Dr Melanie Garson said offensive cyberwarfare was inherently risky and that, once an attack is launched, it could be difficult to control. She also noted the UK could launch its own cyber attacks, but may not do so for the same reasons. Dr Garson is a lecturer on conflict resolution and international security specialising in cyberattacks at University College London (UCL).
Cyberwarfare is also largely untested compared to traditional tactics. Digital systems are interconnected and blowback from a cyberattack can do as much damage to the country launching the attack as its intended target, according to Dr Garson.
She said: “The system is fundamentally leaky – the pipelines are leaky. You just don’t know whether it will blow back and negatively affect you. We are so interconnected that the possibility that it can come back and hit you, you’ll sort of have an own goal, is very, very high.
“There has been a lot of speculation about Russia’s offensive cyber capability, and why it’s not being used more in the conflict. There are two main reasons.
“One of the reasons is that to hit the communications network when they need to use that communications network isn’t rational or logical and damages what they need to do. Beyond that, there is a risk that it could come back to hurt them more than the hurt they are trying to cause.”
She noted, however, that the UK and other Western powers could engage in offensive cyberwarfare if targeted.
She said: “The UK has the cyber command, the US has an equivalent.
“We have, without a doubt, the capability to engage maliciously, should we wish.”
Whether large scale cyber attacks should be considered an act of war has been debated by academics and military tacticians. Most agree that it largely depends on the circumstances and scope of the attack. Dr Garson weighed in on the debate.
She said: “That’s the million dollar question. This is one of the things that has been argued ever since the cyber attack in Estonia – it turned the lights out for two weeks.
“Estonia then, at that point, wanted NATO to use Article 5 and believed it was sufficient for collective defence. So, this conversation has been ongoing.”
READ MORE: Putin humiliated following ‘huge losses of elite units’
Determining where a cyber attack originated can often take months. If a country is hit by a missile, it can respond almost immediately while a response to a cyber attack cannot be initiated until it is known with certainty where the attack originated.
Dr Garson pointed to a cyber attack against Ukraine in February which was only recently confirmed by Western powers to have been carried out by Russia.
She said: “You can classify something as an act of war but you have to be 100 percent sure that it came from the actor that you believe it did.
“If we are looking at the timeline to confirm attribution, and you’re looking at the time lag to respond. It’s not like someone lobs a missile and I can lob a missile back.”