The Subversive Trilemma: Why Cyber Operations Fall Short of Expectations

For three decades, states have engaged in cyber conflict, yet the strategic utility of cyber operations remains unclear. Strategic utility refers to measurable contributions toward a state's political goals or shifts in the balance of power.¹ Similar to the 1920s–1940s air power debates, scholars have expected new technology to revolutionize conflict and provide independent utility.² When warplanes first emerged, some experts predicted the end of conventional warfare because airplanes were able “to strike mortal blows to the heart of the enemy at lightning speed.”³ Similarly, when the World Wide Web gained popularity in the 1990s, some analysts predicted a future of cyberwar in which “neither mass nor mobility but information” would become decisive.⁴ Subsequent theorizing envisioned strategic cyber strikes similar to strategic aerial attacks, shaping fears of a “cyber Pearl Harbor.”⁵ There is, however, a key difference between the two. World War II demonstrated the terribly destructive capacity of aerial bombing, confirming its combat effectiveness (or the capacity to destroy target sets).⁶ Consequently, scholarly debate has primarily examined “whether the destruction of target sets attains political goals.”⁷ In contrast, “cyber wars” remain hypothetical, the combat effectiveness of cyber operations remains unproven, and scholars increasingly question their utility in warfare.⁸

Instead, a new “cyber revolutionary” school of thought asserts that information technology revolutionizes conflict short of war by increasing the effectiveness of nonmilitary instruments. Lucas Kello argues that “the virtual weapon is expanding the range of possible harm and outcomes between the concepts of war and peace,” creating a novel strategic state of “unpeace.”⁹ Despite its different focus, this new revolutionary thesis rests on remarkably similar assumptions about the operational effectiveness of cyber operations as the cyberwar theories that preceded it. Operational effectiveness concerns the capacity to produce desired effects against a target set. As I will show, cyberwar and cyber revolution scholars expect three key properties of information technologies to provide superior operational effectiveness: the speed of communication, the global scope and scale of computer networks, and the ease of online anonymity.¹⁰ Information technology has produced significant economic efficiencies, and revolutionary scholars expect comparable gains in effectiveness by employing the technology in conflict. A key instrument of utilizing information technology in security competition is cyber operations, which I define as the exploitation of vulnerabilities in information and communications technologies (ICTs) to produce desired outcomes against adversaries.¹¹ Because the revolutionary thesis posits that information technology increases effectiveness, its adherents expect cyber operations to expand the independent strategic utility of instruments short of war. As Richard Harknett and Max Smeets conclude, “cyber operations and campaigns can be pivotal in world affairs by independently … supporting the maintenance or alteration of the balance of power … without having to resort to military violence.”¹² Just as cyberwars failed to manifest in practice, however, empirical evidence for this cyber revolution remains scarce. On the contrary, a growing body of research shows how cyber operations seem to fall short of their promise, both in warfare and conflict short of war.¹³

I argue that the reason for this shortfall lies at the operational level of conflict, whereby actors deploy combinations of tactics to attain strategic goals.¹⁴ Stephen Biddle has shown how operational mechanisms are crucial for determining the strategic utility of new technologies in conventional war, and I contend the same applies to cyber conflict.¹⁵ Prevailing expectations tend to focus on the strategic promise of new technology, but they overlook the operational mechanisms required to fulfil it. In this article, I show that the mismatch between promise and practice is the consequence of the subversive nature of cyber operations, whose operational trilemma limits strategic utility. Cyber operations produce outcomes by exploiting vulnerabilities in computer systems and the way they are embedded in modern societies.¹⁶ This mechanism is commonly known as hacking.¹⁷ Hacking may appear to be a novel instrument, yet its primary reliance on exploitation reveals its parallels to subversion.¹⁸

Subversion is an understudied instrument of power used in nonmilitary covert operations. Consequently, the field of international relations lacks a theory of subversion. Building on existing work in intelligence studies, this article develops such a theory and shows why cyber operations rely on subversion. It demonstrates that the defining characteristic of subversion is its reliance on the secret exploitation of vulnerabilities in a system of rules. Accordingly, I define subversion as exploiting vulnerabilities to secretly infiltrate a system of rules and practices in order to control, manipulate, and use the system to produce detrimental effects against an adversary. In traditional subversion, states target social systems. Typically, states have used undercover spies to infiltrate groups and institutions, establish influence within the latter, and then use this influence to produce desired outcomes against an adversary.¹⁹ Although cyber operations target a different kind of system, I show that the mechanism of exploitation has the same subversive characteristics.

Subversion's reliance on exploitation distinguishes it from warfare and diplomacy, the two classic instruments of power in security competition. Subversion holds great strategic promise because of two key properties of exploitation: its secrecy and indirect reliance on adversary systems. Secrecy can be either covert (the identity of the actor is obscured) or clandestine (the activity itself is obscured).²⁰ Existing research identifies two strategic benefits of secrecy: it lowers states' escalation risks and reputation costs for intervening in the affairs of their adversaries.²¹ The indirect nature of exploitation also lowers resource costs compared to the use of force. It is indirect because subversive actors produce effects through exploited systems. Subversion leverages an adversary's own capabilities against its own systems to produce effects. These effects range from influencing government policies and public opinion to degrading material capabilities through sabotage to undermining institutional efficiency and effectiveness.²² In short, subversion promises a less expensive and less risky alternative to warfare that states can use to actively interfere in their adversaries' affairs and attempt to shift the balance of power when diplomacy falls short. Cyber operations share this promise. Because various social, political, and physical processes are increasingly computerized, subverting these computer systems can produce a range of physical, political, and economic effects. Cyber revolutionary theory accordingly expects cyber operations to offer a low-risk and low-cost, yet highly effective, instrument for conducting sabotage, political interference, and economic disruption.

Yet, I identify an operational trilemma that tends to prevent subversion from fulfilling this promise, and this article shows why cyber operations also face this trilemma. The same characteristics that enable the promise of subversion (i.e., its secret and indirect nature) require significant efforts to establish and maintain. These efforts constrain operational effectiveness across three key variables. First, they slow operational speed, defined as the time required from starting an operation until it produces effects. Second, they constrain the intensity of effects, determined by both scope and scale. Scope concerns the severity of effects against individual targets, and scale comprises the number of targets affected and thus the scale of societal impact.²³ Third, efforts to maintain secrecy and exploit systems limit control, defined as the extent of control over a targeted system, and over the effects produced through this system.

These constraints pose a trilemma for actors because the three variables (i.e., speed, intensity of effects, and control) are negatively correlated—a gain in one variable tends to produce losses across the other two variables. For example, the higher the operational speed, the less intensity and control actors tend to achieve. As mentioned, the revolutionary thesis expects information technology to enable high-speed cyber operations with large-scale effects under a mantle of secrecy. In practice, however, the trilemma prevents actors from achieving these properties all at once. Consequently, in most circumstances cyber operations fall short of their strategic promise and provide, at best, limited strategic utility.

