978-9934-564-90-1 RUSSIA’S STRATEGY IN CYBERSPACE Published by the NATO Strategic Communications Centre of Excellence ISBN: 978-9934-564-90-1 Authors: Janne Hakala, Jazlyn Melnychuk Project manager: Sanda Svetoka Design: Kārlis Ulmanis Riga, June 2021 NATO STRATCOM COE 11b Kalnciema Iela Riga LV1048, Latvia www.stratcomcoe.org Facebook/stratcomcoe Twitter: @stratcomcoe Aknowledgments This publication is developed in the framework of the joint cooperation project of the NATO StratCom COE and NATO Cooperative Cyber Defence COE. We would also like to thank Dr Juha Kukkola, Dr Ieva Bērziņa, Varis Teivāns and Mark Laity for advice and review of the publication. This publication does not represent the opinions or policies of NATO or NATO StratCom COE. © All rights reserved by the NATO StratCom COE. Reports may not be copied, reproduced, distributed or publicly displayed without reference to the NATO StratCom COE. The views expressed here do not represent the views of NATO. Contents Introduction . 6 Russia’s “information confrontation” . 7 Russian conceptions of ‘cyber’ . 7 Protecting ‘information’: cognitive and technical . 7 National security interests and strategic objectives . 10 Russia’s threat perception . 11 Strategic deterrence . 12 Securing the information space - ‘digital sovereignty’ . 14 State actors and proxies . 19 Activities in cyberspace . 25 Implications and objectives . 34 Conclusion and recommendations . 36 Endnotes . 40 _______________________________________________________________________________________________________ 3 INTRODUCTION Headlines connecting Russia to the vague notion of ‘cyber’ have become daily bread for Western publics and decision makers alike. From the damage done by NotPetya or attacks against Ukraine and Georgia, to Russia’s hacking and leaking operations in US and European elections, Russia’s offensive operations are consistent threat. An increasingly important tool in what Russia views as the ongoing “information confrontation,” Russia utilizes cyber operations alongside other military and non-military means to pursue strategic objectives. On the other hand, recent years have seen attacks such as disinformation. However, Russia’s attempts to close and secure its the center of gravity in the ‘information own digital information space. By using a confrontation’ lies in peoples’ minds and combination of legal and technical means, perception of events, both domestically and the Kremlin tries to impose control both over internationally. digital infrastructure and content, efforts which are aimed at ensuring independence This report seeks to clarify the role of from the global Internet network and thus cyberspace in Russian strategic thinking. enhancing their information security. It will analyse cyber operations as a subset of Russia’s ‘information confrontation’ Russia sees activities in cyberspace as a and explore how this philosophy is put subset to the all-encompassing framework into practice. The report will examine both of ‘information confrontation,’ which is offensive measures, such as participation in derived from the Russian understanding the information war, and defensive measures, of relations between states and, more such as Russia’s efforts to secure its own specifically, a subset of the struggle information space from foreign influence. between great powers for influence in the Finally, it will conclude with several policy world. According to Russian thinkers, the recommendations for NATO strategic information confrontation is constant and communications in addressing Russia’s ongoing, and any means can be used to gain offensive activities in cyberspace. superiority in this confrontation. Activities in cyberspace are one of several tools of warfare in the information environment, including psychological operations, electronic warfare (EW), and kinetic action. In practice, cyberspace can be used both for physical attacks on infrastructure, and cognitive 4 ________________________________________________________________________________________________________ RUSSIA’S “INFORMATION CONFRONTATION” Russian Conceptions of ‘Cyber’ rather than ‘warfare’.4 This paper uses the term ‘information confrontation’ due to its Russia’s conceptualization of ‘information established status in discussions regarding confrontation’ and the role of cyberspace hostile Russian informational activities. within it is outlined in strategic policy documents, such as National Security The confrontation includes a significant Strategy (2015), Foreign Policy Concept psychological remit, whereby an actor (2016), Information Security Doctrine (2016), attempts to affect informational resources Military doctrine (2014), Conceptual Views (documents in information systems) on the Activity of the Armed Forces in the as well as the minds of the adversary’s Information Space (2016), as well as works military personnel and population at large.5 and publications by Russian military thinkers. Ultimately, cyber operations (or information- technical means) are one of many methods From the Russian perspective, cyber warfare used to gain superiority in the information or the Russian equivalent ‘information- confrontation. Russia, and particularly technological warfare,’1 is only a part of Russian President Putin’s regime, sees the the overarching concept of “information information confrontation as a constant confronta tion” (informatsionnoe protivo­ geopolitical zero-sum competition between borstvo). The Russian Ministry of Defence great powers, political and economic describes the information confrontation as systems, and civilizations.6 the clash of national interests and ideas, where superiority is sought by targeting the adversary’s information infrastructure Protecting ‘Information’: while protecting its own objects from Cognitive and Technical similar influence.2 The translation of the term informatsionnoe protivoborstvo into Publicly available Russian doctrines English has proven difficult, and has often and policy documents do not explicitly incorrectly been translated as ‘information reference cyber operations. Furthermore, warfare’3 (‘informacionnaja vojna’), despite Russian documents do not use the the fact that protivoborstvo refers to ‘counter- term ‘cybersecurity’, but refer instead to struggle’, ‘countermeasure’ or ‘counteraction’ ‘information security.’ This term differs from _______________________________________________________________________________________________________ 5 Russia perceives the information space in very geopolitical terms, with their domestic information space representing a continuation of territorial state borders, which they view as constantly being violated by foreign intrusions.13 the Western notion of ‘information security’ and websites within the information and (or in short: infosec) in that it encompasses telecommunications network of the Internet not only the protection of critical digital […], communications networks, information networks, but society’s cognitive integrity as technologies, entities involved in generating well.7 There are several reasons why Russian and processing information, developing and military thinkers apply the term ‘cyber’ when using the above technologies, and ensuring talking about Western threats and activities, information security, as well as a set of but are reluctant to link the term to Russia’s mechanisms regulating social relations in own capabilities and actions. Some authors the sphere”.9 argue that this deliberate choice is related to negative connotations around Soviet-era The information space refers to activities ‘cybernetics,’ as well as the importance the to form, transform, and store information, term ‘information security’ holds for Russia’s as well as ‘influencing individual and public own domestic politics8. consciousness, information infrastructure and information itself.’10 When discussing the operational environ- ment, Russia uses the term ‘information According to Ofer Fridman, Russia space’ (informatsionnoe prostranstvo), or conceptualizes cyberspace as the ‘information sphere’ (informatsionnaya intersection between hardware, software, sfera), which again is more comprehensive infrastructure, and content11. In this than the Western concept of ‘cyberspace’ or framework, the information-technological ‘cyber domain.’ The 2016 Russian Doctrine of layer includes hardware, software and Information Security defines theinformation infrastructure, while the information- sphere as: psychological layer includes hardware, software and content.’ Irrespective of “a combination of information, infor- the means used – technological (for matization objects, information systems example, destroying digital infrastructure) 6 ________________________________________________________________________________________________________ or psychological (manipulating a message waging information war,” in practice the on social media) – activities in cyberspace concept covers a wide array of activities are understood in terms of their effect (often with an emphasis on affecting the in the information space.12 Importantly, human mind); this includes the spreading Russia perceives the information space of disinformation, electronic warfare, in very geopolitical terms, with their the degradation of navigation support, domestic information space representing psychological pressure, and the destruction a continuation of territorial state borders, of adversary computer capabilities.15 which they view as constantly being violated by foreign intrusions.13