventional weapons development, this competition does not pause while governments formally debate whether they are at war. It occurs every day.

Cyber weapons are difficult to count

Traditional arms-control negotiations depend partly on measurement. Inspectors can count missiles, launchers, aircraft, ships, or warheads. Cyber arsenals are much harder to quantify.

A cyber capability might consist of:

• Knowledge of an undisclosed software vulnerability

• Stolen usernames, passwords, or cryptographic keys

• Access already established inside a target network

• Malware designed for a particular industrial system

• A supply-chain compromise affecting trusted software

• A database of personal information useful for targeting officials

• A group of specialists capable of conducting sophisticated operations

• Relationships with criminal organizations or proxy hackers

These capabilities can be stored on ordinary computers, distributed between agencies, or hidden inside compromised networks. An adversary may possess access to a power grid, telecommunications provider, military contractor, or government department without using that access immediately.

As a result, governments often do not know the true size of another country’s cyber arsenal. They may know that a rival has advanced technical organizations but not which vulnerabilities, access points, tools, or contingency plans it possesses.

This uncertainty encourages further investment. Each state must assume that its opponents may have capabilities it has not yet detected.

Cyber weapons are perishable

A missile remains a missile until it is destroyed, dismantled, or becomes obsolete. A cyber weapon may lose its value as soon as the target patches a vulnerability, changes its network configuration, replaces equipment, or detects the attacker’s presence.

This creates an unusual dilemma for cyber powers.

If a government discovers a serious vulnerability, it may disclose the weakness so that domestic companies and institutions can repair it. That improves collective security. Alternatively, the government may secretly retain the vulnerability for intelligence collection or future military use.

Keeping the vulnerability secret may provide an offensive advantage, but it also leaves friendly systems exposed if they use the same technology. A tool developed against a foreign target can potentially be stolen, copied, modified, or redirected.

Cyber arsenals therefore produce risks for their owners as well as their intended targets.

The private sector possesses strategic power

Another major difference from traditional arms races is the role of private companies.

Governments generally control nuclear weapons, military aircraft, and ballistic missiles. But much of cyberspace is designed, operated, and defended by private entities. Telecommunications networks, cloud platforms, software products, submarine cables, satellite services, data centres, financial networks, and industrial technology may belong to corporations rather than states.

Consequently, a technology company may detect a foreign cyber campaign before the government does. A cloud provider may possess intelligence from millions of systems. A cybersecurity company may identify malicious software used across several countries. A software developer may determine whether a vulnerability is patched quickly or remains exploitable.

This means national cyber power cannot be measured solely by military expenditure. It also depends on:

• The strength of the domestic technology sector

• The security of software supply chains

• Access to advanced semiconductors

• Cloud-computing capacity

• Technical education and research

• Relationships between government and industry

• The ability to attract and retain skilled personnel

• Public confidence in national institutions

The cybersecurity arms race is therefore simultaneously military, commercial, scientific, and educational.

Smaller actors can compete asymmetrically

Cyber capabilities can give smaller states and non-state actors influence beyond their conventional military strength.

Building an aircraft carrier, strategic bomber fleet, or missile-defence system requires enormous industrial and financial resources. Conducting cyber espionage or disruptive attacks may require far fewer people and much less visible infrastructure.

This does not mean advanced cyber operations are easy. Penetrating hardened military networks or manipulating specialized industrial equipment can require years of research, intelligence, testing, and operational preparation. Major states still enjoy substantial advantages.

Nevertheless, cyber operations lower some barriers to strategic competition. Criminal groups can attack hospitals and companies. Proxy organizations can target government services. Hacktivists can disrupt public websites. Commercial intrusion tools may allow governments with limited domestic capability to acquire sophisticated surveillance or exploitation services.

ENISA’s 2025 threat assessment analyzed 4,875 incidents recorded between July 2024 and June 2025 and described a threat ecosystem involving state-linked actors, cybercriminals, hacktivists, and other groups using overlapping methods against European digital infrastructure. 

The cyber arms race therefore has more participants than a conventional great-power military competition.

Attribution makes deterrence difficult

Traditional deterrence depends on an adversary believing that aggression will be detected and punished. Cyber operations complicate both requirements.

Attackers may route operations through compromised infrastructure in several countries, use publicly available hacking tools, imitate another group’s methods, employ contractors, or work through criminal proxies. Governments can often attribute major operations by combining technical evidence with intelligence, diplomatic information, and knowledge of the attacker’s objectives. But attribution may require time and may not always produce evidence that can be publicly disclosed.

