Cyber Persistence Theory in the Russo-Ukrainian war

Cyber Persistence Theory (CPT) was introduced in our book, ‘Cyber Persistence Theory: Redefining National Security in Cyberspace’, two months after Russian tanks rolled into Ukraine. It refers to how states set conditions in and through cyberspace by exploiting others’ vulnerabilities (technical and cognitive) while securing their own.

The book focuses on how states exploit cyberspace for strategic gain outside of armed conflict, but CPT also provides insights into state cyber behaviour during war. It has accurately explained Ukrainian and Russian cyber behaviour.

It’s about the initiative

Initiative shifts so states must persist

Russia probed, manoeuvred, and experimented in Ukrainian networks for years. As early as March 2021, Russian cyber operators reportedly began compromising Ukrainian critical infrastructure and essential government services, laying the groundwork for the invasion. Anticipating a potential attack, Ukraine requested a ‘hunt forward‘ team from US Cyber Command to search and find suspected malicious Russian activity. That team was deployed from December 2021 to mid-February 2022, shortly before the invasion began.

After the attack, Ukraine’s Telecom regulator suspended all inbound roamers from Russia and Belarus to make Ukraine’s core network attack surface (3G/4G) less vulnerable to Russian-originated cyberattacks. Ukraine’s Computer Emergency Response Team also helped to preclude potentially significant Russian cyber actions. Through initiative persistence, Ukraine seized back the edge lost from past Russian cyber intrusions.

Ukraine’s effective cyber defences and resilience surprised many. CPT has an explanation—Ukraine showed initiative persistence against Russia in and through cyberspace. Since 2017, Ukraine and US Cyber Command built trust and cooperation at the operational level to create resilience. Ukraine also partnered with private sector technology firms to improve cyber defences, which paid off once the tanks rolled. Experience and insight focusing on one main adversary enabled the Ukrainians to anticipate and proactively contain Russian cyber campaigns.

Interconnectedness in war

Interconnectedness and constant contact endure during conflict

The interactions between states, businesses, and citizens continue during war— taking on new importance. In the Russo-Ukrainian war, some non-state technology actors operated at unprecedented scale and speed. Starlink, a private internet satellite company, is perhaps the best-known example. It allowed the Ukrainian internet to continue operating during the Russian invasion days after Kyiv requested its services.

Crowdsourcing apps also aided Ukrainian military operations. In the March 2022 fight for Voznesensk, a southern town of 35,000 people, Ukrainian volunteers used the Viber social messaging app to send the coordinates of Russian tanks to Ukrainian armed forces, which allowed Ukrainian forces to direct artillery fire at Russian positions. The subsequent Ukrainian attack led to Russia’s first major rout. Retreating Russian soldiers left behind nearly 30 of their 43 vehicles, including tanks, armoured personnel carriers, rocket launchers, and trucks, as well as a damaged Mi-24 helicopter gunship.

Exploitation ≠ escalation

We can act and not escalate

As we would expect in armed conflict, Russia breached agreed competition limits by attacking Ukraine’s critical infrastructure. Yet Russia has not targeted non-combatant states in the same way.

Moscow wants to avoid NATO directly entering the war. Russia’s opening cyber salvo on the Viasat satellite system had collateral damage outside Ukraine, but subsequent strikes sought to limit spillover. Although Russian-affiliated cyber actors have significantly increased activities against NATO member states, the numerous malware strands and wiperware campaigns avoided targeting networks, systems, and devices.

Moscow still seeks strategic advantage but appears to recognise escalation risks. Its restraint suggests tacit limits still apply, even amidst armed conflict.

Cybersecurity requires all hands

Citizens play a key part, even in conflict

The logic behind a “whole-of-nation-plus” approach is to leave no flank exposed, in competition or armed conflict. A key lesson from the Russo-Ukrainian war is the vital role of the private cyber sector and populace.

CPT noted a shift toward more engaged citizens in cyber security. The US-based National Cybersecurity Alliance’s cyber education framing links individuals to national-level security, calling on all to “do your part.” Ukraine’s citizenry epitomises this, securing the nation from cyber and kinetic attacks.

For example, young Ukrainian volunteers built a system called Griselda that scrapes data from social media and other sources to provide up-to-date situational intelligence. This assists the Ukrainian military and government in identifying where minefields exist and what infrastructure repairs are required. Ukrainians have also developed apps for coordinating supply deliveries, identifying evacuation routes, and disrupting Russian military websites.

Keeping up the effort

Cyber initiative persistence is a feature of modern-day international politics because politics unfolds in cyberspace. The rationale that propels digital security does not change when strategic competition morphs into armed conflict. Opportunities and vulnerabilities may take on greater urgency when war erupts, but the core logic persists. As CPT posits, the states that understand cyber initiative persistence and apply it well will tend to gain more relative security than those that do not.

The current conflict in Europe aligns with CPT’s expectations. Cyber action alone may not be independently decisive in armed conflict, but it can be cumulatively strategic. Ukraine’s efforts to seize the cyber initiative certainly helped stave off early defeat.

The views expressed are those of the authors and do not necessarily reflect the official views of any US government department or agency.