Cyberspace Operations Research Articles

What we mean

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

The future

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

The strategic utility of cyber operations

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

The cyber dimension of the Russia–Ukraine war

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

Responsible cyber power

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

A short history of cyber operations

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

Strategic risks

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

Maintaining balance

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

The UK model

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

Attacking the issue

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

The Use of Cyber Tools by the Russian Military: Lessons from the War against Ukraine and a Warning for NATO?

This article examines the Russian military’s Information Warfare (IW) activities. The particular focus here is on the use by this military of operations in cyberspace as a strategic force-multiplier. It seeks to shed light on why such operations are so important to this military and what goals it hopes to achieve through their use. In particular, this article highlights the role played by what Russian analysts refer to as cyber-psychological and cyber-technical opera- tions. Having established the background to the Russian military’s IW thinking, this article then goes on to examine the application of its cyberspace operations against Ukraine: both before the 2022 invasion and as part of it. It is from this examination of the cyber- attacks conducted against Ukraine that a better understanding of the potential of Russian IW can be generated. As such, lessons can be drawn from this conflict as to how, in the future, the Russian military might employ IW specifically against NATO states as part of a major kinetic confrontation. But, as this article notes, drawing lessons as to the actual strength of Russian IW capabilities from the Ukraine conflict may be a flawed process. It may be the case that the Russian military might not have shown its true cyber hand in Ukraine. It may be saving its best cyber tools for any future conflict with NATO itself.

The Offense-Defense Balance in Cyberspace

The study of cyber strategy and its implications for international security has become increasingly crucial, necessitating an examination of the unique challenges posed by the dynamic and stealthy nature of the cyber domain. This paper addresses whether offensive or defensive strategies prevail in cyberspace, especially in light of evolving technological landscapes and debates over cyber threats. By applying offense-defense theory from international relations, the research explores the nuanced relationship between offensive and defensive operations in cyberspace. Despite prevalent views favoring offense dominance, recent skepticism questions the severity of cyber threats and suggests a possible overemphasis on offensive operations. This paper systematically examines the core concepts, findings, and operational variables of offense-defense theory, providing clarity to the conceptual debates surrounding cyber conflict. Recognizing the unique characteristics of the cyber domain, it urges a careful consideration of biases that may distort judgments about offense dominance. The evolving nature of cyberspace and its potential for redesign introduces caution and underscores the need for a nuanced understanding of the offense-defense balance. The preliminary assessment concludes that the question of whether offense or defense "dominates" in cyberspace is overly simplistic. Given the intricate interactions of cyber capabilities, other coercive means available to states, and the dynamic evolution of cyber technology, this question can only be answered within specific contextual and chronological boundaries. Within such conditions, the state of the offense-defense balance is crucial to tactical and operational decision-making. At the strategic policymaking level, the more coherent question is how cyber technologies are shifting the balance of advantages between offense and defense in the overall military posture of states. In essence, this paper provides valuable insights into the ongoing discourse on cyber strategy, theoretical frameworks, and nuanced analyses to inform policy and strategic decision-making in the face of evolving cyber threats.

A Theory of Offensive Cyberspace Operations and Its Policy and Strategy Implications

The significance of Offensive Cyberspace Operations (OCO) in cyber warfare and national security is increasingly recognised, yet academic literature lacks a dedicated theoretical framework to fully articulate its unique aspects and strategic dimensions. Traditionally enveloped within the broader context of information warfare, OCO's distinct characteristics have often been overlooked. Addressing this gap, our paper aims to delineate the specificities of OCO and establish a structured conceptual model that enhances understanding and operational clarity. To achieve this, the study adopts an interpretive approach, drawing from existing literature on information warfare and cyberspace, alongside official U.S. government and military publications on cyberspace operations. Employing the theory-building method, we focus primarily on conceptualization. This involves creating a coherent conceptual framework through abstraction, synthesis, and diagramming, informed by seminal works in the field. Among the paper's key contributions are detailed conceptual models that shed light on OCO's integration within the broader cyber domain, the influence of U.S. policy and strategy on OCO, and the critical triad for successful operations: access, vulnerabilities, and payloads. Furthermore, we elucidate the primary and secondary components of OCO, specifically cyberspace attack and exploitation, offering new insights into their roles and implications. Thus, the framework includes conceptual maps highlighting OCO's key elements, relationships, and challenges, aiming to advance academic discourse, practical strategies, and policy in cyberspace operations. This effort marks a significant step forward in both theoretical engagement and practical application within the field.

