Cyber Warfare

Cyber warfare is the use of digital attacks to disrupt, damage, deceive, or spy on an adversary. It ranges from stealing secrets to sabotaging physical infrastructure through the computers that control it, and it occupies a genuinely new and unsettled place in warfare, because it can produce real-world effects, blackouts, disabled equipment, corrupted data, without a soldier crossing a border or a missile leaving a rail, which makes it attractive precisely because it blurs the line between war and peace.

Stuxnet and the arrival of physical cyber attack

The moment cyber warfare stopped being theoretical was Stuxnet, the malicious code discovered around 2010 that had been sabotaging Iran's nuclear enrichment centrifuges by subtly manipulating their industrial controllers while showing operators normal readings. Widely attributed to a US-Israeli effort, Stuxnet demonstrated that a cyber attack could physically destroy equipment, quietly and deniably, an act of sabotage delivered entirely through code, and it changed how the world understood cyber warfare's potential. Since then the field has grown to include attacks on power grids, notably the Russian-attributed strikes that darkened parts of Ukraine in 2015 and 2016, on financial and government systems, and on the operational technology that runs pipelines, water systems, and factories, the physical infrastructure of a society, all reachable through the networks that control it.

Much of what is called cyber warfare, though, is actually espionage rather than attack, the theft of secrets on a massive scale, and the line between spying and warfare in cyberspace is one of the domain's persistent ambiguities. State actors continuously penetrate networks to steal military technology, government secrets, and commercial intellectual property, activity that is enormously damaging but sits below what anyone would call an act of war, and this gray zone, aggressive, harmful, but ambiguous, is where most cyber conflict actually lives.

The problems that make it dangerous and murky

Two features make cyber warfare especially difficult to govern. First, attribution: it is often genuinely hard to prove who launched an attack, because attackers route through compromised systems in other countries, use tools that others also possess, and operate through deniable proxies, which means the victim may not be able to convincingly identify the attacker, and without confident attribution, retaliation and deterrence both falter. Second, escalation and thresholds: nobody has firmly established what level of cyber attack constitutes an act of war warranting a military response, whether a devastating attack on a power grid could justify a physical counterattack, or how cyber operations fit the laws of armed conflict, and this ambiguity is exploited deliberately, with actors calibrating attacks to stay below the threshold that would trigger a forceful response. Ukraine has been the most intense cyber-warfare environment yet, with continuous attacks and defenses running alongside the physical war, and one lesson has been that cyber effects, while real, have been less decisive than some predicted, harassing and disrupting rather than delivering knockout blows, which has tempered earlier visions of cyberwar as a war-winning weapon.

Is cyber warfare a substitute for conventional force or a complement to it?

Increasingly it looks like a complement, integrated into conventional operations rather than replacing them. Early theorizing imagined cyber attacks might win wars on their own by paralyzing an enemy society, but experience, especially in Ukraine, suggests cyber effects are more useful woven into a broader campaign, disrupting communications, degrading systems, and enabling other operations, than as a standalone war-winner. Cyber warfare also serves powerfully in the gray zone below open conflict, letting states pressure, punish, and spy on each other without the risks of overt military action, which may be its most consequential role, a persistent, deniable form of conflict that never quite becomes war but never quite stops either.