Understanding Cyberwarfare

Lessons from the Russia-Georgia War

Sarah P. White

March 20, 2018

Understanding Cyberwarfare: Lessons from the Russia-Georgia War

Capt. Sarah P. “Sally” White is a cyberspace operations officer in 

the US Army. She is currently pursuing her PhD in the Harvard 

Department of Government, where her research interests 

include military innovation and comparative cyberspace 

doctrine. She has served in the 82nd Airborne Division and the 

780th Military Intelligence Brigade (Cyber). Following graduate 

school, she will serve as an instructor in the West Point 

Department of Social Sciences.

Understanding Cyberwarfare: Lessons from the Russia-Georgia War

1

Cyberattacks had become an established tool

of statecraft by the time theywere used against

the Republic of Georgia in the summer of

2008, albeit one without a legal framework and

whose long-term implicationsremained poorly

understood.1

Nevertheless, the war between

Russia and Georgia thattook place in August of

that year was remarkable for its inclusion of a

series of large-scale, overt cyberspace attacks

that were relatively well synchronized with

conventional military operations. Conducted

by an army of patriotic citizen hackers, the

cyber campaign consisted of distributed denial

of service (DDoS) attacks and website

defacements that were similar in nature but

different in method to what had occurred in

Estonia the year prior. In total, fifty-four news,

government, and financial websites were

defaced or denied, with the average denial of

service lasting two hours and fifteen minutes

and the longest lasting six hours.

2 Thirty-five

percent of Georgia’s Internet networks

suffered decreased functionality during the 

 1 Examples of the state-sponsored use of cyberattacks prior to 2008 include espionage (e.g., Titan Rain,

Moonlight Maze), support to precision military raids (e.g., Operation Orchard), sabotage (e.g., Stuxnet, the

planning for which is estimated to have begun in 2007), and coercion (e.g., Estonia). Several books provide an

accounting of these and other events, to include Segal, Hacked World Order; Kaplan, Dark Territory; and Healy,

Fierce Domain.

2 Tikk et al., Cyber Attacks against Georgia.

3 Russell, “Georgia-Russia War.”

4 Ibid.

5 Interviews conducted with members of the Georgian military, government, and defense ministry, June 2017,

in the Republic of Georgia, reinforced the point that while the cyberattacks added a layer of chaosto the

Georgian response, they did not affect military decision making about the crisisin a significant way.

attacks, with the highest levels of online

activity coinciding with the Russian invasion of

SouthOssetia on August 8, 9, and 10.3 Even the

National Bank of Georgia had to suspend all

electronic services from August 8–19.

4 While

there is strong political and circumstantial

evidence that the attacks were encouraged by 

the Russian state, definitive technical

attribution—and thus definitive legal

culpability—have remained elusive.

The cyberattacks had little effect on

conventional forces and were not decisive to

the outcome of the conflict,5 but they

nevertheless offer significant lessons on the

character of modern warfare for scholars of

conflict and military studies. This paper will

offer abrief analysisof severalof those lessons.

First, the attacks reinforced the Russian

interpretation of cyberspace as a tool for

holistic psychological manipulation and

information warfare. By impeding the

Georgian government’s ability to react,

respond, and communicate, the cyberattacks
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

2

created the time and space for Russia to shape

the international narrative in the critical early

days of the conflict. Second, the attacks

highlighted the role of third forces on the

modern battlefield. These forces ranged from

the citizen hackers who perpetrated the

attacks to the private companies who were

relied on to defend againstthem. And third,the

attacks provide a useful demonstration of how

the technical concepts of cyberspace can be

understood through conventional operational

concepts in order to more effectively integrate

them with military operations.

Cyberattacks in the Russia-Georgia War 

Reaffirm the Russian View of Cyberspace as a 

Tool for Psychological Manipulation and 

Information Warfare

In analyzing Russian cyber doctrine, one must

understand that neither the word “cyber” nor

the term “hybrid warfare” exist independently

in the Russian conceptual framework; instead, 

 6 Giles, “Russia’s ‘New’ Tools for Confronting the West.”

7 Medvedev, “Military Doctrine of the Russian Federation”; Giles, “Military Doctrine of the Russian Federation

2010.”

8 Connell and Vogler, “Russia’s Approach to Cyber Warfare.”

9 Thomas, “Information Security Thinking.”

they are used almost exclusively in reference

to Western activities.

6 While the US military

has established an understanding of

cyberspace as a discrete domain of warfare

that deserves its own doctrine, its own troops,

and its own unique menu of lethal and

nonlethal effects, Russia treats cyberspace as a

subordinate component to its holistic doctrine

of information warfare.7 Cyber operations, to

the Russian mind, are regarded more broadly

“as a mechanism for enabling the state to

dominate the information landscape,” rather

than as a narrow mechanism for the

achievement of discrete effects on

communication systems.

8 This distinction is 

evident in the Russian use of the phrase

“information security” rather than the more

narrowly technical notion of “cybersecurity”

that prevailsin US discussion.9

Furthermore, the Russian conception of

information warfare is also more holistic in

character than the typical Western

understanding. Whereas the West tends to

view information as data that is transmitted

and stored on networks—a data- and systemcentric perspective that arose out of the

information theory movement of the mid-
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

3

twentieth century—other conceptions see

information as a platform for shaping

individual and collective perception, to alter

how people make decisions and how societies

see the world.10 The Russian conception of

information warfare reflects this second, more

psychological tone. Shaped by a history of

confrontation with adversaries who were

technologically and economically superior,the

Russian military tradition depended on

achieving victory through a qualitative, nearspiritual sense of moral superiority.

11 This

moral superiority required the deliberate

cultivation of a sense of psychological and

cultural integrity that was strong enough to

withstand the effects of outside influence.

