Cyberattacks have yet to play a significant role in Russia’s battlefield operations in Ukraine – cyberwarfare experts explain the likely reasons
- Written by Nadiya Kostyuk, Assistant Professor of Public Policy, Georgia Institute of Technology
Throughout the latter half of 2021, as it became clear that Russia was massing a large portion of its conventional combat power on the eastern borders of Ukraine, analysts offered contrasting predictions about the role cyberspace would play in an armed conflict. These predictions capture an ongoing debate about whether conflict in cyberspace is destined to supplant conventional conflict[1] or exacerbate it.
As the war has evolved, it’s clear that analysts on both sides of the debate got it wrong. Cyber operations did not replace the military invasion, and as far as we can tell, the Russian government has not yet used cyber operations[2] as an integral part of its military campaign[3].
We are political scientists who study the role of cybersecurity[4] and information[5] in international conflict. Our research[6] shows that the reason pundits on both sides of the argument got it wrong is because they failed to consider that cyber and military operations serve different political objectives.
Cyber operations are most effective in pursuing informational goals, such as gathering intelligence, stealing technology or winning public opinion or diplomatic debates. In contrast, nations use military operations to occupy territory, capture resources, diminish an opponent’s military capability and terrorize a population.
A tactical role for cyberattacks?
It’s common in modern warfare for new technologies to substitute for traditional military tactics. For example, the U.S. has made extensive use of drones, including in conflicts in Yemen and Pakistan where crewed aircraft and ground forces would be difficult or impossible to use. Because drones allow the U.S. to fight on the cheap with much less risk, they substitute for other forms of warfare.
In theory, cyber operations could have played a similar tactical role in Russia’s invasion of Ukraine. But the Russian government has yet to use cyber operations[7] in a manner that is clearly coordinated with military units and designed to smooth the advance of ground or air forces. When Russia invaded Ukraine, hackers disrupted access to satellite communications[8] for thousands of people, and it was apparently a concern for Ukrainian defense officials[9]. But overall, Ukraine has managed to maintain internet access[10] and cellphone service[11] for most of the country.
Russia has sophisticated[12] cyber capabilities, and its hackers have worked their way into Ukrainian networks[13] for many years. This raises the question of why Russia has not, for the most part, used cyber operations to provide tactical support[14] for its military campaigns in Ukraine, at least until this point.
Separate roles
In recent studies, we examined whether cyber operations mostly serve as complements to, or substitutes for, conventional conflict. In one analysis[16], we examined conventional military campaigns around the world[17] over a 10-year period using the Militarized Interstate Disputes[18] dataset of all armed conflicts. We also focused on the conflicts in Syria and eastern Ukraine[19]. Our results suggest that cyber operations are generally not being used as either.
Instead, nations tend to use these two types of operations independently from each other because each mode of conflict serves different objectives, and cyberwarfare is most effective for gathering intelligence, stealing technology or winning public opinion or diplomatic debates.
In contrast, nations use traditional forms of conflict to control tangible assets, such as capturing resources or occupying territory. The various goals offered by Russian President Vladimir Putin for invading Ukraine, such as preventing Ukraine from joining NATO[20], replacing the government[21] or countering fictitious Ukrainian weapons of mass destruction[22], require occupying territory.
There may be other reasons for the lack of overlap between cyber and conventional fronts in Ukraine. The Russian military could consider cyber operations ineffective for its purposes. The newness of cyber operations as a tool of war makes it difficult to coordinate[23] with conventional military operations. Also, military targets might not be accessible to hackers because they might lack internet connectivity.
In any event, evidence[24] that the Russian government intends to use cyber operations to complement[25] military operations is thin[26]. Our findings suggest hacking groups in previous conflicts faced considerable difficulties in responding to battlefield events, much less shaping them.
How Russia is using cyber operations
The main target of Russia’s digital campaign in Ukraine is ordinary Ukrainians. To date, Russian cyber operations have sought to sow panic and fear, destabilizing the country from within[27], by demonstrating the country’s inability to defend its infrastructure[28], for example, by defacing or disabling websites.
