Cyberwarfare facts for kids

Cyberwarfare specialists from the United States Army during a training exercise in 2019. They help protect computer systems.

Cyberwarfare is when countries use cyberattacks against each other. These attacks can cause serious harm, similar to traditional fighting. They can also mess up important computer systems. The goals might include spying, damaging things, spreading propaganda, or even affecting a country's economy.

Experts have different ideas about what cyberwarfare truly means. Some think the word "warfare" is too strong because no cyberattack has been as big as a real war. Others believe it's the right word when cyberattacks cause physical damage to people or objects in the real world.

Many countries, like the United States, United Kingdom, Russia, China, Israel, Iran, and North Korea, have special teams for cyber operations. These teams can both attack and defend. As countries explore these digital tools, there's a higher chance that cyber operations could lead to physical conflicts. However, it's still rare for a cyberattack to become a full-scale, long-lasting war.

One time, on May 5, 2019, Israel Defense Forces took physical action against a building. This happened because of an ongoing cyberattack linked to that building. It was a rare event where a cyberattack led to a physical response.

Understanding Cyberwarfare

What is Cyberwarfare?

Defining cyberwarfare can be tricky, and not everyone agrees on one perfect definition. Most experts, military groups, and governments talk about attacks between countries or groups supported by countries. However, some definitions also include other groups, like activist hackers or criminal organizations, depending on the situation.

One way to think about it is using technology to fight within computer networks. These networks store, share, and communicate information online. It's like a new way of fighting that involves both attacking and defending computer systems.

Some experts say that "cyber war" is a bigger idea than "cyberwarfare." Cyberwarfare includes the methods and steps used in digital attacks. But "cyber war" usually means a large-scale, long-lasting conflict that might involve physical violence. So far, no such large-scale "cyber war" has happened. Instead, countries have sometimes responded to digital attacks with smaller, targeted cyber actions. For example, in June 2019, the United States launched a cyberattack against Iranian systems after an incident involving a US drone.

Countries can also use cyber sanctions to respond to digital attacks. These are economic penalties against a country or group suspected of cyberattacks. For instance, the United States has often used economic sanctions related to cyber incidents. Laws like the Iran Cyber Sanctions Act of 2016 have imposed sanctions on individuals responsible for cyberattacks.

Different Kinds of Cyber Attacks

Cyberwarfare can create many dangers for a country. Digital attacks can support traditional fighting. For example, hackers might mess with air defense systems to help an air attack succeed. Besides these "hard" threats, cyberwarfare can also involve "soft" threats like spying and spreading false information.

Some experts compare powerful digital weapons to biological weapons. They believe these tools could be just as destructive in our connected world.

Digital Spying (Espionage)

PRISM: a secret spying program where the NSA collects user data from companies like Facebook and Google.

Spying has always happened between major countries, and digital spying is similar. While spying isn't usually seen as an act of war, some incidents can cause big problems between nations. These are sometimes called "attacks."

Here are a few examples:

• Massive spying by the US on many countries, revealed by Edward Snowden.
• The US NSA recording many phone calls in countries like the Bahamas without permission.
• The "Titan Rain" probes, which were digital intrusions into American defense contractors' computer systems since 2003.
• The Office of Personnel Management data breach in the US, which many believe was done by China.
• A security company found that one of the European Union's diplomatic communication channels was hacked for three years.

Causing Damage (Sabotage)

Computers and satellites that control important activities can be vulnerable. If they are attacked, they could disrupt equipment. Hacking military systems that handle orders and communications could allow enemies to listen in or send wrong information. Power, water, fuel, communication, and transportation systems are all at risk. Experts say that even everyday things like the electric power grid, trains, or the stock market could be targets.

In 2010, security experts found a harmful software program called Stuxnet. It got into factory computers and spread worldwide. This was seen as the first attack on important industrial systems that are key to modern economies.