Furthermore, the imperatives of Soviet

authoritarianismdepended onthe tight control

of information flowsto preventthe population

frommobilizing againststate power.12

The Russian approach to the Internet

today is in many ways a natural evolution of

this cultural legacy. Unlike the UScybersecurity

framework, which has been overwhelmingly

 10 Lawson, “Russia Gets a New Information Security Doctrine.”

11 Adamsky, Culture of Military Innovation.

12 Soldatov and Borogan, Red Web.

13 Thomas, “Information Security Thinking.”

14 Galperovich, “Putin SignsNew Information Security Doctrine.”Thenew information security doctrine is of the

same spirit as both the 2000 and 2010 versions,the former of which includes asthreats, “the devaluation of

spiritual values, the propaganda of examples of mass culture which are based on the cult of violence, and on

spiritual and moral values which run counter to the values accepted in Russian society.” Quote taken fromGiles,

“Information Troops.”

concerned with threats to the hardware and

software of the Internet rather than threats to

the psyche of users, the Russian information

security doctrine treats informationpsychological and information-technical

threats with equal severity.

13 The 2016 version

of this doctrine, for example, describes the

threat of an “informational pressure” that has

“the aim of diluting traditional Russian

spiritual-moral values.”14 The consistent

language of the past three iterations of this

doctrine suggest that Russia is just as

concerned with maintaining psychological,

perceptual, and cultural integrity as it is with

the physicalstate of networks or their resident

data.

Noticeably absent from these

discussions on cyber conflict is any mention of

the role of the offense in cyberspace,

something that US and British governments

have far more openly discussed. There are

several possible motivations for this absence,

not the least of which concerns the legitimate 

desire to keep offensive capabilities secret. An
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

4

equally plausible reason is that rigid

delineations between offense and defense are

both difficult to establish and logically

unnecessary in a cyberspace doctrine that is

more psychologically than technically oriented.

A 2007 article in Moscow Military Thought

reinforces this idea: “In our view, isolating

cyber terrorism and cyber crime from the

general context of international information

security is, in a sense, artificial and

unsupported by any objective necessity.”15 By

wrapping conventional notions of

cybersecurity into an idea of information

security that is broader and more

psychologically defensive, Russia creates the

conceptual space to stretch the boundaries

between offensive and defensive activity—as

we have seen in numerous Russian

disinformation campaigns.

Understanding Russia’s psychological

approach to information warfare—and further

understanding its information warfare

approach to cyberspace operations—allows

one to evaluate the 2008 cyberattacks in their

proper context. A distinguishing characteristic

of psychological warfare concernsitstendency

to target populations rather than militaries, a

 15 Giles, “Information Troops.”

16 Deibert, “Cyclonesin Cyberspace.”

17 Bumgarner and Borg, Overview by the US-CCU.

18 Russia-Georgia Cyber War—Findings and Analysis.

characteristic that was reflected in the RussiaGeorgia War. The specific targets selected for

the campaign isolated the Georgian

government from its most effective means of

strategic communication and, in the process,

rendered it unable to communicate with either

its own population or with the outside world.

Russia then filled the void created by this

information blockade with a concerted

propaganda campaign that allowed it to

saturate the news media with its own version

of events.

16 Furthermore, while analysts agree

that Russian hackers had the expertise to

create lasting physical effects on Georgian

infrastructure, their avoidance of doing so 

reinforces the idea that psychological

manipulation and narrative control was a more

important long-term purpose than any

structural or service degradation the hackers

may have been able to create.17 The significant

amount of time that Russian hackers spent

discussing the merits and drawbacks of 

different kinds of malware furthersuggests an

understanding of the campaign’s higher

strategic needs.18 It is worth noting, however,

that the technical success of the cyberattacks

was notmatched bya successwith the strategic
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

5

narrative, as the Russians failed to gain

international consensus around their version

of events. Lessons learned from this failure led

directly to Russian success in Ukraine six years

later.19

In cyberspace as in physical space, it is

crucial to avoid interpreting the actions of an

adversary from the lens of one’s own doctrine.

Russian behavior in cyberspace in Georgia and

beyondmusttherefore be evaluatedwithin the

context of Russia’s conceptual orientation to

the cyberspace domain. This orientation

manifests itself in an information security

doctrine that is preoccupied with a sense of

both physical and psychological vulnerability

and that, therefore, implicitly grants societal

targetsthe same legitimacy as military ones. As

a result, the Russian perspective on cyberspace

views deception, manipulation, and denial as

legitimate tools of statecraft that today’s mass

communication platforms readily enable.

Actions that we would characterize as discrete,

technical, and fundamentally offensive in 

character—such as DDoS and website

defacement—instead reflect Russia’s holistic

approach to cyberspace as a tool of

 19 Giles, “Information Troops.” Thisidea of Georgia as a warm-up for Ukraine, in physical and in informational

space, was also reinforced during author interviewsin Georgia.

20 Russia has employed many of these same information-warfare tools against domestic audiences, as Soldatov

and Borogan describe in The Red Web.

21 Since 2008, Russian has conducted cyber operations and information operations in conjunction with a

military campaign in Ukraine and Syria and absent a military campaign in Finland, Latvia, France, Germany,

and the United States.

information warfare rather than as a

fundamentally separate war-fighting

domain.20 The 2008 Russia-Georgia War was

the first overt test of this approach in a

conventional military context; in the decades

since, it has been implemented with increasing

refinement both inside and outside the postSoviet sphere and both inside and outside a

conventional military setting.21

Cyberattacks in the Russia-Georgia War 

Highlight the Increasing Relevance of Third 

Forces to Future Conflict

The cyberattacks of the Russia-Georgia War

provide empirical evidence of the extent to

which cyberspace empowers third-party nonstate actors in modern conflict. The US Army

Strategic Studies Institute categorizes these

actors as “third forces,” or “organizations that

can influence the outcome of armed conflict
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

6

but are not, strictly speaking, combatants.”22

The Russia-Georgia War provides several 

examples of how third forces can exert

influence on the battlefield both inside and

outside state control. The first such example is

the Russian hackers themselves. Russia has a

well-documented history of employing

civilians, criminal syndicates, and armies of

social media bots23 to rapidly increase the

depth and breadth of its offensive cyber 

footprint with minimal levels of state

attribution.