This creates opportunities for deniable aggression.

A government may steal information, prepare access to infrastructure, interfere with public institutions, or support disruptive proxy activity while denying involvement. The target must then decide whether to respond through sanctions, criminal indictments, diplomatic measures, cyber operations, economic pressure, or military force.

A mistaken attribution could punish the wrong actor and intensify an international crisis. A failure to respond could encourage further operations.

Cybersecurity is also an economic race

Cybersecurity competition is not limited to destroying or disabling networks. It includes gaining technological and economic advantage.

Cyber espionage can target:

• Defence designs

• Pharmaceutical research

• Semiconductor technology

• Artificial-intelligence models

• Energy systems

• Negotiating strategies

• Government policy documents

• Corporate intellectual property

• Personal information about decision-makers

A country that repeatedly steals strategically valuable research may accelerate its technological development while imposing costs on competitors. Conversely, a nation unable to protect its universities, companies, and supply chains may lose economic strength without suffering a conventional military attack.

Technology standards are another field of competition. Countries and companies seek influence over telecommunications architecture, digital identity, artificial intelligence, cloud services, encryption, payment systems, and industrial connectivity. The entities that shape these systems may gain economic advantages and strategic visibility into how global digital infrastructure operates.

Cybersecurity has therefore become connected to industrial policy, trade restrictions, export controls, investment screening, and competition over critical technologies.

Why the arms-race analogy is incomplete

Despite these similarities, cybersecurity should not be viewed exactly like nuclear competition.

Nuclear weapons are primarily instruments of catastrophic destruction and deterrence. Cyber capabilities are used much more routinely for espionage, crime, political interference, military preparation, and limited disruption.

Cyber operations can also vary enormously in severity. Stealing diplomatic emails, temporarily overwhelming a website, encrypting a hospital network, manipulating an electrical grid, and disrupting military command systems are all “cyber” activities, but their consequences are profoundly different.

Moreover, cyber defence can sometimes improve collectively. When a vulnerability is disclosed and patched worldwide, many countries become safer simultaneously. Sharing indicators of compromise, malware samples, and defensive guidance can reduce risk across borders.

Traditional arms races usually assume that one side’s military gain reduces the security of another. Cybersecurity can follow that pattern, but defensive cooperation can also produce shared benefits.

The absence of effective cyber arms control

International institutions have attempted to establish expectations for responsible state conduct in cyberspace. The United Nations Open-Ended Working Group has addressed threats, international law, voluntary norms, confidence-building measures, capacity-building, and institutional dialogue concerning state behaviour in information and communications technologies. 

These efforts are important, but cyber arms control remains difficult.

States may agree in principle that civilian infrastructure should be protected, yet disagree over definitions, attribution standards, acceptable intelligence activity, and how international law applies to particular operations.

Verification is another obstacle. Even where governments make commitments, outside inspectors cannot easily determine whether a state has retained undisclosed vulnerabilities, planted access inside foreign networks, or created offensive malware.

The world therefore faces an arms race without a mature inspection system, universally accepted enforcement mechanism, or reliable method for counting capabilities.

What victory means in the cyber arms race

No country can permanently “win” cybersecurity. Technologies change, new vulnerabilities emerge, personnel make mistakes, and adversaries adapt.

The most successful nations will not be those claiming complete immunity from attack. They will be those that can:

• Detect intrusions rapidly

• Prevent one compromise from spreading nationally

• Keep essential services operating

• Recover systems from trusted backups

• Protect sensitive research and communications

• Coordinate government, military, and private-sector responses

• Attribute attacks with reasonable confidence

• Communicate credibly with the public

• Impose proportionate consequences on persistent attackers

• Develop enough skilled personnel to sustain national capability

Resilience is therefore as important as offensive power.

Cybersecurity is the new arms race, but it is broader, less visible, and more continuous than previous military competitions.

It is an arms race over software vulnerabilities, data, artificial intelligence, encryption, semiconductors, satellites, communications networks, industrial systems, technical talent, and control of digital infrastructure. It includes governments, military organizations, intelligence services, corporations, criminals, contractors, and proxy groups.

Unlike a nuclear arms race, cyber competition does not revolve around weapons that are merely stockpiled for a possible future conflict. Cyber capabilities are already used every day for espionage, disruption, coercion, theft, and strategic preparation.

The central danger is not simply that countries will accumulate increasingly powerful digital weapons. It is that competition will proceed faster than international rules, crisis-management systems, and public understanding can develop.

