Russian Cyber Operations. Scott Jasper
The lack of firm attribution to the Russian government does not change the legal classification of the cyber operations. Michael Schmitt and Liis Vihul find that “when cyber operations accompany kinetic hostilities qualifying as armed conflict (as with the conflict between Russia and Georgia in 2008), IHL [international humanitarian law] applies fully to all cyber operations that have a nexus to the conflict, whether they are launched by states, non-states groups or individual hackers.”107 For example, IHL prohibits injurious or destructive cyberattacks against civilians and civilian objects. This determination is consistent with Rule 80 of the Tallinn Manual 2.0, which delineates that “cyber operations executed in the context of an armed conflict are subject to the law of armed conflict.”108 The authors of the Tallinn Manual 2.0 agreed that “the law of armed conflict applied to the cyber operations that occurred during the international armed conflict between Georgia and Russia in 2008 . . . because they were undertaken in furtherance of those conflicts.”109 The term international armed conflict is appropriate because there were hostilities between two or more states.110
The problem in the Georgian case is that in order to hold a state—in this matter, Russia—responsible for the cyberattacks under the law of armed conflict, it must be established that the cyberattacks can be directly connected with a particular state. Eneken Tikk points out that “the governing principle of state responsibility under international law has been that the conduct of private actors—both entities and persons—is not attributable to the state unless the state has directly and explicitly delegated a part of its tasks and functions to a private entity.”111 She also states that the rules governing state responsibility codified into the 2001 Draft Articles on Responsibility of States for Internationally Wrongful Acts can be considered as a reflection of customary international law. Tikk concludes that in Georgia in 2008, as in Estonia in 2007, it has not been possible “to prove support by any certain state behind the cyber attacks.”112 Therefore, the cyber operations alone in both cases do not constitute a breach of what can be regarded as a state’s international duty so as to even qualify as an internationally wrongful act and justify the use of countermeasures in kind in response.
Investment Trends
The need to modernize the Russian military became obvious after its dismal tactical performance in Georgia in 2008. In direct-fire engagements, Georgian forces inflicted more damage on Russian units due to superior Georgian tanks and infantry fighting vehicles equipped with reactive armor and advanced radios and fire-control systems.113 In 2010, Russia embarked on an ambitious State Armament Program (SAP), setting a goal of 30 percent share of modern equipment (i.e., with advanced technology) by 2015 and 70 percent by 2020. Russia reached an actual share of 60 percent before President Putin approved the SAP 2018–27 in December 2017.114 The SAP emphasizes programs for the development of a viable twenty-first-century military, including the improvement of antiaccess capabilities.115 The SAP also funds six new nuclear or hypersonic weapon systems designed to penetrate and evade US antimissile defenses.116 However, the SAP is not just about new and more capable weapons but also “well trained, manned and equipped land, sea and air forces” for “rapid, high intensity conventional operations within a geographically limited zone.”117
Russia has showcased the newest weapon platforms in displays and parades. For instance, a military show in August 2018 just outside Moscow featured the latest fighter jet, the Su-27, and the Armata battle tank.118 A naval parade the previous month sent forty ships through waters near Saint Petersburg and anchored eleven more, including the guided-missile frigate Admiral Gorshkov, at parade formation.119 Shows of military force are impressive but can be questionable on substance, while actual operations prove the existence of true capability. The commander of US European Command told lawmakers in March 2018 that “at sea, on land, in the air—frankly, every domain—Russia’s increasingly modernized military is operating at levels not seen since the Cold War.”120 US Navy leaders concur by contending that “in terms of great power competition,” Russia operates its newest attack submarines in the North Atlantic “at a pace not seen since the Cold War.”121
Over a period of two years, Russia demonstrated the ability to strike into Syria from virtually all directions.122 In the Caspian Sea, the frigate Dagestan and three Buyan-M-class corvettes launched twenty-six Kaliber subsonic cruise missiles more than nine hundred miles into Syria.123 In the Mediterranean, Kaliber cruise missiles were launched by the frigate Admiral Grigorovich and the Kilo-class attack submarine Rostov-on-Don.124 In addition, Russian strategic bombers flying from northern Russia released Kaliber cruise missiles at targets in Syria.125 The Russian defense minister, Sergei Shoigu, said new Russian weapons have “proven their worth in the conflict.”126 Their impressive performance lends credence to a 2018 RAND Corporation report that “improvements in Russia’s military forces over the last decade have reduced the once-gaping qualitative and technological gaps between Russia and NATO.”127 However, the display of military power in Syria was by a finite number of units.
New air and surface platforms with similar advanced capabilities have suffered technical issues and funding shortages that have delayed or limited production. For instance, the stealth frigate Admiral Gorshkov was commissioned in July 2018, two years later than expected due to periodic funding shortages for the entire program.128 Also, it is uncertain whether compatibility problems with its Poliment-Redut air-defense missile system have been solved. The second ship in the Admiral Gorshkov class is delayed, and two more are uncertain to enter service since they depend on Ukrainian-made gas-turbine engines.129 In the aviation sector, President Putin has announced intentions for a modest buy of seventy-six Su-57 fifth-generation fighters by 2028.130 The aircraft is supposed to replace the MiG-29 and Su-27, with original plans to purchase 150 aircraft over a decade. The most likely reasons for the reduced acquisition are shifting defense priorities and budgetary deficits.
The hard reality is that while military modernization remains a priority, the Russian defense budget is severely constrained. While Russia seeks respect on the world stage with military forces that are comparable to those of the United States and NATO, President Putin reassures domestic audiences that defense spending will not rise at the expense of domestic priorities.131 From 2012 to 2015, increases in defense expenditures averaged 12 percent a year, but defense spending fell by 15 percent from 2015 to 2018, reducing allocations for modernization of the armed forces.132 Projections within the 2018–20 budget show defense expenditures falling from 3.8 percent of GDP in 2016 to 2.6 percent in 2020, their lowest level since 2008. While the SAP was ostensibly delayed for the last two years, the Kremlin shows no sign of abandoning modernization in approving $270 billion for the SAP 2018–27.133 However, for an energy-dependent economy, fluctuating oil prices could hinder aspirations for armament modernization, as oil plunged to a fifteen-month low in December 2018.134 While Russia will attempt to modernize its entire military, progress in 2019 will have been mostly “in its air defense, submarine and electronic warfare capabilities.”135 Consequently, the need for low-cost cyber operations will not necessarily fade away.
Conclusion
The restoration of Russia’s great power status is clearly connected to military power in Russian strategic culture.136 Therefore, conventional military and nuclear forces remain essential in the context of “Russian responses to perceived security challenges which are asymmetric in the broad sense.”137 Moscow has deployed antiaccess/area-denial (A2/AD) capabilities in the “strategic outposts” of the Kola Peninsula, Kaliningrad, and Crimea to dissuade, deter, or, if ordered, defeat third-party intervention.138 Famed historian Stephen Blank agrees that military forces play a vital role in Moscow’s strategic rivalry with Washington but not necessarily a primary role. He argues that “even as Moscow builds up its conventional and nuclear weapons . . . , it conducts an unrelenting asymmetric information and cyber warfare that targets key socio-political, infrastructural institutions