I test this theory through an in-depth case study of the ongoing Russo-Ukrainian conflict. This protracted conflict started in 2013, and it includes five major disruptive cyber operations that attempted election interference, sabotage, and economic dislocation. As a paradigmatic example of cyber-enabled low-intensity conflict involving one of the world's leading cyber powers, Russia, against a much weaker adversary, one would most expect to observe the utility of cyber operations. With its long duration and multiple cyber operations in a real-world “test lab” of cyber conflict, the constraints of the trilemma are least likely to apply.²⁴ Consequently, the Russo-Ukrainian conflict is a crucial case.²⁵ I introduce and use a systematic framework to measure operational effectiveness across the variables of speed, intensity, and control, and I triangulate strategic utility. The case study leverages rich original data from field interviews with experts in Ukraine, leaked Russian documents and emails, and forensic reports. Evidence from these sources supports my theory that the subversive trilemma constrains operational effectiveness and limits strategic utility.

This article makes three main contributions. First, it furthers the current debate in cybersecurity between cyber revolutionaries and an emerging rival thesis of “cyber evolution,” whose proponents point out the general strategic continuity between cyber conflict and intelligence contests.²⁶ The theory of the subversive trilemma clarifies what types of intelligence operations cyber operations reproduce, and how operational constraints limit their strategic utility. Second, the theory contributes to security studies by clarifying the strategic role of cyber operations as instruments of subversion that promise an effective alternative to force yet offer limited utility in practice. The theory of subversion also contributes to international relations, which has neglected the topic. Third, the article adds rich empirical evidence on the mechanisms, constraints, and utility of cyber operations that will be useful for both cybersecurity and international security scholars.

The argument proceeds as follows. First, I outline how expectations about the strategic utility of cyber operations have evolved. Second, I develop the theory of subversion from which I derive a set of expectations and hypotheses. This section also specifies the research design and empirical strategy. Third, I present the case study, which examines the operational effectiveness and strategic utility of cyber operations in the Russo-Ukrainian conflict. I conclude with a discussion of alternate explanations and potential limitations of the study before laying out the implications for international security.

Cybersecurity scholars' expectations concerning the strategic utility of cyber operations have shifted from warfare to conflict short of war. Initial research expected cyber operations to provide independent utility in warfare, enabling strategic cyber strikes and offering an offensive advantage.²⁷ Such cyberwar theorizing rested on three assumptions about the effectiveness of cyber operations: information technology enabled unrivaled operational speed compared to conventional warfare,²⁸ while the Internet's design facilitates anonymity²⁹ and its global scale allows actors to disrupt or damage targets at massive scale.³⁰ Accordingly, other scholars assumed that the same three properties also offered strategic utility as complements to the use of force.³¹ But scenarios of cyberwar and escalation did not manifest in practice. Instead, the intensity of cyber conflict has remained below the threshold of war.³²

Cyber revolution theory proposes, accordingly, that cyber operations offer states a newly effective instrument in competition short of war, revolutionizing the way states compete.³³ Although they consider different types of conflict, revolutionary scholars and cyberwar theorists base their arguments on remarkably similar assumptions. Cyber revolution scholars emphasize how information technologies increase the speed,³⁴ scale,³⁵ and relative ease of anonymity³⁶ of instruments short of war, enhancing their effectiveness and elevating their strategic utility. In particular, Michael Fischerkeller and Richard Harknett suggest that technological change has expanded the scope and scale of intelligence operations to such an extent that it constitutes a “difference in kind” in strategic utility,³⁷ while Michael Warner suggests that information technology may have “fixed covert action's problem of scale.”³⁸ Ben Buchanan goes as far as proclaiming the advent of a “new form of statecraft,” whereby “one of the primary ways governments shape geopolitics is by hacking other countries.”³⁹ The underlying assumptions about the strategic promise of information technology continue to be widely shared yet rarely tested empirically. Moreover, the scarce empirical work on key cases indicates the limited effectiveness and utility of cyber operations.⁴⁰

A rival set of scholars argues that cyber operations are merely an evolution of covert operations.⁴¹ While this perspective specifies the larger strategic space (i.e., intelligence contests), it still lacks a theory about the operational mechanisms and strategic utility of cyber operations. Intelligence operations encompass a broad range of activities, from passive information collection to active interference,⁴² and cyber operations cannot likely reproduce all of them equally well. As Loch Johnson has shown, covert operations have been deployed to produce a wide range of effects, from influencing public opinion to sabotage to full-blown secret wars.⁴³ Importantly, evolution theory does not clarify which of these effects cyber operations can and cannot produce, and thus their strategic utility remains unclear. Current scholarship on covert operations focuses primarily on military operations.⁴⁴ Yet, the premise of the current shift in scholarly attention toward conflict short of war is the emerging consensus that cyber operations are relatively ineffective and irrelevant in warfare.⁴⁵ Hence, cyber operations are not likely to be useful substitutes for military covert operations. Rather, as the next section shows, cyber operations are nonmilitary instruments of subversion.

In this section, I develop the theory of subversion. I show how both subversion and cyber operations rely on secret exploitation and face an operational trilemma that limits their strategic promise. There is no general theory about subversion, and the scholarly work on the topic is scarce. Existing studies either tie their definition of subversion to a specific goal, the overthrow of governments from within,⁴⁶ or they examine its use in specific contexts, such as using nonstate proxies to undermine state authority⁴⁷ or great power competition.⁴⁸ But Cold War scholar Paul Blackstock identified a common operational mechanism used in subversive operations regardless of specific goals or context that offers a foundation for a general theory: the secret exploitation of political or social vulnerabilities.⁴⁹ While Cold War subversion primarily targeted entire political systems, any system of rules and practices is potentially vulnerable to subversion because it contains flaws that allow subversive actors to infiltrate and manipulate the system in unexpected ways. The main system of rules targeted by traditional subversion are institutions, and recent research has examined the use of subversion against institutions of all kinds.⁵⁰ If exploitation is successful, subversive actors can use the targeted systems to produce detrimental effects against an adversary, without revealing either their identity or the subversive activity itself.⁵¹ Subversion is thus covert and clandestine. For example, a spy might become an employee at an industrial facility and gain access to machinery that they manipulate to damage the facility and possibly surrounding areas, but they hide the subversion by making it look like an accident.

Cyber operations rely on the same mechanism of secret exploitation, but they target computer systems rather than political systems. Exploitation is possible because the behavior of computer systems is determined by different layers of code, consisting of logical rules and instructions.⁵² Hacking, the central instrument used in cyber operations as commonly defined, involves secretly exploiting flaws in these rules to make computer systems behave in unintended ways.⁵³ In practice, hackers establish undetected and unauthorized access and control over an adversary's computer systems, which they manipulate to produce detrimental effects against the adversary. For example, hackers might target computer systems that control physical machinery and manipulate their operation in a way that damages or destroys the machinery. The 2010 Stuxnet operation that sabotaged Iranian nuclear enrichment centrifuges with a computer virus offers a key example.⁵⁴ In addition to targeting technical vulnerabilities in computer systems, hackers also use “social engineering” to exploit pathologies in human behavior to get people to unwittingly provide access to systems.⁵⁵ Phishing emails are a classic example.⁵⁶ Cyber operations thus share the core characteristics of subversion, namely the reliance on secret exploitation and the indirect use of adversary systems to produce effects. Accordingly, cyber operations are an instrument of subversion—and technical experts routinely refer to hacking as subversion.⁵⁷

The secret and indirect nature of exploitation distinguishes subversion from the two classic instruments of power in world politics: warfare and diplomacy (see table 1). In the words of Carl von Clausewitz, war is “the use of physical force to compel an enemy to one's will.”⁵⁸ It shifts the balance of power by destroying adversaries' material capabilities. Warfare typically involves direct interaction, but states can also covertly pursue “secret wars.”⁵⁹ In contrast, diplomacy relies on direct and overt forms of communication to exert influence through reasoned discourse, bargaining, or signaling.⁶⁰ Diplomacy shifts the balance of power through alliances and international law.⁶¹

Strategically, subversion promises a way for states to intervene in adversary affairs when diplomacy falls short to produce results, and yet at lower risks and costs than going to war. The secret and indirect nature of exploitation enables this promise. As discussed, secrecy reduces escalation risks and lowers reputational costs. The indirect nature of exploitation adds a third benefit: lower resource costs, since effects are produced through adversary systems, rather than one's own material capabilities. Subversion can provide independent strategic utility by undermining, manipulating, or disrupting the institutions that modern societies depend on, weakening adversaries or influencing their foreign policy. Cyber subversion holds the same promise, as revolutionary scholars emphasize.

