On August 26, President Donald Trump declared a national emergency over foreign actors exploiting vulnerabilities in the U.S. bulk-power system. The order framed the problem as one of national security, public safety, and economic resilience. A month later, CISA issued new guidance on cyber decoys to help critical-infrastructure defenders catch intruders using legitimate credentials and native tools. Those moves improve prevention and detection. They do not answer the harder deterrence question: what happens after defenders discover that a sophisticated adversary is already inside? 

If removing hostile access would also halt power, logistics, communications, or another essential service, the intrusion can create leverage before a destructive command is ever issued. The strategic problem is therefore larger than penetration. It is whether the defender can withdraw trust without inflicting the disruption the adversary hoped to create. 

 A Foothold Can Coerce Without Firing 

The U.S. has already documented the pre-positioning problem. A joint federal fact sheet on Volt Typhoon says the People’s Republic of China-linked group compromised organizations in communications, energy, transportation, and water systems to position itself for potential disruption during a future crisis. Pre-positioning matters because an unused foothold can still shape decisions if leaders believe evicting it will damage their own mission.  

This is a form of coercive dependence. A defender can become so reliant on a remote connection, cloud service, supplier, identity system, or shared data source that severing the compromised path appears nearly as costly as leaving it in place. An adversary then gains value from access even without activating a destructive effect.  

Selective Disconnection Is Deterrence by Denial  

Joint CI Fortify guidance released in July addresses the operational side of this problem. It urges critical-infrastructure operators to prepare to isolate vital operational technology and enabling systems while maintaining essential operations. Britain’s operational-technology guidance likewise distinguishes full site isolation from service-specific isolation and hardware-enforced trusted communications.  

The strategic value is in the word selective. A suspected component may still be allowed to observe while losing permission to issue commands, change configurations, move resources, or communicate outside a defined boundary. The goal is to remove the adversary’s options faster than the defender removes its own mission.  

This is deterrence by denial at the level of system architecture. An attacker that expects access to produce a reliable ability to stop the mission gains less from the intrusion if the defender can rapidly reduce that access to a narrow, monitored state while essential functions continue.  

The Disconnect Control Can Be Attacked Too  

Isolation is not automatically safe. False alarms, manipulated telemetry, or ambiguous indicators can push defenders toward unnecessary shutdowns and hand an adversary disruption without a successful destructive action. Exercises should therefore evaluate both genuine compromise and misleading evidence, including who can impose restrictions, which facts justify the decision, and how an incorrect restriction is reversed.  

The same discipline applies to the control plane itself. The authority to isolate a site, revoke a supplier, or cut a management path should not depend on the same compromised credential or platform it is meant to constrain. Separation of duties and independent control paths turn disconnection from a policy promise into an operational capability.  

Recovery Must Be Earned  

Disconnection is only half of the problem. A defender that can isolate a compromised dependency but cannot establish when reconnection is justified may trade adversary leverage for self-imposed paralysis. NIST’s cyber-resiliency engineering guidance defines resilience around the ability to anticipate, withstand, recover from, and adapt to attacks or compromise while reducing mission risk from dependence on cyber resources.  

Recovery should therefore be configuration-specific and evidence-based. Restoring connectivity does not prove that credentials, software, data, and control paths are trustworthy again. Decisionmakers should know which configuration is returning, what evidence supports renewed trust, what limitations remain, and who accepts the residual risk.  

Measure the Denial Capability  

Three measures can turn these concepts into a deterrence capability that leaders can evaluate. The first is containment time: how quickly can the defender restrict the suspected dependency? The second is mission effect preserved during isolation: what essential service remains available? The third is trusted recovery time: how long before access and authority can be restored on a defensible evidentiary basis?  

These measures matter across alliances as well as inside a single operator. President Trump’s June national cybersecurity memorandum calls for key military and intelligence missions to remain viable in contested cyber environments and for greater coordination across agencies, industry, and international partners. Shared cloud services, communications, logistics systems, and identity providers make one partner’s isolation decision capable of affecting another partner’s readiness.  

No serious cyber strategy can promise that capable adversaries will never penetrate important systems. The stronger deterrence signal is that penetration does not guarantee strategic leverage. A defender that can detect a foothold, sever the dangerous dependency without surrendering its essential mission, and restore trust for evidence makes access less valuable in the first place.  

A decoy can reveal that an adversary is inside. Deterrence begins when the defender can take that access away without taking itself offline. 

Burak Oktenli is an independent researcher based in Washington, DC, conducting research on deterrence, cyber resilience, assurance, and machine authority in autonomous systems. His analysis has appeared in Global Security Review, RealClearDefense, the Modern War Institute at West Point, RUSI, and Articles of War. Views expressed in this article are the author’s own.

Cyber Deterrence Begins with the Power to Disconnect was originally published on Global Security Review.

