Holding state-sponsored hackers and other cyber proxies to account

(Joyce Hakmeh, Harriet Moynihan, Nayana Prakash – Chatham House) In Russia’s war on Ukraine, ‘cyber proxies’ – non-state actors ranging from criminal groups and hacktivists to private entities – have carried out disruptive cyberattacks and other hostile acts against Ukraine and its allies. Russian or pro-Russian proxies operate with varying degrees of state direction and sponsorship. Some proxies have been linked with intelligence services like the GRU, others are sponsored at arm’s length or quietly tolerated by the authorities, while others still are incidentally or opportunistically aligned with Kremlin agendas. Because the identity of these groups is often opaque and their composition fluid, cyber proxy activity is difficult to combat. The use of proxies provides Russia with plausible deniability, complicates attribution of cyberattacks and other hostile operations, and helps insulate the Russian state and individual actors from sanctions. This paper proposes options that states anywhere can use to counter cyber proxies. We explore how proxies work, map the Russian cyber proxy ecosystem, and consider how international and domestic law can be leveraged to bring cyber proxies – whether of Russian or indeed other origin – to account. We consider accountability through the prism of ‘disruption’ and ‘cost imposition’, which together establish deterrence. And we argue that the West’s tactical responses to hostile cyber proxy activity need to be replaced by a strategic approach that integrates ‘core levers’, ‘amplifiers’ and long-term ‘enabling’ policies. – Holding state-sponsored hackers and other cyber proxies to account | Chatham House – International Affairs Think Tank