In practice, subversion tends to fall short of its promise. Blackstock noted in 1964 that scholars and policymakers have “greatly overestimated” the effectiveness and utility of subversion,⁶² and more recent quantitative studies document the high failure rate of subversive operations.⁶³ The reason for this failure, I argue, is a subversive trilemma that constrains effectiveness and limits strategic utility. As this section shows, cyber subversion faces the same trilemma.

The indirect and secret nature of exploitation that enable the strategic promise of subversion require significant efforts to establish and maintain. In general, secrecy in covert operations requires extra “time, skills, an money.”⁶⁴ Subversion requires further efforts because it depends on secrecy to succeed. Whereas secret warfare operates on a spectrum of secrecy and can continue even when the cover has been blown,⁶⁵ discovery of a subversive operation typically means failure. I argue that this constraint applies to cyber subversion as well. In traditional subversion, the victim can arrest the spy involved;⁶⁶ in cyber subversion, victims can delete computer viruses and “patch” vulnerabilities.⁶⁷

To fulfil the promise of secret exploitation, I find that actors must meet four distinct challenges that constrain operational effectiveness. They must identify suitable vulnerabilities in a system designed by others, exploit them without being detected, establish access and control over the system without detection, and maintain control to produce effects through this system that achieve their desired outcomes. As detailed below, these four challenges constrain operational effectiveness across three variables: operational speed, intensity of effects, and control.

First, speed is limited because identifying vulnerabilities and developing means of exploitation requires reconnaissance and learning how target systems function. Both processes take time. Spies have had to learn new languages or skills to infiltrate institutions.⁶⁸ Hackers similarly study how complex computer systems function and write code to exploit them, which can take months.⁶⁹ Moreover, cyber subversion may require more time than traditional subversion because hackers cannot use force to override logic in programming code if their means of exploitation fails.⁷⁰ In contrast, spies can use limited force to gain access, such as by blackmailing individuals or forcing open a door.

Second, the need to establish access to target systems without detection limits the intensity of effects. In general, only effect types for which suitable target systems exist are possible. If there are no vulnerable institutions that control physical machinery within a targeted state, traditional subversion cannot produce physical effects. This constraint applies to cyber subversion as well, whereby only those social and physical processes controlled by computers are within reach. Even for vulnerable targets, the scope and scale of effects that actors can produce through a target system depend on the scope and scale of their access to the system. Expanding the scope and scale of access increases discovery risks, however, thus limiting the maximum intensity that can be achieved without discovery. In traditional subversion, for example, Lindsey O'Rourke identifies a resulting dilemma between the scale of an operation and the need for secrecy.⁷¹ I expect the same to apply to cyber subversion. Undoubtedly, cyber operations facilitate a greater scale of effects compared to traditional subversion because computer viruses can multiply and spread automatically.⁷² This capacity does not negate the dilemma between secrecy and scale, however; the more systems that are affected, the more likely one of the affected victims will discover the compromise. Moreover, automated proliferation may spread beyond its intended targets. Accordingly, the infamous Stuxnet malware was discovered by a Belarusian antivirus firm because it spread, apparently accidentally, far beyond the targeted nuclear enrichment plant in Natanz.⁷³

Third, the need to avoid discovery and the indirect production of effects via manipulation of a target system limit control, both over the system itself and the effects produced through it. A subversive actor's control over a target system is never absolute because, as discussed, upon discovery the victim can neutralize it. Even if it remains undiscovered, however, subversive actors can only establish control over those parts of the system with which they have become familiar. A spy may be unable to gain access to a targeted organization or may lack the language skills required for infiltration.⁷⁴ Likewise, hackers may be unfamiliar with certain computer systems and find no way to access them. Most importantly, subversive actors do not have full control over effects for two reasons. First, they may lose control over the subversive agent. Pressure from undercover work may prompt spies to behave erratically or defect.⁷⁵ Although they don't have feelings, computer viruses used in cyber subversion may similarly go rogue. The Morris Worm of 1988, for example, was designed as a harmless network mapping tool, but its automated spread combined with bandwidth-consuming activity caused massive unintended disruptions across the early Internet.⁷⁶ Finally, because actors have limited control over target systems, these systems may respond unexpectedly to manipulation, which risks causing the subversion to either fail to produce the desired effect or create negative and unintended consequences.

Crucially, these constraining variables of speed, intensity, and control are negatively correlated, producing a subversive trilemma. As illustrated in figure 1, holding all else equal, improving one variable tends to produce corresponding losses across the remaining variables. Increasing operational speed means less time for reconnaissance and development, which increases the risk of making mistakes and that targets will discover the subversion, both of which decrease control. Increasing intensity requires actors to expand the scope or scale of access to systems, which increases discovery risks. Lowering discovery risks for a given effects intensity tends to increase development time requirements, which reduces speed. Moreover, increasing control usually reduces speed because hackers need more time for reconnaissance and development plus extra efforts to avoid collateral damage by limiting the scale of effects and, thus, intensity.

This subversive trilemma constrains operational effectiveness and thus severely limits the strategic utility that subversion can achieve in practice. Speed, intensity, and control are essential components of operational effectiveness, yet each of these variables can lead to mission failure and no more than two can be maximized at once. Increasing both speed and intensity proportionally “doubly” decreases control, for example, because the more intense the possible effects are, the more sensitive the target and the more challenging the undetected exploitation is likely to be. Hence, pursuing both maximum intensity and speed makes it highly likely that an operation either fails to produce a strategically significant outcome or produces unintended consequences that impose further costs. Conversely, maximizing both control and speed is likely to constrain intensity to such a degree that it is extremely unlikely to produce a strategically significant outcome. Maximizing both intensity and control in turn tends to reduce speed to a glacial pace. Accordingly, forensic evidence indicates that the carefully calibrated Stuxnet operation took five years to develop.⁷⁷ In theory, operations that maximize intensity and control are most likely to produce significant strategic gains, but in practice, their glacial pace renders them mostly useless in urgent crises and makes premature discovery probable. If high speed is necessary, such operations are likely unable to go after the most sensitive targets because they require significant reconnaissance and development time, and the scope of control that they have over a given target system is also limited. Meanwhile, more intense effect types, such as damage or disruption, involve greater risk of collateral damage or unintended consequences. Maximizing control requires either avoiding such effect types or restricting use to fewer and less sensitive targets—both of which reduce effect intensity.

Because of this trilemma, like traditional subversion, cyber subversion is unlikely to deliver on its strategic promise except in “unicorn” scenarios in which hackers are both exceptionally skilled and exceptionally lucky. Otherwise, in line with the different configurations of the trilemma outlined above, cyber operations will tend to be too slow, too low in intensity, or too unreliable to provide significant utility.

