Trialoog editor
States are making increasingly deliberate use of cyberspace to put pressure on others, gather information and achieve their foreign and security policy objectives. According to Estonia’s Ambassador at Large for Cyber Diplomacy Helen Popp, technological capability has become an important part of states’ economic, military and political power.
Popp noted that international relations are increasingly being shaped not only in foreign ministries and at negotiating tables, but also in data centres, submarine cables, cloud infrastructure and digital platforms. “Technology is not simply one sector among others that drives the economy or puts policy into practice. It has become a source of power for states,” Popp said at the autumn seminar of the AI Focus Centre.
That power is reflected, among other things, in how states use cyberspace. A cyberattack can disrupt services or critical infrastructure, but it can also form part of intelligence gathering, information operations or broader political pressure.
This is not a new issue for Estonia. Public services began moving online gradually in the 1990s, and as the digital state developed, its dependence on reliable and secure digital systems grew. A turning point came in the spring of 2007, when coordinated cyberattacks targeted Estonian banks, government agencies and other services. According to Popp, the denial-of-service attacks of the time were not particularly sophisticated by today’s standards, but their scale and coordination were unprecedented at the time.
Estonia raised the attacks at NATO, the European Union and other international organisations, and cyberattacks increasingly came to be seen as a matter of foreign and security policy.
The political purpose of cyberattacks
States now use cyberspace increasingly deliberately to achieve their political objectives. According to Popp, both geopolitical tensions and rapid technological development are keeping the threat level high. She considers attacks on critical infrastructure particularly serious.
Russia, she said, uses cyberspace as a tool of foreign and security policy. Ukraine is the main target, but countries supporting Ukraine are also under pressure. Alongside cyberattacks, intelligence gathering and information operations are used, with organisations connected to the military and defence industry among the targets.
In Popp’s view, cyberattacks cannot be considered separately from the wider political situation. Last year, Estonia experienced attacks by pro-Palestinian groups, illustrating how directly international tensions can spill over into cyberspace. When a cyber incident occurs, it is therefore not enough to ask what happened to a system: understanding the timing of the attack and the choice of target is equally important.
For Popp, stability in cyberspace does not mean the complete absence of conflict. Rather, the aim should be to make states’ behaviour as predictable as possible, reduce the risk of miscalculation and escalation, and establish a shared understanding of the limits of acceptable conduct.
“Technology is not simply one sector among others that drives the economy or puts policy into practice. It has become a source of power for states.”
For Popp, stability in cyberspace does not mean the complete absence of conflict. Rather, the aim should be to make states’ behaviour as predictable as possible, reduce the risk of miscalculation and escalation, and establish a shared understanding of the limits of acceptable conduct. Photo: Grete-Liis Johanson
New technologies blur the boundaries of conflict
In cyber conflicts, it is often difficult to tell where ordinary confrontation between states ends and a more serious conflict begins. Identifying an attacker can take a long time, and even after analysis it is not always clear how to respond to a violation.
“In cyberspace, conflicts often remain in a grey area: they cannot be categorised as war, yet they are no longer an ordinary diplomatic confrontation either,” Popp said.
The fact that not all countries see the digital world in the same way adds to the complexity. While Western countries once largely shaped international rules governing the internet, China, India, Indonesia, South Africa and others have now brought their own visions to the table. Their views on state control, privacy, human rights and an open internet may differ from those of Western countries.
“We are not just arguing about protocols or standards. We are arguing about what our societies will be like,” Popp said.
Artificial intelligence adds another layer to an already complex situation. According to Popp, it could significantly change cyber conflicts, including by intensifying them. AI can help prepare attacks more quickly, automate activities and make existing attack techniques more effective.
This does not mean that attackers always need sophisticated AI-based solutions. A weak password, a poorly protected system or human error is often enough. AI can help identify and exploit these weaknesses more quickly and carry out attacks on a larger scale than before.
Other states are watching the response
According to Popp, it is a mistake to assume that every state can act as it pleases in the digital world. In 2015, agreement was reached at the United Nations that international law also applies in cyberspace and that states should follow norms of responsible behaviour. One of these norms, for example, states that a country should not attack another country’s critical infrastructure.
Having rules does not, however, mean they are always followed. Popp cited Russia’s cyberattack on Ukraine’s power grid, which took place just weeks after the relevant norm was approved. She said such violations must be met with a response, including publicly naming the attacker where necessary.
This matters not only as a way of putting pressure on the particular offender. States assess responses to understand the chains of cause and effect that may operate in the digital environment. “There are a whole host of countries watching very closely how we respond to what happens in cyberspace,” Popp said.
If violations go unanswered, others may conclude that agreed boundaries can be crossed without significant consequences. Public responses therefore help define more clearly what the international community will and will not accept in cyberspace.
“In cyberspace, conflicts often remain in a grey area: they cannot be categorised as war, yet they are no longer an ordinary diplomatic confrontation either.”
This article is based on Helen Popp’s presentation at the autumn seminar of TalTech’s AI Focus Centre, held on 22–23 October at LaSpa in Laulasmaa.
The AI autumn seminar brought together TalTech researchers, doctoral candidates, and representatives of the public sector and partner organisations. Its aim was to discuss developments in artificial intelligence, showcase TalTech’s AI research and create new opportunities for collaboration.