On Jan. 14, 2022, hackers that the Ukrainian government identified as Russian attacked Ukrainian government websites.
Photo illustration by Pavlo Gonchar/SOPA Images/LightRocket via Getty Images[29]
In addition, Russia has been using information campaigns to attempt to win the “hearts and minds” of Ukrainians. Prior to the start of the conflict, White House press secretary Jen Psaki warned of a 2,000% increase from the daily average in November[30] in Russian-language social media content[31]. This suggests that the purpose of these information operations was to make the case for Russia’s intervention on humanitarian grounds[32] and to build support for intervention among the Ukrainian public. The Russian government’s domestic actions[33] emphasize the value its leadership places on information operations.
A supporting role
Hackers’ actions tend to occur out of the public eye, rather than in the flamboyantly violent manner favored by Hollywood cyber villains, which means it’s difficult to know for sure what’s happening. Nevertheless, the lack of overlap between cyber and conventional military operations makes sense operationally and strategically. This is not to say that the informational focus of cyber operations has no effect on military operations. Good intelligence is essential for success[34] in any military conflict.
We believe Russia is likely to continue conducting information campaigns to influence Ukrainians, its domestic public and international audiences. Russia is also likely to seek to further penetrate Ukrainian networks to access information that potentially assists its military operations. But because cyber operations have not been thoroughly integrated into its military campaigns so far, cyber operations are likely to continue playing a secondary role in the conflict.
[Understand new developments in science, health and technology, each week. Subscribe to The Conversation’s science newsletter[35].]
References
- ^ supplant conventional conflict (www.chathamhouse.org)
- ^ not yet used cyber operations (www.nytimes.com)
- ^ part of its military campaign (www.vox.com)
- ^ cybersecurity (scholar.google.com)
- ^ information (scholar.google.com)
- ^ Our research (www.dropbox.com)
- ^ yet to use cyber operations (www.nytimes.com)
- ^ disrupted access to satellite communications (www.wired.com)
- ^ concern for Ukrainian defense officials (twitter.com)
- ^ maintain internet access (www.washingtonpost.com)
- ^ cellphone service (www.wsj.com)
- ^ sophisticated (www.c4isrnet.com)
- ^ worked their way into Ukrainian networks (www.wired.com)
- ^ used cyber operations to provide tactical support (thehill.com)
- ^ Photo by Aris Messins/AFP via Getty Images (www.gettyimages.com)
- ^ one analysis (www.dropbox.com)
- ^ military campaigns around the world (www.isanet.org)
- ^ Militarized Interstate Disputes (www.correlatesofwar.org)
- ^ the conflicts in Syria and eastern Ukraine (doi.org)
- ^ preventing Ukraine from joining NATO (abcnews.go.com)
- ^ replacing the government (www.nbcnews.com)
- ^ countering fictitious Ukrainian weapons of mass destruction (thebulletin.org)
- ^ difficult to coordinate (doi.org)
- ^ evidence (www.dropbox.com)
- ^ complement (www.rand.org)
- ^ thin (doi.org)
- ^ sow panic and fear, destabilizing the country from within (www.usatoday.com)
- ^ demonstrating the country’s inability to defend its infrastructure (www.wsj.com)
- ^ Photo illustration by Pavlo Gonchar/SOPA Images/LightRocket via Getty Images (www.gettyimages.com)
- ^ 2,000% increase from the daily average in November (www.whitehouse.gov)
- ^ Russian-language social media content (www.whitehouse.gov)
- ^ humanitarian grounds (www.whitehouse.gov)
- ^ domestic actions (www.reuters.com)
- ^ essential for success (doi.org)
- ^ Subscribe to The Conversation’s science newsletter (memberservices.theconversation.com)
Authors: Nadiya Kostyuk, Assistant Professor of Public Policy, Georgia Institute of Technology