My theory refines cyber evolution theory by specifying a distinct set of operational characteristics that shape strategic utility. It produces three expectations and three corresponding hypotheses for the case analysis. First, like cyber revolution theory, I expect states to primarily deploy cyber operations independently from diplomacy and warfare. Unlike cyberwar theories, I expect states to primarily use cyber operations as part of subversive campaigns against nonmilitary targets. Second, I expect the operational variables of speed, intensity, and control to be negatively correlated. Specifically, the different permutations of this trilemma produce the following hypotheses: increasing speed tends to decrease intensity and control (H1); increasing intensity tends to decrease speed and control (H2); increasing control tends to decrease intensity and speed (H3); and increasing two variables tends to doubly decrease the remaining variable (H4). Evidence supporting these hypotheses across different cyber operations would support my theory, whereas evidence of operations scoring high across all three variables, or actors achieving simultaneous increases across all three variables would support cyber revolution theory or cyberwar theory (for operations deployed for warfare). Third, I expect most cyber operations to fall short of providing measurable strategic utility, and I expect the subversive trilemma to be a key limiting factor.

I test these expectations in a case study of the Russo-Ukrainian conflict, which started in 2013. The five cyber operations within the case provide internal variation and allow within-case comparison. The Russo-Ukrainian conflict is a paradigmatic case of cyber-enabled limited conflict that occupies the gray zone between peace and conventional war, in which cyber revolution theorists expect cyber operations to provide added utility.⁷⁸ Four of the cyber operations in this case are attributed to Sandworm, which is an advanced hacker group that is in turn attributed to Russia's Glavnoye Razvedyvatelnoye Upravlenie (GRU) intelligence service.⁷⁹ Russia is a leading cyber power that is known for having a high tolerance for risk,⁸⁰ and the Sandworm group is one of the world's most skilled and most dangerous hacking groups.⁸¹ I expect the constraints of the subversive trilemma to be less pronounced in this case for several reasons. In addition to the linguistic and cultural similarities between the two countries, Russian spies have penetrated Ukrainian institutions, and many Ukrainian industrial facilities rely on Russian technologies.⁸² Moreover, Sandworm had seven years to adapt and improve its tradecraft. Hence, the conditions render cyber operations most likely to demonstrate their effectiveness and utility, while the constraints of subversion I identify are least likely to apply compared to conflicts with less favorable conditions.

I proceed in three steps. First, I verify whether and how Russia deployed cyber operations in coordination with its diplomatic and military efforts. Second, I measure relative operational speed, intensity, and control to assess whether and how the subversive trilemma constrained effectiveness. I base my measurement for speed on how much time elapses between when the hackers start to develop the cyber operation and when it concludes. To measure intensity, I track both scope (i.e., degree of intrusiveness) and scale (i.e., number of affected devices and individuals). I follow Loch Johnson's escalation ladder of covert operations, which ranks thirty-eight different types of operations according to their intrusiveness (the lower the rank, the higher the intrusiveness) and groups them according to risk.⁸³ Finally, I use four key indicators to measure control: premature discovery, failure to produce effects, time to neutralize effects, and collateral damage.

Third, to evaluate strategic utility I analyze whether and how cyber operations contribute to Russia's strategic goals and/or cause a shift in the balance of power. It is challenging to determine strategic utility for conventional weapons let alone for secret cyber operations.⁸⁴ Indeed, for all five cyber operations Russia has neither publicly acknowledged its involvement nor clearly stated its goals. To determine the strategic utility of these cyber operations despite these constraints, I follow established practice in intelligence studies to draw inferences using triangulation among multiple sources of data.⁸⁵

In this case study, I use process-tracing⁸⁶ and leverage mostly original data from four main primary sources: field interviews with Ukrainian cybersecurity experts and witnesses,⁸⁷ leaked documents and emails,⁸⁸ forensic reporting, and social media posts and local media reporting.⁸⁹ I primarily measure utility through impacts on the balance of power defined as the distribution of material capabilities.⁹⁰ I also examine whether and how the subversive trilemma limits the strategic utility of each operation.

The Russo-Ukrainian conflict has its origins in Ukraine's pursuit of closer relations with the European Union and the West. Despite President Viktor Yanukovych's close ties with Russia, in February 2013, the Ukrainian Parliament voted to commit to an EU-Ukraine Association Agreement.⁹¹ This vote threatened Russian interests of maintaining Ukraine within its sphere of influence. A key part of the Kremlin's Ukraine strategy has been spreading “rumour, speculation, half-truth, conspiracy, and outright lie, to obscure the realities of Russian activities.”⁹² Consequently, the drivers of foreign policy continue to be hotly debated.⁹³ Yet, even amidst these acrimonious debates, there is broad consensus that Russia has pursued two complementary strategic goals.⁹⁴ It wants to prevent and reverse Ukraine's realignment toward the European Union and the West as well as maintain Ukraine within its sphere of influence. Accordingly, Russian scholars highlight Russia's priority to “stop the pro-Western Kiev government”⁹⁵ and explain that “Russia looks at the former USSR states as creating arcs of safety in Eastern Europe.”⁹⁶ Public statements by Russia's leadership warn Ukraine against the “inevitable financial catastrophe”⁹⁷ that would result from EU integration, and President Vladimir Putin has repeatedly emphasized the shared history of Ukraine and Russia and their “sameness”⁹⁸ as “one people.”⁹⁹

To achieve these goals, Russia leveraged diplomacy, (semi-covert) warfare, and subversion. Initially, Russia applied increasing diplomatic pressure on the Yanukovych government while mobilizing a network of subversive proxy actors, comprised of church organizations such as the “Union of Orthodox Citizens“ and other separatist groups, to stimulate pro-Russian sentiment. Aleaked document in 2013 outlines Russia's goals to ”create a network of Russian influence … [to] prevent the signing of association agreements between Ukraine and the EU … [and] neutralizethe political and media influence of European integrators.“¹⁰⁰ This campaign involved some curious measures, such as a series of rock concerts,¹⁰¹ which unsurprisingly failed to produce measurable results.¹⁰² Russia's diplomatic efforts, however, were successful. Following a secret meeting with Putin, Yanukovych unilaterally withdrew from EU association negotiations in November 2013, prompting tens of thousands of Ukrainians to gather at Maidan square to protest.¹⁰³ In February 2014, Yanukovych's government collapsed. In response, Russia utilized its subversive proxies to conduct a regime change operation in Crimea. Subsequently, Russia's proxies organized protests around government institutions in the regional capital Sevastopol, which Russia supported with unmarked military forces.¹⁰⁴ These proxies then helped organize a referendum, coordinated from Moscow, deciding secession before Ukraine could react and producing a fait accompli.¹⁰⁵ In the Donbass region, Russia deployed similar tactics, but pockets of local resistance allowed the Ukrainian government to launch a countercampaign in May 2014.¹⁰⁶ Russia and Ukraine remain in a protracted stalemate with ongoing, significant bloodshed.

