Russia:  The Cyber Global Protagonist

Since 1989, after Russia ceased military operations in the Afghanistan conflict, there was a period of reflection and soul searching amongst the country’s military and political leadership – not unlike the post-Vietnam era for the United States. Afghanistan was a quagmire: as Russia discovered and then the eastern powers realised in their failure at the hands of a vicious insurgency. While this period, between roughly 2001 to 2021 for western forces in Afghanistan and Iraq radically transformed western military doctrine, tactics, and equipment, the Russians were embroiled in their own post-Afghanistan conflicts and had begun to embrace cyber capabilities in several powerful ways.

The Chechen conflict began in 1994, and then after a lull was reignited in 2009. That provided a battleground in which to apply the hard lessons learned in fighting an insurgency. In the Second Chechen War, from 1999 to 2007, Moscow effectively insulated the Russian information space from outside influence – this included information warfare capabilities to ensure the public remained supportive of the conflict. [1] Then, in 2008, Russia invaded Georgia, specifically South Ossetia and Abkhazia, catching NATO off-guard with sudden cyber-attacks which were only hinted at by the Estonian DDoS attacks conducted the previous year.

The Russian invasion of Georgia was the first war in history in which cyber warfare coincided with military action and for the first-time cyber forces – supported by potentially outsourced or conscripted Russian cyber criminals – became part of the cyber force.[2] What we do know from public statements is that Russia’s “General Staff Main Intelligence Directorate’s (GRU) Main Centre for Special Technologies (GTsST, also known as Unit 74455 and Sandworm) carried out a widespread disruptive cyber-attack against the country of Georgia.[3] We are not certain exactly who was wearing uniforms. What we do know is the first wave of cyber-attacks launched against Georgian media sites were in-line with tactics that had been used in military operations: “cyber seizure” of the internet equivalent of TV and radio stations, regarded as the key sources of information…