Provisioning the external infrastructure for Cyberspace Operations. A spotlight on Russian APT groups

Provisioning the external infrastructure for Cyberspace Operations. A spotlight on Russian APT groups

The Legal Status and Targeting of Hacker Groups in the Russia-Ukraine Cyber Conflict

Abstract The armed conflict between Russia and Ukraine has been characterized by a considerable number of cyber operations by States and non-State actors in support to either party to the conflict. One year since the Russian invasion of Ukraine, the ‘Russia-Ukraine cyber conflict’ offers valuable insights for estimating the effectiveness of International Humanitarian Law in regulating the status and the conduct of individuals engaging in cyberspace operations during wartime. By discussing the status of hackers groups and individuals who have conducted cyber operations in support of Ukraine, this Article claims that the relevance of the concept of combatancy is diminished in the cyber domain, and that the notion of direct participation in hostilities must be adapted to the specific features of cyberspace. Furthermore, the article focuses on the issues relating to the targeting of individual who directly participate in hostilities by conducting cyber operations in support of Ukraine. By doing so, the Article argues that cyber direct participants place themselves at an increased risk of being attacked, even though the Russian armed forces are limited in their targeting decisions by the principles of proportionality and precaution.

Defining the "Cyber-Pearl Harbor" - Validation of the DSLP-framework in "Offensive Cyberspace Operations Targeting Ukraine: A Cyber Pearl-Harbor"

The use of cyberattacks against organizations, health care and individuals have increased along with the constant digitalisation. Nations have also fallen victim to cyberattacks, often combined with other means of war. A Cyber-Pearl Harbor (further shortened as CPH) is a term mentioned by the former United States Secretary of Defense, Mr. Leon Panetta, who described it as “combined attacks that result in human death and physical destruction and that paralyzes an entire nation”. Gazmend Huskaj used Panetta's definition in order to create a framework (herein the “DSLP-framework”) for classifying an event as a CPH. This study strives to see if the DSLP-framework can be validated since the term has been widely used for the last 25 years. However, a universal definition of the term seems to be missing, therefore it is not certain that the criteria presented in the framework is accurate. A qualitative case study was conducted through a literature review regarding the term CPH and semi structured interviews with three experts were done, which were later analysed through a thematic analysis. The framework was applied to three real life cases: a public health sector in Costa Rica, a TV-tower in Kyiv, Ukraine and the grocery company Coop in Sweden. The result from applying the DSLP-framework to each case was that only the case of TV-tower in Kiev, Ukraine, could be classified as a CPH. The following conclusions were drawn in this study: 1) The framework could not be validated due to lack of data, and 2) The interviewees views differed from the framework making it hard to find common ground.

Gentlemen, you can't fight in here. Or can you?: How cyberspace operations impact international security

AbstractThe military now views cyberspace as a new warfare domain, with constant cyber operations potentially causing significant consequences. Internationally, countries are heavily involved in cyberspace, but international law lags behind this evolution, raising questions about its application and retaliation measures. This article investigates international law in cyberspace and cyber operations in warfare and terrorism, exploring recent calls for increased legislation. The impact of cyberspace nonregulation on international security is examined from both positive and negative perspectives. It argues that solving anonymity and attribution issues requires state collaboration, with an initial step of cooperation against cyber‐terrorism. The conclusion emphasizes the necessity of cyberspace regulation and legislation for international and national security, offering a starting point for discussion.

The Russia-Ukraine Conflict from 2014 to 2023 and the Significance of a Strategic Victory in Cyberspace

The article explores Russian engagement in cyberspace during the conflict with Ukraine. Many experts have been surprised not only by the lack of coordination between offensive military operations in cyberspace and other domains, but also by the absence of significant cyberattacks. The central argument revolves around the perceived inadequacy of Russian capabilities. However, the authors contend that such an assessment is flawed and stems from the imposition of Western expectations onto a non-Western actor. They argue that the Russians’ employment of cyberspace not only aligns with their strategic culture but also represents a continuation of their utilisation of cyber as a tool for disinformation, which was previously observed during the war with Georgia in 2008 and the initial phase of the conflict with Ukraine in 2014. The aim of the article is threefold. Firstly, it discusses the Western strategic discourse regarding the potential use of cyberspace in warfare. In contrast to the position of Western experts, the second part of the article presents the Russian approach. The third section describes how the application of Russian cyber warfare concepts has played out in practice during the conflict in Ukraine.

A survey and characterization of Close Access Cyberspace Operations

A survey and characterization of Close Access Cyberspace Operations

Frequency Analysis of Russian Propaganda Telegram Channels

On 24 February 2022 Russia launched a full-scale invasion of Ukraine. In addition to large-scale military operations against Ukraine, many information attacks were organized. These attacks began before the invasion: for several months, Russia has been actively paving the way for the war by launching different types of information operations in cyberspace. As an example, Russian propaganda media were promoting the idea of “Russian world”, which calls into a question the existence of Ukraine as an independent state and justifies Russian military aggression. In this work, Russian propaganda Telegram channels were analyzed using term frequency analysis with bag-of-words technique. For this analysis, text data from Telegram propaganda channels was collected and processed. The obtained results revealed different patterns in Russian propaganda against Ukraine via Telegram channels.