Although Russia has (thus far) failed to achieve its two core strategic goals, these efforts have produced significant strategic gains. First, the balance of power shifted in Russia's favor as it expanded its territory into Crimea and gained partial control over Donbass.¹⁰⁷ Despite prevailing conceptualizations of a cyber-enabled “hybrid war” in Ukraine, however, cyber operations played no role in attaining these gains.¹⁰⁸ Existing research shows cyber operations were irrelevant to military action in the Donbass or Crimea, and there is also no evidence that any cyber operations attributed to Russia contributed to the regime change operation in Crimea.¹⁰⁹ This absence is particularly surprising considering that Russian “information warfare” doctrine includes cyber operations as being relevant to the objectives it pursued in Ukraine.¹¹⁰ Instead, Russia deployed its cyber operations independently of the warfare effort as part of a larger subversive campaign targeting the remaining territory of Ukraine.

The final phase of the Russo-Ukrainian conflict is characterized by slow-paced Russian efforts to weaken Ukraine. Although cyber operations have remained irrelevant in the military clashes in Donbass, in Ukraine's remaining territory, Russia used election interference, sabotage, disinformation, propaganda, and economic warfare to conduct a long-term, slow-burning subversive campaign to weaken Ukraine and keep it within its sphere of influence.¹¹¹ Five major cyber operations attributed to Russian-sponsored actors contributed to this campaign, and the analysis in this section examines their operational mechanisms and strategic utility. Table 2 summarizes key findings.

election interference (2014). The first cyber operation attempted to disrupt Ukraine's 2014 presidential elections by sabotaging the computer systems of the Central Elections Commission (CEC). It moved fast and pursued intense effects by disrupting a core political process in democracies, yet it failed to influence the elections because the hackers missed a security measure that the CEC used to neutralize the compromise. This outcome provides support for the subversive trilemma and is congruent with H4. Consequently, as I expect, the operation provided Russia—whose military intelligence agency GRU most likely sponsored it—with little measurable strategic utility. Furthermore, I find circumstantial evidence that Russia deployed this cyber operation as part of its larger subversive campaign rather than to support its diplomatic and military initiatives.¹¹² This finding confirms the expected independent strategic role of cyber operations.

The group behind this cyber operation to sabotage the CEC's computers developed it within only two months, which is very fast compared with the five years it took to develop Stuxnet.¹¹³ The hackers had to work quickly because Ukraine's elections announcement in March 2014 was unexpected. Forensic evidence indicates the initial compromise of Ukraine's CEC occurred shortly after.¹¹⁴ Although the vulnerability and means of exploitation remain unknown, on May 21 the hackers deployed malware (i.e., a computer virus) that disrupted the CEC's computer systems for at least several hours.¹¹⁵ The CEC successfully restored service before election day on May 25.¹¹⁶

The hackers moved fast while pursuing intense effects that were low in scale yet high in scope because they aimed to disrupt a core democratic process.¹¹⁷ Yet, as predicted by the trilemma, they had insufficient control over the CEC's computer system. The intended effect of the cyber operation became clear on May 23, when the hacker collective Cyber Berkut boasted to have “destroyed PC and network infrastructure of the Ukrainian CEC,” and challenged the elections' legitimacy as being under “total U.S. control.”¹¹⁸ Cyber Berkut is a front organization for GRU¹¹⁹ and is likely linked to high-profile threat actor APT 28.¹²⁰ Contrary to its claims, however, the vote counting remained unaffected because the hacker's reconnaissance overlooked the fact that the CEC could use its backups to restore service.¹²¹ This evidence supports H4. Consequently, the cyber operation failed to help Russia disrupt Ukraine's election or to shift the balance of power. The elections proceeded unhindered, and their integrity was widely accepted.¹²²

powergridi (2015). The second Russian-sponsored cyber operation sabotaged equipment by the energy providers Prykarpattyaoblenergo, Chernovtsoblenergo, and Kievoblenergo, causing a power outage in Western Ukraine on December 23, 2015, that affected 230,000 people and lasted six hours. These highly intense effects featured both high scope and scale and required substantial time to develop, yet the hackers failed to produce strategically significant lasting effects because they had insufficient control over the targeted systems. Although the hackers successfully exploited the power grid infrastructure, ultimately the companies used a simple switch to neutralize the disruption. The outage affected less than 1 percent of Ukraine's population and comprised only about 0.015 percent of Ukraine's daily energy consumption.¹²³ According to a senior advisor to the Ukrainian government, its short duration and timing on the day before Christmas caused minimal economic disruption.¹²⁴ In contrast to sensationalist Western coverage naming this an “act of cyberwar,”¹²⁵ only a few local Ukrainian outlets covered it, and none on the front page.¹²⁶ This outcome supports the subversive trilemma (specifically H2) and its constraining influence on strategic utility.

I also find no evidence that this cyber operation was linked to Russia's military or diplomatic efforts at the time. Military clashes continued throughout December 2015 despite a truce.¹²⁷ There were no major diplomatic events. It is plausible, as some have argued, that this cyber operation was retaliation for sabotage to Crimea's power supply in November 2015 that destroyed the power lines linking it to the mainland, but there is no conclusive evidence.¹²⁸ This sabotage operation against the power grid was more intense than the effort to disrupt the CEC's computer systems. A power blackout can cause both physical damage and possibly death, particularly in winter.¹²⁹ As the subversive trilemma would predict, this relative increase in intensity correlated with a significant decrease in speed (see table 2). On May 12, 2014, one day after the Donbass referendum, Sandworm used a Portuguese university's compromised server¹³⁰ to send phishing emails to employees of the targeted energy firms.¹³¹ Curiously, the sender address was a Portuguese university, and these emails contained general information on Ukraine's railway system.¹³² This cyber operation therefore relied on the unlikely scenario of the victims being sufficiently interested in Ukraine's railway system to click on the malicious attachment. Somebody did, though, providing Sandworm access to corporate systems.¹³³

Forensic evidence indicates that hackers needed another five months to access the physical control systems in order to exploit its technical vulnerabilities. In October 2014, threat intelligence vendor iSight reported that Sandworm was exploiting a “zero-day” vulnerability (a previously unknown vulnerability about which the software vendor is unaware) in Microsoft Windows to target energy providers.¹³⁴ Subsequent analysis showed that the hackers had identified a vulnerability in an industrial control system that establishes an interface for human-machine interaction (HMI).¹³⁵ HMI systems themselves, however, cannot cause physical effects (i.e., disrupting the power supply).¹³⁶ The hackers needed another fourteen months to learn how to operate a power plant.¹³⁷ At 3:30 p.m. on December 2015, Sandworm operatives manually entered commands that caused the temporary blackout, using built-in functionality to cause an unexpected outcome.¹³⁸

The cyber operation disrupted power service by remotely disconnecting approximately thirty power substations and delayed restoration by simultaneously inundating phone support centers with calls.¹³⁹ Ninety minutes later, the hackers attempted to prevent the power companies from restoring service by deleting all data on the affected computers.¹⁴⁰ Yet, employees at these Soviet-era power plants neutralized the disruption and restored power within six hours by switching to manual control.¹⁴¹ Although it later became clear that all the affected utility providers discovered the compromise months before Sandworm attempted to disconnect the power substations, none of the victims reported or acted upon the premature discovery.¹⁴² It was primarily luck rather than stealth that enabled the hackers to control the system long enough to attempt to produce effects.

