Europe | Digital daggers drawn

Will war in Ukraine lead to a wider cyber-conflict?

Russia and the West will be cautious in wielding cyber power against one another

Two young woman walk past a Ukraine map-shaped graffiti downtown Kyiv, Ukraine, February 4, 2019 (Photo by Sergii Kharchenko/NurPhoto via Getty Images)

Russian missiles slammed into Kyiv on the morning of February 24th. But its computer networks were already long under attack. On February 23rd, as the country was still bracing for an invasion that was expected to be imminent, the websites of Ukraine’s parliament and several government agencies were put out of action. A similar digital assault on Ukrainian government websites and banks on February 15th and 16th was quickly attributed by America, Britain and other governments to the gru, Russia’s military-intelligence agency. Last month the websites of several government ministries were defaced with the message, “Be afraid and expect the worst.”

How bad could a modern cyberwar be, and will other countries be affected? “Ukraine, sadly, has been Russia’s cyber playground for years,” notes Ciaran Martin, the founding chief executive of the National Cyber Security Centre, the defensive arm of gchq, Britain’s signals-intelligence agency. In 2016 suspected Russian malware disrupted Ukraine’s electricity grid and cut power to a fifth of Kyiv in the middle of a bitter winter. Inspired partly by Stuxnet, a suspected American-Israeli “worm” that disrupted Iran’s uranium-enrichment centrifuges, the attack was aimed at the protective relays which shut down electrical systems in abnormal conditions. Two years later Ukraine said it had halted a suspected Russian attempt to disrupt a chlorine plant.

The latest attacks were not so sophisticated. They took the form of “distributed denial of service” (ddos)—a crude method of disruption in which a website is overwhelmed with spurious requests for information. Their impact was “minimal”, noted Chris Krebs, the former head of America’s Cybersecurity and Infrastructure Security Agency (cisa). Their purpose, he suggests, was to “distract and confuse”, perhaps paving the way for “more severe activity”——the sort that might accompany Russia’s invasion, as it unfolds. Indeed, computer network operations—the term often used by professionals in lieu of “cyber-attack”—have been a part of wars for well over two decades.

America and Britain, for instance, have spoken openly about their offensive cyber-operations during the campaign against the Islamic State (is) group in Iraq and Syria, when their intelligence agencies and armed forces disabled is drones, jammed phones, took down jihadist propaganda and sowed dissension in the group’s ranks. As its troops cross the border Russia is likely to attempt the same techniques against Ukraine, both to support its military offensive (for instance, by disabling Ukrainian air defences) and to destabilise the government in Kyiv (by, say, spreading disinformation).

Western officials worry about the spillover of any cyber-conflict in Ukraine, whether accidental or deliberate. In 2017 the “NotPetya” cyber-attack on Ukraine, which irreversibly encrypted data on computers, caused $10bn-worth of damage around the world (it was widely blamed on Russia). This month cisa issued a warning to American organisations, saying that Russia could escalate “in ways that may impact others outside of Ukraine”. British firms have received similar warnings.

Although Western countries have said they will not send soldiers to fight in Ukraine, they have begun to impose sanctions and and have promised further “massive” punishment. “If we’re talking about Russia being engaged in the most significant military operation since the second world war, in what it considers an existential struggle, and at the same time, the West—with every moral justification—decides to cripple the Russian economy, it’s hard for me to believe that they’re going to take that sitting down,” warns Samuel Charap, a former us State Department adviser now at the rand Corporation, a think-tank. He views a response in cyberspace as the likeliest countermeasure: “You could imagine the sort of asymmetrical response—shutting down some major Western banks for a couple of days.”

America and Britain have both been helping Ukraine to harden its cyber-defences in recent months, and may assist in repelling attacks on the country. But on computer networks, the line between defence and offence is not always clear. America’s doctrine of “defend forward” means that it might be willing to defend Ukrainian networks by stopping attacks at source—that is, inside Russian networks—if necessary. “I’m a soldier—I was always taught the best part of defence is offence,” declared Ben Wallace, Britain’s defence secretary, on February 21st in response to a question from an mp about offensive cyber-capabilities.

Western governments might also seek to disrupt Russian military networks, communications or “cognitive” operations such as altering data to confuse or mislead Russian forces. “The calculation may be that the Russians have overstepped the mark and that now is the time for a cyber response,” says Marcus Willett, a former deputy head of gchq. “There’s a great temptation to reach for cyber operations, because they feel more robust than sanctions but not at the level of firing missiles.”

Yet that is a “fine line”, warns Mr Willett. Concepts of deterrence, signalling and escalation in cyberspace are still evolving. And in many ways, Western infrastructure is more vulnerable because so much more of it is dependent on computer networks. “If you start going against Russian networks, then the Russians may well be well placed to do similar things on us and allied networks. In terms of international law, it also opens a whole can of worms which we may not want to open at this particular juncture.” Russia and America have probed one another’s infrastructure, including such sensitive areas as power and water supplies, for years.

Senior American figures say they are worried about miscalculation. Mark Warner, a Democrat who chairs the Senate’s intelligence committee, warns that norms of cyber-deterrence and escalation are poorly understood. He paints a scenario in which a Russian cyber-attack causes deliberate or inadvertent harm to civilians in Europe, prompting nato to retaliate.

On balance, such risks are probably manageable, argues Mr Martin, the former British cyber defence chief, who is now at the Blavatnik School of Government at Oxford University. Russia’s aim is to keep nato out of a war in Ukraine rather than drag it in, he says, so the Kremlin is likely to treat cyber-escalation in the same way it weighs up other instruments of statecraft, such as military force. Thus far, Western officials say they have seen little out of the ordinary when it comes to Russian cyber-activity against their countries. “Moscow will only launch a major disruptive cyber offensive against the West if it’s ready for escalation into some really dangerous territory,” he concludes.

And even once cyber power is used, escalation is not certain. Indeed, multinational wargames conducted between 2017 and 2020 by Jacquelyn Schneider, a fellow at the Hoover Institution at Stanford University, found that participants (mostly Westerners) were more likely to use cyber-operations for intelligence gathering, and to support military operations on the battlefield, than to target critical infrastructure. “We will see a lot of cyber-operations in a conflict between Russia and Ukraine,” she concludes, “but it will not be the primary factor that drives violence or leads to horizontal escalation to other countries in the region.”

“Whatever the rhetoric,” says Mr Martin, “the West faces constraints on the use of its own cyber power.” America and its allies routinely lambast Russia, China, Iran and North Korea for their irresponsible behaviour in cyberspace. They would be wary of resorting to similar means, such as highly disruptive attacks on civilian infrastructure. So would the lawyers that vet these things. “What sort of cyber operation against Russia would genuinely deter it?” asks Mr Martin. “What good, for example, would taking out Russian media do? And would we seriously go as far as doing things that would put Russian civilians in harm’s way?”

Our recent coverage of the Ukraine crisis can be found here

Discover more

Vladimir Putin blames an Islamist attack on Ukraine and America

How to use a disastrous security failure to bolster dictatorship

Why the French are drinking less wine

A younger generation is rejecting old Mediterranean habits