The central strategic lesson is equally clear: national security can no longer be separated from cybersecurity. A country that cannot protect its data, infrastructure, communications, technology supply chains, and public information environment cannot fully protect its sovereignty.

Cybersecurity is not replacing conventional military power. It is becoming one of the foundations upon which military, economic, political, and social power now depend.

Where should the line be drawn between individual religious rights and public interests?

 

Where should the line be drawn between individual religious rights and public interests?

Where Should the Line Be Drawn?

The line should be drawn where the exercise of a religious practice causes a specific, substantial and demonstrable threat to other people’s rights, safety or equal citizenship.

Religious belief itself should receive exceptionally strong protection. Religious conduct may be regulated, but only when the government can justify the restriction through clear law, reliable evidence and proportionate measures.

A practical rule is:

Protect conscience broadly; restrict conduct only to prevent concrete harm.

1. Belief should be virtually absolute

The state should not punish people for:

• Believing or disbelieving in a religion.

• Changing or leaving a religion.

• Holding conservative, unconventional or unpopular doctrines.

• Privately questioning religious teachings.

• Identifying as atheist, agnostic or nonreligious.

• Peacefully expressing theological opinions.

Governments should not decide whether a belief is true, rational, orthodox or socially desirable. Once the state begins evaluating theology, religious freedom becomes dependent on political approval.

The freedom to believe must also include freedom from coercion. Families, religious institutions and governments should not force people to convert, remain in a religion or participate in worship.

2. Public religious practice can be regulated

Religion is not confined to private thought. It may involve worship, clothing, dietary rules, education, employment, preaching, ceremonies and public institutions.

These manifestations deserve strong protection, but they are not unlimited. Regulation may be justified when necessary to protect:

• Life and physical safety.

• Public health.

• Children and vulnerable people.

• National security.

• Public order.

• Equal access to essential services.

• The fundamental rights of others.

The key question is not whether a practice is religiously motivated. It is whether the practice produces a legally relevant harm.

3. Public interest must mean more than public discomfort

Governments often invoke “public order,” “national culture” or “social cohesion” too broadly. These terms should not become excuses for suppressing minority religions.

A restriction should not be imposed merely because:

• A religious practice is unfamiliar.

• The majority finds it offensive.

• A minority community appears culturally different.

• Religious clothing is highly visible.

• A belief conflicts with prevailing social opinion.

• Political leaders claim that uniformity would make governing easier.

The public interest must be concrete and evidence-based. Majoritarian discomfort is not the same as public harm.

4. Restrictions should pass a rigorous test

Before limiting religious conduct, a government should answer five questions.

Is the restriction lawful?

The rule must be publicly accessible, clear and predictable. Officials should not have unlimited discretion to decide which religious practices are acceptable.

Does it pursue a legitimate objective?

The objective might be protecting health, safety, public order or another person’s rights. Preserving the cultural dominance of the majority religion is not a legitimate objective in a pluralistic democracy.

Is there evidence of a real problem?

Authorities should identify an actual or reasonably foreseeable harm. Speculation, stereotypes and generalized security fears are insufficient.

Is the restriction necessary?

The government should consider whether education, accommodation, mediation, safety procedures or targeted enforcement could solve the problem without restricting the right.

Is it proportionate?

The burden imposed should not exceed what is required to address the harm. A narrowly tailored restriction is preferable to a comprehensive ban.

5. The state should regulate harm, not identity

Laws should focus on prohibited conduct and apply consistently regardless of the offender’s religion.

For example:

• Violence should be prosecuted whether motivated by religion, nationalism or personal hostility.

• Fraud should remain unlawful even when committed by a religious institution.

• Child abuse should not be excused as religious discipline.

• Forced marriage should be prohibited regardless of cultural justification.

• Incitement to violence should be addressed according to the same legal standard across communities.

A government should not respond to the misconduct of some individuals by restricting an entire religious population.

6. Reasonable accommodation should come before prohibition

Many conflicts between religious practice and public policy can be resolved without choosing one side completely.

Reasonable accommodations may include:

• Allowing flexible scheduling for religious observances.

• Providing alternative meals in schools, prisons or hospitals.

• Permitting religious clothing when it does not create a genuine safety problem.

• Adjusting an employee’s duties where this does not burden colleagues or deny services.

• Allowing alternative forms of oath or affirmation.

• Providing private spaces that may be used for prayer or reflection.

Accommodation should be refused when it would create excessive hardship, compromise essential safety standards or seriously impair another person’s rights.

The goal is not to guarantee that religious practice will never involve inconvenience. It is to avoid unnecessary exclusion.