Stuxnet was very good at slowing down Iran's nuclear program. It showed that digital weapons could be used for both defense and attack. It's hard to control cyber tools because many different groups, not just countries, can use them. Small groups of skilled software developers can affect global politics and cyberwarfare just as much as large government agencies. These groups sometimes share their tools online, making it easier for others to create big attacks. There are also illegal markets where these digital weapons are bought and sold.

Stopping Services (Denial-of-Service)

A DoS attack, or a distributed denial-of-service (DDoS) attack, tries to make a computer or network service unavailable. Attackers often target popular websites like banks or payment systems. They might use many internet-connected devices with weak security to launch these large attacks. DoS attacks aren't always digital; physical attacks on important infrastructure, like cutting undersea communication cables, can also cause major disruptions.

Protecting Power Grids

An electrical substation in the United Kingdom. Power grids are important targets in cyberwarfare.

Governments know that electric power grids are vulnerable to cyberwarfare. For example, the United States Department of Homeland Security works with industries to find weak spots and improve security for control systems. They also want to make sure new "smart grid" networks are built with strong security. In 2009, there were reports that China and Russia had secretly entered the U.S. electrical grid. They allegedly left behind software that could disrupt the system. China denied these claims.

A major power outage caused by a cyberattack could harm the economy or create big problems for a country. For instance, Iranian hackers caused a massive power outage in Turkey in 2015, affecting 40 million people. In June 2019, Russia claimed its electrical grid was under cyberattack by the United States. The New York Times reported that American hackers had planted malware that could disrupt the Russian grid.

Spreading Information (Propaganda)

Cyber propaganda tries to control information and influence what people think. It's a type of psychological warfare that uses social media, fake news websites, and other digital tools. In 2018, a British Army leader said that these attacks, sometimes from countries like Russia, try to make people lose trust in a country's political and social systems.

Propaganda is a planned effort to change how people see things and behave. The internet is a very important way to communicate today. Messages can spread quickly to many people, which can be used for bad purposes. Some groups might use the internet to trick people into believing certain ideas.

Harming Economies

In 2017, the WannaCry and Petya (NotPetya) cyberattacks caused huge problems. They pretended to be ransomware but caused widespread disruptions in Ukraine and for organizations like the U.K. National Health Service, a big pharmaceutical company, and a shipping company. These attacks are also a type of cybercrime, specifically financial crime, because they hurt businesses and groups financially.

Why Do Cyber Attacks Happen?

Countries engage in offensive cyber operations for several reasons. Experts say that these operations are attractive because they offer cheap and low-risk ways to weaken other countries and strengthen their own position. Over time, digital attacks can harm economies, change political opinions, start conflicts, reduce military power, and even allow countries to blackmail others by accessing their critical systems.

Military Reasons

Cyber operations have become very important for the military. In the U.S., the USCYBERCOM was created to handle cyberspace operations. Its job is to find and stop cyberattacks and protect military computer networks. The command can also be ordered to attack targets like military control systems, air defense networks, and weapons systems that rely on computers.

It's often hard to figure out who is behind internet attacks and why they are happening. This makes it difficult to know when a digital act should be considered an act of war.

Many cyberwarfare incidents are driven by political reasons. For example, in 2008, Russia launched a cyberattack on the Georgian government's website during military operations. Hackers from Armenia and Azerbaijan have also been involved in cyberwarfare as part of their conflict.

Jobs in cyberwarfare are growing in the military. All branches of the United States military actively recruit people for these roles. A 2024 study on military cyber operations during the Russo-Ukrainian War found that these operations can be effective at the start of a war, especially when combined with traditional military actions.

Activist Hacking (Hacktivism)

Hacktivism is when people use computers and networks to promote a cause. This can involve attacks, theft, or digital sabotage to draw attention to their ideas. Groups like Anonymous are often shown in the media as "cyber-terrorists" who hack websites and release private information. However, hacktivism is also about people who are politically motivated to change the world.

