Future of Cybered Conflict: Theory Gaps & Resilience Lessons from Ukraine's War

• In Event: Cyber War in Ukraine and Beyond

Abstract

Prior to Russia’s February 24, 2022 wholesale invasion of Ukraine, one strand of theorizing about cyber war and one strand of empirical research on cyber capabilities of specific nations suggested that cyber operations would play a large, if not determinative, role in the outcome of the war. The expectation was that Ukraine would fold in days against the might of the Russian onslaught. Experts had long argued that Russia was the most capable and dangerous cyber adversary; in 2022 Harvard’s Belfer Center judged Russia to be the third most powerful comprehensive cyber power (Voo, Julia, Hemani, and Cassidy 2022:9). Others also assumed that massive Russian cyber operations would be employed as a fully integrated and multiplicative component of Russian conventional superiority (Kofman and Kendall-Taylor 2021: 146-148). Yet, since the war’s initial stages, analysts have been surprised that Russian cyber operations were not having an observable impact (Rid 2022) on Ukrainian national systems or morale.

This paper will contrast the key prewar hypotheses about the resilience of any relatively digitized national socio-technical-economic system to the impacts of cyber operations in modern war and the post-invasion adjustments in explanations for limited success of Russian cyber operations. Nations are large scale socio-technical-economic systems. For them, resilience is the sweet spot where the national leaders foresee as many systemically disruptive events as needed and accommodate them in advance, and, in the process, reduce the potential disruption from devastating surprising rogue events as well. These varied existential elements of systemic resilience related to cybered vulnerabilities or strengths may or may not be visible until the nation faces cybered conflict with adversaries attempting to defeat the defending nation. This work will argue that scholars of both security studies and cyber have had difficulty integrating their theories with the concepts and realities of systemic resilience, and therefore overestimate the aggressor’s ability to apply at scale – and predetermine the effects of – cyber capabilities against most modern complex national systems, including that of Ukraine.

Incorporating relevant data from previous hacking incidents, cyber campaigns, and small-scale wars with emerging insights from the Russia-Ukraine war, the discussion will conclude by proposing an alternative explanation of ‘contingent cybered systemic resilience’. To goal is to enhance the theoretical and empirical validity of cybered conflict analyses going forward. While cyber/AI tools and tactics will be an intrinsic component of conflict from peace to war going forward, the effectiveness of its use in offense against any state will depend as much or more on the variable specifics of the defender including their systemic resilience.

Authors

• Chris C. Demchak, Naval War College

• Peter Dombrowski, Naval War College