Ukraine, economic “war,” and the cyber conflict that could follow
Tolstoy is famously reported as saying “You may not be interested in war, but war is interested in you.” Immediately before missiles and bombs struck and Russian tanks and troops invaded, a poll suggested Americans were not too interested in the disaster unfolding in the Ukraine. In fact, it showed 72% of Americans opposing the U.S. taking a major role in the crisis. That may need to change as the war, it appears, is interested in America and American interests.
That poll result might have been driven by the fact that before the Ukraine exploded, Americans were mainly concerned about domestic “pocketbook issues…including rising inflation.” Events of the past day, however, will force them to look abroad. The reality is that Americans may well find themselves on the receiving end of major effects from the Ukraine conflict, effects with the potential to spiral into an extremely dangerous situation not just for those in the U.S. but for everyone around the world.
President Biden has committed to taking “severe sanctions” action against Russia, but was frank about how they could impact the U.S. economy. Although he promised to try to minimize the effects, he warned “defending freedom will have costs for us as well, here at home. We need to be honest about that.” Personally, I’m not sure Americans took him seriously enough–at least until now.
“Pocketbook issues” for Americans are already emerging as a result of the conflict. Today we’ve seen, for example, oil prices skyrocket and stocks tumble–and this may be only the start of cascading economic effects that will inevitably impact most Americans over the longer term.
Let’s start our inquiry by doing a quick examination of how we got here.
What went wrong?
There will certainly be more detailed analysis to come, but here are some quick thoughts (in no particular order):
a) Gradualism failed. The “relatively mild” response a few days ago after Russia recognized the breakaway territories in the Ukraine, along with the seeming political dithering as whether Russia had “invaded” at that point, could have sent a message Putin welcomed. Sure, experts say that the U.S. and its allies wanted to reserve its most severe sanctions in case of a “substantial escalation” by Russia, evidently assuming that such a contingent threat would deter Putin.
That didn’t happen. The notion that the gradual application of coercive measures can succeed against totalitarian societies is, in my opinion, a suspect notion. In the military sphere, gradualism was tried without success during the Vietnam War, but that lesson of history seems to have been forgotten.
Several days ago, Ukrainian President Volodymyr Zelensky practically begged the West to impose sanctions before the invasion. CBS News reported him as saying:
“You’re telling me that it’s 100% that the war will start in a couple of days. Then what [are you] waiting for?” Zelensky said. “We don’t need your sanctions after the bombardment will happen, and after our country will be fired at or after we will have no borders or after we will have no economy or parts of our country will be occupied. Why would we need those sanctions then?”
No one seemed to have been convinced. I believe people like Putin equate gradualism with weakness and indecisiveness.
b) Putin obviously is convinced Russia can weather sanctions. After all, the sanctions put in place last year “over 2020 election interference, a huge cyberattack on U.S. government and corporate networks, illegal annexation and occupation of Ukraine’s Crimea, and human rights abuses” were viewed by economists, CNBC said, as “mostly symbolic.”
Moreover, in early February, the New York Times reported that “there may be more behind [Putin’s] confidence than military power or empty bravado.” It explained that “[o]ver the past several years, Mr. Putin, Russia’s president, has restructured his country’s economy for the specific purpose of withstanding Western financial pressure.” The Times did say that “changes provide only a cushion against sanctions, not an impenetrable shield.”
Maybe. But this morning the Times said China, which refuses to call Russia’s’ actions an “invasion”, cleared the way to import wheat from all regions of Russia. It explained:
The move is part of a series of agreements signed by President Vladimir V. Putin during his recent trip to Beijing — a visit which saw China and Russia proclaim that their partnership had “no limits.” For Russia, the world’s largest wheat exporter, China’s huge domestic economy offers a potential bulwark against Western sanctions.
Putin may have also concluded that despite all the rhetoric of solidarity, countries in Europe and elsewhere may not have the resilience to suffer the blowback that sanctions on Russia can cause.
c) The decision to forego any ambiguity about a military response may have lessened the West’s leverage. The U.S., NATO, and the free world made it overtly clear that they would not help Ukraine with military force even to defend itself against the kind of aggression that Europe has not seen since World War II.