24 In thistradition,the cyberattacks

in Georgia were not perpetrated by a

uniformed arm of the Russian state, but by

patriotic citizens who were engaged and

recruited through social media. The primary

hacker forums for coordination and tool

dissemination were xaker.ru and

StopGeorgia.ru. The hacker communities

within them followed a distinct hierarchy in

which the more technically skilled forum

leaders provided the tools, vulnerabilities, and

target lists for the less tech-savvy followers to

action.25

 22 US Army War College Key Strategic Issues List 2016–2017.

23 Chen, “Agency.”

24 Klimburg, “Mobilising Cyber Power.” See also Soldatov and Borogan,Red Web, for examples of domesticuse.

25 Russia-Georgia Cyber War—Findings and Analysis.

26 Klimburg, “Mobilising Cyber Power.”

27 Ibid.

28 Deibert, “Cyclones in Cyberspace.”

29 Bumgarner and Borg, Overview by the US-CCU.

Russian political culture has two 

attributes that make it particularly adept at 

marshaling these non-state cyber resources in 

the service of its strategic goals, a process that

Alexander Klimburg calls “mobilizing cyber

power.”26 The first is a historically cozy

relationship between the state and organized 

crime. In cyberspace this relationship is most

evident in the nefarious online activity of the

Russian Business Network (RBN), which is the

only criminal organization identified by NATO as

a major strategic threat.27 ShadowServer

Foundation identified at least six different C2

servers used in the conflict, all of which had a

preexisting record of DDoS activity.

28 Some of

the zombie computers involved even conducted

attacks on unrelated e-commerce websites 

amidst the Georgia campaign.29 The second

attribute that enables Russian recruitment of its

patriotic hacker community is a long-standing

political tradition of propaganda, agitation, and 

narrative control designed to shape the 

collective psyche and mobilize the popular

consciousness in service of the state. This 
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

7

tradition led to the creation of several Kremlinsponsored youth movements in the mid-2000s,

which have since been implicated in both trolling 

and DDoS operations against Kremlin 

opponents.

30 Accordingly, the first step of the kill

chain for the Georgia cyberattacks entailed an

encouragement of novices “through patriotic

imagery and rhetoric to get involved in the

cyber war against Georgia.”31

While Russia claims that it neither 

supports nor encourages these cyber privateers, 

internal military discourse indicates that the 

Russian state is well aware of the strategic 

advantages they provide. Following the 2008 

campaign, discussion within the Russian military 

cited a poor performance in the information 

domain as evidence of the need for “Information 

Troops” within the Russian armed forces who 

were capable of conducting full-spectrum

information operations.

32 Criticisms of this

proposal stemmed from a reluctance to cede

the many benefits of the existing arrangement.

First, the use of citizen hackers allows Russia to

circumvent one of the greatest challenges in

cyberspace: recruiting and retaining talent. The

execution of effective cyberspace operations

 30 Soldatov and Borogan identify two groups in particular: Nashi (“Ours”) and Molodaya Gvardiya (“Young

Guard”), the latter of which created its own media wing in 2013 to help with domestic Internet censorship.

31 Russia-Georgia Cyber War.

32 Giles, “InformationTroops.”

33 Evans and Reeder, Human Capital Crisis in Cyber Security; “US Army Introduces Cyber Fast Track for Civilians”;

Borderless Battle.

requires a level of creativity and innovation that

disciplined, hierarchical, and process-oriented 

militaries find difficult to accommodate. 

Recognizing that military organizations are ill 

situated to cultivating talent, the best coders 

often head to the private sector, leaving

militaries with a crisis in manpower even as the

requirements for effective cyber defense and 

offense increase.33 A reliance on third-party

actors allows a state to capitalize on the richest

talent pools without having to significantly

overhaul their entrenched military processes.

These private-sector actors, unburdened by the 

rigid hierarchies of authority that rightfully 

safeguard the military application of lethal 

violence, are far more proficient in the type of 

operational agility that cyberspace requires. This 

agility was evident in the chronology of the 

Russia-Georgia War, as the Russian hackers were 

able to effectively counter each successive 

Georgian response, through rapidly executed 

actions of increasing technical sophistication.

Furthermore, the use of non-state

hackers allows the Russian state to elude

formal attribution from the hackers’ cyber 

activities. Since attribution is a precondition for
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

8

retaliation, the use of non-state hackers

enables a state to inhabit an operational gray

space that complicates the pursuit of a

response and obfuscates the applicability of

international law.

34 To this day, there exists no

forensic evidence that definitively connectsthe

Russian government to cyber actions against

Georgia. Referencing the effectiveness of the

citizen-led Georgian campaign, one report

stated outright that “there is no need for the

state machine in modern cyber warfare.”35 In

the Russian calculus, the use of non-state

hackers offers a set of utilitarian advantages 

that outweighs any associated reputational

costs: citizen hackers are anonymous, they can

be mobilized quickly, they require no

additional state training, and they are

operationally agile. While Russia has recently

signaled an intention to bolster the cyber 

capability of its armed forces, the

aforementioned advantages suggest that its

reliance on third-party actors to execute the

state’s cyber operational dirty work is unlikely 

to go away as an auxiliary tactic any time

soon.

36

Acknowledging the role of unregulated

 34 Tikk et al., Cyber Attacks against Georgia.

35 Giles, “InformationTroops.”

36 Connell and Vogler, “Russia’s Approach to Cyber Warfare.”

37 Tikk et al., Cyber Attacks against Georgia.

38 Other noteworthy examples of patriotic hacking wars include Kosovo in 1999, the Second Intifada in 1999, digital 

skirmishes between India and Pakistan in 2000, and the Hainan Island Incident in 2001.

third-party actors in cyber conflict also requires

us to contend with the patriotic amateur

hacking wars that such actors will inevitably

incite. Because amateur hackers are not bound

by the same considerations of collateral

damage that restrict military cyberspace 

operations, their potential involvement in

future conflict is a concerning development.

One of the first elements of Georgian society

that was deliberately attacked was a hacking

forum called www.hacking.ge, an effort to

forestall a Georgian counterattack by

neutralizing its citizen hacking community.

37

This action precipitated limited Georgian

attacks against Russian websites, thereby

resulting in an independent cyber conflict

between non-state actors under the cover of

officially declared state hostilities.

