Offensive cyber operations in the test of time

In 2022, I published ‘Offensive Cyber Operations: Understanding Intangible Warfare’. The book attempted to capture the breadth, depth, and nuances of offensive cyber operations. I analysed campaign complexities through four major claims and by focusing on four case studies: the United States, Russia, China, and Iran.

A year has now passed since publication. Did I get it mostly right?

The answer, on the whole, is yes.

Joint offensive operations

Claim 1: Conducting joint offensive cyber operations – in harmony with an overarching military strategy – is difficult to do consistently well

Unique to military operations, offensive cyber does not work at a battlefield tempo – at least not easily. Preparing a single strategic capability may require days to years of careful work: target development, network intrusion, intelligence collection, pre-positioning, and bespoke research and development. This process is resource-expensive and high-risk, and the resulting capability may only be used in a handful of instances. Despite the perception, a cyber operation done well is anything but cheap. It requires both investment and patience.

I predicted that only top-tier threat actors would launch strategic offensive cyber operations and would do so infrequently. Military planners know that capabilities are not useful when used in isolation: they must be used jointly. Offensive cyber operations have proven difficult to integrate effectively with other military activities, and therefore are often shunned by impatient forces in favour of more predictable, well-understood means.

We continue to see precious few instances of offensive operations. Even a war at the scale of the Russian invasion of Ukraine has not publicly yielded many examples. The most notable incident thus far was the 2022 attack against the Viasat satellite network, which purportedly impacted the Ukrainian military at the early stages of the invasion. The Viasat attack demonstrated a rare alignment of objectives, targets, forces, and effects. But it was a one-off, and all attacks that followed have been opportunistic wipers employed against wartime objectives with little regard for harmonising effects or truly supporting manoeuvring forces.

Cyber operations & electronic warfare

Claim 2: Cyberwarfare and electronic warfare are wartime siblings and share both history and use

Researchers underplay the crucial relationship between offensive cyber operations and electronic warfare. They are operational siblings. This relationship is more than a curiosity: offensive cyber operations can and should be used as an extension of electronic warfare in tactical scenarios. As battlefields become increasingly packed with transmitting equipment and data streams, combining electronic warfare and cyber capabilities offers significant military potential.

Electronic warfare has evolved well beyond simply transmitting disruptive patterns on the electromagnetic spectrum. Such capabilities can now produce meaningful data, resulting in feeding junk readings to undiscerning sensor software, overriding command and control telemetry, or exploiting protocol vulnerabilities. Considering electronic warfare may now impact the target’s software or even its underlying network, these tactics should be viewed at least partly through the lens of offensive cyber operations. More and more scholars and practitioners agree.

Civilian technology, including radios, phones, laptops, and drones, is commonplace on the battlefield. While practitioners often (rightly) mock the label “military-grade” as insubstantial, military hardware has often undergone useful “hardening” — investment to ensure survivability under harsh, adversarial circumstances. Civilian equivalents rarely have the same qualities, for good reason – a hobbyist using a commercial drone does not require the same anti-jamming defences that a fielded unit requires when directing deep artillery strikes. Yet nowadays, both may end up using the same equipment.

The explosive use of commercial off-the-shelf hardware and software in wartime sharpens my year-old argument. Tactical targeting of both civilian and military equipment by cyber-enabled electronic warfare will only become more frequent. These activities should be considered part of cyberwarfare, alongside the classic network intrusion approach.

An eager Russia

Claim 3: Russia is a prolific, technically capable cyber offensive actor, but consistently disappoints

Russia is often considered a top-tier user of offensive cyber capabilities. Perhaps controversially, I argued instead that they are severely hamstrung by their own operational culture. Russian cyber forces are operationally impatient and lack discipline. As a result, they often create massive collateral harm or radically undershoot their objectives.

In the past year, this claim has become even more evident. Nearly every major Russian cyber operation was riddled with issues. Even the Viasat attack was a sledgehammer where a scalpel may have fared better. Cascading impacts against a range of critical non-combatant targets demonstrated poor tradecraft and further codified Russia as an irresponsible belligerent. Russia has had limited success in fielding effective coordinated strategic operations following Viasat, a further indication that its forces are not up to the task. Opportunistic wipers that roughly correspond to targets of kinetic operations are of limited use to the Russian military campaign.

Moscow is still unable to overcome the limitations of its own operational culture. Strokes of technical brilliance are shrouded by internal competition, poor leadership demanding instant results, a disregard for consequences, and limited effective coordination of cyber and kinetic operations.

Comparably, Russian security services remain dangerous adversaries. Their eagerness to target civilian critical infrastructure and wanton disregard for collateral damage means that they pose a grave threat to both their intended targets and those who happen to share infrastructure, software, or equipment with their targets. However, their limited ability to consistently execute against military objectives means that they remain unproven in wartime.

An adaptive China

Claim 4: China is an adaptive, ascendant threat, one largely yet untested in conflict but attentive to lessons painfully learned by others

I previously claimed that China shows promise in its cohesion and adaptability. Chinese officials have marshalled their national resources to build up a potent cyber force. They have established software vulnerability pipelines, developed a quasi-private sector, and unified their military structure to conduct cyber operations effectively. Similarly, they have a proven track record of implementing lessons learned by others, including in the field of cyber operations.

However, we have yet to see what they can achieve. Although we have observed reasonably high-quality Chinese network operations for several years, we have little public evidence of bleeding-edge offensive operations indicative of an ability to degrade bespoke Western military hardware or networks.

Nonetheless, they appear to be getting better. Reporting from private-sector threat intelligence companies and the government suggest that Chinese tradecraft is improving. Some security companies note that Chinese intrusions are becoming harder to observe. Even when detected, Chinese threat actors demonstrate more mature efforts at evasion, persistence, and pursuit of objectives. This trajectory suggests that China’s longer-term military goals, such as its targeting of Taiwan, may have also matured. When paired with a robust Chinese doctrine and structure encouraging integrated use of offensive cyber within military operations, they are set up to do well.

Conclusion

Even short-term predictions in cyberspace are volatile. Public visibility is limited, and our experience short-lived. My assessments have held so far because each of my claims holistically examined each country — through doctrine, leaks, technical documents, geopolitical context, and visible operational activity. The most effective way to produce sustainable analysis in cybersecurity is by relying on the full range of sources our field has to offer.