7. Essential public services require special care

The balance becomes more difficult when religious convictions affect healthcare, education, emergency services or public administration.

A private individual may have broad freedom to live according to religious principles. A public official or essential-service provider has additional obligations because other people depend on the service.

For example, a professional may request accommodation for a religious objection. But accommodation should not result in:

• A patient being denied urgent medical treatment.

• A citizen being refused a government service.

• A student being excluded from legally required education.

• A customer being denied essential goods or services.

• Colleagues repeatedly carrying an unreasonable burden.

• Discrimination against a protected group.

Where possible, institutions can reorganize responsibilities. Where accommodation would make the service unavailable or unequal, the public duty should generally prevail.

8. Children’s rights require independent protection

Parents have an important right to raise children according to religious convictions. However, children are also individual rights-holders.

Parental religious authority should not justify:

• Physical or sexual abuse.

• Forced marriage.

• Severe neglect.

• Dangerous labor.

• Permanent denial of basic education.

• Coercive practices that threaten life or health.

• Punishment for reporting abuse.

Medical disputes require particular sensitivity. Minor adjustments or nonessential choices may be accommodated. When a child faces a serious and preventable risk of death or major injury, the state may have a duty to intervene.

The threshold should be significant harm, not mere disagreement with a family’s beliefs.

9. Public-health restrictions must be neutral and consistent

Governments may temporarily restrict religious gatherings during serious public-health emergencies, but religious institutions should not be treated less favorably than comparable secular activities.

A legitimate public-health rule should be:

• Based on medical evidence.

• Limited in duration.

• Reviewed regularly.

• Applied consistently.

• No broader than necessary.

• Open to judicial challenge.

If crowded concerts, political meetings or commercial venues are permitted under certain precautions, religious gatherings should normally receive comparable treatment.

10. Security concerns need individualized evidence

Religious freedom does not protect terrorism, violent conspiracy, recruitment for armed groups or financing of criminal operations.

However, security policy should distinguish between:

• Peaceful religious conservatism and violent extremism.

• Theological disagreement and criminal incitement.

• Foreign religious relationships and unlawful foreign control.

• Community activism and preparation for violence.

Surveillance, closure of institutions and restrictions on movement should be based on credible evidence and due process—not clothing, ethnicity, religious vocabulary or membership in a broad faith community.

Collective suspicion is both unjust and strategically ineffective.

11. Expression should be restricted only at a high threshold

Religious expression may offend, criticize or challenge others. Nonreligious expression may similarly criticize religions.

A free society should protect:

• Religious preaching.

• Peaceful efforts to persuade others.

• Criticism of religious beliefs.

• Criticism of atheism or secularism.

• Satire and theological debate.

• Peaceful protest.

Intervention becomes more defensible when expression intentionally and credibly encourages discrimination, violence or other unlawful action against identifiable people.

The distinction should remain between attacking an idea and threatening people.

12. Equality places limits on religious autonomy

Religious organizations require meaningful autonomy over doctrine, worship and internal leadership. The government should not ordinarily appoint clergy, rewrite theology or determine religious orthodoxy.

Nevertheless, institutional autonomy cannot become total immunity from law. Religious institutions may still be subject to rules concerning:

• Financial accountability.

• Protection from abuse.

• Building and fire safety.

• Employment conditions.

• Criminal conduct.

• Child safeguarding.

• Data protection.

• Contractual obligations.

Some positions directly responsible for religious teaching may reasonably require adherence to the faith. Different considerations apply when a religious organization operates publicly funded schools, hospitals or commercial services serving the general population.

The more an institution performs a public function, the stronger its obligations to the public generally become.

A workable boundary

The proper line can be summarized through three zones:

Protected zone

Belief, worship, identity, peaceful expression, religious association and ordinary religious practice should generally be protected.

Accommodation zone

Where religious practice conflicts with administrative rules or workplace requirements, authorities should seek a practical accommodation that protects both religious exercise and institutional functioning.

Restriction zone

Restriction is justified when there is strong evidence of serious harm involving violence, coercion, exploitation, abuse, denial of fundamental rights or a substantial threat to safety and public order.

The central principle

Public interest should prevail only when it represents the protection of real rights and tangible harms, not a desire for cultural conformity.

The state should neither automatically defer to every religious claim nor automatically prioritize government convenience. It should use the least restrictive means available, treat comparable cases consistently and preserve equal citizenship.

The line is crossed when religious liberty becomes a power to harm, coerce or deprive others of their rights. It is also crossed in the opposite direction when government invokes public interest to suppress peaceful beliefs simply because they are unpopular.