After mounting evidence that Russia has been behind various cyber attacks against the United States aimed at influencing the US political system, it appears that Russia is now testing the limits of the current norm-based international regime that have thus far kept global cyberwar unrealized.
Cyberwar is the new Cold War—and this time it will be waged not only between two actors, but rather multiple of warring participants.
Across the world, cyber security is considered as a major global issue. Together, the difficulty of applying international law to this domain and the overall lawlessness of cyberspace has been a topic of debate from analysts and states alike. Yet, we have not seen any major cyber conflicts. The agreement about cyber security between China and the US from last year decreased the number and severity of well-documented cyber attacks by the now infamous Chinese hackers, and the conflict in Ukraine has been described as the cyber war that never was. Unfortunately, this does not mean it has been eliminated, and recent Russia-US cyber tensions show why.
Russia’s Approach to Cyberwar
Russia’s use of cyberwarfare is perhaps better described by using the term “information warfare,” which itself was coined and is used by Moscow to speak about cyber attacks. The major attack on the Ukrainian electricity network that left some 80 000 people without electricity last December was not a sophisticated act, but rather was enabled by weak Ukrainian security standards and Russian exploitation of information regarding how those standards functioned. Russian cyber activities are kept focused on information, in line with its terminology for cyber-related attacks.
Read German Terror Attacks Reveal Dangerous Feedback Loop
Russia’s approach to cyberwar goes hand in hand with the intensive Russian information propaganda across Eastern Europe. It is based on the influence and seizure of sensitive information, the manipulation of public opinion, and the undermining of government authorities. In Ukraine, Russian cyber activities do not have direct military objectives, but are strategically supportive and exploitative. This approach directly exploits the nature of the current norm-based international regime.
Ineffective Cyber Norms
The current international regime is built on the assumption that cyber attacks cannot legally trigger a physical response. This is chiefly based on the problem of attribution for cyber attacks, where it is often nearly impossible to identify a particular computer as the source of an attack, let alone the person behind that computer. However, another issue is key here—the concept of a kinetic or lethal attack.
There is no doubt that cyberwar attacks can have devastating kinetic effects, especially in the context of the automation of much of our industrial processes or the proliferation of the Internet of Things into our lives. Regardless, states have thus far respected the lethality threshold.
Listen to Stratfor's Reva Goujon: Europe Fragmentation Accelerating Post-Brexit
During the Cold War, a nuclear exchange was a constant threat that avoided a direct global conflict thanks to the model of “mutually assured destruction.” The pure destructive capacities on the both sides made a nuclear exchange a zero-win situation. At present, cyberspace currently works on a similar norm, ensuring states constrain their cyber operations to some extent.
However, it is a fragile, undefined, and tacit norm. Cyberspace is an environment where offensive capabilities are always ahead of the defensive ones. Furthermore, cybersecurity vulnerabilities are so extensive and ever-evolving that it is hard to image that countries like China, Russia, and the United States are not already capable of launching relatively simple attacks with major destabilizing impacts. It only takes two to three days of power outages for unimaginable economic, social, and military-related consequences to be inflicted. An example of this looming risk can be seen in the fact that Iran has already hacked into a small dam in New York.
Today’s Risk of Cyberwar
Such attacks could be used in the event that an outright conflict breaks out, but the major issue that needs grappling with today is the perilously thin line that exists between lethal cyberwar attacks and regular cyber operations. Even more so, non-lethal cyber attacks can still impose severe political impacts and threaten national security interests, making the international norm regime seem even more ill-equipped.
The recent hacks of the New York Times and Democratic National Committee databases by alleged Russian hackers linked to the Kremlin shows clear attempts of Russia to affect the political democratic process in the United States. In reaction, President Obama has highlighted the wide array of cyber offensive and defensive capabilities the US possesses in an attempt to deter any further attacks.
With that in mind, it appears far less likely that Russia and the United States will go on a similar cooperative path as Beijing and Washington did. Russia’s informational warfare will continue to test how far non-lethal cyber operations can go, continuing the risk for a cyber attack exchange between Moscow and Washington into the foreseeable future.
