ARGUMENT: DIGITAL “SHOCK AND AWEThere Is No Cyber “Shock and Awe”: Plausible Threats in the Ukraine Conflict

People are talking about cyberwar again. Russia’s massive military buildup along Ukraine’s borders holds the potential of triggering the largest-scale military clash since World War II – and many analysts say that there is a potential for destabilizing and devastating cyberattacks preceding, accompanying, and following Russia’s military actions.

Lennart Maschmeyer and Nadita Kostyuk, writing in War on the Rocks, note that Jason Healey predicts that if Russia invades, “the opening salvo is likely to be with offensive cyber capabilities.” William Courtney and Peter A. Wilson from RAND warn of the “massive employment” of cyber warfare tools to create “shock and awe causing Ukraine’s defenses or will to fight to collapse.”

They note further that, accordingly, the United States and the United Kingdom have deployed cyber warfare teams to help Ukraine defend against an impending strategic cyber strike against critical infrastructure. Some go further, suggesting that Russia may not need to use military force at all, because cyberstrikes can “achieve much the same effect from across the border.” This assessment is apparently shared by policymakers working on countering the Russian threat to Ukraine, with an (anonymous) senior Biden administration official recently stating as much.

The add:

These predictions suggest that cyber operations will provide significant strategic advantages to Russia either as complements to military force, or as standalone instruments — or at least that policymakers and commentators think that they will. Current warnings of escalating cyber warfare conjure deep-seated fears of cyber doom and the recurring specter of a “cyber Pearl Harbor” strategic surprise attack. In practice, however, cyber warfare has been a failure. Our research shows that cyber operations have remained irrelevant on the battlefield, while standalone operations to weaken Ukraine through election interference, critical infrastructure sabotage, and economic disruption largely failed to contribute to Russia’s strategic goals of making Ukraine abandon its pro-European Union and pro-NATO foreign policy. Consequently, current fears of cyber warfare defy not only Russia’s track record in Ukraine, but also strategic logic. Given that Russia’s cyber operations have failed to produce significant strategic value to date, why would we expect this to suddenly change now? Or, to put it more pointedly: If cyber operations offer such effective and potent instruments, why did Russia go through the trouble (and costs) to mobilize its troops? Current predictions of cyber onslaught do not offer a persuasive answer.

Giving in to these fears risks fighting phantom threats, playing into Russia’s hands by distracting from the need to counter its military threat and sowing fear and confusion — at least among Western audiences. A level-headed analysis of the threat that distinguishes what is theoretically possible from what is practically feasible is urgently needed. Our research suggests that, contrary to hysteria, cyber operations will remain of secondary importance and at best provide marginal gains to Russia.

They conclude:

Cyber operations are not strategically irrelevant, nor are surprise cyber strikes of strategic relevance impossible. Rather, in assessing their threat we should distinguish what is possible in theory from what is feasible, and thus probable, in practice.

….

Exaggerated fears of hypothetical cyber strikes — either used as substitutes or complements to military operations — distract from the clear and observable threat of invasion and, in doing so, may trigger misallocation of valuable resources needed to respond to it. Perpetuating such fears also risks playing into Russia’s hands by exaggerating its cyber capabilities and distracting from the need to prioritize efforts to counter its military threat.