Cyber Conflict: From Apathy to Action

Download a printable PDF of this article

When Russia escalated its war of aggression against Ukraine in February of 2022, many predicted it would unleash catastrophic cyber attacks as part of its overall operations. When these did not materialize, at least overtly, some observers concluded that worries about cyber threats were overblown. Contrary to these assessments, cyber operations have indeed played a role in Russia’s campaign, just as they have at various points since 2014, beginning when Russia occupied Ukraine’s Crimea and instigated conflict in the Donbass and continuing with cyber operations against Ukraine’s power grid in 2015 and 2016, see Donghui Park & Michael Walstrom, Cyberattack on Critical Infrastructure: Russia and the Ukrainian Power Grid Attacks, Jackson School of Int’l Studies, Oct. 11, 2017, and the launch of a devastating malware attack in 2017. Sarah Marsh, US Joins UK in Blaming Russia for NotPetya Cyber-Attack, The Guardian, Feb. 15, 2018. On the eve of the 2022 invasion, Russia conducted a supply chain attack that corrupted and disabled thousands of satellite modems in Ukraine and across Europe, knocking customers offline and disrupting Ukrainian military command and control. AJ Vicens, UK, EU, US Formally Blame Russia for Viasat Satellite Hack Before Ukraine Invasion, CyberScoop (May 10, 2022); Patrick Howell O’Neill, Russia Hacked an American Satellite Company One Hour Before the Ukraine Invasion, MIT Technology Review (May 10, 2022). There is growing evidence of ongoing Russian cyber operations targeting Ukraine and accompanying concerns that Russia may escalate and target the United States and other allies. See James Pearson & Christopher Bing, The Cyber War Between Ukraine and Russia: An Overview, Reuters (May 10, 2022); Tom Burt, The Hybrid War in Ukraine, Microsoft (Apr. 27, 2022); Gordon Corera, Ukraine War: Don’t Underestimate Russia Cyber-Threat, Warns US, BBC News (May 11, 2022).

None of this comes as a surprise to those who have followed cyber threats in recent decades. Since the birth of the Internet, criminals, non-state actors, and states have leveraged the inherent vulnerabilities of cyberspace to do harm. Data theft, ransomware attacks, and critical infrastructure disruptions, to name a few, are now near daily occurrences. For instance, the Conti ransomware group, believed to operate out of St. Petersburg, Russia, encrypted critical systems throughout Costa Rica and then threatened the overthrow of the newly elected government in May 2022. President Rodrigo Chaves’s emergency declaration and assertion that his country was “at war” with “an international terrorist group” illustrates the magnitude of the problem. Corin Faife, Costa Rican President Says Country Is “at War” with Conti Ransomware Group, The Verge (May 18, 2022).

The use of information and communications technologies (ICT) has also elevated the age-old art of propaganda and malign influence operations to unprecedented levels and effect. States, Russia and China first among them, have engaged in sophisticated and sustained campaigns of covert deception and influence to weaken democratic institutions and fracture alliances, all with a broader aim of undermining the rules-based international order. As one expert has described, the modern information environment is “a qualitatively new landscape of influence operations, persuasion, and, more generally, mass manipulation.” Rand Waltzman, The Weaponization of Information: The Need for Cognitive Security: Hearing Before Subcomm. on Cybersec. of S. Comm. on Armed Services, 115th Cong. 1 (2017).

Many view Russia’s 2007 distributed denial of service attack against Estonia as a watershed moment when offensive cyber and ICT-enabled information operations became staples of both statecraft and warfare. Over the last decade, the U.S. intelligence community has identified cyber and information threats as primary national-security concerns and noted that U.S. adversaries, especially China, Russia, North Korea, and Iran, have used and will continue to use cyber operations to “threaten our infrastructure and provide avenues for foreign malign influence threats against our democracy.” Office of the Director of National Intelligence, Annual Threat Assessment of the U.S. Intelligence Community, Feb. 2022. In the years since 2007, the level, sophistication, and frequency of malicious cyber events have steadily increased. See, e.g., Center for Strategic & International Studies, Significant Cyber Incidents (listing cyber incidents since 2006, including WannaCry, NotPetya, and Solar Winds).

Furthermore, cyber threats are not contained to circumstances of traditional warfare. Instead, they are manifesting predominantly in the so-called “Gray Zone,” the uncertain space between peace and armed conflict. The Commander of U.S. Cyber Command, General Paul Nakasone, characterized the evolving threat to the House Armed Services Committee in 2020:

A decade ago, we trained and postured our cyber forces like any other military force: to prevail in future conflict. A central challenge today is that our adversaries compete below the threshold of armed conflict, without triggering the hostilities for which [the Department of Defense] has traditionally prepared. That short-of-war competition features cyber and information operations employed by nations in ways that bypass America’s conventional military strengths.