Making Money

Cyberattacks, including ransomware, can be used to make money. Countries can use these methods to earn a lot of money, which can help them avoid economic penalties and sometimes harm their opponents. For example, in August 2019, it was revealed that North Korea had generated $2 billion to fund its weapons program, avoiding sanctions from the United States, United Nations, and European Union.

Private Sector and Research

Computer hacking is a modern threat in global conflicts and industrial espionage (spying on companies). This type of crime often goes unreported. Companies around the world face millions of cyberattacks every day. Most of these attacks are financially motivated.

Some organizations, like the University of Cincinnati or the Kaspersky Security Lab, also engage in cyberwarfare research. They do this to better understand new security threats and publish their findings.

Getting Ready for Cyber Attacks

Many countries hold exercises to prepare for and understand how to conduct and defend against cyberattacks. These are often called "war games."

The Cooperative Cyber Defence Centre of Excellence (CCDCE), part of NATO, holds a yearly war game called Locked Shields. This exercise tests readiness and improves skills for national organizations. Locked Shields 2019 had 1200 participants from 30 countries. It involved a fictional country facing coordinated cyberattacks on its internet provider, power generation, communication systems, and other important infrastructure. The goal was to keep systems running under pressure and understand how decisions affect the situation.

The European Union also conducts cyber war game scenarios with its member states and partners. These help improve readiness and observe how strategic decisions play out. Some war games go beyond defense and prepare for offensive capabilities. For example, in 2018, the UK government reportedly conducted cyber war games that could "blackout Moscow."

Cyber Activities Around the World

About 120 countries have been developing ways to use the internet as a weapon. They target financial markets, government computer systems, and utilities.

Cyber Activities in Asia

China

China has expanded its cyber capabilities by getting foreign military technology. They use advanced surveillance systems and train soldiers in cyberwarfare. This helps them prepare for digital conflicts against technologically advanced opponents. Some estimates suggest China has a "hacker army" of 50,000 to 100,000 people.

China has been linked to many cyberattacks on public and private organizations in the United States, India, Russia, Canada, and France. However, the Chinese government denies involvement, stating that China is also a victim of cyberattacks.

• In June 2015, the United States Office of Personnel Management (OPM) announced a data breach affecting millions of people. This attack was widely believed to have come from China.
• Operation Shady RAT was a series of cyberattacks starting in 2006, reported in 2011. China is thought to be behind these attacks, which hit at least 72 organizations, including governments and defense contractors.
• The 2018 cyberattack on the Marriott hotel chain, which collected personal details of about 500 million guests, was later identified as part of a Chinese intelligence-gathering effort.
• In February 2024, the Philippines announced it had stopped a cyberattack traced to hackers in China. Several government websites were targeted.
• In May 2024, the UK announced it had taken a database offline after a cyberattack attributed to the Chinese state.

India

India created the Indian Computer Emergency Response Team (CERT-In) in 2004 to stop cyberattacks. In 2011, the government also created the National Critical Information Infrastructure Protection Centre (NCIIPC) to protect important areas like energy, transport, and banking.

• In 2010, a group called the Indian Cyber Army hacked websites belonging to the Pakistan Army and other ministries. This was in response to the Mumbai terrorist attacks.
• In 2016, researchers found a cyberattack called 'Patchwork' that affected about 2500 companies and government agencies. The attackers were believed to be from India and were gathering intelligence.
• The Defence Cyber Agency, India's military agency for Cyberwarfare, became operational by November 2019.

South Korea

North Korea

North Korea has been linked to several major cyber incidents, including the Sony Pictures hack in 2014 and the WannaCry ransomware attack in 2017.

Cyber Activities in Europe

Estonia

In April 2007, Estonia came under cyberattack after a statue was moved. Ministries, banks, and media were targeted. Many of these attacks came from Russia. This attack was very effective because many Estonian government services are online.

