Continuum Cyber Ukraine analysis

False Equivalencies

The first step to examining the tensions surrounding Ukraine is to realise that foreign policy commentators in many outlets need to stop linking the fates of Taiwan and Ukraine.[1] These commentators argue that if Washington doesn't deter Russian aggression in Ukraine, it will encourage Chinese adventurism and ultimately undermine America's ability to defend Taiwan. The same media critics who asserted that the withdrawal from Afghanistan would lead to similar situations are now calling for Ukraine intervention for the same reasons. For these commentators, it is a matter of American credibility.[2]

However, analyses like these focus on superficial similarities between the two situations rather than their fundamental differences. Indeed, both Taiwan and Ukraine as Western-oriented democracies face existential threats from great autocratic powers that view them as territories inherently belonging to them or their sphere of influence. Effective analysis of foreign and defence concerns and policy lies in recognising significant differences where they exist. The US has been committed to the protection and independence of Taiwan since the 1950s, twice threatening atomic war in its defence.[3] Even after the normalisation of relations with mainland China in 1978 and the termination of diplomatic relations with the Republic of China (Taiwan), in 1979, the US Congress passed the Taiwan Relations Act that committed the US to "resist any resort to force or other forms of coercion that would jeopardize [sic] the security, or the social or economic system, of the people on Taiwan." [4]

In contrast, US relations with Ukraine began in 1991, and there are no acts that commit the US to the defence of Ukraine. However, the Budapest Memorandum provides some "security assurances" to Ukraine in exchange for their handover of former Soviet Nuclear Weapons. While there has been discussion about possibly inviting Ukraine to join NATO, this has never eventuated. Bluntly put, unlike Taiwan, the independence of Ukraine is not a vital security concern for the US. Any commentary that attempts to link these situations is just the latest iteration of the discredited domino theory that saw the US and its allies overextend themselves and face defeat in Southeast Asia in the 50s, 60s, and 70s.[5]

Cyberwarfare in Ukraine

Ukraine faces threats on two fronts from Russia — traditional kinetic force and cyberspace. Russia is well known for using Ukraine as a testing ground for new cyber tactics and weapons, particularly since they recognise the potential of cyberattacks to destabilise a country and create dissent amongst the population.

The multiple coordinated attacks on Ukrainian government infrastructure in January is interesting as it may very well be the first public example of multiple types of attacks, not directly linked by the same penetration and coordinated in an effects-based operation.[6] The attacks seem to be a cyber variant of 'terror bombing' that sees the collective punishment of a civilian population to apply political pressure against their leaders. This is usually only effective in a limited war scenario where the population does not accept the costs of violence as an acceptable price for the war effort. However, in an existential or total war scenario, the people will draw closer together against a common enemy.[7] The US firebombing of Tokyo on March 9/10 is a perfect example of this. Unlike US bombings in Europe, this attack deliberately targeted residential areas from the outset. It resulted in the greater indiscriminate loss of life than the atomic bombs or missions like Dresden. The total war setting of these attacks prevented surrender until the horrors of the nuclear bombs broke Japanese leadership.

However, the recent large-scale Russian cyberattacks on Ukraine were hardly a cyber-atomic-bomb, as poor coordination diluted the effectiveness of threats made. These attacks saw the defacement of Ukrainian government infrastructure wherein hackers left behind messages warning Kyiv to "expect the worst" [8] and threats to leak data.[9] Early reports from Ukraine demonstrated that no data had been accessed, and the threat was simply an empty one. The fact that the attack was a website defacement also supports this analysis as there is typically nothing to steal from a web server or CRM system.[10] On Jan 15, a datawiper malware attack masquerading as ransomware affected multiple systems and networks in an unspecified number of Ukrainian government agencies.[11] Kyiv has attributed the attacks to Russia, revealing that the attackers penetrated government systems through a shared software supplier supply-chain attack[12]. However, the delay between the attacks resulted in them being interpreted differently[13] — at least initially. Ukraine's attribution of the attack to Russia suggests that the defacement was a diversionary tactic despite the low sophistication level.

Though unique due to multiple forms of attack, this attack is only the latest in an eight-year-long list dating from after the 2014 annexation of the Crimean peninsula. Indeed, the first ten months of 2021 alone saw 288,000 cyberattacks on Ukraine, with Russian-state backed groups linked to the rising tide of cyberattacks. However, it should be noted that accurately attributing cyberattacks is extraordinarily difficult.[14] Though Ukraine's citizens are certainly weary, they are determined to stand against Russia.[15] It seems that if 'terror bombing' was, in fact, one of the intentions of the January attacks, alongside other more tangible considerations, then it has done little to place pressure on political leaders. If even the world's first instance of a power grid provider being taken out by a cyberattack, the 2015 Ivano-Frankivsk Oblast attack, which left 225,000 people without power for 6 hours in the dead of winter, couldn't accomplish this, then not much will.[16]

Russia has extensive experience in hybrid warfare that utilises cyberattacks in conjunction with kinetic force. While invading Georgia in 2008, Russia knocked out nearly every bank and government website for the duration of the war. Similarly, during the annexation of the Crimean peninsula, Kremlin-backed hackers disrupted communications whilst soldiers carried out their operations.[17]

Conclusion

Is the Russian build-up of military forces and mass cyberattacks the prelude to war? This is difficult to say with certainty. The Russian elite holds Ukraine as an intrinsic part of the Russian sphere of influence for historical and cultural reasons. In pushing for this conceptualisation of Ukraine, both President Vladimir Putin and former President Dmitry Medvedev published texts this year arguing that Ukraine belongs to Russia.[18] Additionally, like Belarus, Ukraine acts as a buffer zone between Russia and NATO. Therefore, Ukraine's continuing Western pivot presents an apparent threat to Russia.[19]

The military build-up, for now, seems to be a way to force Ukraine and NATO's hand. Russia has realised that eight years of subterfuge, proxy war, information warfare, economic attacks, and multiple world-first cyberattacks have done little to deter Kyiv from turning to the West. Hence, Russia seeks to manufacture a crisis situation that can only be solved with Russia's help or on its terms — a method of strategic manipulation they are well versed in.[20]

References

[1] https://warontherocks.com/2022/01/taiwan-is-not-ukraine-stop-linking-their-fates-together/

[2] ibid

[3] https://thediplomat.com/2022/01/the-difference-between-ukraine-and-taiwan/

[4] ibid

[5] ibid

[6] https://gru.gq/2022/01/16/ukraine-my-heart-cyber-just-for-show/

[7] ibid

[8] https://kyivindependent.com/national/is-ukraine-ready-for-cyberwar-with-russia-fears-mount-as-military-build-up-continues/?cn-reloaded=1

[9] https://gru.gq/2022/01/16/ukraine-my-heart-cyber-just-for-show/

[10] ibid

[11] ibid; https://www.aljazeera.com/news/2022/1/16/ukraine-claims-russia-behind-cyberattack-in-hybrid-war