38

Furthermore, while the nationality of the

hackers remained relatively evenly distributed

among pro-Russian and pro-Georgian

sympathizers, the infrastructure that they

fought with touched over sixty different

sovereign countries,suggesting that the digital

repercussions of future conflict will extend far

beyond the physical boundaries of the military
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

9

actionsthat inspired them.39

The multinational nature of the 2008 

Russian cyber campaign raised a variety of legal 

issues that will accompany any use of third forces

on the cyber battlefield. First, the use of citizen 

hackers and other non-state parties complicates 

the selection of an appropriate legal framework 

to govern the international response. As the 

Cooperative Cyber Defense Center of Excellence 

(CCD COE) articulates, the fact that physical

hostilities might meet the standard for

application of the law of armed conflict (LOAC)—

defined as “any difference arising between two 

states and leading to the intervention of armed

forces”—does not mean that cyber hostilities 

will also. On the contrary, both the Council of 

Europe (COE) convention and current US law still 

formally view the July 2008 DDoS attack against 

Georgia as a cyber crime.40 Absent LOAC, a state 

must default to either criminal law or 

information and communications (ICT) 

regulation. While Estonia benefited from a more 

well-developed ICT legal framework that helped 

to guide its response to Russian cyberattack in

2007, Georgia did not have the benefit of

anything comparable in its domestic law. An 

additional legal complication concerned

formal state attribution. In international law, it

 39 Deibert, “Cyclones in Cyberspace.”

40 Korns and Kastenberg, “Georgia’s Cyber Left Hook.”

41 Tikk et al., Cyber Attacks against Georgia.

is assumed that the conduct of a private actor

is not attributable to the state unless the state

has “directly and explicitly delegated a part of

itstasks and functions to a private entity.” 41 As

numerous reports have verified, this level of 

control remains unproven in the case of the 

Russia-Georgia War. Reliance on private cyber 

militias therefore offers a level of plausible

deniability to states who wish to further

complicate the response options that are

legally available to an adversary.

The Russia-Georgia conflict introduced

another type of third-party actor—the private

tech companies that own contested cyber 

terrain.On August 8 the owner of TulipSystems

(TSHost), a private web-hosting company in

Atlanta, contacted the president of Georgia to

offer assistance in reconstituting their Internet

capabilities. On August 9 the Georgian

government transferred critical Internet

capabilities to TSHost servers in the United 

States, including the websites of the Ministry of

Defense and the president. Undeterred, the

cyber attackers brought their DDoS capabilities

to bear on American targets. The significance

of this move cannot be overstated: an

American company, with no authority and no

clear US approval, brought a conflict to the
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

10

shores of a neutral sovereign state by

negotiating directly with a foreign government.

Had the cyberattacks been considered an act of

war rather than an act of international crime,

the unilateral relocation of Georgian cyber 

infrastructure to the United States could have

violated Hague (V) article 3, which forbids

belligerents from erecting on the territory of a

neutral power a “wireless telegraphy station or

other apparatus” for the purpose of

communicating with belligerent forces.

42

Theories of warfare, in physical space or

otherwise, tend to presuppose an ecosystem of

exclusively government actors. Cyberspace 

challenges this presupposition, since the domain, 

the expertise to succeed in it, and its most

sophisticated operational innovations have

evolved largely outside of either state or military 

control. The interconnected nature of the 

domain has caused private actors to become 

increasingly entangled with the affairs of state, 

and state actors to become increasingly

powerless in the face of expanding threats.

43 As 

 42 Korns and Kastenberg, “Georgia’s Cyber Left Hook.”

43 Borderless Battle. See also current congressional testimony on the role of Twitter,Google, and Facebook in

the 2016 US elections.

44 Healy, Fierce Domain.

45 Later examples of this new private-public dynamic include Stuxnet, in which the independent discoveries of

three private cybersecurity firms unintentionally derailed the mostsophisticated cyber sabotage program in

history (see Zetter, Countdown to ZeroDay); cybersecurity firm Mandiant (now FireEye), whose 2013 report on

APT 1 allowed the US government to furtherthe Chinese dialogue without having to disclose classified sources

andmethods; andGoogle Jigsaw, which addressesproblemsof societalsecurity through technologicalsolutions

enacted almost entirely onGoogle’sown platforms. For example, Google Jigsaw’s ongoing counterextremist

campaign redirects potential ISIS recruitstoward more-moderate material.

Jason Healy states in his comprehensive history 

of cyberspace, the primacy of the private sector 

in resolving conflict is one of the crucial 

distinguishing features between cyber and 

traditional conflicts.

44 The Russia-Georgia War 

provides an excellent, early example of the 

implications of such public-private 

entanglement, from patriotic citizen hackers 

who engage in their own private war to 

independent cybersecurity firms who engage in 

their own private diplomacy. By demonstrating 

many of the ways in which cyberspace enables

these so-called third forces, this conflict

foreshadowed many of the challenges and 

critical questions of conflicts to come.45
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

11

Cyberattacks in the Russia-Georgia War Show 

That Cyberspace Can Be Understood through, 

and Employed with, Existing Operational 

Principles

A significant obstacle to planning for and

integrating cyber effects into conventional

military operations is the inability of the

technical and nontechnical communities to

understand one another, a phenomenon that

Jason Healy describes as a “mutual

misunderstanding between the ‘geeks’ and the

‘wonks.’”46 Those with the operational insight

to recognize effective requirements for a

campaign plan usually lack the specific

technical knowledge to articulate how those

requirementsmight be supported, while those

with the technical knowledge to create

solutions often lack adequate access to the

planning process or adequate understanding

 46 Healy, Fierce Domain, 16.

47 Electronic warfare,signalsintelligence, and information operations all possesssimilaritiesto the cyberspace

operations of today. As Michael Warner arguesin his “Cybersecurity: A Prehistory,” current cyberspace

doctrine bears a strong resemblance to concepts of information warfare in the early 1990s.

