Russian Cyber Operations

Coding the Boundaries of Conflict

Scott Jasper

• Publisher: Georgetown University Press
• Year: 2020
• Print ISBN: 9781647122966, 9781626167971
• eBook ISBN: 9781626167995
• Topic: Politics & International Relations
• Subtopic: National Security
• Index: Politics & International Relations

Russia has deployed cyber operations to interfere in foreign elections, launch disinformation campaigns, and cripple neighboring states—all while maintaining a thin veneer of deniability and avoiding strikes that cross the line into acts of war. How should a targeted nation respond? In Russian Cyber Operations, Scott Jasper dives into the legal and technical maneuvers of Russian cyber strategies, proposing that nations develop solutions for resilience to withstand future attacks.

Jasper examines the place of cyber operations within Russia’s asymmetric arsenal and its use of hybrid and information warfare, considering examples from French and US presidential elections and the 2017 NotPetya mock ransomware attack, among others. A new preface to the paperback edition puts events since 2020 into context. Jasper shows that the international effort to counter these operations through sanctions and indictments has done little to alter Moscow’s behavior. Jasper instead proposes that nations use data correlation technologies in an integrated security platform to establish a more resilient defense.

Russian Cyber Operations provides a critical framework for determining whether Russian cyber campaigns and incidents rise to the level of armed conflict or operate at a lower level as a component of competition. Jasper’s work offers the national security community a robust plan of action critical to effectively mounting a durable defense against Russian cyber campaigns.

CHAPTER 1

Analytical Framework

Joel Brenner, a former counterintelligence leader for the US director of national intelligence, has noted that “cyber is one of the ways adversaries can attack us and retaliate in effective and nasty ways that are well below the threshold of an armed attack or laws of war.”¹ The term cyberattack is used in a colloquial sense in discussing cyber operations that refer to various types of “hostile or malicious cyber activities, such as the defacement of websites, network intrusions, the theft of private information, or the disruption of the provision of internet services.”² Therefore, cyber operations described as a “cyberattack” are not necessarily an “armed attack” or an “act of war.” They might qualify under thresholds and conditions for less severe classifications such as a “use of force” or an “internationally wrongful act.” The classification matters, for it determines under international law to what extent injured states can respond to a cyberattack—either with force in self-defense or by lesser means, known as countermeasures. Even though various legal conditions must be met, in any case, attribution to the responsible state under international law is a required condition for appropriate action.

Russian cyber operations exploit legal regimes to avoid thresholds and classifications that prompt or justify meaningful responses. They also use technical means to avoid attribution that is necessary for injured-state responses to an internationally wrongful act or any other type of unlawful attack under international law. The term attribution is defined simply as “determining the identity or location of an attacker.”³ Technical attribution is associated with indicators, such as tradecraft, code styles, domain registration, Internet Protocol (IP) ownership, resource language, and time zone information. Political attribution is more declaratory, usually based on cumulative or circumstantial evidence. For malicious actors, the goal is not only to avoid attribution but also to maintain anonymity for as long as possible during a cyber operation. Thus, in the cyber realm, anonymity infers not only the inability to identify an individual, group, or state actor but also the “inability to recognize an attack is occurring, and the inability to isolate the target or objective of the attack.”⁴ In order to thoroughly analyze and evaluate Russian cyber operations, this chapter will provide a technical (means used for intrusion, evasion, and deception) and legal (regimes for classification as an armed attack, a use of force, or an internationally wrongful act) framework. It will then demonstrate an application of the analytical framework to a case study of destructive Russian cyber operations against the energy sector in Ukraine.

Act of War

No clear legal definition exists for when exactly a cyberattack would constitute an act of war.⁵ US Code defines the term act of war to mean “any act occurring in the course of (A) declared war; (B) armed conflict, whether or not war has been declared, between two or more nations; or (C) armed conflict between military forces of any origin.”⁶ The term armed conflict infers an armed exchange. A more informal interpretation for an act of war is “a hostile interaction between two or more states.”⁷ The challenge is defining what cyber operations could prompt an initiation of armed conflict or a political declaration of war. In the physical domains, the answer might be more obvious. Take, for instance, the devastating attack on the American fleet at Pearl Harbor in 1941 that resulted in the US declaration of war against Japan.⁸ While metrics exist for what counts as a physical act of war, they do not exist for a cyber act of war.⁹

In May 2016, Sen. Mike Rounds introduced the Cyber Act of War Act of 2016, which is a bill “to require the President to develop a policy for determining when an action carried out in cyberspace constitutes an act of war against the United States.”¹⁰ A few months later, in September 2016, Marcel Lettre, undersecretary of defense for intelligence, declared at a Senate hearing that cyberattacks which “proximately result in a significant loss of life, injury, destruction of critical infrastructure, or serious economic impact should be closely assessed as to whether or not they would be considered an unlawful attack or an act of war.”¹¹ His statement affirms the reality that an assessment of what amounts to an act of war is “more a political judgement than a military or legal one.”¹² Professor Michael Schmitt and Liis Vihul, the chief executive officer of Cyber Law International, state that war is a “historical term that no longer enjoys the normative meaning associated with it for centuries, when the fact that states were ‘at war’ or had engaged in ‘an act of war’ meant that certain bodies of law, such as the law of war and neutrality law, applied.”¹³ Instead, “the traditional understanding of war has fallen into desuetude, replaced by a complex admixture of legal concepts.”¹⁴

After World War II, a normative scheme in the form of the Charter of the United Nations (UN) was crafted by the international community. The charter, combined with customary international law norms, dictates how and when states may employ force.¹⁵ The rules applicable during warfare were also reexamined by the international community, which abandoned the need for a declaration of war as the threshold for the application of the law of war.¹⁶ Instead, this body of law was relabeled the “law of armed conflict,” commonly referred to as “international humanitarian law,” which applies whenever armed conflict occurs. The United States has interpreted “armed conflict” according to Common Article 2 of the 1949 Geneva Convention to include “any situation in which there is hostile action between the armed forces of two parties, regardless of the duration, intensity or scope of the fighting.”¹⁷ Therefore, by these standards, “the concept of armed conflict implies forceful acts at whatever level.”¹⁸ For cyber operations to satisfy the armed criteria of armed conflict, they would have to result in injury or death of persons or damage or destruction of property. A host of legal regimes provide the basis for the further interpretation of how international law is applicable to cyber operations.

Legal Regimes

Article 2(4) of the UN Charter prohibits the use of force “against the territorial integrity or political independence of any state.”¹⁹ Unlike the charter, no similar international convention exists today for cyber operations. The closest consensus treatise is the Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (hereafter Tallinn Manual 2.0), written by lawyers, practitioners, and researchers, albeit primarily through Western perceptions, who called themselves the International Group of Experts. The aim of the Tallinn Manual 2.0 is to place existing international law, known as lex lata (the law as it exist...

Table of contents

• Cover
• Half title
• Title
• Copyright
• Contents
• List of Illustrations
• Foreword
• Acknowledgments
• List of Abbreviations
• Introduction. Below the Threshold
• 1 Analytical Framework
• Part I. Cyber Operations
• Part II. Security Dynamics
• Part III. Defensive Solutions
• Conclusion. A Different Approach
• Index
• About the Author