Last July, Juliette Kayyem, a security analyst and Senior Lecturer at the Harvard Kennedy School, raised the question of whether Russia’s persistent cyber and information operations against the United States should be viewed as acts of war. Specifically, she suggested that it was “legal fiction” to treat cyber attacks differently from physical attacks against a nation.
Kayyem made the case for changing our definition of warfare against the backdrop of a series of news stories earlier that year of successful Russian cyber operations against the United States. Last May, Russian operatives succeeded in shutting down the Colonial Pipeline, a fuel distribution system that delivers nearly half of the diesel, jet fuel, and other petroleum supplies across the East Coast. A few weeks later, they shut down JBS, the world’s largest meat producer, which supplies 20% of the nation’s beef. Both shutdowns were brief, but the point was made: Russia had proven its ability to shut down critical elements of our economic infrastructure, should they choose to do so.
More ominous than either of those attacks, however, was the massive “SolarWinds” cyber attack a year earlier. Unlike the ransomware attacks on the Colonial Pipeline and JBS, SolarWinds was a long-term operation in which cyber operatives of Russia’s GRU Military Intelligence Agency and SVR Foreign Intelligence Agency created their own back doors into the networks of hundreds of major corporations. Among the notable aspects of the SolarWinds attack was that the cyber-warriors did not actually do any particular damage once inside corporate networks. Rather, their presence, burrowed deep inside the operations of major companies, raised fears of what they might be capable of doing, should the time come.
As significant as these cyber operations may have been, Russia’s most significant achievement in the cyber realm has been the effectiveness of efforts by the GRU and the Kremlin-directed Internet Research Agency in undermining the social cohesion and stability of democracies across the world.
Kayyem’s argument last year that we were “at war” with Russia was hard for many to grasp. Even now, there is a surreal aspect of the Ukraine war. The barbarity of Russian assaults and the conduct of its soldiers on the ground seem to be a vestige of another era. The images of refugee families in colorful down jackets pulling their rolling luggage seem incongruous with our advanced, globalized world. It is a war without any apparent purpose in an era where war itself – old-fashioned war, with tanks rolling across open fields, cities fire-bombed, and families huddled in underground bunkers – seems to lack purpose. “War is an absurdity in the 21st century,” António Guterres, the Secretary-General of the United Nations, said while visiting the war-torn town of Bucha.
Perhaps that explains why, even as Russia has been hell-bent on destroying our democracy over the past decade, we have treated its operations against us as criminal matters under the jurisdiction of the Department of Justice rather than as acts of war. In the past four years, Robert Mueller and his team indicted twelve officers of the Russian GRU for election interference in 2018. The Department of Justice indicted four members of the FSB – the successor agency to the KGB – and six members of the GRU for a range of cyber operations in the US and across the globe, though in each case those charged were Russian nationals who never set foot in an American courtroom. Even our response to perhaps the most infamous GRU cyber operation, dubbed “Sandworm,” was undertaken through a court-authorized law enforcement operation by the Department of Justice rather than by the military.
As the war in Ukraine has escalated, President Biden has insisted time and again that we are not at war with Russia. It is a stance that has been met with an extraordinary degree of unanimity from Republicans and Democrats alike. Two weeks into Putin’s invasion, speaking on Fox News Sunday, Connecticut Democratic Senator Chris Murphy commented, “I think we need to be clear that we are not going to go to war with Russia,” while Iowa Republican Joni Ernst concurred. Over on ABC’s “This Week,” Florida Republican Marco Rubio summed up the consensus view: “It means starting World War III.”
Yet even as the DC political establishment appeared unified in the notion that war with Russia is unthinkable, there were two groups who fully embraced Juliette Kayyem’s assertion that Russia’s acts against us constituted acts of war: the US and Russian militaries.
Dating back at least a decade, the Russian armed forces have embraced a doctrine referred to as “Next Generation Warfare,” which is fully aligned with Kayyem’s perspective. Next Generation Warfare views cyber, psychological, and information operations (a generalized term encompassing propaganda, social media, and other activities designed to undermine social cohesion and political stability) as essential elements in a continuum of war-fighting tactics, at least as essential to achieving strategic outcomes as are troops on the ground.
In October 2016, just as Russian information operations targeting the 2016 presidential election were in full swing, military analysts at West Point published a report describing Russian cyber warfare and destabilization operations – referred to as “gray zone hybrid threats” – as an essential element of Russia’s strategic warfare doctrine. Those analysts highlighted one salient aspect of gray zone hybrid threats: “aggressors use ambiguity and leverage non-attribution to achieve strategic objectives while limiting counter-actions by other nation-states.”
Said another way, by assuring ambiguity surrounding what was done, how it was done, and who was doing it, Russia’s destabilization operations have left political parties across Europe and here at home at each other’s throats, with little focus on how previously functioning democracies are sliding into disarray. If Robert Mueller achieved anything in his arguably failed tenure as special counsel for the United States Department of Justice following the 2016 election, many of those indictments laid out elements of the Russian operation in fulsome detail.
Suffice it to say, if Russia has been at war with us for the better part of a decade, as Kayyem argued, the evidence suggests that its tactics have been successful. Russia has demonstrated its cyberwarfare capabilities – and increased public anxiety accordingly – with respect to its ability to disable core infrastructure systems. Its information operations, as intended, have undermined our ability as a nation to respond to an external threat, as the analysis of gray zone hybrid threats suggests. And, most significantly, Russia’s efforts to undermine both faith in and commitment to democracy across a large share of the electorate have borne fruit. While historians may yet assess whether Vladimir Putin, Donald Trump, or Mark Zuckerberg made the greatest contribution to the weakening of public faith in democracy in the United States, Russia’s success in turning profit-maximizing social media algorithms into weapons of mass destruction is unarguable.
The notion that the Colonial Pipeline and other cyber attacks represented the testing phase of an integrated military strategy became clear on the eve of Russia’s invasion. Energy “blackmail” – the ability to shut down natural gas pipelines, and turn off the lights and heat across Europe – has long loomed large as a weapon Russia could wield against European countries should it choose to do so. During the two-week period before the Russian military rolled into Ukraine, GRU hackers moved into high gear, launching an assault on liquified natural gas production facilities in the United States, operated by Chevron, Cheniere Energy, and Kinder Morgan, among others. Putin’s objective was straightforward: to shut off alternative sources of supply to Europe on the eve of the invasion, to maximize his leverage over the EU during the conflict to come.
None of this helps us resolve the fundamental dilemma of how to respond to a nuclear-armed state that believes itself to be at war with us, even if we don’t believe we are at war with them. This week, Putin’s Foreign Minister Sergei Lavrov repeated Russia’s thinly veiled threats to use nuclear weapons should the West continue to arm Ukraine, and Russia finds itself with its back against the wall. Like its cyberwarfare and information operations, the use of nuclear weapons is an integrated part of Russia’s warfighting doctrine. But unlike cyber warfare and the like, no one questions whether the use of nuclear weapons would constitute an act of war. And, of course, the threat to use nuclear weapons is itself a gray zone tactic, designed to undermine the ability of Russia’s adversaries to sustain a cohesive response to its war with Ukraine.
The choice Putin is offering the world is stark. Either cede to him the right he has demanded to impose Russia’s will on its neighbors, or he will take the world into the abyss.
But if there is a ray of hope, it is in the wake-up call Vladimir Putin has given the world. Just as his years of war against the West appeared to have borne fruit, and the liberal democratic order appeared to be losing ground across the globe – and just three months after he and China’s Xi Jinping declared victory for their authoritarian new world order – Putin’s invasion of Ukraine has reminded us how much is at stake.