# What Ukraine Shows about Cyber Defense and Partnerships 

Fixation on the offensive aspects of cyber strategy obscures the key role of the defense in reducing cyber threats.

March 17, 2022 • Commentary 

By [Brandon Valeriano](https://www.cato.org/people/brandon-valeriano) and Erica D. Lonergan 

This article appeared in *[National Interest (Online)](https://nationalinterest.org/)* on March 17, 2022. 

Across two days of Congressional testimony on the intelligence community’s latest annual [threat assessment](https://www.dni.gov/index.php/newsroom/reports-publications/reports-publications-2022/item/2279-2022-annual-threat-assessment-of-the-u-s-intelligence-community), lawmakers peppered Gen. Paul Nakasone, Commander of U.S. Cyber Command and Director of the National Security Agency (NSA), with questions about the role of offensive cyber operations in the ongoing conflict in Ukraine. Much of the focus was on the apparent [lack](https://www.scmagazine.com/analysis/threat-intelligence/nsa-director-limited-russia-cyberattacks-so-far-but-threat-remains) of notable strategic Russian cyber operations against Ukraine’s critical infrastructure.

An important question raised by the Ukraine conflict regards its implications for the future of U.S. cyber strategy, particularly the Department of Defense’s “[defend forward](https://nationalinterest.org/feature/how-america-can-better-leverage-private-sector-against-cyber-threats-180344)” approach, which was launched in 2018. While much of the [debate](https://warontherocks.com/2018/09/defending-forward-the-2018-cyber-strategy-is-here/) surrounding this [concept](https://www.cfr.org/blog/implications-defending-forward-new-pentagon-cyber-strategy) has focused on the role of [offensive](https://academic.oup.com/cybersecurity/article/5/1/tyz008/5554878?login=true) cyber operations, collaboration with allies and partners is a critical but less publicly recognized element of defend forward. According to the [strategy](https://media.defense.gov/2018/Sep/18/2002041658/-1/-1/1/CYBER_STRATEGY_SUMMARY_FINAL.PDF), the Department of Defense “will work to strengthen the capacity of these allies and partners and increase \[the Department of Defense’s\] ability to leverage its partners’ unique skill, resources, capabilities, and perspectives.”

Since 2018, U.S. Cyber Command has reportedly conducted a number of joint cyber operations, ranging from working with the [United Kingdom](https://www.bbc.com/news/technology-59335332) to tackle [ransomware](https://www.nytimes.com/2021/12/05/us/politics/us-military-ransomware-cyber-command.html) groups to conducting “hunt forward” cyber operations with allies like [Estonia](https://www.cybercom.mil/Media/News/Article/2433245/hunt-forward-estonia-estonia-us-strengthen-partnership-in-cyber-domain-with-joi/) and [Montenegro](https://www.cybercom.mil/Media/News/News-Display/Article/2002939/us-montenegro-work-together-to-defend-against-malicious-cyber-actors/) to defend against shared cyber threats. This collaboration represents an evident path forward for U.S. cyber strategy after the war in Ukraine.

**Absence of Offensive Attacks With Strategic Impacts**

Fixation on the offensive aspects of cyber strategy obscures the key role of the defense in reducing cyber threats.

With many policymakers and experts holding onto ideas about the [efficacy](https://www.lawfareblog.com/understanding-offenses-systemwide-advantage-cyberspace) of offensive cyber operations during wartime, [observers](https://www.washingtonpost.com/technology/2022/02/28/internet-war-cyber-russia-ukraine/) have been [perplexed](https://www.washingtonpost.com/politics/2022/03/03/11-reasons-we-havent-seen-big-russian-cyberattacks-yet/) at the lack, so far, of cyber operations launched at scale against Ukraine. This is particularly surprising, given that Russian [strategic thinking](https://stratcomcoe.org/cuploads/pfiles/Nato-Cyber-Report_15-06-2021.pdf) conceptualizes a role for cyber operations in targeting critical infrastructure and command and control systems as an enabler of or [complement](https://oxford.universitypressscholarship.com/view/10.1093/oso/9780190618094.001.0001/oso-9780190618094) to conventional military force.

Indeed, U.S. and European officials alike have noted that cyber warfare has not been a [significant](https://www.cybersecuritydive.com/news/ukraine-cyberattacks-limited/620101/) feature of Russia’s initial campaign. For instance, Nakasone is reported to have [testified](https://www.cnn.com/europe/live-news/ukraine-russia-putin-news-03-08-22/h_74886d0a4d035d6e42578f31677c6f51) that although Russia conducted “several” cyberattacks against Ukraine in recent weeks, the level of hacking was not “what we had anticipated” before the war began. Reporters noted that he subsequently clarified that the NSA has observed [three to four](https://www.cnn.com/europe/live-news/ukraine-russia-putin-news-03-08-22/h_74886d0a4d035d6e42578f31677c6f51) Russian cyberattacks against Ukraine and warned about the potential for future [ransomware](https://nationalinterest.org/blog/techland-when-great-power-competition-meets-digital-world/ransomware-payments-keep) attacks. [EU officials](https://www.wsj.com/livecoverage/russia-ukraine-latest-news-2022-03-09/card/cyberattacks-don-t-appear-to-have-increased-so-far-in-ukraine-war-eu-says-mHV8L58ppVwINzQoQzpX) have likewise noted that they “haven’t seen a significant increase in cyberattacks.”

