By: Grant Adams
Source: Shutterstock - (Tomasz Makowski)
Introduction:
In late 2021 competition over Ukraine has moved from a simmer to a boil. Russia has increased their military presence on the Ukrainian border, potentially signaling a hybrid warfare scenario with use of cyber grey-zone warfare (CGW) against Ukraine. Among information security experts, many say that now modern warfare will actually initiate over the internet. However, the built-in ambiguity of strategic cyber capabilities could lead to physical conflict. As negotiations falter and war becomes an imminent threat this scenario must be avoided at all costs.
The Russian government has used CGW in Eastern Ukraine at a tactical level for years. Now they have increased their strategic CGW abilities facing off with peer competitors like the U.S. and probing weaker states like Ukraine. Consequently, they are targeting Ukraine to test if they can gain an offensive advantage in a conflict. Technologies like AI and machine learning can bolster attacks while predictive defense and hybrid cloud deployments can defend against strategic cyber-attacks targeting critical infrastructure by contracted hackers. Tactical technologies like GPS spoofing and cell phone hacking may become a more definitive factor on the battlefield than ever conceived. Thus, the U.S. needs to consider the costs of supporting a vulnerable ally like the Ukrainians, possible bargaining postures, and how U.S. commercial export policy of our own cyber defenses affects these tenuous situations. Moreover, there is a persistent question: how to ease the ongoing cyber-arms-race that the U.S. and the Russians are engaged in? Both sides are incentivized to avoid unsustainable arms-racing, if not protracted war, in fact the Russians even more so. But can both sides cooperate without getting burned?
Given that negotiations stalled with Putin, the probability of both parties defecting becomes higher as does the danger of accelerating the arms race in cyberspace and war. This concept comes from “Cooperation Under the Security Dilemma”, by the late scholar Robert Jervis. He articulated that arms racing, and cooperation can be a dicey iterated game when there is ambiguity of capacity for offence or defense within technologies or states. I believe that the U.S. could alleviate this security dilemma by being more forthright and restrained in its intervention. The U.S. could start by blocking Ukraine’s admission to NATO, while balancing with the cultivation of their defense capacity through the private sector and the clarification of technological transfers. This would make a Russian defection costly while supporting Ukrainian self-determination. Coercion by offence becomes less practical for the Russians as it decreases the credence of Putin’s concerns over NATO’s mission creeps on the world stage. Meanwhile, politically safe concessions are made by the U.S. would bolster Ukraine, create more business, and allow for agreeable bargaining. Finally, and most importantly, restraint will de-escalate an ongoing cyber arms-race between the West and Russia as we don’t want to accidentally start a conflict with a fateful key stroke.
Status-Quo in the East:
Russia’s impatience with what it claims is threatening Western behavior does not mean it wishes to take swathes of Ukrainian territory for good. In actuality, Russia has a myriad of reasons to enact a quick, hard incursion to gain an overland route to the Crimean Peninsula like their incursion in Georgia in 2008. Putin is also past his bargaining breakpoint regarding Ukraine as Mr. Zelensky hopes to move to join the EU if not NATO. NATO’s admission of Ukraine into the alliance could result in a 5-minute flight time for NATO missiles aimed at Moscow, which is intolerable. To stop this, the Kremlin is eager to leverage a claim to protect a minority of Russian speakers in the Donbas, and favorable conditions may permit this to occur sooner than later. In early 2022, the ground in eastern Ukraine will be frozen solid (great for T-90’s), approximately 100,000 fresh conscripts who have been amassed at the border will be deployable and ongoing tensions with the rest of Europe over the Belarusian border crisis may provide a pretext for action. Offence currently has military advantage in this situation, but it is questionable if this will lead to conflict due to non-military costs to the Putin regime’s political survival and more so if U.S. offensive-defensive postures are distinguishable. Nonetheless, cyberwarfare will be the opening salvo in any context.
For almost two decades Ukraine has been a testing ground for Russian hackers to deny, disrupt and degrade capabilities. Yet, the Ukrainians and Americans have learned to defend against these attacks to a certain degree as evidenced by the small-scale attack on Ukrainian government systems. Previously, the cyberattacks that opened the 2008 Russo-Georgian incursion were largely symbolic, but may now they may be much more devastating as demonstrated by recent crippling attacks on SolarWinds in the US. Critically, it is still questionable how secure the internet of the Ukrainian government and utilities are from a major Russian attack. While Sec. Blinken called U.S. commitment to Ukraine ironclad and warned Moscow that any escalatory actions would be condemned, the U.S. must do more in cyberspace despite already spending tens of millions on Ukrainian cyber defenses. This includes greater intelligence sharing in addition to decisive technologies such as cyber defenses with improved AI to assist predictive methods that can prevent attacks before they happen.
