position should not be to counter cyber with cyber. to date non-cyber tools have been more effective tools at changing our adversaries cyber behavior. when we choose to act, we should choose carefully because our actions set precedent. we need to be prepared for retaliatory action, which may not be as surgical due to their inherent capability of calibrating cyber tools. that s why using cyber to counter cyber attacks risks unintended consequences. we currently cannot put a lot of stock, at least in my mind, in cyber deterrence. unlike nuclear weapons, cyber capabilities are difficult to see and evaluate and are ephemeral. it is accordingly very hard to create the substance and psychology of deterrence, in my view. we also have to take some steps