48 While the analogy that the US military is “building an airplane while in flight” in respect to cyberspace

operationsis woefully overused, there are important parallelsto be drawn between the creation of air doctrine

in the interwar years and the creation of cyber doctrine today. The Germans, the Americans, and the Brits all

came to different conclusions asto how air powershould be used, each of which failed to prove holistically

effective when the motivating strategic circumstances were upturned. Several of the factorsthat wentinto

these conclusions are present in some degree today: interservice rivalries and the consequentjostling for

resources;the influence of technologies developed (or not) in the civilian sector; the multiple perspectives on

the nature of the threat and of future war; the influence of personnel background on the thinking of each

country’s new air organizations; and most importantly, the set of assumptionsthat underpinned each service’s

estimation of the validity of their doctrinal projections. See Murray and Millett, Military Innovation in the

Interwar Period, for a more detailed account of this and other examples of differing approachesto the same

technology.

of the larger strategic picture. Both sides are

often stifled by poor communication channels

and unaccommodating legal authorities. The

resultant lack of demonstrated cyberspace

effectiveness only further disinclines the

supported community from requesting cyber 

effectsin the future, thus perpetuating a cycle

of missed opportunities for successful

cyberspace integration that inhibits further

capability development. Integration efforts are

further stifled by the perception that

cyberspace is new and different, when one

could argue that there are clear historical

analogues both for its effects47 and its

integration.

48

This gap in understanding is based in

large part on the erroneous notion that

cyberspace is too technical and too unique for

the traditional war-fighting community to

grasp. While the Army has made an effort to
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

12

rectify this conceptual discrepancy through the

integration of 131A targeting warrants into its 

cyber formations and through tactical

outreach initiatives such as Cyber Support to

Corps and Below (CSCB), developing a shared

understanding of cyberspace operations

remains an institutional challenge throughout

the broader force. The author is intimately

familiar with the American experience in this

regard, but Russian military discourse suggests

that they also face similar challenges.

49

Generating an understanding of cyberspace

outside the cyberspace community (and in

some casesinside it as well) istherefore critical

to the successful implementation of

cyberspace capabilities on a large scale. The 

Russia-Georgia conflict offers several important

lessonsin thisregard.

In offering the first publicly available

evidence that large-scale, overt cyberattacks

can be effectively nested with and understood

through the lens of a maneuver campaign, the

Georgian war represents a critical opportunity

to bridge the conceptual gap that currently

stifles the art of the possible in planning for

effective cyberspace operations. First, the war

demonstrated that cyber effects must pursue

the same strategic, operational, and tactical

purpose as the maneuver campaign they

support. One of Russia’s primary strategic

 49 Giles, “InformationTroops.”

objectives in Georgia was to reassert its power

in the former Soviet periphery. Russianstrength

had to be contrasted withGeorgian impotence,

and so the Georgian government itself became

the center of gravity for both the cyber 

campaign and the physical campaign.

Cyberattacks enabled this purpose by

demonstrating the Georgian government’s

tenuous authority in digitalspace while Russian

conventional forces demonstrated the same in

physical space. Furthermore, by targeting only

those sites whose loss would pose an

inconvenience rather than those that would

cause chaos or injury, Russian hackers

demonstrated a level of restraintin theirtarget

selection that nested with the strategic need to

avoid overly provoking the international

community.

The Russia-Georgia War also helped to

debunk the “speed of cyber” fallacy. This

fallacy centers on a myth that everything in

cyberspace happens instantaneously, creating

a sense of temporal misunderstanding that

complicates effective cyber planning. It is true

that cyberattacks can unfold more rapidly than

attacks in physical space, since the digital

domain is unencumbered by the limitations of

terrain, logistics, or human endurance.

However, because cyberattacks are dependent

on a long process of identifying vulnerabilities,
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

13

developing exploits against those

vulnerabilities, and then maintaining access to

the targets that have them, a successful cyber 

campaign still requires months, if not years, of

preparation and planning. Furthermore, a

trained cyber force requires human capital

supported by doctrine, training, technology,

command and control, and physical

infrastructure. As Dave Hollis states, one

“cannot engage in cyber war from a cold

start.”50 In cyberspace, asin physicalspace,the

speed of a campaign’s execution is often

inversely related to the amount of time spent

preparing to carry it out.

That Russian hackers were able to

immediately engage in website defacement

and denial of service attacks atthe outbreak of

hostilities in Georgia reveals the extent to

which they had prepared for such hostilities

beforehand. Asthe US-CCU reports, one of the

tools used for website defacement had been

created over two years prior, specifically for a

campaign against Georgia. Many of the

subordinate domains to StopGeorgia.ru had

been registered several months before the

outbreak of hostilities, and the hosting

company used to register the site had been

reported by malware-monitoring sites nearly

two months prior to the conflict.51 The

 50 Hollis, “Cyberwar Case Study.”

51 Carr, Inside Cyber Warfare.

extensive preparation required in advance of

cyber conflict allows for the assessment of

synchronized cyberspace actions as an

intelligence indicator for follow-on military

operations. In the case of Georgia, these

indicators took several forms and appeared at

several different stages of the operational

cycle: chat rooms in which hackers were

recruited during the force-mobilization

process; reconnaissance of digital targets to

identify exploitable vulnerabilities; attacks

against rival hacker communities as a

preemptive strike on the adversary’s rear; and

the neutralization of news sites prior to

physical attack could all be seen,

retrospectively, as mounting evidence of an

armed campaign. Systematically identifying

when, why, and how each of these indicators

appears in adversary behavioral patterns can

help improve how we integrate both offensive

and defensive cyber capabilities into

conventionaloperationalprocesses.

Additionally, while the specific tactical

language of cyberspace may differfrom that of

maneuver, the Georgian campaign

demonstrated that many of the same general

principles still apply. An acknowledgment of

thisfact isimportant in helping to reframe how

we consider and communicate cyberspace
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

14

operations in a conventional kinetic context.

For example, a technical explanation of SQL

injection, blind SQL injection, and the use of

Benchmark to maximize expended processing

power—techniques that were all used in

2008—could be reconceived for a different

audience as a discussion of creating massing

effects while maintaining economy of force.

The command and control principles behind a

DDoS attack could be further understood as an

example of centralized command and

decentralized execution, with numerous

command and control centersthat enableunity

of effort across an otherwise invisible

cyberspace army.