**The Potential Success of Cyber Defense**

A number of potential [hypotheses](https://www.washingtonpost.com/politics/2022/03/07/putins-invasion-ukraine-didnt-rely-cyber-warfare-heres-why/) could account for the absence of large-scale cyber warfare in the initial stages of Russia’s campaign. As we have noted [elsewhere](https://www.washingtonpost.com/politics/2022/03/07/putins-invasion-ukraine-didnt-rely-cyber-warfare-heres-why/), the [logic](https://www.tandfonline.com/doi/abs/10.1080/09636412.2017.1306396?journalCode=fsst20) behind leveraging cyber for [decisive effects](https://oxford.universitypressscholarship.com/view/10.1093/oso/9780190618094.001.0001/oso-9780190618094) on the battlefield lacks empirical support. Past [behavior](https://www.tandfonline.com/doi/abs/10.1080/01402390.2018.1559152) demonstrates that while cyber activities can be useful for undermining trust, gaining an information advantage, or causing disruption, they have [little impact](https://journals.sagepub.com/doi/abs/10.1177/0022002717737138) on the battlefield. One hypothesis in particular warrants further exploration: the role of successful cyber [defense](https://nationalinterest.org/blog/techland-when-great-power-competition-meets-digital-world/russian-cyber-war-ukraine-was-fantasy) and resilience in Ukraine.

A persistent—but erroneous—assumption about cyberspace is that the offense has an advantage over the defense. Many experts depict cyberspace as an “[offense-superior domain](https://watermark.silverchair.com/isec_a_00138.pdf?token=AQECAHi208BE49Ooan9kkhW_Ercy7Dm3ZL_9Cf3qfKAc485ysgAAAp8wggKbBgkqhkiG9w0BBwagggKMMIICiAIBADCCAoEGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMF-MqWNqeuKSJSo2kAgEQgIICUpZGxcBHsF6Kq3K1-hYJR57ATJIuEgN4F8Ly6WkBmJeLYxyrTaGSP9vPUxNoulB_ORgWOrLszZGgI0H8wLcmQ-L_PO0vkOBFy0sRlQxWM6_0RnErhM1q5btujrm4XZBsQZYqh43UD6AvBPsGCW6KrsWIeCDyRq417LIBsJaoj8i74VWi1fILiHI2sYxGvBiIJqdEMqG590JA_ZnHqLE4XzJZYxAnAjmPcVYD-tAl2fZ7HqBy2PkJaSQCwbvkdXsV1I_0G6rT2dzoVF1FHuXGSsLC3kc7ApqQEXW5WoolzLIcdy8o9qWMMrLPka3sQdR2O4V1islNWKZY2_yXD0Li907EFkDO7TZf8SBJjuBz98RG5LkuIvj99stuV6gmhv2RDZMtkj43U5JXCvEs0hWfkslwDcQM8KHGXLX2R48ontz376e5qYTWlgpT-G7GceDjyu5iU0VFHBICeR19wVNQhTOcL3TxIxOt9flGP-rYEO2lDf6SsZvUievLDAnQoPWl3NPmeaQIUklpEp6RTZZ8-muHY9O676hPCZ9zKQv315ZbOcNb01ZG7YXAgbCUBwGAHLvTnG8PjUeflJXQI_gBhP2C7D2teDJibWS_GW-G0B7bTmObzs1tmQX7C591VrBhYUgBKyBOAzFC81KkecNsbQTAOj3lnj5-MdR1R6uxlC3CeqYPgIls05WaoYdhaIJk-9Yrs9aLqv5dfXqCg9vmpqdmppyVqTBcEhrsPQJcm8O5iREc5Dz5aqgKB0l-Gm-LhgHAcc1POUuonIatOqFM9XgvUg),” where attacks happen quickly and, often, with [little warning](https://warontherocks.com/2022/01/preparing-for-inevitable-cyber-surprise/). But many [political scientists](https://offensivecyber.org/2021/12/20/does-the-cyber-offense-have-the-advantage/) are skeptical, particularly given the [time](https://academic.oup.com/cybersecurity/article/3/1/19/3003367?login=true), [resources](https://www.airuniversity.af.edu/Portals/10/SSQ/documents/Volume-13_Issue-3/Borghard.pdf), and [skill](https://direct.mit.edu/isec/article-abstract/41/3/72/12149/What-Is-the-Cyber-Offense-Defense-Balance?redirectedFrom=fulltext) that successful cyber offense—especially at the strategic level—can demand.

