In 2016 and 2017, cyber-incidents made
headlines around the world and increasingly represent a
tool of choice for many actors. The ramifications of
effective cyberattacks was on full display, from Russian
meddling in the US presidential election to the crippling
of the globe’s largest shipping company Maersk through
NotPetya malware. However, not all these events had
the same political ramifications. In 2016 and 2017, we
analyzed five cyber-related conflicts in Hotspot Analysis
reports. This Hotspot Synthesis gives an overview of
these five cases and identifies and analyzes trends and
particularities observed in the five Hotspot Analysis
reports.
This Hotspot Synthesis argues that cyberconflicts,
understood as the use of cybermeans in
strategic contexts or political conflicts, are different
from cybercrime due to their political components.
Increasingly, states politicize, militarize and securitize
cyberspace as a strategic domain. This trend was
observed in several policy documents analyzed in the
CSS Cyber Defense Project’s National Best Practice
Snapshots Handbook (see Dewar 2018a). The study
showed that cybersecurity was increasingly taken into
account at the policy and Grand Strategy levels. In
addition, the strategic choice of targets and the strategic
attribution are other political aspects of cybersecurity
that reflect the increasing politicization of the subject.
State actors’ motives in cyberspace are very different
than those of cybercriminals. State actors choose their
targets for other reasons than pure economic gain.
Strategic attribution of cyberattacks by the targeted
state is also a political choice and can act as a means to
many an end (e.g., deterrence, provoke a reaction).
Though a politicization of cyberspace and cybersecurity
issues was observed, the technical innovations in the
cybersphere remained rather limited. Malware
developers did not invent new special features, but
instead spent resources in developing more effective
vectors to deliver malware. In addition, even if malware
could be adapted to cause more damage, perpetrators
have often shown restraint in the extent of their attacks.
The use of cyberspace, and the political
dimensions inherent in cyber warfare, is also highly
dependent on the context. This Hotspot Synthesis
identified three main categories of contexts based on
the Hotspot Analysis reports: internationalized civil wars
(Syria), asymmetric military operations between states
(Ukraine), and strategic relationships between great
powers (USA-Russia, USA-China and elections in
Europe). The study showed that in each category, actors
used different tools and techniques and targeted other
types of objectives.
The analysis of Hotspots in 2016 and 2017 also
shed light on the disagreements between states
regarding legitimate and illegitimate uses of cyberspace
in strategic interactions. Cyberspace crosses all political
and legal principles of the use of force. Cyberattacks are
used to target civilians and non-civilians, in peace and in
war, domestically and internationally. The versatility of
cyberattacks creates a particular challenge for states, as
they attempt to find common understanding on many
elements of cybersecurity. The lack of definitional
consensus regarding cybersecurity issues works to
heighten tensions between states when cyber-activities
are in play, as well as heighten the risks of
misperception. In Hotspot Analysis reports, we
identified two major points of contention: intelligence
and information warfare. The disagreement on
intelligence is rooted in the perceived goal of
cyberespionage. Some states see a difference between
cyberespionage for economic purposes and
cyberespionage for national security purposes. The lack
of a common set of norms increased tensions between
states and augmented the risk of misperceptions in their
relations. Information warfare can cause further conflict
when cyberspace is used to influence electoral
campaigns in foreign states. While some states consider
the use of cyberspace as a vector to influence their own
or other states’ political processes as legitimate, other
states do not. The ambiguity around the appropriate use
of cyberspace also strained relations between states.
This Hotspot Synthesis is the first document in a
series of reports. The series will analyze various cyberactivities
in the context of their political conflicts and
strategic relationships, as well as highlight trends in the
use of cybertools.