Don’t Ignore Ukraine: Lessons From the Borderland of the Internet

Most Americans might consider the events occurring in Ukraine—a distant conflict somewhere along the border between the Russian Federation and Western Europe—to be someone else’s problem. What that perspective fails to appreciate, however, is how these seemingly distant events set the stage for a new form of hybrid warfare that is already targeting Western citizens. Many of the techniques we are observing in Ukraine, especially those in the digital realm, are not meaningfully constrained by international borders; if left unchecked they could significantly undermine Western digital, physical, and political structures.

The characteristics of hybrid warfare are the flexible use of conventional, unconventional, political, and economic means to achieve strategic ends while avoiding broader international conflict. Ukraine’s experiences places it on the front lines of this new form of conflict—it has seen kinetic operations in Crimea and the Donbas; cyber attacks; unconventional tactics like targeted assassinations; distributed hit lists against Ukrainian officials, officers, and soldiers; and information operations directed against the population.

For the past ten days, our research team from the Army Cyber Institute has been on the ground in Ukraine meeting with NGOs, businesses, journalists, government ministries, universities, the army staff, and individual soldiers and civilians across the country. When the Petya cyber attacks began to wreak havoc across Ukraine’s civilian and business infrastructure, we were traveling on a rail line affected by the attack. While our travel was not interrupted, the incident dominated Ukrainian news outlets, radio, and conversation, providing an indication of the psychological impact of these events. This illustrates one of the central lessons of the conflict in Ukraine: individual cyber attacks may not cause devastating physical damage, but the toll they wage on the consciousness of a nation suffering under the weight of inflation, economic stagnation, and an ongoing conventional conflict combine to create a siege mentality. What we have found illustrates how cyber attacks, as an element of hybrid warfare create effects felt broadly requiring a response that integrates multiple actors across public and private spheres.

Ukraine has experienced an impressive number of cyber attacks. In the last two years, the Ukrainian energy grid has been attacked twice. Rail, financial, aviation, security, and civilian business sectors have also sustained robust attacks. These events significantly affect the everyday lives of the country’s citizens. Cyber attacks cut off electricity to hundreds of thousands of customers, rendered ATMs inoperative, and interfered with access to medical records. In one especially disruptive incident, millions of Ukrainians were unable to access their bank accounts during the New Year holiday, one of the most important celebrations in the country. While Ukraine has been able to limit the permanent physical damage caused by these attacks, they have eroded confidence in Ukrainian President Poroshenko’s administration as it tries to build democratic institutions in the midst of an ongoing conflict.

Nevertheless, Ukraine is resilient. It suffered immeasurably in the last century under the dual onslaught of Soviet and Nazi forces, losing nearly 16 million citizens to war and famine, the nuclear disaster at Chernobyl, two political revolutions, and the ongoing economic depression. Adding to its historic fortitude, polling indicates that the majority of Ukrainians possess a desire for a “Western” leaning national identity. These factors indicate that Ukraine is likely to weather the current crisis as well. However, the West should not and cannot afford to ignore the reality of what is happening in Ukraine, especially within its digital infrastructure.

Its psychological fortitude notwithstanding, Ukraine’s resilience to recent cyber attacks also stems from its relatively early stage of digital development. When our lead researcher served as a Peace Corps volunteer in Kupiyansk Region of Kharkiv Oblast from 2005 until 2007, Ukraine had a rudimentary internet infrastructure. Over the past decade, Ukraine’s digital connectivity has improved from very low penetration dial-up internet and GPRS/EDGE mobile networks to high-speed cable and 3G connectivity. Despite these technological leaps, Ukraine’s digital infrastructure pales in comparison with that of most Western countries, including the United States. Many of Ukraine’s critical infrastructure systems still feature non-digital fallbacks or bypass digital systems altogether. For example, when hackers disabled seven substations during a 2015 cyber attack on the regional electricity distribution company Ukrainian Kyivoblenergo, operators were able to manually override the digital SCADA systems to restore power to approximately 225,000 customers. These analog capabilities are not intentional, but they provide Ukraine with options in the face of a digital onslaught.

We are in the process of learning the myriad ways digital weapons can achieve political effects and manipulate the digital and physical environments within nations. The United States and many Western nations lack similar analog systems to fall back on in the event of an equivalent sustained attack. Long ago, we traded the resilience of non-digital back-up systems for digital convenience and modernization. This has resulted in substantial returns on investment and created new markets and efficiencies that propel our economies and societies forward. However, we must also realize that the internet in Ukraine and the internet in America are one and the same. The very same skills and tools, whether technical or informational, being used on foreign networks are also appearing in the United States and Western Europe. And yet our systemic vulnerabilities are far more expansive.

Ukraine—a nation whose name translates to “on the borderland” or “borderland”—is once again the frontier of a conflict that threatens to engulf the West. Unlike Ukraine’s absorption of the Mongol invasions in the 13th century, the digital invasions of the 20th century are being honed against Ukraine and then spreading into global networks. If we ignore the plight of Ukraine, we miss the opportunity to prepare to defend ourselves against future challenges that will substantially impact the political, economic, and societal structures that lie at the foundation of western culture.

The views expressed are those of the author and do not reflect the official policy or position of West Point, the Department of the Army, the Department of Defense, or the U.S. Government.