Cyber and Information Warfare

In April 2007, Estonia—one of the most digitally connected countries in the world—watched its banks, government ministries, and newspapers go dark almost overnight. The trigger wasn't a bomb or an invading army; it was a dispute over the relocation of a Soviet-era war memorial in Tallinn. Waves of coordinated cyberattacks, later traced to networks inside Russia, flooded Estonian servers with traffic until the country's digital infrastructure buckled. Historians now call it one of the first true nation-on-nation cyberwars—and it proved that a war can be fought, and felt, entirely without a single soldier crossing a border.

By the end of this lesson, you will be able to: - Explain the difference between cyberwarfare (attacking systems) and information warfare (attacking minds) - Describe how the Stuxnet worm physically destroyed Iranian nuclear centrifuges without a single missile - Identify tactics used in disinformation campaigns, including troll farms, bot networks, and deepfakes - Explain why 'attribution'—figuring out who launched an attack—is one of the hardest problems in cyber conflict

Geopolitics scholars split this kind of conflict into two related but distinct battlefields. Cyberwarfare targets systems: power grids, banking networks, military command systems, and industrial equipment. Its weapons are malicious code—worms, viruses, and exploits—that can shut down a hospital's computers or open a dam's floodgates. Information warfare targets minds: it uses propaganda, forged documents, manipulated videos, and social media manipulation to change what people believe, whom they trust, and how they vote. The two often work together. A cyberattack that knocks out a country's power grid is far more effective if it's followed by a disinformation campaign blaming the wrong country and sparking public panic.

In 2010, cybersecurity researchers discovered a stunningly sophisticated piece of malware later named Stuxnet. It had been secretly spreading through computers at Iran's Natanz nuclear enrichment facility, most likely delivered on an infected USB drive by someone who didn't know what they were carrying. Stuxnet didn't just steal data—it took control of the industrial equipment (called PLCs, or programmable logic controllers) that spun uranium-enrichment centrifuges. The worm quietly sped the centrifuges up and slowed them down in destructive patterns while feeding false 'everything is normal' readings to the human operators watching the control screens. By the time Iranian engineers understood what was happening, an estimated 1,000 of Natanz's roughly 5,000 centrifuges had been destroyed—a setback of at least a year to Iran's nuclear program, achieved without a single explosion crossing a border.

While Stuxnet attacked machines, information warfare attacks trust itself. During the 2016 U.S. presidential election, investigators traced thousands of fake social media accounts to the Internet Research Agency, a 'troll farm' based in St. Petersburg, Russia, that employed hundreds of people to pose as ordinary American voters, argue on both sides of divisive issues, and organize real-world rallies—sometimes scheduling opposing protests at the same location on the same day. Newer tools have raised the stakes further: deepfakes use AI to generate realistic fake video or audio of real people saying things they never said. In 2022, a crude deepfake video falsely showing Ukrainian President Volodymyr Zelenskyy telling soldiers to surrender was posted to a hacked news website—it was debunked within hours, but it previewed a tactic experts expect to get far more convincing.

Even when cybersecurity firms are highly confident about who launched an attack, governments face a dilemma: publicly blaming a rival nation can require revealing classified intelligence-gathering methods, and a wrong accusation can trigger a real conflict. This uncertainty is itself a weapon—nations can launch deniable attacks, knowing that proving responsibility beyond doubt is nearly impossible. International law, largely written for battlefields and borders, still has no universal agreement on what counts as an 'act of war' in cyberspace.