Hooked! #11: Special law enforcement operation, groundbreaking cyber war, or just another day mowing America’s back lawn?

Hello! 

United States’ officials’ allusions to cyber operations in the days after the 3 January move to depose Venezuelan president Nicolás Maduro led to a predictable onslaught of chatter about ‘cyber war’ and explanatory viral videos with catchy, AI-vibes slogans like ‘Venezuela wasn’t defeated by bombs. It was defeated by software.’ 

However, when even the Daily Mail could only describe the possibilities of ‘Caracas’ revenge’ as ‘maybe doing some phishing, doing some DDoS’ and encouraged people in the US to ‘avoid suspicious emails and maintain strong passwords’, it became rather clear that we were not on the precipice of Digital World War III. The images accompanying the articles on cyber war tended toward the conventional (explosions, clouds of smoke, bombed out vehicles), and it seems unlikely that the 100 reported deaths stemmed from cyber effects. 

If the cyber aspects of the operation are confirmed, it will represent one of the first times the US government has openly acknowledged these capabilities, with Chairman of the Joint Chiefs of Staff Dan Caine saying that the US Cyber Command was involved in the ‘dismantling and disabling’ of air defence systems. President Donald Trump announced in a press conference that, ‘The lights of Caracas were largely turned off due to a certain expertise that we have. It was dark, and it was deadly,’ which many interpreted as confirmation of some form of cyberattack. 

The parallels to Russia’s cyber actions targeting energy infrastructure in Ukraine – covered in Binding Hook by Dan Black – can’t be ignored. 

Chinese cybersecurity company Antiy published a review of what might have happened, including historical background, concluding only – assuming the Google Translate version is accurate – that cyber intelligence gathering was an important component of the operation, and that cyberattacks may have been involved in the power outage and the disabling of air defence systems. 

At least one event initially identified as a possible pre-invasion cyberattack – a 2 January routing leak – turned out to be the likely result of ‘poor technical practices … rather than malfeasance’. (Meanwhile, the US has not taken credit for some earlier, rather impactful cyberattacks that the Venezuelans blamed them for, as well as a series of first Trump administration attacks, apparently an effort by the CIA to stave off the president’s urge to do something more aggressive. Now we know how that turned out.)

As Lennart Maschmeyer notes in a LinkedIn post, while a cyberattack is ‘absolutely plausible’, it’s not a given – the US has other non-cyber expertise and tools that could produce similar results. Maschmeyer adds that while the US may be able to disable the Russian air defence systems used in Venezuela, using that ability in this context ‘would also burn this capability for future use…’ Would it be worth wasting that capability on Maduro, a dictator that we had more or less happily put up with for 13 years?

Jon Lindsay highlights the question of worth in a couple of blogs, going into more detail about defence systems and the ‘use it and lose it’ aspect of cyber capabilities, as well as arguing that the operation would never have happened if it had required years of fighting and serious American dollars and lives. He adds that this ability to merge ‘sophisticated’ technologies with other complex moving parts in a highly efficient – and cheap – way also means such tools and operations are more likely to be used against ‘weaker targets who lack any meaningful strategic deterrent,’ that is ‘by the strong against the weak’ – a classic conundrum of offensive cyber.

Read Max van der Horst’s review of Lindsay’s Age of Deception

While we may never know the full extent of the role cyber played in the 3 January operation, it’s abundantly clear that the Trump administration wants to advertise its cyber prowess. Joshua Steinman, who served as senior director for cyber on the National Security Council in the first Trump administration, wrote on X, ‘This is it. Ten years of work. … When we re-architected the way the U.S. operates in cyberspace…, it was FOR THIS PURPOSE. To make cyber a tool of national power.’

In the absence of details, it is tempting to conclude that this glimpse of cyberwar was as much an information campaign as an operational one.

Taking US statements at face value, however, invites a different question. Assume offensive cyber operations were indeed used in Venezuela. That requires taking seriously the constraints sceptics routinely emphasise: long preparation timelines, uncertainty of effects in complex systems, and the risk of losing valuable exploits or tooling once operations are exposed. Against that backdrop, the puzzle is not whether cyber could have been used, but why it was considered worth using here.

One explanation is bureaucratic: a desire to demonstrate that cyber has finally matured into an operational tool of national power, even if the marginal military value was limited. Another is instrumental. Cyber operations can offer advantages that other options do not – covert disruption without immediate attribution, wide-scale effects without physical access or kinetic strikes, or temporary and reversible interference rather than permanent destruction. Framed this way, the episode is less about cyber’s decisiveness than about the conditions under which its advantages are judged to outweigh its drawbacks.

Until next month!

Katharine Khamhaengwong

Binding Hook Senior Editor

---

Read more Binding Hook on offensive cyber:

• Daniel Moore examines how the conclusions of his 2022 book Offensive Cyber Operations: Understanding Intangible Warfare stands a year after publication.
• Gil Baram and Noya Peer look at the cyber aspects of last year’s Iran-Israel war.
• David Kirichenko speaks with a member of Ukraine’s volunteer IT Army to learn more about their continued cyber successes. 
• Kamil Bojarski asks us to consider what we really mean when we use terms like ‘cyberattack’ versus ‘military operation’.