The writer is a former FT Moscow bureau chief
Not long after the Maidan Revolution that overthrew Ukraine’s president Viktor Yanukovych in 2014, I had a haunting conversation with a Russian commentator in Moscow. Echoing the standard Kremlin line, he said it was a tragedy that Russia had “lost” Ukraine. But, he added privately, it might have been even worse had Russia “won”.
His argument was that if Moscow had succeeded in propping up a puppet regime in Kyiv then Russia might then have been dragged into a civil war, battling an insurgency in western Ukraine and facing sanctions from abroad. Russia would have been drained of blood, treasure and international respectability for years to come. Just as Moscow’s invasion of Afghanistan in 1979 had led to the unravelling of the Soviet Union, so an intervention in Ukraine may have jeopardised President Vladimir Putin’s regime. Given the invasion of Ukraine launched on Thursday morning, that scenario has moved closer to reality.
But what fallout might Russia’s invasion have on the rest of the world?
Moscow’s assault has already triggered a spike in energy prices. It may lead to threats against Nato countries bordering Russia and Belarus. But one of the most chilling fears is that a regional conflict could escalate into an invisible global confrontation in cyber space. Arguably, cyber warfare started years ago and has now become a permanent condition of the modern world as rival powers look to spy on each other, steal secrets, degrade infrastructure and spread disinformation. The only open question is how intense it might become.
In her book This Is How They Tell Me The World Ends, Nicole Perlroth described how Ukraine became ground zero in this new era of cyber warfare as Russian hackers consistently tried to undermine the country. Since 2014, Ukraine’s government agencies, central electoral commission, power grids, banks and airports have all experienced sporadic attacks.
Last month, hackers defaced 70 Ukrainian websites leaving behind the message: “Be afraid and expect the worst.” Just before the invasion, several Ukrainian ministries and state banks were targeted. And many western organisations are indirectly exposed: according to Ukraine’s foreign ministry, more than 100 of the Fortune 500 companies use Ukrainian IT services.
For years, Russia has been the world’s most active nation state hacker and has developed formidable cyber capabilities. Microsoft’s Digital Defense Report, published last October, attributed 58 per cent of all known nation state cyber attacks to Russia over the previous year. The top three target countries were the US, Ukraine and the UK. Some commentators have argued that it is only a matter of time before the west experiences a “cyber Pearl Harbor”.
Speaking before Thursday’s assault, western security experts considered it unlikely that Putin would launch a massive cyber attack against a Nato country: it would only invite a damaging response. “The catastrophisation of the problem is not particularly helpful,” said Sir Alex Younger, the former head of Britain’s Secret Intelligence Service, at an FT Forums event on Wednesday. “Cyber attacks can be devastating things but they don’t compare to surface-to-surface missiles landing on suburbs of Kyiv.” Focusing on extreme cyber scenarios also risked distracting from the chronic damage caused by the theft of intellectual property, the erosion of strategic advantage and criminal threats that could best be addressed by determined leadership and standard cyber security hygiene.
The greatest cyber spillover from the Ukraine crisis might come from accidental contamination or the escalation of criminal attacks originating from Russia, said Ciaran Martin, the former chief executive of Britain’s National Cyber Security Centre. He cited the experience of the NotPetya malware attack, unleashed against Ukraine in 2017, that caused an estimated $10bn of economic damage. Several big companies, including Maersk, FedEx and Merck, were badly hit. But so was Rosneft, the giant Russian oil company, highlighting how such attacks are indiscriminate and difficult to control.
The fact that Putin has invaded Ukraine emphasises the limitations of cyber weapons. Ultimately, the Russian leader has resorted to overwhelming military force to achieve his objectives in Ukraine. It makes little sense for him to provoke a broader conflict with the west by launching cyber attacks. But then war has a way of scrambling logic. As Ukraine’s president Volodymyr Zelensky has said: “in the 21st century there are no more foreign wars”.