To be clear, I am not recommending U.S. troops fight in Ukraine at this point and, I recognize that it could well be true that no nation was – or is – prepared to come to Ukraine’s aid with military force. Nevertheless, the West’s political decision to remove any ambiguity in that regard may have facilitated Russia’s risk-reward calculation.
d) The U.S. may have underestimated Putin’s deeply-held views about Russian history, the humiliations he thinks Russia has suffered, and the place he believes it deserves in the world – things that he put on full display in his recent speech. It is easy to conclude his contentions are counter-factual or wildly overstated, but the mistake is to think he – and millions of Russians – don’t genuinely see the world that way.
Indeed, the recent speech is hardly the first time he’s expressed these views, as he made them clear last summer. Of course, this doesn’t mean we need to accept any effort from Putin or anyone else to re-write history, but it does point out a consequence of the ahistorical mindset of too many Americans.
We need to be aware that history for Russians (and, for that matter, Chinese and others), has a much more of a ‘here and now’ influence than it seems to have in this country. Thus, we can miss – or dismiss – the grave risk flawed historical beliefs may present when they are embraced by our adversaries.
What now?
I expect you’ll see a raft of articles about the cascading economic consequences of the conflict on ordinary Americans – as well as others around the globe. As one commentator put it this morning “Higher gas prices and inflation are certain. Oil raced above $100 a barrel almost as soon as the Russian assault started.” We should expect much more fallout.
Today President Biden announced that the U.S. and its allies will impose at least some of the threatened “severe economic sanctions.” Additionally, Congress may carry through with its own “mother of all sanctions“ package. Although we may not know how exactly Russia will respond, we should certainly expect that they will.
Can harsh economic actions justify armed conflict?
Do truly unprecedented sanctions aimed at crippling Russia’s economy and, presumably, imposing harsh economic pain on its citizenry “for years to come,” justify a war? The conventional legal answer is “no.” Generally, economic sanctions do not violate international law, even if they are unilaterally imposed. (Unsurprisingly, the Russians may have a different view, at least when they are being sanctioned.) Nations should take into account their humanitarian impact, but it is unsettled exactly how that process should work.
Article 2 (4) of the UN Charter does forbid the threat or use of force, but as Mike Schmitt and Andru Wall observed in 2014:
Unfortunately, the Charter does not define the term “use of force,” nor does the text of Article 2(4) add granularity to the concept. The context, travaux préparatoires, and subsequent treatment, however, leave little question that the Charter banned armed force, while lesser forms of coercion, such as economic or psychological coercion, were not outlawed.
Professor Max Waxman likewise says that as a “general matter” under the UN Charter “most economic and diplomatic assaults or pressure, even if they exact tremendous costs on a target State, are not barred in the same way.”
Thus, in theory, otherwise lawful sanctions, even severe ones that impact Russian civilians, are not illegal and would not, for example, authorize force in “self-defense” or otherwise serve as a casus belli. But will the Russians see it that way?
Maybe (likely?) not. The sanctions being imposed are intended, the President says, to “vastly degrade [Russia’s] ability to thrive in the weeks, months and years ahead.” and are being touted by commentators as “economic war” against Russia. Could the Russians then decide to wage economic warfare of their own?
Could economic conflict with Russia become a full-blown cyber war?
If the U.S. and Russia engage in “economic war,” how vulnerable is the U.S to a Russian response? While the U.S. is much less dependent upon Russian energy and food commodities that Putin might cut off to punish some allies, our economy does have a large cyber “attack surface”, so to speak, that the Russia could hack. Here again, international law is unsettled, and Russia could exploit that ambiguity.
The analysis is laid out in an earlier post, “Is Bitcoin targetable?” but suffice to say it is legitimately arguable that cyber-operations designed to be economically-coercive and to not directly cause physical harm would not be an “attack” within the meaning of international law. For example, the scrambling of data lacks the violence usually associated with an “attack” and, accordingly, the argument would be that doing so doesn’t violate the UN Charter’s prohibition on the use of force.
Similarly, some believe that data is not sufficiently tangible to be a civilian “object” protected by international law. Despite the adverse impact of snarled or destroyed data on civilians, international law has not yet definitively come to a broader interpretation. A 2018 law review article noted:
Perhaps the clarification will come in response to a future situation where one party to an armed conflict deliberately targets and destroys civilian banking records causing widespread anxiety but without causing any consequent physical damage, and the attacking State claims to have done so legitimately because data is not an object, thus rendering the rules on targeting inapplicable.
In a post last summer (“Cyber disruption,” ransomware, and critical infrastructure: A new US understanding of “attack”?) I suggested that the U.S. may be taking the position that significant ransomware or other hostile cyber actions warranted characterization as an “attack” even without the kind of physical destructiveness traditionally associated with that term as used in international law. However, the U.S. has not made any explicit announcements along that line.