Before H. Subcomm. on Intelligence and Emerging Threats and Capabilities of H. Comm. on Armed Services, 116th Cong. (2020) (statement of General Paul M. Nakasone, Commander, United States Cyberspace Command).

The need to deter and actively counter these threats and, when appropriate, leverage cyber capabilities to affirmatively advance U.S. national interests has become increasingly evident and the years since 2012 have seen a profound shift in the U.S. approach to the realities of cyber and information conflict. Yet U.S. law and policy have struggled to keep pace. The introduction of technologies such as artificial intelligence and quantum computing will only exacerbate these challenges going forward.

Before turning to a survey of domestic legal and policy developments, a note on terminology is in order. The term “offensive cyber operations” or OCO means different things to different communities. Many refer to non-passive, cyber-enabled intelligence collection activities, or espionage, as “offensive.” For example, U.S. Department of Defense (DoD) doctrine includes cyberspace exploitation, i.e., intelligence and information collection, within its broad definition of OCO. Joint Publication 3-12, Cyberspace Operations II-7 (Jun. 8, 2018). For the DoD, OCO also encompasses cyberspace attack — the creation of “noticeable denial effects (i.e., degradation, disruption, or destruction) in cyberspace or manipulation that leads to denial effects in the physical domains.” Id. Although many of the tools and methodologies of cyber espionage may overlap with — and at times be difficult to distinguish from — operations designed to generate disruption or denial effects inside or outside of cyberspace, effects operations present markedly different risk profiles and implicate different legal and policy questions than intelligence collection. As such, the DoD definition of OCO is overbroad and can lead to confusion. Thus, this review focuses on the OCO “subset” of out-of-network effects operations, whether offensive or defensive.

Cyber Operations: From Apathy to Security Awareness

Although the Internet grew out of a 1969 DoDresearch project called the ARPANET, see Giovanni Navarria, How the Internet Was Born: From the ARPANET to the Internet, The Conversation (Nov. 2, 2016), decades passed before the DoD and broader national-security community recognized that this new technology was something more than just a benign means of data curation and communication and began to grapple with the implications of cyberspace for national security. The realization that cyberspace also offers opportunities for offensive action took even longer.

While basic computer and information security initiatives began as early as 1972, the true nature and extent of the cyber threat were not immediately apparent. In 1986, a German citizen employed by the KGB, the Soviet security agency, gained access to the ARPANET to steal information about the U.S. Strategic Defense Initiative in one of the first known examples of cyber espionage. The Spy Who Hacked Me, Infosecurity Magazine (Oct. 31, 2011). Two years later, the Morris Worm took down 10 percent of the embryonic Internet — the first real alert to the inherent vulnerabilities of the emerging ICT environment. Taking notice, the DoD set up its first Computer Emergency Response Team, and in 1990 President George H.W. Bush designated the National Security Agency (NSA) responsible for protection of national security systems, classified and critical command and control networks. National Security Directive 42, National Policy for the Security of National Security Telecommunications and Information Systems (Jul. 5, 1990). But these early initiatives were limited, stove-piped, and defensive in nature.

It was not until 1995 that “DoD leaders publicly acknowledged that U.S. military networks were vulnerable to remote attacks,” U.S. Cyber Command, Our History, and it took nearly another ten years before the Joint Chiefs of Staff recognized cyberspace as a domain of conflict in and through which the U.S. military needed to operate. National Military Strategy of the United States of America 2004. In 2004, President George W. Bush promulgated the first U.S. policy to address potential out-of-network cyber operations with National Security Presidential Directive (NSPD) 38, National Strategy to Secure Cyberspace (Jul. 7, 2004), a directive that remains classified although it has been superseded.

