A few days ago, David Frederick, executive director of U.S. Cyber Command, provided some interesting insights on the active cooperation between U.S. and Ukrainian armed forces in the cyber domain. Since the end of 2021, U.S. Cyber National Mission Force teams have been operating in Ukraine to strengthen local I.T. critical infrastructures. After the February 2022 Russian Invasion of Ukraine, the cooperation continued and deepened, with even more active intervention of U.S. military and private experts. From a strategic and international law point of view, this is very interesting and raises some questions.
Since the beginning of the invasion, many NATO countries have provided aid to the government of Kiev. This aid has been of an economic, food, and infrastructure nature, but above all, it has consisted of large arms supplies. The reaction of Moscow was immediately particularly harsh, affirming that the military supplies could trigger the enlargement of the conflict leading to a confrontation between the Russian Federation and the Atlantic Alliance. Furthermore, Russian rhetoric on the reasons for the invasion often refers to the presence of American forces in Ukrainian territory since 2014. But cybersecurity cooperation is never mentioned.
Ukraine has been the target of Russian cyber attacks for years, and everyone expected an intensification of these during the invasion. The only cyber attack worthy of note was the one against the KA-SAT network of Viasat, but in addition to the spread of some malware, the actions of Russian cyberwarfare, for the moment, have been minimal. Interestingly, though, the only major attack was on US-owned infrastructure, which did not lead to a widening conflict or a substantial increase in the U.S. or NATO intervention in Ukraine. So, to sum up, military aid to Ukraine in the cyber field has not generated any particular Russian reaction, just as the attack on an American space asset has not escalated the war. What does this mean?
This dynamic can be interpreted as evidence that cyberwarfare and space warfare are dominions of war still too unexplored by law and strategic sciences to be construed as conventional warfare tactics. This has severe consequences for the security of both critical and commercial infrastructure. In addition, there is a risk of crystallizing hybrid warfare practices between nations that are not openly belligerent. From a human security point of view, this leads to a lowering of societal resilience, while from an economic point of view risk of multiplying the costs of mitigation beyond the substantial financial losses.
Therefore, the war in Ukraine is the first conflict in history in which cyberspace and outer space are simultaneously active battlegrounds (and not passive as in previous wars like the First and Second Gulf Wars). This calls for in-depth reflection on the nature of war activities in these fields. For example, what is the red line separating an undeclared conflict from a real war? What assets are considered strategic? And, above all, can it happen that a nation deems an act of war a cyber or space attack that has indirectly caused human victims?