Russia’s President Vladimir Putin and Chief of the General Staff Gen. Valery Gerasimov at a military academy reception. Photo Credit: Mikhail Klimentyev/AFP via Getty Images
By: Madison Creery, Columnist
Although Russia’s latent cyber capabilities are only ranked sixth in the world, Russia is the second most active state in the realm of offensive cyber operations.[i] One of the top priorities of the US Department of Defense is, unsurprisingly, to counter and deter these very operations, which have been seen in Georgia, Ukraine, and even the U.S. itself.[ii] However, the U.S. cannot accomplish this objective without first understanding why and how Russia employs “cyberwarfare.” From its definition of “cyber” to its implementation of information warfare for strategic effect, Russia views this new domain differently than the U.S. A “one-size-fits-all” approach to countering offensive actions in cyberspace will, therefore, no longer work. The sooner the U.S. realizes this, the better.
Not “Cyberwarfare”
The U.S. tends to throw the terms “cyber” and “cyberwarfare” into mission statements, doctrines, and policy recommendations like it is confetti: There are “cyber” capabilities, “cyber” power, “cyberspace,” as well as “cyber” forces.[iii] The U.S. even has a “National Cyber Strategy.”[iv] However, when its adversary does not view its own actions as part of the “cyber” domain, there will inevitably be dissonance in both doctrine and employment of tactics. Russia sees its strategy of disrupting communications and manipulating information as a type of “informatization,” not cyber offense.[v] For them, cyber operations are not a separate form of warfare but one tool of many within the broader framework of information warfare. This holistic view of “informatization” includes computer network operations, electronic warfare, and psychological and information operations.[vi] The U.S., on the other hand, views cyber as a domain separate and distinct from information warfare and the psychological aspects associated with it.[vii]
This is important, as it shapes how a nation chooses to integrate classic “cyber” tools (such as worms, viruses, hacking, and espionage campaigns) with information and deception tactics. To Russia, they are one and the same.[viii] Classic cyber-attacks, such as DDoS assaults and website defacements, simply set the stage for information warfare.[ix] Consequently, Russian strategy does not prioritize “cyber Pearl Harbors” or one-time, major cyber-attacks. Russia instead sees a constant and unending struggle within the information space.[x] Indeed, Russia has continually “demonstrated a willingness to employ offensive cyber [capabilities] in situations other than war to affect political and economic outcomes.”[xi] How Russia integrates its information capabilities with traditional military action also varies greatly from the U.S.
The Gerasimov Doctrine: Combining Multiple Instruments of Power
In February 2013, General Valery Gerasimov, Russia’s Chief of the General Staff, famously coined the “Gerasimov Doctrine,” laying out Russia’s new theory of modern warfare.[xii] With a preference for manipulation through disruption and distortion, alongside an operational interest in deception and surprise, this approach seeks to create an environment of permanent unrest and conflict within an enemy state.[xiii] Unlike like the days of old, when large conventional forces dominated, General Gerasimov foresees a future battlefield largely shaped by nonmilitary means. To accomplish this goal, Gerasimov seeks to rebalance Russian strategy toward nonmilitary tools, suggesting a 4:1 ratio between nonmilitary (often influence operations, cyber, and covert action) and military action.[xiv] General-Lieutenant Andrey Kartapolov similarly suggested that Russia’s “new-type” warfare will involve 80-90% propaganda and only 10-20% violence.[xv] To the U.S., these numbers may seem too heavily biased toward nonmilitary capabilities as a means to achieve strategic objectives. However, Russia is not seeking to “win” in the traditional sense; it is not focused on defeating an enemy’s army. Instead, it is looking to sow discontent and chaos to win the political war of influencing and pressuring decision makers.[xvi]
According to Russian military doctrine, a major feature of modern military conflict is “the prior implementation of measures of information warfare in order to achieve political objectives without the utilization of military force” and shape adversaries’ behavior in a way that elicits a favorable response.[xvii] This does not require an overwhelming superiority in kinetic military forces but rather capable computer networks and information operations that can exploit opportunities to allow military forces to make greater gains on the ground.[xviii] This approach was evident during the 2014 Ukraine crisis: Cyberattacks against Crimea shut down its telecommunications infrastructure and disabled major Ukrainian websites before Russian forces entered the peninsula with relative ease. The targeted cyber-attacks also allowed Russia to briefly gain command of the information space, permitting it to shape the narrative within Crimea by painting itself as a “savior”.[xix] Though effective in sowing chaos and confusion in the targeted state, Russia does not employ its tactics of information warfare simply as a matter of principle but as a matter of necessity. Fighting protracted, conventional wars is simply a feat the Russian military simply cannot accomplish in its current state.[xx]
Closing the Gap in Conventional Capabilities
Despite Russia’s heavy investment in modernizing its military forces, there remains a gap between its conventional capabilities and those of the U.S.[xxi] Russia knows that it currently cannot compete head-to-head with the U.S. (economically, militarily, or technologically), so it creates new battlefields within the information space.[xxii] This approach can help neutralize, or at least offset, an enemy’s military superiority[xxiii] by creating possibilities for asymmetrically reducing the fighting potential of its adversaries through disruption attacks on communication nodes and the simple creation of chaos and distrust.[xxiv]
Given the differences between American and Russian conceptions of cyber as a strategic tool, the U.S. must modify its approach for countering offensive cyber operations. Most importantly, it needs to modify its policy of treating information warfare as a separate entity from cyber. Instead of engaging in dramatic cyberattacks, such as a “cyber Pearl Harbor,” Russia is practicing a new style of information operations that obscures and confuses its target.[xxv] The use of political warfare and nonmilitary means to undermine adversaries from within epitomizes the highest form of warfare: the ability to defeat an enemy without ever formally engaging their conventional forces.[xxvi] Although Russia may not have reached this level quite yet, its capabilities and tactics are continuing to improve. The U.S. needs to understand and adapt to this sooner rather than later.