power grid ii (2016). One year after it disrupted power substations in Western Ukraine, Sandworm targeted the power grid in Kyiv, Ukraine's capital. The hackers had developed an advanced technique capable of more intense effects than its predecessor, which could, in theory, inflict lasting damage to Ukrenergo's power plant machinery.¹⁴³ But this capability failed, and Ukrenergo was able to neutralize the outage even faster than before. Maximizing intensity correlates with reduced speed and control—confirming H2. Like its predecessor in 2015, there is no evidence linking this cyber operation to Russia's ongoing military and diplomatic efforts in Ukraine. The key military events in October 2016 were infighting among the pro-Russian rebels in the Donbass region and the assassination of rebel leader Arsen “Motorola” Sergeyevich Pavlov.¹⁴⁴ Given the timing of this sabotage operation (days before Christmas), a Ukrainian government official speculated that its primary purpose was to inflict psychological distress rather than to advance Russia's military or diplomatic agenda.¹⁴⁵

Sandworm required an additional twelve months (thirty-one months total) to develop this cyber operation compared with its 2015 predecessor. The hackers used this time to deepen their knowledge about power substations and to develop a more advanced and, theoretically, more effective malware. According to industrial cybersecurity experts Dragos, the hackers attempted to trigger an automated protective system that would take targeted substations offline (i.e., “islanding”) by rapidly activating and deactivating power circuits.¹⁴⁶ This malware was theoretically capable of “coordinated targeting of multiple electric sites and could result in a few days of outages.”¹⁴⁷ Forensic analysis revealed that the malware could cause lasting physical damage by deactivating Siemens's protective relays.¹⁴⁸

The additional time that it took Sandworm to develop this sabotage operation against the power grid in Kyiv correlates with an increased potential intensity of effects, confirming expectations of the subversive trilemma. This cyber operation qualifies as an “extreme option” in Johnson's escalation ladder, given its potential physical damage.¹⁴⁹ At 11:53 p.m. on December 17, 2016, Sandworm's malware deenergized the Severyana power substation near Kyiv, resulting in a loss of 202.9 megawatts—enough to power around 600,000 Ukrainian households according to average consumption statistics by the International Energy Agency.¹⁵⁰ Ukrenergo had learned from the 2015 sabotage, however, and swiftly switched to manual control, so that “within an hour and fifteen minutes, power was restored in full.”¹⁵¹ In practice, this operation thus achieved less intense effects than its predecessor.

Dragos's analysis of this cyber operation underlined that deploying the advanced technique to damage targets “would be very difficult to do at scale.”¹⁵² Yet, the hackers never got that far. The networking protocol of the targeted industrial control systems reversed Internet protocol (IP) addresses when executing commands, but Sandworm had missed this and entered the wrong addresses, which resulted in “nonsensical communication.”¹⁵³ When I interviewed Volodymyr Styran, a cybersecurity expert at Berezha Security, he concluded that Sandworm hackers are “just people” who “screwed it up at some point, as they did in previous incidents.”¹⁵⁴ The triangulation of evidence indicates that this cyber operation neither contributed to Russia's strategic goals nor achieved a shift in the balance of power, which confirms my expectations. The economic and psychological impacts of this second sabotage operation against Ukraine's power infrastructure were even less significant than in 2015. The outage occurred overnight when most businesses were closed and most people were asleep. Although some U.S. media outlets covered the event, the incident barely registered in Ukrainian media.¹⁵⁵ Accordingly, security researcher Marina Kratofil concluded that the operation “should not have long and serious consequences.”¹⁵⁶

notpetya (2017). Sandworm's fourth operation, NotPetya, used data-destroying self-proliferating malware to cause a massive disruption that measurably affected Ukraine's GDP. The hackers took much less time to prepare this operation (see table 2), opting to reduce the scope of the effects in order to maximize scale. Although at first glance NotPetya appears to provide evidence that supports cyber revolution theory about the scale advantage of cyber operations, I argue that NotPetya's scale resulted from a loss of control. Indeed, NotPetya's collateral damage and follow-on costs highlight the operational perils of maximizing scale, providing further evidence of the subversive trilemma and H4.

There is no evidence suggesting that Russia orchestrated the NotPetya cyber operation in coordination with its military and diplomatic efforts. On the diplomatic front, Ukrainian President Petro Poroshenko banned several high-profile Russian websites in May 2017,¹⁵⁷ while military clashes continued between Russia and Ukraine despite agreeing to another ceasefire agreement on June 24.¹⁵⁸ There is no indication that NotPetya was linked to any of these events.

Sandworm started to develop NotPetya in December 2016, when it released the “Moonraker worm,” which could self-proliferate across networks and disrupt systems through data encryption.¹⁵⁹ It took Sandworm only six months to adapt the generic “Green Petya” malware upon which NotPetya was based.¹⁶⁰ Between January and March 2017, Sandworm targeted two unnamed financial institutions to test a new supply-chain malware propagation mechanism with a new malware called Python/TeleBot.A.¹⁶¹ NotPetya used a similar supply-chain mechanism as the hackers compromised the software update server of a popular accounting software provider and hid malware within automated updates that would be sent to customers. This server update thus automatically spread the malware to its entire user population. According to Styran, NotPetya was “technically simple,” but the hackers showed a spark of “genius” by exploiting the victims' trust in the automated server update.¹⁶²

By May 2017, Sandworm had figured out how to compromise its key target, the Ukrainian software firm Intellect Services, which produces the popular M.E.Doc accounting software.¹⁶³ Ukrainian hacker Sean Townsend noticed that at least one of the firm's servers had not been updated since 2012,¹⁶⁴ and Ukrainian authorities confirmed that the last update occurred in February 2013.¹⁶⁵ Before deploying NotPetya, Sandworm propagated another newly developed piece of malware called “Xdata” through this server. XData infected 134 victims and caused some minor disruptions, but it did not significantly affect Ukraine.¹⁶⁶ Ukrainian cybersecurity expert Victor Zhora speculates that XData was a “proof of concept” aimed to “map the network” of victimized firms.¹⁶⁷ Sandworm finally deployed NotPetya, propagated it to M.E.Doc clients via a compromised software update on June 22, and activated it across all infected machines on June 27. NotPetya self-proliferated across networks from all affected machines before executing a disk encryption program that irreversibly destroyed all data on targeted computers. The ransom demand that NotPetya displayed on hacked computers turned out to be deception, because neither the bitcoin address it listed for payments nor the decryption key existed.¹⁶⁸

NotPetya's economic disruption ranks in the middle of Johnson's escalation ladder (rung nineteen of thirty-eight).¹⁶⁹ It achieved massive scale, however, disabling an estimated 500,000 computers in Ukraine alone.¹⁷⁰ Its automated proliferation ultimately affected organizations across sixty-five countries,¹⁷¹ including targets in Russia such as the state-owned oil company Rosneft.¹⁷² NotPetya's speed and apparent success in producing intense effects suggest that Sandworm successfully bypassed the subversive trilemma. But I show that this cyber operation confirms H4, because the increase in speed and intensity of effects correlate with a decrease in control. The hackers could neither predict nor control NotPetya once they had set it in motion. Days before NotPetya's automated proliferation and encryption was activated on infected computers, M.E.Doc had sent another clean update to its customers, which Anton Cherepanov suggests was “an unexpected event for the attackers.”¹⁷³ It is exceedingly unlikely that Sandworm could map the near-instantaneous spread of NotPetya across hundreds of thousands of systems just a few weeks later.¹⁷⁴ Forensic evidence indicates that Sandworm had “underestimated the malware's spreading capabilities,” which then “went out of control.”¹⁷⁵ The result was significant collateral damage.