Existing doctrinal language and

principles are equally relevant to the

demystification of the cyber defense. Estonia, 

having a comparatively robust ICT

infrastructure with stronger regulatory and 

legal frameworksto govern itthan what existed

in Georgia, was able to defend in place—albeit

with limited success—against a much larger

attacking force. Georgia, on the other hand,

with a physical and legal ICT infrastructure that

was poorly developed in comparison, had to

employ a mobile defense in which it shifted

website hosting to alternate battle positions—

in this case, other countries that had more

available bandwidth and greater filtering

 52 Donovan, “Russian Operational Art in the Russo-Georgian War of 2008.”

capacity. Georgian hackers then attempted a

twofold response that was met with limited

effect. After first blocking Russian IP addresses

and known attack protocols, they attempted a

counterattack against select Russian websites.

In response, Russian hackers employed IP 

spoofing to mask the source location of their

attacks and changed elements of their attack

protocols. While this response is rather prosaic

from a technical perspective, it encapsulates

the maneuver doctrinal pattern of action,

reaction, counteraction; and as such, it can be

understood froma maneuverstandpoint as an

example of classic Soviet operational art—

“attacking with operations from multiple

directions so that the enemy is faced with

overwhelming challenges on where to

concentrate its effort.”52 Cultivating an 

understanding of cyber defense according to

maneuver principles could greatly improve the

ability of fighting organizations to defend

themselves, as it renders otherwise

unintelligibletechnicalterminology into amore

broadly accessible format.

The final theme we see in the Georgian

cyberattacks is that terrain in cyberspace

matters. One of the many fallacies about

cyberspace, and one that feeds the systemic

hyperbole around discussions of cyberwar, is

that cyberspace has no geography. As the
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

15

analysis in the preceding section shows,

however, geography played a significant role in

the effectiveness of cyberattacksin Georgia. US

doctrine defines cyberspace in terms of three

layers: physical, logical, and cyber persona.53

While a great deal of malleability exists at the

logical layer, allowing users to create, modify,

and destroy cyber terrain in a way that has no

physical analogue, cyberspace operations still

have to contend with realities at the physical

layer that no amount of software can

overcome. For example, the fact that Estonia

possessed its own Internet exchange point

(IXP) in 2007 allowed it to cut off the brunt of

malicious Russian traffic without hindering its

ability to communicate internally. Absent this

critical piece of Internet geography, Georgia

lacked the ability to defend against

international attacks without simultaneously

sabotaging their own domestic capabilities.54

Furthermore, the physical reality of

cyberspace is the first point of reference for

determining jurisdiction and the application of

authorities; as a result, it is also where the

global nature of cyberspace can quickly run

into geopolitical issues of sovereignty, as

demonstrated in the decision by Tulip Systems

 53 Joint Chiefs of Staff, Cyberspace Operations.

54 Healy, Fierce Domain, 72.

55 Russell, “Georgia-Russia War.”

56 Raymond et al., “Key Terrain in Cyberspace.”

to host Georgian networks on US servers. The

geography of cyberspace in the Russia-Georgia

War meant that Russia was able to effectively

isolate Georgia from the global Internet by

targeting a few vulnerable choke points of cyber 

terrain. Georgia’s physical dependence on

Russian network infrastructure, with nearly half

of Georgian network routes passing through

Russia, amplified the effectiveness of the

Russian cyberattacks.

55 This reality

demonstrates that terrain dictates the plan in

cyberspace no differently than it does in

conventional maneuver and can once again

help to focus the often-chaotic nature of

cyberspace planning.56

Asthe first publicly available example of

a coordinated cyberattack employed in concert

with a conventional military campaign, the

Russia-Georgia War demonstrated that

cyberspace operations can be employed with

and understood through the same maneuver

principles that it supports. It therefore serves

as a useful template for addressing the critical

conceptual gap between the technical and

nontechnical planning communities that

continues to challenge the effectiveness of

cyberspace operations nearly a decade later. 
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

16

However, such a realization carries with it

several cautions. First, while cultivating an 

understanding of cyberspace through the lens

of maneuver principles serves the necessary

purposeof demystifyinganotherwise-abstruse

domain, in itself this effort is insufficient for

creating the type of detailed technical

understanding thatis necessary for cyberspace

operations personnel. Second, this effort 

should not be pursued at the exclusion of the

type of deep strategic thinking required to fully

realize the domain’s military and grand

strategic potential. For example, one of the

more revolutionary aspects of cyberspace is

the extentto which it promotes a near-constant

state of low-level conflict, one that equally

defies our traditional understandings of war

and our traditional frameworks for strategy.

57

As we attempt to integrate new technology

into existing doctrine, we would be wise to

embark on the critical venture of questioning

which aspects of our doctrine deserve to be

reconsidered. Historical experience offers

ample evidence of the perils that befall those

militaries that fail to adequately question their

own doctrinal assumptions as they pursue the 

 57 For examples of the discussion overthe extent to which cyberspace is unique,see Rid, “Cyber War Will Not

Take Place”; Stone, “Cyber War Will Take Place!”; Gartzke, “Myth of Cyberwar; Lee and Rid, “OMG Cyber!”;

Junio, “How Probably Is Cyber War?; Lawson, “Beyond Cyber Doom”; Lindsay, “Stuxnet and the Limits of Cyber

Warfare”; Haggard and Lindsay, “North Korea and the Sony Hack.” Further discussions concern cyberspace’s

role in deterrence, a framework that was inherited from the nuclear age and whose fundamental precepts only

questionably apply to the cyber domain. See Glaser, Deterrence of Cyber Attacks and USNational Security; Rid

and Buchanan, “Attributing Cyber Attacks”; Lindsay and Gartzke, “Coercion through Cyberspace”; Buchanan, 

Cybersecurity Dilemma;Nye, “Deterrence andDissuasion in Cyberspace.”

development and implementation of new

technologies of war.

Conclusion

Methods of cyberattack have evolved in

sophistication and complexity since their first

overt integration with large-scale ground

maneuver in the 2008 Russia-Georgia War.

However, while technologies have changed in

the past decade, the underlying dynamics of

cyber conflict have not. This paper has

attempted to highlight three of the more

enduring lessonslearned from the conflict that

remain applicable to scholarly and military

pursuits.

First, the 2008 cyber campaign

reinforces the Russian conception of cyberspace

as a tool for information warfare rather than as

a discrete, effects-based war-fighting domain.