The digital Silk Road (DSR), China’s initiative to invest in critical telecommunications and emerging technology in foreign countries, is a vehicle to lower the barriers to cyber coercion and propagate the digital curtain. By embedding its “model of technology-enabled authoritarianism” in recipient nations, Beijing seeks to shape the digital ecosystems of other countries in ways that serve its strategic interests. Such attempts call for a proactive and coordinated response from the United States and its regional partners—one that builds a resilient, tech-driven organization capable of countering China’s digital expansion across the the Indo-Pacific.

The United States and China are engaged in a great power competition, one which has seeped into multiple theaters and domains. The Indo-Pacific region is generally understood to be the frontline of this contest.

However, China’s burgeoning technological capacity has led to cyberspace being a critical juncture in this competition; one where traditional borders fade, thereby allowing the proliferation of gray zone tactics. Such tactics are deployed in various ways—infiltrating critical infrastructure, cyber espionage, and disinformation campaigns—on key democracies in the region.

Considering the geopolitical significance of the Indo-Pacific, China’s attempts to use cyber coercion to cleave the region from the United States’ sphere of influence highlights a calculated strategy by the Chinese Communist Party (CCP). The region is home to over 50 percent of the world’s population, and 80 percent of global trade volume transits through its channels. It houses “seven of the world’s largest militaries, and five American treaty allies.”

Moreover, digital connectivity and internet adoption rates are the fastest growing compared to any region in the word, making it rife with opportunities and threats. These vulnerabilities not only indicate further volatility for regional governments but could also undermine American national security.

The list of cyber incidents already attributed to Chinese state-sponsored entities is extensive, and its targets are equally expansive. Advanced persistent threat (APT)—long-term, sophisticated, and entrenched cyber intrusions designed to hack, steal, and/or neutralize systems—have been a weapon of choice for those entities. For instance, APT-30 and APT-40, which targeted Association of South East Asian Nations (ASEAN) members and New Zealand’s government, respectively, are reportedly linked to the Chinese government.

Furthermore, American intelligence and cybersecurity agencies recently confirmed that Volt Typhoon, a Chinese state-sponsored entity, compromised American critical infrastructure ranging from telecommunications to water systems; its reach even included US territories such as Guam.

While the specter of ATPs and digital intrusions have entered the purview of several governments in the Indo-Pacific region, individual efforts to deter those threats are futile. This is often due to strategic inertia, a shortage of specialized workers, and asymmetric capabilities.

A consolidated effort by the United States and its regional partners is needed to build consensus, direct resources, and establish a digital enforcement body. This could address those issues while mitigating any potential upheaval from China’s tactics. Fortunately, the groundwork for such a partnership is already in place.

On July 1, 2025, the 10th Quad foreign ministers’ meeting was hosted by US Secretary of State Marco Rubio, where he was joined by his counterparts from Japan, India, and Australia. It was the second such meeting since January, signifying the importance placed on the vision of the group by the Trump administration.

The measures agreed upon as a result are further evidence to that fact—initiatives to bolster maritime and transnational security, economic security, critical and emerging technology, among others. Therefore, the vast security mandates of those initiatives provide a viable path to constructing a techno-centric partnership while addressing the region’s strategic, skills, and capabilities gaps when it comes to deterring China’s digital incursions.

The decision to expand the Indo-Pacific Partnership for Maritime Domain Awareness (IPMDA)—a technology-focused initiative to augment the maritime security landscape—provides a practical foundation for a techno-centric partnership. Its stated goal of developing a “common operating picture” for the IPMDA could lead to the basis for a strategic consensus among potential members.

Furthermore, incorporating insights from the first Maritime Initiative for Training in the Indo-Pacific (MAITRI) workshop could assist in closing the skills gap for a regional digital workforce, further adding to the partnership’s feasibility.

Additional features which could be utilized for the partnership and address the capabilities gap include the Quad Cyber Challenge and the Quad Partnership on Cable Connectivity and Resilience. The Cyber Challenge seeks to enhance the cyber ecosystem, digital awareness, and resourcing among member nations.

The Partnership on Cable Connectivity and Resilience, on the other hand, bears a more tactical responsibility of strengthening telecommunications infrastructure, specifically, undersea cables—arguably the most critical component of the digital ecosystem. Although these initiatives are focused on Quad member-nations, they could be expanded in a larger forum to engage ASEAN and Pacific subregional organizations such as the Pacific Island Forum, providing more opportunities for resource allocation.

There is institutional and strategic momentum behind the formation of a tech-centric partnership, not to mention the critical security imperative that exists. The broad consensus, coupled with the runway to take near-term action, makes this a prospective enterprise. Such concrete action is necessitated if the US and its regional allies expect to maintain a free and open Indo-Pacific and establish an active deterrent to China, which seeks to write the rules and draw the margins of the evolving digital age.

Abrar Rahman Namir is currently interning at Associated Universities and assisting in the Batteries and Energies to Advance Commercialization and National Security program as a supply chains and trade analyst.

Tech-centric Partnership in the Indo-Pacific to Deter Digital Curtain was originally published on Global Security Review.