NotPetya's economic disruption decreased Ukraine's gross domestic product (GDP) by approximately 0.5 percent in 2017, which shifted the balance of power in Russia's favor and provided it with independent strategic utility.¹⁷⁶ Unlike Sandworm's previous cyber operations, NotPetya was prominently reported in Ukrainian media.¹⁷⁷ Leaders from Ukraine, the United States, the United Kingdom, and Australia condemned Russia for the destructive cyber operation, underlining its significance.¹⁷⁸ Yet, I argue that NotPetya's loss of control indicates the scale of its impact was accidental and produced unintended consequences. The United States imposed sanctions against Russia, particularly the GRU leadership. The U.S. Department of Justice subsequently indicted six GRU officers for deploying destructive malware.¹⁷⁹ These significant unforeseen costs reduce NotPetya's overall strategic utility and confirm the expected constraining influence of the subversive trilemma. More importantly, despite its scale, NotPetya did not measurably contribute to Russia's goals: Ukraine maintained its pro-EU course.

badrabbit (2017). When developing NotPetya's successor, BadRabbit, Sandworm used the same technique of disabling targets through encryption, but they added efforts to control its spread and effects. Consequently, it achieved no measurable strategic utility. As predicted by H3, the increase in control decreased intensity and speed. Moreover, I argue that BadRabbit offered little, if any, strategic utility to Russia because the cyber operation only spread to a small number of targets. Its strategic irrelevance provides further support for my hypothesis that the subversive trilemma is a limiting factor.

BadRabbit does not appear to be linked to Russia's diplomatic or military initiatives, providing further evidence of the expected independent strategic role of cyber operations. Prior to BadRabbit, the EU-Ukraine Association Agreement entered into full force on September 1, 2017, marking Russia's failure to reverse Ukraine's foreign policy course. Forensic evidence indicates that Sandworm started to develop BadRabbit around September 2016.¹⁸⁰ As the subversive trilemma would predict, increasing control affected BadRabbit's operational speed. Hackers took twelve months to develop BadRabbit compared with only six months for NotPetya. BadRabbit and NotPetya used largely the same code and both cyber operations encrypted data on affected systems before displaying a ransom demand.¹⁸¹ But Sandworm attempted to “improve upon previous mistakes” by making encryption reversible on BadRabbit and using a manually rather than automatically spreading mechanism.¹⁸² Victims who visited compromised websites (so-called watering holes) manually clicked on “OK/install” when the site offered users fake Adobe Flash Player updates that contained malware.¹⁸³

BadRabbit pursued the same effect type (i.e., economic disruption, or rung nineteen on Johnson's escalation ladder) as NotPetya, but at a fraction of the scale and significantly less intensity. Like NotPetya, it appears that BadRabbit mostly targeted businesses' computer systems, especially banks and media firms but also transport providers. When BadRabbit encrypted compromised systems on October 24, 2017, however, it only affected approximately 200 targets in Russia, Ukraine, Turkey, and Germany.¹⁸⁴ Curiously, most victims (65 percent) were in Russia,¹⁸⁵ whereas 75 percent of NotPetya's targets were in Ukraine.¹⁸⁶ Yet, Sandworm only targeted Ukraine's critical infrastructure. More importantly, forensic evidence shows that critical infrastructure targets were not infected through the malicious Flash Player, indicating that Sandworm “already had a foot inside their [Ukrainian targets] network and launched the watering hole attack at the same time as a decoy.”¹⁸⁷

Consistent with the subversive trilemma, BadRabbit's improved control over the spread of the malware and its effects came at the cost of low speed and low intensity. There are no indications of premature discovery, nor of prior operational missteps that could have compromised the effects. BadRabbit neither auto-proliferated nor produced any significant collateral damage.¹⁸⁸ The available evidence suggests that BadRabbit caused temporary, reversible, and inconsequential disruptions.¹⁸⁹ It received minimal media coverage both within Ukraine and abroad, while Ukraine's newly established “cyberpolice” attributed the operation to “criminals” rather than political operatives.¹⁹⁰ Consequently, BadRabbit neither contributed toward Russia's strategic goals nor shifted the balance of power. Tellingly, since BadRabbit, Sandworm has abandoned any attempts at active effects cyber operations against Ukraine, returning to a focus on pure espionage.¹⁹¹

Because the decision-making processes of the Kremlin and the Russian intelligence agencies who almost certainly sponsored the cyber operations discussed remain inaccessible, alternate interpretations concerning the intentions behind their use abound. This section addresses two alternative interpretations: signaling and experimentation.

The first alternative interpretation holds that Russia deployed cyber operations primarily as signaling tools. Signaling is the core mechanism in coercive diplomacy, in which actors demonstrate and deploy capabilities to signal resolve and induce adversary actions.¹⁹² Effective signals have a clear recipient and content, neither of which is the case regarding the five cyber operations that I examine in this article. For example, one interpretation of the two power grid sabotage cyber operations holds that, “Russia is using cyber intrusions to signal the risk of escalation in a crisis” to its rivals (i.e., the United States and NATO).¹⁹³ Joseph S. Nye Jr., in contrast, speculates that Russia is signaling to Ukraine, “reminding Ukraine of its vulnerability in a hybrid war with a different level of plausible deniability.”¹⁹⁴ Similarly, one interpretation of NotPetya suggests it was “designed to send a political message: if you do business in Ukraine, bad things are going to happen to you.”¹⁹⁵ A second interpretation sees Russia “demonstrating its ability to disrupt faith in public institutions.”¹⁹⁶ These interpretations are plausible, and so are many others, yet there is little tangible evidence to support them.¹⁹⁷ Ultimately, the existence of multiple interpretations indicates that the signal is unclear. More importantly, even if signaling was the intent, it does not challenge my findings on the limiting role of the subversive trilemma.

The second alternate explanation suggests that Russia deployed cyber operations primarily to test and develop its capabilities. A Dragos report about the power grid sabotage operation in 2016 noted that it was “more of a proof of concept than what was fully capable.”¹⁹⁸ Ben Buchanan picks up this point, suggesting that Sandworm perhaps wanted to “see how the code worked in practice so they could refine it for future use,” and he quotes Dragos's CEO Robert M. Lee warning of the potential threat to critical infrastructure around the world.¹⁹⁹ There are three key issues with this interpretation. First, it is highly unlikely that an actor will spend years developing a capability and deploy it without pursuing any strategic gains. Moreover, doing so risks losing the capability by allowing potential future victims to remove the vulnerabilities it exploits. In the words of Lee, “it would be extraordinarily weird to stage an entire attack as just a proof of concept.”²⁰⁰ Second, there is no empirical evidence supporting this interpretation. Sandworm has not used this toolset again, nor has it pursued other critical infrastructure sabotage using similar methods. Significantly, forensic analysis by Symantec showed that the 2017 intrusions in the U.S. energy grid attributed to Russia were the work of a different actor and shared no tools or techniques.²⁰¹ Third, the “proof of concept” interpretation ultimately suggests that cyber operations are instruments of future higher-stakes conflict. Yet as the analysis shows, despite multiple years of experimentation and testing, Sandworm did not overcome the subversive trilemma.

