Cyber Diplomacy and Russia's War in Ukraine
Last updated 07:38 AM EST • Read time: 9m
Why the Department of State’s ‘Tech Diplomacy’ Rework Needs a Wartime Reboot
On April 21, Russian-affiliated cyber operatives succeeded in compromising EUROCONTROL’s (European Organization for the Safety of Air Navigation) digital systems.[1] The intergovernmental organization’s nearly two thousand employees were forced to use unofficial communications, as systems were forced offline.[2] While the hack failed to disrupt flights, it is illustrative of a larger corpus of ‘cyber events’ sponsored or steered by the Russian Federation in allied cyberspace. In what observers have called a “hybrid warfare strategy,” kinetic operations in Ukraine have been coupled to Russian cyber operations against Ukraine and NATO member states over the past fifteen months.[3] These attacks—and the commercialized cyber-criminal network that facilitates them—are ballooning, particularly as the balance of power teeters on the ground in Ukraine.[4] Military and industrial infrastructure in Ukraine and states viewed by Russia as ‘Ukraine-aligned’ (including the United States) has become subjected to an almost incessant stream of cyber bombardment. This blitz has been largely unsuccessful, thanks to advanced cyber defense systems and ad hoc consortiums of private cybersecurity firms.[5] However, as evidenced by the ‘EUROCONTROL hack,’ a similar event that stymied train travel in Germany last year, and numerous successful Russian cyber operations in Ukraine over the last few months, sometimes the dam breaks.[6] Such lapses in secure allied cyberspace are costly—and have the potential to spiral out of control (like Russian-sponsored Sandworm attacks on Ukraine’s power grid in 2015).[7] With heightened Russian cyber operations expected in the coming months,[8] target states must prepare, deter, and defend. In the wake of a difficult year for cyber-preparedness, the U.S. Department of State (DOS) can play a heightened role in contending with Russian cyber aggression, while buttressing allies’ cyber capabilities.
The recent ‘Vulkan Files’ leak confirmed what Russian cyber activity suggested. The Russian Federation views cyber operations as weaponry on par with its ground assaults in Ukraine.[9] Indeed, cyber incursions have become part and parcel of Vladimir Putin’s war in Ukraine and pressure campaign against NATO (and otherwise Ukraine-aligned) states. These operations, outfitted like any kinetic incursion with strategic implications, are aimed as “[‘]attack[s] on the enemy’s will to fight,’” present or future.[10] The Russian Federation has long engaged in contra-state cyber operations, making up the world’s second largest share of verifiable state-sponsored cyber operations from 2005 to 2022.[11] However, its operations in cyberspace exploded at the onset of the Russo-Ukrainian war last year, with Ukrainian cyber incidents tripling last year alone.[12] Its cyber instrument, FoxBlade (a trojan virus designed to wipe local systems),[13] entered Ukrainian networks a full day before its ground forces, comprising what Microsoft’s President Brad Smith called the true “first shots” of the war.[14] Since then, cyber capabilities have been employed in tandem with ground operations, manifesting in repeated attacks against more than 100 Ukrainian entities.[15] Microsoft’s Threat Intelligence Center, which has monitored Russian cyber activity since the start of the war reported last year that it “detected Russian network intrusion efforts on 128 targets in 42 countries outside Ukraine [...] represent[ing] a range of strategic espionage targets likely to be involved in direct or indirect support of Ukraine’s defense, 49 percent of which have been government agencies.”[16] Such a barrage is echoed by anecdotal consensus and ministerial warnings from NATO allies (at least 17 of which have experienced ‘events’) that their systems are under “permanent fire” from Russian cyber elements.[17]
These attacks are only projected to intensify as the Russian Federation struggles to compensate for what has been a lackluster showing on the battlefield—and as it seeks to make international support more costly.[18] It is well-positioned to do so. A prime feature of the Russian toolkit since 2015, Scan-V, “scours the internet for vulnerabilities,” storing them for future exploitation.[19] These vulnerabilities are easily surrendered to infamous Russian cyberweapons, like NotPetya (a crippling ransomware) or its newer peers developed within the early months of the war.[20] Furthermore, the commercialization of cyber-crime (i.e.. sale of prepackaged cyberweaponry to the highest bidder) has clouded attribution and facilitated easy deployment of cyber instrumentation, meaning that the extent of Russian-sponsored cyber operations are likely far more extensive than the ‘fog of war’ permits intelligence to ascertain.[21]
U.S. Department of Defense practitioners often argue that military cyber infrastructure is best situated as the proprietor of cyber capabilities.[22] Even so, a globalizing Russian cyber campaign against Ukraine and its allies requires a whole-of-government, diplomatic counter. Thus, DOS—as the United States’ prime facilitator of international cooperation—has a role to play in sharpening American cyberpower, particularly as it relates to allies and adversaries within the space. Cyber threats and vulnerabilities, such as those propagated by the Russian Federation, have indeed prompted an uptick in ‘cyber-oriented’ rhetoric and initiatives at DOS, which precisely target these junctures.