[i] Brandon Valeriano, Benjamin Jensen, and Ryan C. Maness, Cyber Strategy: The Evolving Character of Power and Coercion (New York, N.Y.: Oxford University Press, 2018), 110.
[ii] “Summary of the 2018 National Defense Strategy of The United States of America: Sharpening the American Military’s Competitive Edge,” Department of Defense, 2018. https://dod.defense.gov/Portals/1/Documents/pubs/2018-National-Defense-Strategy-Summary.pdf.
[iii] “Summary: Department of Defense Cyber Strategy,” Department of Defense, 1. https://media.defense.gov/2018/Sep/18/2002041658/-1/-1/1/CYBER_STRATEGY_SUMMARY_FINAL.PDF.
[iv] “National Cyber Strategy of the United States of America,” White House, September 2018. https://www.whitehouse.gov/wp-content/uploads/2018/09/National-Cyber-Strategy.pdf.
[v] Michael Connell and Sarah Vogler, “Russia’s Approach to Cyber Warfare,” CAN Analysis & Solutions, March 2017, 3. https://www.cna.org/cna_files/pdf/DOP-2016-U-014231-1Rev.pdf.
[vi] Ibid, i.
[vii] Ibid, 5.
[viii] Ibid.
[ix] Valeriano, Jensen, and Maness, “Cyber Strategy,” 131.
[x] Connell and Vogler, “Russia’s Approach to Cyber,” i.
[xi] Ibid, 1.
[xii] Valeriano, Jensen, and Maness, “Cyber Strategy,” 114.
[xiii] Molly K. McKew, “The Gerasimov Doctrine: It’s Russia’s New Chaos Theory of Political Warfare. And It’s Probably Being Used on You,” Politico, September/October 2017. https://www.politico.com/magazine/story/2017/09/05/gerasimov-doctrine-russia-foreign-policy-215538.
[xiv] Valery V. Gerasimov, “Principal Trends in the Development of the Forms and Methods of Employing Armed Forces and Current Tasks of Military Science Regarding Their Improvement,” Vestnik Akademii Voennykh Nauk 1, no. 1 (2013): 24–29.
[xv] Lt. Col. Timothy Thomas (Ret.), “The Evolving Nature of Russia’s Way of War,” Army University Press, July/August 2017. https://www.armyupress.army.mil/Journals/Military-Review/English-Edition-Archives/July-August-2017/Thomas-Russias-Way-of-War/.
[xvi] Valeriano, Jensen, and Maness, “Cyber Strategy,” 111.
[xvii] The Military Doctrine of the Russian Federation, approved by Russian Federation presidential edict on February 5, 2010 (translated). http://carnegieendowment.org/files/2010russia_military_doctrine.pdf.
[xviii] Jen Weedon, “Beyond Cyber War: Russia’s Use of Strategic Cyber Espionage and Information Operations in Ukraine,” in Kenneth Geers (ed.), Cyber War in Perspective: Russian Aggression against Ukraine (Tallinn, Estonia: NATO Cooperative Cyber Defense Center of Excellence, 2015), 66.
[xix] Azhar Unwala and Shaheen Ghori, “Brandishing the Cybered Bear: Information War and the Russia-Ukraine Conflict,” Military Cyber Affairs 1, no. 1 (2015).
[xx] Keir Giles, 2017, “Assessing Russia’s Reorganized and Rearmed Military,” Carnegie Endowment for International Peace, May 2017.
[xxi] H. Reisinger and A. Golts, “Cutting Through the Fog: Reflexive Control and Russian STRATCOM in Ukraine,” Center for International Maritime Security, November 26, 2015, http://cimsec.org/cutting-fog-reflexive-control-russian-stratcom-ukraine/20156, 8.
[xxii] McKew, “The Gerasimov Doctrine,” 2017.
[xxiii] Reisinger and Golts, “Cutting Through the Fog,” 2.
[xxiv] Gerasimov, “Principal Trends,” 2013.
[xxv] Valeriano, Jensen, and Maness, “Cyber Strategy,” 131.
[xxvi] Amos C. Fox and Andrew J. Rossow, “Assessing Russian Hybrid Warfare: A Successful Tool for Limited War,” Small Wars Journal, August 8, 2016, https://fortunascorner.com/2016/08/09/assessing-russian-hybrid-warfare-a-successful-tool-for-limited-war/.