Russian Cyberwar

The Center for European Policy Analysis (CEPA) recently published a 38-page study https://cepa.org/russian-cyberwarfare-unpacking-the-kremlins-capabilities by two esteemed researchers, Irina Borogan and Andrei Soldatov. The opening premise is that Russia has not demonstrated its cyber warfare adroitness in support of its invasion of Ukraine. Whether the Russians tried, and their efforts failed due to the capabilities of Ukraine’s cyber defenders or because leadership meddling disrupted the execution strategies of the professional cyber warriors, hasn’t yet been revealed. What is evident is that the Ukraine example has called into question the Russian playbook being technologically focused and suggests that the political quotient is much more in play than perhaps previously suggested.

In closing the report draws four conclusions:

* Russia does not have a true cyber command. There is no clear delineation of operational responsibility and no uniform system of reporting and accountability

* The organizational, strategic, and cultural differences that characterize Russia’s various military and security agencies in the conventional field do not carry over into cyber operations.

* The lack of a true cyber command appears to mean that agencies tend to apply conventional approaches to cyber, rather than developing command-and-control approaches tailored to the cyber domain.

*. Russia’s cyber-active state, quasi-state, and non-state cyber actors share roots in the Soviet and early post-Soviet SIGINT and cyber spheres — roots that continue to shape how Russian cyber functions to this day.