This conception has inspired increasingly

assertive efforts to pursue Russian strategic
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

17

objectives through digital means, to include the

2016 and 2017 targeting of US and European

democratic elections. Turning our scholarly

sights toward Russian information-warfare

doctrine, as well as its Soviet doctrinal

predecessors, will better prepare us to contend

with those uses of cyberspace that do not fit

neatly into our own doctrinal framework and

that do not present as cleanly defined offensive

acts.

Second, the 2008 Georgian cyberattacks

demonstrated the increasing influence of third

forces to the modern battlefield. As such, they

exemplify the diffusion of power phenomenon

that takes the mechanisms of conflict beyond

state control. The influence of these actors on

the cyber battlefield both complicates the

direct application of the laws of armed conflict

and affects the range of state action available

for response, since private actors own the

majority of cyberspace infrastructure. Efforts

are underway to more effectively harness the

power of the private sectorin pursuit of holistic

cybersecurity,

58 but a great deal of research

remains in understanding the implications of

these actorsto modern conflict.

Finally, the conflict demonstrated that

cyberspace operations can be effectively

leveraged with and understood through

traditional operational principles—an insight

of evolutionary utility thatshould not preclude

the embrace of cyberspace’s revolutionary

qualities. Military professionals must be as

comfortable speaking about cyberspace

operations asthey are those on land, in air, or at

sea if we are to fight effectively moving

forward. The Russia-Georgia conflict offers one

possible interpretation of how to merge these

different war-fighting vocabularies.

Success in war depends not on simply

discovering a new technology but on

discovering the best way to use it. Thus, the

effective operational integration of cyberspace

with conventional military activity is

contingent on the effective conceptual

integration of cyberspace operations with how

we envision future war. While a great deal of

deep, doctrinal thinking remains to be

accomplished in creating that holistic vision,

our efforts would be well served by looking

toward the lessons of past cyber conflicts to

inform how we approach the future.

 58 Borderless Battle.

Understanding Cyberwarfare: Lessons from the Russia-Georgia War

19

Bibliography

Adamsky, Dima. The Culture of Military Innovation: The Impact of Cultural Factors on the Revolution in

Military Affairs in Russia, the US, and Israel. Palo Alto, CA: Stanford University Press, 2010.

Borderless Battle: Defending against Cyber Threats; Hearing before the Committee on Homeland

Security, House of Representatives. 115th Cong., 1st Sess. March 22, 2017.

https://www.hsdl.org/?view&did=800990.

Buchanan, Ben. The Cybersecurity Dilemma: Hacking, Trust, and Fear between Nations. New York:

Oxford University Press, 2016.

Bumgarner, John, and Scott Borg. Overview by the US-CCU of the Cyber Campaign against Georgia in

August of 2008. Special report. US Cyber Consequences Unit, 2009.

Carr, Jeffrey. Inside Cyber Warfare: Mapping the Cyber Underworld. Sebastapol, CA: O'Reilly Media,

2010.

Chen, Adrian. “The Agency.” New York Times, June 2, 2015.

https://www.nytimes.com/2015/06/07/magazine/the-agency.html.

Connell, Michael, and Sarah Vogler. “Russia’s Approach to Cyber Warfare.” CNA's Occasional Paper

series, CNA, Arlington, VA, March 2017, https://www.cna.org/CNA_files/PDF/DOP-2016-U014231-1Rev.pdf.

Deibert, Ronald J. “Cyclonesin Cyberspace: Information Shaping and Denial in the 2008 RussiaGeorgia War.” Security Dialogue 43, no. 1 (2012): 3–24.

Donovan, George T. “Russian Operational Art in the Russo-Georgian War of 2008.” Strategy Research

Project, US Army War College, Carlisle, PA, 2009.

Dorell, Oren. “Russia Engineered Election Hacks and Meddling in Europe.” USA Today, January 9,

2017. https://www.usatoday.com/story/news/world/2017/01/09/russia-engineered-electionhacks-europe/96216556/.

Evans, Karen, and Franklin Reeder. A Human Capital Crisis in Cyber Security: Technical Proficiency

Matters. Washington, DC: Center for Strategic and International Studies,Commissionon

Cybersecurity,2010.https://csis-prod.s3.amazonaws.com/s3fspublic/legacy_files/files/publication/101111_Evans_HumanCapital_Web.pdf.

Fanelli, Robert L. “Cyberspace Offense and Defense.” Journal of Information Warfare 15, no. 2

(2016): 53–65.

Freedburg, Sydney J., Jr. “Russia’s Information War: Latvian Ambassador, Finnish Strategist Warn on

Cyber.” BreakingDefense,June6,2014.https://breakingdefense.com/2014/06/russiasinformation-war-latvian-ambassador-finnish-strategist-warn-on-cyber/.
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

20

Galperovich,Danila. “Putin SignsNew Information SecurityDoctrine.” Voiceof AmericaNews,

December 8, 2016. http://www.voanews.com/a/russia-new-information-securitydoctrine/3628197.html.

Gartzke, Erik. “The Myth of Cyberwar: Bringing War in Cyberspace Back Down to Earth.” International

Security Studies 38 no. 2 (2012): 41–73.

Giles, Keir. “Information Troops: A Russian Cyber Command?” In 3rd International Conference on Cyber 

Conflict, edited by C. Czosseck, E. Tyugu, and T. Wingfield. Tallin, Estonia: CCD COE Publications, 2011.

———. “The Military Doctrine of the Russian Federation 2010.” NATO Research Review, NATO 

Defense College, Rome, February 2010, 

http://www.conflictstudies.org.uk/files/MilitaryDoctrine_RF_2010.pdf.

———. “Russia’s ‘New’ Tools for Confronting the West: Continuity and Innovation in Moscow’s

Exercise of Power.” Chatham House: The Royal Institute for International Affairs, London,

March 2016, https://www.chathamhouse.org/publication/russias-new-tools-confronting-west.

Glaser, Charles L. Deterrence of Cyber Attacks and USNational Security. Washington, DC: Cyber 

Security Policy Research Institute, George Washington University, 2011.

Haggard, Stephan, and Jon R. Lindsay. “North Korea and the Sony Hack: Exporting Instability through

Cyberspace.” AsiaPacific Issues paper, no. 117, Analysis from the East-West Center, Honolulu, HI, 

May 2015).