This article has argued that cyber operations are an instrument of subversion whose operational effectiveness is constrained by a subversive trilemma. The demands of the mechanism of secret exploitation that cyber operations rely upon result in actors facing trade-offs between improving either speed, intensity, or control of operations. Increasing the effectiveness of one variable tends to decrease the others. In most circumstances, cyber operations thus tend to be too slow, too low in intensity, or too unreliable to contribute to political goals or shift the balance of power. Consequently, cyber operations tend to fall short of their strategic promise and deliver limited utility. The case study of the Russo-Ukrainian conflict provides strong support for this theory. All five cyber operations that I examine in this article showed clear evidence of the constraining role of the trilemma.

This theory has several implications for the study of cyber conflict. Most importantly, the subversive trilemma significantly hinders the ability of cyber operations to successfully produce independent strategic utility. Success requires alleviating the trilemma without raising costs above those of potential diplomatic or military alternatives. Specifically, effects must be sufficiently intense to contribute to a given goal, while the operation must produce these effects within a timeframe that is short enough to avoid discovery but long enough to increase the likelihood of both achieving the intended effects and avoiding unintended consequences. Furthermore, it requires conditions for success that are rarely present: the availability of systems that control social, economic, or physical processes of strategic significance, yet also contain vulnerabilities that operators can exploit without premature detection. Finally, long development time involving highly skilled operators is expensive; the more intense, physical effects an operation pursues, the less favorable the cost-benefit ratio is likely to be.²⁰² Moreover, even under ideal conditions, the potential effect on the balance of power is still likely marginal.

Cyber operations are most likely to deliver on their strategic promise in two scenarios. The first scenario is long-term, low-stakes competition between adversaries with a significant power differential. Although most of the conditions above are present in Ukraine, the deployment of multiple cyber operations did not measurably contribute to Russia's strategic goals. Hence, it likely requires decades to develop a successful cyber operation, which makes it difficult to isolate the operation's influence in order to measure its effects. Importantly, the most significant power shift that traditional subversion can achieve is regime change. Cyber operations alone are likely incapable of such effects. Accordingly, cyber operations are most likely to deliver utility if they are integrated with traditional subversion.²⁰³

The second scenario is high-stakes competition among nuclear-armed peer competitors that expect eventual military confrontation. The tensions between the United States and China are a key example. Potential nuclear escalation renders the risks and costs of using conventional force unacceptably high. Although the subversive trilemma suggests an unfavorable cost-benefit ratio for cyber operations that pursue highly intense effects at the operational level, strategic benefits may still outweigh these costs. The party in a “domain of losses” is especially likely to be more risk-accepting, and thus more likely to accept the limits of control.²⁰⁴ If states use cyber operations to target military assets for sabotage, cross-domain effects indicate potential inadvertent escalation risks.²⁰⁵ Because cyber operations can likely achieve only marginal changes to the balance of power over longer-term competition, they are only likely to make a difference when both actors are closely matched and neither side exhibits exponential growth rates.

In lower stakes, nonnuclear dyads, capable states can be expected to regularly employ cyber operations even though they have a high failure rate, as has been the case historically with traditional subversion.²⁰⁶ For the same reason, however, their impact on security competition should not be overestimated because their strategic utility remains limited, barring “unicorn” scenarios in which all favorable conditions align and the subverting actor is extremely lucky.

Three major policy implications follow from this argument. First, it confirms the current shift away from a strategy of cyber deterrence rooted in theories of warfare, whose aim is to avoid costly engagements.²⁰⁷ Second, alternative emerging strategies of “persistent engagement” and “defend forward” that guide U.S. posture should consider the subversive trilemma as a limiting factor to avoid unintended consequences.²⁰⁸ These new strategies build on assumptions of cyber revolution theory, and they aim to maximize the utility of cyber operations as instruments of low-intensity strategic competition while minimizing risks by participating in “agreed competition” that adheres to a set of tacit rules of engagement.²⁰⁹ The findings of this study, however, suggest that the subversive trilemma is the more likely explanation for the observed low intensity of competition. By pursuing more aggressive engagement, the United States may shift adversary cost-benefit calculi toward more risk-taking, such as increasing effects intensity at the cost of control, which inadvertently intensifies cyber competition.²¹⁰ Finally, persistence is a key requirement for actors to succeed in exploiting targets. Yet, long-term planning, reconnaissance, and stealth as well as space for creative development are just as if not more important to maximize effectiveness and utility of cyber operations. Privileging persistence, as the current strategy does, risks neglecting these requirements for success. Conversely, defenders in cyber conflict can benefit from exploiting the trilemma and exacerbating its constraining role on adversary operations. Defensive strategies should prioritize the capacity to detect and neutralize intrusions. If immediate neutralization is impossible, defensive measures should aim to slow adversary speed, limit their control, and maximize the barriers that adversaries must overcome to achieve or intensify effects. The same principles should guide systems design, as well as security rules and practices. Existing counterintelligence strategies provide a useful basis to develop such strategies.

Furthermore, while this study has focused on the utility of cyber operations as independent strategic instruments, its findings also apply to their use as complements to other instruments of power. Just like traditional subversive operations have been deployed to contribute to military goals, such as undermining command structures, so can cyber operations.²¹¹ Regardless of strategic context, any cyber operation that produces effects through hacking relies on the subversive mechanism and is thus bound by its trilemma.²¹² Consequently, the trilemma can be expected to apply across multiple strategic contexts.

To verify this theory, further research tracking evidence of the subversive trilemma in varying strategic contexts and by different actors is required. Findings from this study supported H2, H3, and H4, but the cases examined did not produce the configuration of the trilemma predicted by H1. Quantitative research verifying the predicted correlations across a larger universe of cases will be especially useful. Second, historical comparative research is needed to verify the proposition that the quality of subversion has not changed despite the technological advances of the information revolution. In this regard, the integration of cyber operations with traditional subversion is a key topic of interest. While this study has focused on hacking, assessing the impact of new technology on effectiveness and utility requires more empirical examinations of another key instrument of subversion: influence operations that use disinformation and propaganda.

Finally, looking ahead, changes in design features of ICTs may alter the subversive trilemma. The most likely change is simplification and standardization in cyber-physical systems²¹³ and the rise of the Internet of Things (IoT),²¹⁴ which could make it easier for cyber operations to produce physical effects at scale. This change could increase cyber operations' intensity and potential to affect the balance of power, but the perils of losing control over an operation would still exist. Similarly, advances in artificial intelligence may improve control over scale-maximizing operations by facilitating computer network mapping and command-and-control functions.²¹⁵ Defenders in cyber conflict (i.e., administrators of computer systems being targeted by cyber operations), however, would likely benefit as well because artificial intelligence promises superior means of detecting exploitation.²¹⁶ Consequently, the trilemma will likely remain relevant.

The author thanks Ronald Deibert, Jesse Driscoll, Nadiya Kostyuk, Gabrielle Lim, Jon Lindsay, Louis Pauly, Irene Poetranto, Max Smeets, Lucan Way, the team at the Citizen Lab at the University of Toronto, the team at the Center for Security Studies at ETH Zürich (especially Alexander Bollfrass, Myriam Dunn Cavelty, Mauro Gilli, Enzo Nussio, and Andreas Wenger), as well as the anonymous reviewers for their helpful comments on earlier drafts of this article. He is also grateful to Lesia Bidochko, Daria Goriacheva, Oksana Grechko, and Mariya Green for research assistance. The author is also indebted to Olga Paschuk for her interpretation services in Ukraine. Finally, the author thanks Lisa Maschmeyer for designing figure 1. The online appendix for this article is available at doi.org/10.7910/DVN/IZ65MC.