Some senior leaders seem to think that the lack of Russian cyberwar is due to the success of Ukraine’s defense. Nakasone [noted](https://www.nytimes.com/2022/03/08/us/politics/us-intelligence-russia-ukraine.html) that this success in minimizing cyber activity might be due to “some of the work that others have been able to do to prevent \[Russian\] actions.” However, he did not elaborate on what specific “work” might have been done or the “others” that may have been involved.

There have been numerous media reports indicating that the United States has been assisting Ukraine in its cyber defense efforts for several months. After reporting last [December](https://www.nytimes.com/2021/12/20/us/politics/russia-ukraine-cyberattacks.html) that U.S. Cyber Command would be supporting Ukrainian network operators, the *New York Times* [reported](https://www.nytimes.com/2022/03/06/us/politics/us-ukraine-weapons.html) on March 7 that “forces from United States Cyber Command known as ‘cybermission teams’ are in place to interfere with Russia’s digital attacks and communications—but measuring their success rate is difficult.”

The [*Financial Times*](https://www.ft.com/content/1fb2f592-4806-42fd-a6d5-735578651471) notes that “officials in Ukraine and the U.S. are careful to describe the work of the ‘cybermission teams’ as defensive,” with successes reportedly including protecting Ukrainian rail systems as they evacuate civilians and providing support to thwart distributed denial of service (DDoS) attacks. In addition to protective moves by the United States, tech giants in the [private sector](https://www.cnbc.com/2022/02/28/microsoft-says-it-informed-the-ukrainian-government-about-cyberattacks.html) and Ukraine’s [“](https://www.wired.com/story/ukraine-it-army-russia-war-cyberattacks-ddos/)[IT Army](https://www.wired.com/story/ukraine-it-army-russia-war-cyberattacks-ddos/)” appear to be factors in limiting the potential scale of Russia’s offensive cyber operations. But it is an open question just how far the United States can go in supporting Ukraine without becoming more directly involved in the war. As [Kim Zetter](https://zetter.substack.com/) puts it in [*Politico*](https://www.politico.com/news/2022/03/12/cyber-russia-hacking-security-00016598), now is not the time to “poke around and find out.”

**Implications for U.S. Cyber Strategy**

It will take time to sort out the [factors](https://www.nytimes.com/2022/03/11/opinion/russia-ukraine-cyberattacks.html) that account for the lack of significant Russian cyberattacks in the first few weeks of the war in Ukraine. However, if the evidence ultimately supports Nakasone’s initial contention that successful cyber defense—conducted not only by Ukraine but also by “other” parties—played a role in mitigating Russia’s cyber threat, then there are two important implications for the [future](https://www.solarium.gov/report) of U.S. cyber [strategy](https://www.lawfareblog.com/layered-cyber-deterrence-strategy-securing-connectivity-21st-century).

First, investing in cyber defense and resilience—especially in anticipation of impending adversary actions—is not a fool’s errand. Second, there are opportunities for the Department of Defense to build on existing international partnerships as part of its defending forward concept. These tasks are mutually reinforcing; anticipatory defensive measures depend on early warning, which is enabled by the kind of shared understanding of the threat environment that comes with working with other stakeholders—especially allies and partners that may be closer to or have better knowledge of adversary cyber activity.

Therefore, fixation on the offensive aspects of the Department of Defense’s cyber strategy obscures the key role of the defense in reducing cyber threats. Indeed, defensive collaboration is a critical enabling factor in the defend forward strategy and should be prioritized even more in the wake of [Russia’s invasion](https://nationalinterest.org/feature/why-putin-miscalculated-ukraine-201216) of Ukraine.

Ukraine is now [joining](https://ccdcoe.org/news/2022/ukraine-to-be-accepted-as-a-contributing-participant-to-nato-ccdcoe/) NATO’s Cooperative Cyber Defense Centre of Excellence as a contributing participant after a unanimous vote in favor of Ukrainian membership. Moving forward, it is imperative for the United States to take collaboration seriously by institutionalizing multilateral and bilateral agreements with partner states and making such agreements central to its cyber strategy. [Shaping the environment](https://www.solarium.gov/) in favor of the defense is a path toward stability amid the instability witnessed in outright warfare.

##### About the Authors 

[![Brandon Valeriano](/sites/cato.org/files/styles/author_picture/public/2021-01/Brandon%20Valeriano.jpg?itok=uWBnrysC)](/people/brandon-valeriano) 

##### [Brandon Valeriano](/people/brandon-valeriano)

Former Senior Fellow, Cato Institute

##### Erica D. Lonergan 

Research Scholar, Saltzman Institute of War and Peace Studies at Columbia University.