The war in Ukraine serves as a stark reminder of the diverging approaches to establishing red lines in the realm of cyber operations, accentuating the complexities inherent in establishing normative frameworks for governing cyberspace. The intersection of cyber warfare with traditional kinetic conflict further exacerbates the complexities of norm development, underlining the urgent need for sustained efforts to bridge gaps and address grey areas in international law.

In the contemporary landscape of warfare, the lines between traditional kinetic operations and cyber warfare are increasingly blurred. Last year alone, the Security Service of Ukraine (SBU) thwarted over 4,500 major cyber-attacks. Many of these cyber-attacks were coupled with scores of conventional missile strikes. This underlines the urgent need for international cooperation to confront cyber threats.

Had Moscow used cyber operations to substitute kinetic operations in February 2022, we would have seen a full-blown cyber war instead of a conventional invasion. In fact, the consequences of the pre-war period were modest and most of the actions taken seemed to be rushed or poorly planned. Russia failed to achieve its strategic objectives using cyber operations and the Kremlin concluded that its only option was to launch a military campaign.

At the 2013 meeting of senior Russian and American defence officials, General Nikolai Makarov ridiculed the lack of information warfare in the US Cyber Command’s (USCYBERCOM) mission. In his provocative speech he told his counterparts, “one uses information to destroy nations, not networks” and taunted that the omission of information warfare proves the Americans’ ignorance. That was also a clear message about Russian priorities for cyberspace, which were later reflected in Russian strategic documents and also applied in Ukraine in 2022.