Decisive Technologies:
Cyber weapons will take two primary forms in such a conflict - strategic and tactical. Strategically state-sponsored criminal hackers will launch denial of service (DoS) cyberattacks oriented toward communications, transportation, and energy infrastructure. With command and control as well as resupply structures affected, the Ukrainian army, which has become better equipped and professionalized would make ultimately futile efforts to repel initial Russian advances if DoS powered by AI occurs. This is possible even though military spending as a portion of GDP has doubled, to 4 percent in Ukraine. America has also given $2.5 billion worth of equipment to Ukraine. After the Ukrainians regroup to hold a security perimeter tactical cyber weapon will become more critical. GPS spoofing, where a receiver is tricked to think it is somewhere else spatially or temporally, may be able to conceal Russian unit positions from Intelligence, Surveillance and Reconnaissance (ISR) units. What is worse is that GPS spoofing can be unknown to users as they create backup systems to protect themselves. Combatting this can be expensive for developing nations like Ukraine. Spoofing is by no means the only tactical tool as the Russians have a history of utilizing cell phone data to target Ukrainian positions for artillery and sewing disinformation though psychological operations. In addition, Russians have enjoyed warping Ukrainian public consciousness though disinformation. Using a mix of structural and productive power as defined by Barnett and Duval, social media-based propaganda fomented fears that Russian speaking Ukrainians would be targeted by a so-called "fascist" government in Kyiv and have taunted frontline soldiers via texts as early as 2016. As such, the U.S. and Ukraine held their third cyber dialogue in Kyiv on March 3, 2020 to reaffirm a shared commitment to an interoperable and secure cyberspace. Subsequently, the U.S. invested $8 million in Ukrainian cybersecurity through USAID in 2020 and plans to increase funding until 2024. These new funds were issued two months after Ukrainian authorities asked the FBI to assist in investigating an attack on Ukrainian gas company Burisma by Russian military hackers. Undoubtedly, this kind of attack has become more powerful with AI, which could be more effective in a conflict.
Export Policy Matters:
US commercial and military exports to Ukraine were catalytic for competition over Ukraine and must not only be considered in terms of direct transfers of technology, but how the U.S. manages its oil exports to the region and how it impacts other’s dependencies on Russian hydrocarbons. Biden is currently under pressure to ban exports of petroleum products to lower domestic costs at the pump. However, those in the petroleum industry believe that this would be a gift to Putin and to the detriment of our allies in the short term, making them beholden to Russian beneficence. Furthermore, arms sales by NATO allies to Ukraine has caused Putin to demand a binding security guarantee, which would keep NATO weapons out of Ukraine. Missiles that could threaten a strike on Moscow within 5 minutes are of particular concern. Traditionally, the U.S. has supplied medical, ISR, communication and other defensive technologies to Ukraine but Russia perceives these defensive measures as a major threat. This is because of the offence-defense ambiguity as described by Jervis regarding cyber and physical assets, which makes it difficult for Moscow to parse their purpose. Javelin Missiles for example, while best as defending against armored vehicles, could be used in an assault to retake Crimea. Moreover, it must be well understood if this security guarantee, in Putin’s eyes, applies to exportation of advanced cyber capabilities and if the Russians will react unfavorably. Critically, quantum computing technology, which is akin to any other powerful tool that can be used for good or ill, must be well considered when thinking about whether to share this with weak allies. If disseminated broadly, the consequences are unknown how it could be used against the US.
Policy Proposal & Conclusion:
As a security dilemma like Ukraine unfolds it becomes more important to determine the actual costs of being exploited in negotiations. In this case both the U.S. and Russia don’t want to be taken advantage of. Russia doesn’t want missiles within striking range of Moscow and the U.S. doesn’t want a democracy to succumb to Russian influence. Furthermore, the ambiguity of cyber weapons makes it harder to distinguish if they are deployed for offensive or defensive reasons. Thus, any cyber-skulking sounds alarms for both parties. Policy makers need to avoid this ambiguity with Russia by showing restraint and allowing the Ukrainians and Europeans to manage their own affairs. Specifically, this means the U.S. should recognize that it has a stronger bargaining position when it clarifies its intentions and makes a major concession in barring Ukraine from joining NATO, while buttressing our ally’s cyber defenses especially deterrence by denial in cyberspace. Yet, this may not matter. There are many reasons why Putin could invade Ukraine and it is doubtful he will regardless of our actions as the cost of a protracted war would not be politically favorable. Rather he seeks to find a better bargaining position though border brinksmanship to get NATO to back away from being in striking range of Moscow. While both sides signal resolve, no Western state seems willing to conduct a war against Russia for Ukraine’s sake and Putin knows it. In addition, Putin is most likely bluffing but will continue to disrupt NATO allies and Ukraine without repercussions though GCW. If Putin is not reassured the U.S. and NATO do not have plans of attacking Russian interests, if not the homeland, GCW and brinksmanship will continue to escalate. This kind of arms racing is not favorable for the U.S. and should be resolved. Furthermore, this should not be seen as an instance of appeasement, but if Putin believes that his bargaining position is not restored to where it was pre-Maidan Revolution, then we may have to prepare for hybrid warfare, conventional conflict, or spiraling arms racing in cyberspace. This proposal may run into pushback from military planners, but its positive merits could ease escalating tensions and allow for better bargaining in an iterated game.
Additional Note:
Please consider listening to this podcast from Intelligence Matters with Michael Morell with U.S. National Cyber Director Chris Inglis, which thinks broadly about cyber security and deterrence strategies that the U.S. is working on that may further provide insight for your briefing: https://open.spotify.com/episode/0gD1ZdFVz8C4EI6yZWGMR9?si=N4jj02M0Qo663zkha7n13g
Grant Adams is a Master of International Affairs student specializing in International Politics.
A native of San Diego, Grant did not expect to return home to pursue a graduate degree after working in the San Francisco Bay Area. However, he has since found a wonderful community of scholars at UCSD's School of Global Policy and Strategy. There he studies international affairs with a focus on politics, security, and climate change.
Comments