International law may, however, be moving in that direction. Professor Mike Schmitt told us last October:
However, we are seeing a degree of movement. For instance, in 2019, France suggested that “A cyberattack could be categorized as an armed attack if it caused substantial loss of life or considerable physical or economic damage.” The economic harm comment cuts new ground. Yet, while other states have not gone as far as France, there seems to be a growing sense among government officials around the world that in some cases a hostile cyber operation could cause non-physical consequences severe enough to trigger the right of self-defense.
As with the use of force issue, they are zeroing in on the “scale and effects” of the cyber operation’s consequences. This will inevitably lead them away from a strict interpretation by which only significant injury or physical damage qualifies as an armed attack.
I agree but–at present–I don’t think we have enough state practice or opinio juris to definitively conclude that the shift in norm interpretation has taken place, let alone matured into customary international law.
Thus, while ransomware, “wiper” malware, denial of service attacks, and similar hostile cyber events may violate other aspects of international law (and, certainly, domestic law), we could see U.S. civilians and civilian institutions subject to hostile cyber operations that, it could contended, do not breach the UN Charter prohibition on the use of force, nor the law of war precepts that forbid deliberate attacks on civilians and civilian objects.
How bad could it get? (Real bad.)
PBS reports that “President Vladimir Putin cast aside international condemnation and sanctions and warned other countries that any attempt to interfere would lead to ‘consequences you have never seen’.”
It is not clear exactly what he might consider to be “any attempt to interfere” but we cannot dismiss the notion that sanctions or even diplomatic steps could fall in that category. With respect to “consequences you have never seen,” these certainly could include cyber operations, as Ukraine has already suffered them.
David Meyer writes in Fortune report that experts see serious dangers:
“I think the risk right now is high and rising,” said Derek Vadala, chief risk officer at the U.S. cyber risk ratings firm BitSight, who warned that western companies should ensure their systems are patched against known vulnerabilities. “Everyone is on a heightened state of preparedness right now.”
Some good news? The New Scientist says that although experts think digital attacks will be a “big factor” they don’t expect a “massive cyberwar.” Interestingly, they also cite Professor Agnes Venema’s belief that in the event of Russian attacks, “international law will limit Western attacks on civilian networks.” The professor adds:
“Those countries who consider the international legal order as worthy to uphold will always apply human rights law and principles such as distinction between military targets and civilian infrastructure when acting,” she says. There is also the risk of escalating the conflict. “You need to consider what happens when you release such a weapon,” says Venema. “After all, it can be used against you in the future.”
But do we think the Russians feel that way? And, if not, how bad could it get, particularly if escalation occurs? Recall that Russians were alleged to have been behind the “Solar Winds” hack which might have implanted malware in computers across the country. That malware might be activated for destructive purposes.
Consider as well this sobering assessment from a 2020 post:
Just last summer Prof. Jeremy Straub acknowledged in an article that so far cyber-attacks “have done little more than steal data.” but warns that “there are signs that hackers have placed malicious software inside U.S. power and water systems, where it’s lying in wait, ready to be triggered.”
Prof. Straub says he’s “concerned that a cyberattack with widespread impact, an intrusion in one area that spreads to others or a combination of lots of smaller attacks, could cause significant damage, including mass injury and death rivaling the death toll of a nuclear weapon.”
Concluding thoughts
Now that people are dying and a country is being destroyed, Americans will be more focused on a conflict that could spiral into a wider war. In any event, it will likely impact them economically in some way for months and even years to come despite the President’s insistence he is committed to avoiding any adverse repercussions on the American people. It really is hard to see how all negative ramifications can be fully avoided.
Notably, today the President repeated “his warning to Russia about conducting cyberattacks on American targets,” but he was, David Sanger of the New York Times reports, “deliberately vague on how the U.S. would respond, with counter-cyberattacks or in other realms.” I endorse such ‘deliberate ambiguity’ in this instance even as I recognize there are no panaceas.
Lawfire contributor retired colonel Bill Knightly makes this grim observation that will be familiar to those who have studied war: “Once this war genie is out of the bottle there is no telling what unintended consequences lie ahead.” Indeed.
We need to pray that diplomats find a way to peace, but also gird ourselves–individually and collectively—for tough days ahead.
Remember what we like to say on Lawfire®: gather the facts, examine the law, evaluate the arguments – and then decide for yourself!