During these early years, U.S. efforts to develop strategies and structures to address emerging cyber threats were often disjointed and primarily focused on the security of domestic networks. For example, in 2008, the Federal Bureau of Investigation and the Department of Homeland Security established, respectively, the National Cyber Investigative Joint Task Force and the National Cybersecurity and Communications Integration Center. In 2010, prompted by a breach of classified networks, the DoD stood up U.S. Cyber Command as a subordinate unit to U.S. Strategic Command for the purpose of “integrating cyber defense operations across the military.” William F. Lynn III, Defending a New Domain: The Pentagon’s Cyberstrategy, 89 Foreign Affairs 97, 98 (Sept.-Oct. 2010)

Despite these efforts, the United States Government was “not organized to address [the] growing problem effectively [then] or in the future,” with “[r]esponsibilities for cybersecurity . . . distributed across a wide array of federal departments and agencies, many with overlapping authorities, and none with sufficient decision authority to direct actions that deal with often conflicting issues in a consistent way.” The White House, Cyberspace Policy Review: Assuring a Trusted and Resilient Information and Communications Infrastructure 2009. Structural and policy deficiencies continued to hamper effective action for several years and, to some extent, continue today. Moreover, to the extent OCO were contemplated, they were considered through the lens of traditional warfighting and only as a supporting effort to combat operations. Even then, capacity lagged far behind theory, and supporting law and policy were embryonic.

Cyber Offense: From Theory to Action

In 2016, the DoD publicly acknowledged having conducted OCO as part of its broader campaign to defeat the Islamic State in Iraq and Syria (ISIS). According to then Secretary of Defense Ash Carter, U.S. Cyber Command had conducted the operations to cause ISIS to “lose confidence in their networks, to overload their networks so that they can’t function, and do all of these things that will interrupt their ability to command and control forces.” Sean Lyngaas, Carter: U.S. Disrupting Islamic State Computer Networks, The Business of Federal Technology, FCW, Feb. 29, 2016. Although little detail was provided, this was considered an extraordinary revelation.

Part of the U.S. campaign against ISIS involved a highly sophisticated and coordinated operation to degrade its digital media and propaganda infrastructure, an operation dubbed Glowing Symphony. Dina Temple-Raston, How the U.S. Hacked ISIS, National Public Radio, Sept. 26, 2019. Although cyber operations were conducted as part of combat operations, U.S. Cyber Command assessments later revealed the inordinate difficulty of the approval process, where, for example, “interagency non-concurs” prevented execution of Glowing Symphony as originally designed and ultimately required elevation of the decision to the White House. USCYBERCOM After Action Assessments of Operation GLOWING SYMPHONY, National Security Archive (Jan. 21, 2020).

Lessons learned from the counter-ISIS operations later informed U.S. activities to defend the 2018 midterm elections from Russian interference. Maryann Lawlor, The Past Can Profit Cyber Planning, SIGNAL, Jul. 1, 2021. That effort, led by a U.S. Cyber Command-National Security Agency task force, involved a range of innovative initiatives, including discrete OCO, in support of wider U.S. government actions to protect the 2018 elections. As important as the cyber operations were for election security, gaining approval for their execution was anything but assured. The pre-2018 legal and policy frameworks were simply not conducive to action. As Admiral Michael Rogers, the Commander of U.S. Cyber Command and Director of the NSA, noted in 2017, outside of limited authority delegated in an order from the Secretary of Defense regarding Countering Adversary Use of the Internet, or CAUI , any cyber operation intended to create an effect on non-U.S. networks required the President’s approval. Foreign Cyber Threats to the United States: Hearing Before S. Comm. on Armed Services, 115th Cong. 418 (2017). Obtaining that approval faced significant legal, policy, and bureaucratic hurdles. And, as Glowing Symphony illustrates, not even operations in support of ongoing hostilities were immune from these challenges.

In 2012, NSPD-38 was superseded by Presidential Policy Directive 20 (PPD-20). PPD-20 was anchored on a declared policy of restraint, under which the United States would “undertake the least action necessary to mitigate threats” by prioritizing “network defense and law enforcement as preferred courses of action” to responding to hostile cyber incidents. Office of the White House Press Sec’y, Fact Sheet on Presidential Policy Directive 20 (2013). It established a review process for cyber operations that became infamous for stifling action. As the Joint Staff Deputy Director for Global Operations later described, PPD-20 required “an interagency process that went through the National Security Council and all the way up from a policy coordination committee to a deputies’ committee to a principals’ committee” and meant “anyone could stop the process at any point.” Sydney J. Freedberg, Jr., Trump Eases Cyber Ops, But Safeguards Remain: Joint Staff, Breaking Defense (Sept. 17, 2018). According to public reporting, the number of operations conducted under the PPD-20 approval framework were few. See, e.g., Hearing to Receive Testimony on the Posture of United States Special Operations Command and United States Cyber Command in Review of the Defense Authorization Request for Fiscal Year 2023 and the Future Years Defense Program: Hearing Before the S. Comm. on Armed Services, 117th Cong. 40-41 (Apr. 5, 2022).