Assessing Russian Cyber & Disinformation Strategy in Support of the Ukraine War

• In Event: The War in Ukraine

Abstract

What lessons can be learned from the early phase of the Ukraine war concerning Russia's capabilities, strategy, and approach in cyberspace? To what extent do these point to broader possible conclusions about the role of cyber and information operations during direct military conflict? Russia is one of the U.S.’s foremost competitors in the development and strategic integration of cyber, information, and emerging capabilities. Yet, since its invasion of Ukraine, Russia has not leveraged these capabilities to as great a battlefield advantage as expected. Early reports of their outside-theater sub-threshold uses (to undermine international support for Ukraine) have likewise suggested limited impact in key theaters. This article examines Russian use of cyber and information capabilities to influence the course of the Ukraine war, analyzing the relative effectiveness of their uses both within and outside of the direct theater of armed conflict.

The article begins by laying out what has been considered unique about Russia's approach and how it has weighed upon US and Western cyber threat perceptions. This includes both the unique and surprising uses of cyber-enabled information operations – including the strategic spread of mis- and dis- information – in ways thought to demonstrate democratic vulnerabilities. It also includes Russia's significant technical cyber capabilities and demonstrated willingness to use these in ways targeting critical infrastructure. This discussion specifically addresses how Ukraine has long been a testbed for using various combinations of these tools for apparent political and strategic objectives.

Following from this prior understanding of Russia’s capacities and strategy, the article examines expectations that existed concerning Russia's potential use of its array of cyber capabilities in relation to the war in Ukraine and the extent to which these expectations have been met. This includes both expectations about how such capabilities could be used surrounding military invasion and escalation, and also about how they might contribute to ongoing war efforts. I look at what is actually known of Russia's uses of these capabilities during the war, and assess possible reasons why these have not proven as impactful as many predictions would have suggested. I also examine ways in which some uses of these capabilities – particularly information campaigns targeting populations outside Ukraine to affect support cohesion – might not be fully evident yet and could still prove more impactful.

Finally, the article draws some preliminary conclusions about possible lessons that can be learned from these observations – both specifically about Russia's cyber capabilities and strategy and, more theoretically, about how cyber and information operations contribute to the course of armed conflict. What do the roles of cyber and (mis-/dis-)information operations in the war show about Russia's actual capabilities, strategy, and priorities in cyberspace? To what extent have prior assessments overestimated its ability to integrate these in operational and strategic planning? And what understandings do these events support concerning the potential influence of cyberspace on the course of above-threshold conflict? I particularly consider the possible take-aways regarding influence of these tools on escalation dynamics and partnership cohesion and what we can and cannot say based on currently available information.

Author

• Jaclyn A Kerr, National Defense University