Current DOS initiatives come at a time when ‘cyber diplomacy’ has been “haphazard.”[23] While current efforts at modernization, coordination, and cyber-preparedness are valiant, they tend towards too little too late. Demand for ‘boots-on-the-ground’ (“hunt-forward presence”) cyber expertise (often a joint provision of DOS and the Department of Defense’s Cyber Command) at American embassies in allied states has only grown following Russia’s increased cyber activity.[24] These DOS-DOD capabilities and employees craft intergovernmental cybersecurity coordination and intimate shareable capabilities to allied governments. These elements serve in and alongside defense of allied cyberspace and have quickly become a feature of the Russo-Ukrainian War. If Russian aims were to isolate Ukraine and scramble its allies, such actions have done quite the opposite, illustrating the grave need for a unified cyber front.
As Ukraine’s allies have hastened to develop new means of defense, reconstitution, and deterrence, it has become strikingly clear that “defense [and deterrence] against a military invasion now requires for most countries the ability to disburse and distribute digital operations and data assets across borders and into other countries.”[25] It is this forward-facing capability that DOS must be catalyzed to assemble. As a strong cyber power, continued American alliance and coordination (facilitated by DOS capabilities) with weaker cyber powers can: bolster what is otherwise uncredible ‘cheap talk,’ defend ally networks, and stem transnational cyber weapons at their source (i.e., ‘stop the spread,’ cyber edition).
To do this, DOS’s nascent cyber officer program must be pursued with all haste. It should draw upon intra-agency expertise, relocating preexisting officers (DOD or DOS) qualified to receive cyber skill codes to what are America’s most vulnerable Ukraine-aligned allies. These locales’ embassies should be staffed with cyber expertise and policy guidance first. Deployment must be paired with clarion policy. American cyber policy (DOS or otherwise) has long lacked a clear-eyed declaration of what retaliation (if any) an adversary would risk should they engage in cyber operations against the United States or its allies. This sort of declaration would not only bolster U.S. deterrence, but also that of closely aligned allies who are housing American cyber capabilities. With other ‘great power’ cyber attacks on the horizon, DOS cyber capabilities will become even more attractive—and necessary—to decision makers at home and abroad.[26]
Zacharias Negron is a Chancellor's Scholar and research assistant at Vanderbilt University, as well as an RRI-AHS National Defense Fellow. He also recently served with the Subcommittee on Cybersecurity and Infrastructure Protection on the Hill.
Notes:
[1] Julia Horowitz and Catherine Nicholls, “European air traffic control says attack by ‘pro-Russian hackers’ not affecting flights,” CNN Business News, April 21, 2023, https://edition.cnn.com/2023/04/21/business/eurocontrol-russia-hackers/index.html.
[2] Bojan Pancevski, “Europe’s Air-Traffic Agency Under Attack From Pro-Russian Hackers,” The Wall Street Journal, April 20, 2023, https://www.wsj.com/articles/europes-air-traffic-agency-under-attack-from-pro-russian-hackers-54b4514d?mod=article_inline.
[3] Jenna McLaughlin, “Russia bombards Ukraine with cyberattacks, but the impact appears limited,” NPR News, March 3, 2023, https://www.npr.org/2023/02/23/1159039051/russia-bombards-ukraine-with-cyberattacks-but-the-impact-appears-limited; and “A year of Russian hybrid warfare in Ukraine,” Microsoft Threat Intelligence Division, March 15, 2023, https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/03/A-year-of-Russian-hybrid-warfare-in-Ukraine_MS-Threat-Intelligence-1.pdf.
[4] Shane Huntley, “Fog of war: how the Ukraine conflict transformed the cyber threat landscape,” Google Threat Analysis Group, February 16, 2023, https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/.
[5] McLaughlin, “Russia bombards Ukraine with cyberattacks, but the impact appears limited.”
[6] Horowitz and Nicholls, “European air traffic control says attack by ‘pro-Russian hackers’ not affecting flights;” Tom Fairless, “Germany Blames Sabotage for Train Outage,” The Wall Street Journal, October 8, 2022, https://www.wsj.com/articles/germany-blames-sabotage-for-train-outage-11665235569?mod=article_inline; Huntley, “Fog of war: how the Ukraine conflict transformed the cyber threat landscape.”