Healy, Jason, ed. A Fierce Domain: Conflict in Cyberspace, 1986 to 2012. London: Carbon Capture and 

Storage Association, 2013.

Hollis, David. “Cyberwar Case Study: Georgia 2008.” Small Wars Journal, January 6, 2011.

http://smallwarsjournal.com/print/10080.

Intelligence Community Assessment. Assessing Russian Activities and Intentionsin Recent US

Elections, ICA2017-01D, January 6, 2017. Office of the Director of National Intelligence.

https://www.dni.gov/files/documents/ICA_2017_01.pdf.

Joint Chiefs of Staff. CyberspaceOperations, Joint Publication 3-12 (R), February 5, 2013.

http://www.jcs.mil/Portals/36/Documents/Doctrine/pubs/jp3_12R.pdf.

Junio, Timothy J. “How Probable Is Cyber War? Bringing IR Theory Back into the Cyber Conflict

Debate.” Journal of Strategic Studies 36, no. 1 (2013): 125–33.

Kaplan, Fred. Dark Territory: The Secret History of Cyber War. New York: Simon and Schuster, 2016.

Klimburg, Alexander. “Mobilising Cyber Power.” Survival 53, no. 1 (2011): 41–60.

Korns, Stephen W., and Joshua E. Kastenberg. “Georgia’s Cyber Left Hook.” Parameters 38, no. 4

(2009): 60–76.
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

21

Lawson, Sean. “Russia Gets a New Information Security Doctrine.” Forbes, December 9, 2016.

https://www.forbes.com/sites/seanlawson/2016/12/09/russia-gets-a-new-information-securitydoctrine/#503b640f3fc4.

———. “Beyond Cyber Doom: Assessing the Limits of Hypothetical Scenariosin the Framing of Cyber

Threats.” Journal of Information Technology and Politics 10, no. 1 (2013): 86–103.

Lee, Robert M., and Thomas Rid. “OMG Cyber!” RUSI Journal 159, no. 5 (2014): 4–12.

Lindsay, Jon R. “Stuxnet and the Limits of Cyber Warfare.” Security Studies 22, no. 3 (2013): 365–404.

Lindsay, Jon R., and Erik Gartzke. “Coercion through Cyberspace: The Stability-Instability Paradox

Revisited.” In The Power to Hurt: Coercion in Theory and Practice, edited by Kelly M.

Greenhill and Peter J. P. Krause, 179–203. New York: OxfordUniversityPress, 2016.

Medvedev, Dmetry. “Military Doctrine of the Russian Federation.” Originally published on the 

President of the Russian Federation website. February 5, 2010. Translated by Carnegie Endowment 

for International Peace.

http://carnegieendowment.org/files/2010russia_military_doctrine.pdf.

Murray, Williamson, and Allan R. Millett, eds. Military Innovation in the Interwar Period. New York: 

Cambridge University Press, 1996.

Nye,Joseph S.,Jr. “Deterrence and Dissuasion in Cyberspace.” International Security 41, no. 3 (2016): 

44–71.

Raymond, David, Tom Cross, Gregory Conti, and Michael Nowatkowski. “Key Terrain in Cyberspace:

Seeking the High Ground.” In 2014 6th International Conference on Cyber Conflict: Proceedings, 

edited by P. Brangetto, M. Maybaum, and J. Stinissen, 287–302. Tallinn, Estonia: NATO CCD 

COE Publications, 2014.

Rid, Thomas. “Cyber War Will Not Take Place.” Journal of Strategic Studies 35, no. 1 (2012): 5–32.

Rid, Thomas, and Ben Buchanan. “Attributing Cyber Attacks.” Journal of Strategic Studies 38, nos. 1–

2 (2015): 4–37.

Russell, Alison Lawlor. “The Georgia-Russia War.” In Cyber Blockades. Washington, DC: Georgetown 

University Press, 2014.

Russia-Georgia Cyber War—Findings and Analysis. Phase I Report. ProjectGreyGoose,October 17, 

2008. https://www.scribd.com/doc/6967393/Project-Grey-Goose-Phase-I-Report.

Segal, Adam. Hacked World Order: How Nations Fight, Trade, Maneuver, and Manipulate in the Digital

Age. New York: PublicAffairs, 2016.

Soldatov, Andrei, and Irina Borogan. The Red Web. New York: PublicAffairs, 2015.

Standish, Reid. “Why Is Finland Able to Fend Off Putin’sInformation War?” Foreign Policy, March 1,

2017. http://foreignpolicy.com/2017/03/01/why-is-finland-able-to-fend-off-putins-informationwar/.
Understanding Cyberwarfare: Lessons from the Russia-Georgia War

22

Stone, John. “Cyber War Will Take Place!” Journal of Strategic Studies 36, no. 1 (2013): 101–8.

Thomas, Timothy L. “Information Security Thinking: A Comparison of US, Russian, and Chinese

Concepts.” In International Seminar on Nuclear War and Planetary Emergencies—26th Session, edited by R. 

Ragaini, 344–56. River Edge, NJ: World Scientific Publishing, 2002.

Tikk, Eneken, Kadri Kaska, Kristel Rünnimeri, Mari Kert, Anna-Maria Taliharm, Liis Vihul. Cyber

Attacks against Georgia: Legal LessonsIdentified. Tallinn, Estonia: Cooperative Cyber Defense

Center of Excellence, 2008.

Tucker, Patrick. “The Sarin Gas Attack in Syria Ignited an Information Battle.” Defense One, April 6,

2017. http://www.defenseone.com/technology/2017/04/sarin-gas-attack-syria-ignitedinformation-battle/136819/?oref=defenseone_today_nl.

“US Army Introduces Cyber Fast Track for Civilians.” Signal, February 13, 2017.

http://www.afcea.org/content/?q=Blog-us-army-introduces-cyber-fast-track-civilians.

US Army War College Key Strategic Issues List 2016–2017. Carlisle, PA: US Army War College Press, July

31, 2016. https://ssi.armywarcollege.edu/pdffiles/PUB1334.pdf.

Warner, Michael. “Cybersecurity: A Prehistory.” Intelligence and National Security 27, no. 5 (2012):

781–99.

Zetter, Kim. Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon. New

York: Broadway Books, 2016.