[7] Harding, Luke et al., “‘Vulkan files’ leak reveals Putin’s global and domestic cyberwarfare tactics,” The Guardian, March 30, 2023, https://www.theguardian.com/technology/2023/mar/30/vulkan-files-leak-reveals-putins-global-and-domestic-cyberwarfare-tactics.
[8] Huntley, “Fog of war: how the Ukraine conflict transformed the cyber threat landscape;” Kate Connolly, “German minister warns of ‘massive’ danger from Russian hackers,” The Guardian, February 26, 2023, https://www.theguardian.com/world/2023/feb/26/german-minister-warns-of-massive-danger-from-russian-hackers; and Russell Hope, “Russia-linked cyber attack groups want to 'destroy' UK, minister warns,” Sky News, April 19, 2023, https://news.sky.com/story/russia-linked-cyber-attack-groups-want-to-destroy-uk-minister-warns-12860186.
[9] Harding, Luke et al., “‘Vulkan files’ leak reveals Putin’s global and domestic cyberwarfare tactics;” and Connolly, “German minister warns of ‘massive’ danger from Russian hackers.”
[10] Harding, Luke et al., “‘Vulkan files’ leak reveals Putin’s global and domestic cyberwarfare tactics.”
[11] “Cyber Operations Tracker,” Council on Foreign Relations Digital and Cyberspace Policy Program, No Date, Accessed on April 27, 2023, https://www.cfr.org/cyber-operations/.
[12] “Report: the number of recorded cyber incidents almost tripled in 2022,” State Service for Special Communications and Information Protection of Ukraine, February 16, 2023, https://cip.gov.ua/en/news/u-2022-roci-kilkist-zareyestrovanikh-kiberincidentiv-virosla-maizhe-vtrichi-zvit.
[13] “DoS:Win32/FoxBlade.A!dha,” Microsoft Security Intelligence, February 23, 2022, https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=DoS:Win32/FoxBlade.A!dha&ThreatID=2147813512.
[14] Brad Smith, “Defending Ukraine: Early Lessons from the Cyber War,” Microsoft: On The Issues, June 22, 2022, https://blogs.microsoft.com/on-the-issues/2022/06/22/defending-ukraine-early-lessons-from-the-cyber-war/.
[15] Clint Watts, “Is Russia regrouping for renewed cyberwar?” Microsoft: On The Issues, March 15, 2023, https://blogs.microsoft.com/on-the-issues/2023/03/15/russia-ukraine-cyberwarfare-threat-intelligence-center/.
[16] “Defending Ukraine: Early Lessons from the Cyber War,” Microsoft Corporation, June 22, 2022, https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE50KOK.
[17] Connolly, “German minister warns of ‘massive’ danger from Russian hackers;” and Hope, “Russia-linked cyber attack groups want to 'destroy' UK, minister warns.”
[18] Huntley, “Fog of war: how the Ukraine conflict transformed the cyber threat landscape.”
[19] Harding, Luke et al., “‘Vulkan files’ leak reveals Putin’s global and domestic cyberwarfare tactics.”
[20] Ibid; and Clint Watts, “Is Russia regrouping for renewed cyberwar?”
[21] McLaughlin, “Russia bombards Ukraine with cyberattacks, but the impact appears limited.”
[22] Suzanne Smalley, “State to gain more ability to monitor DOD cyber ops under White House agreement,” Cyberscoop, May 10, 2022, https://cyberscoop.com/state-to-gain-authorities-to-monitor-dod-cyber-ops-under-new-white-house-agreement/.
From Siberia to Fairford: How Operation Spider’s Web Has Changed the Rules of Airpower
By Frank A. Rose • RealClearDefense
Faster Simulations, Better Defense Decisions
By Rut Lineswala • RealClearDefense
Will HASC Have an Oversight Subcommittee in the Next Congress?
By Christopher J. Bright • RealClearDefense
The U.S. is Overpaying for Missiles
By Alex Lee • RealClearDefense
The U.S. Nuclear Deterrent Umbrella
By Peter Huessy • RealClearDefense
From Siberia to Fairford: How Operation Spider’s Web Has Changed the Rules of Airpower
By Frank A. Rose • RealClearDefenseFaster Simulations, Better Defense Decisions
By Rut Lineswala • RealClearDefense
Bombers Could Have a Major Air-to-Air Combat Role
By Joseph Trevithick, The WarZone
Pentagon, Lockheed Agree to 10-Year Deal for 850 F-35 Jets
By M. Scanlon, Military T.
The Marine Corps Has a Boot Problem
By Travis Pike, Sandboxx News