France

In 2013, the French Minister of Defense ordered the creation of a cyber army. This force protects French and European interests. By 2019, France had 2600 "cyber-soldiers" and 4400 reservists.

Germany

In 2013, Germany revealed its 60-person Computer Network Operation unit. The German intelligence agency, BND, announced it was hiring "hackers" for a new "cyber defense station" unit. In March 2013, the BND president said they saw up to five attacks a day on government offices, mostly from China.

Russia

Russian security services have been accused of organizing denial of service attacks against other countries. Notable examples include the 2007 cyberattacks on Estonia and the 2008 cyberattacks during the South Ossetia war.

• In October 2016, US officials accused Russia of interfering with the 2016 United States presidential election.
• In June 2019, the New York Times reported that American hackers had planted malware that could disrupt the Russian electrical grid.

Ukraine

Ukraine has experienced many cyberattacks.

• From 2014 to 2016, a Russian hacking group called Fancy Bear reportedly used Android malware to target the Ukrainian Army's artillery.
• In 2014, Russians were suspected of using a cyber weapon called "Snake" to attack Ukraine during political unrest.
• On December 23, 2015, the Black-Energy malware was used in a cyberattack on Ukraine's power grid. This left over 200,000 people without power.
• Ukraine saw a huge increase in cyberattacks starting 2022. Many Ukrainian bank and government websites became unavailable.

United Kingdom

MI6 reportedly hacked an Al Qaeda website and replaced bomb-making instructions with a cupcake recipe.

In October 2010, the director of Government Communications Headquarters (GCHQ) said the UK faced a serious threat from cyberattacks by hostile countries and criminals. Government systems were targeted 1,000 times each month.

Cyber Activities in the Middle East

Iran

Iran has been both attacked and has carried out several cyberwarfare operations. It is seen as a growing military power in this field.

Flag of Cyber Police (FATA) of Islamic Republic of Iran

• In September 2010, Iran was attacked by the Stuxnet worm. This worm was thought to specifically target its Natanz nuclear enrichment facility. Stuxnet is believed to have been developed by the United States and Israel.
• The Iranian state-sponsored group MuddyWater has been active since at least 2017. It is responsible for many cyberattacks across different sectors.

Israel

Israel has placed growing importance on cyber-tactics. Many international tech companies have research operations in Israel, often hiring veterans from the military's computer units.

• In September 2007, Israel carried out an airstrike in Syria. Experts thought Israel might have used cyberwarfare to make their planes invisible to radar.
• In 2025, Israel was the most targeted country globally for politically motivated cyberattacks. This included a big increase in DDoS attacks from both state-sponsored and activist groups.

Saudi Arabia

On August 15, 2012, the Shamoon virus destroyed over 35,000 computer systems at the national oil company Saudi Aramco. The attackers claimed they were fighting oppression. An employee reportedly opened a harmful email, allowing the virus to enter the network. The virus erased files and made computers unusable. This attack was called a "Cyber Pearl Harbor" by the US Defense Secretary. Saudi Aramco had to buy many new hard drives to restore its operations.

United Arab Emirates

The United Arab Emirates has launched cyberattacks targeting people who disagree with the government. Ahmed Mansoor, an Emirati citizen, was jailed after sharing his thoughts online. He was spied on as part of a secret project called Raven, which used a hacking tool called Karma to spy on opponents and journalists.

In September 2021, three former American intelligence officers admitted to helping the UAE with hacking crimes. They provided advanced technology and broke US laws. They hacked computers and phones of activists and journalists.

Cyber Activities in North America

United States

Cyberwarfare is a key part of America's military strategy. The US military believes a cyberattack can be a reason for war, just like a traditional attack.

• In 1982, a pipeline in the Soviet Union exploded. This was allegedly due to a Trojan Horse computer malware planted by the Central Intelligence Agency in pirated software.
• In 2009, President Barack Obama called America's digital infrastructure a "strategic national asset."
• In May 2010, the Pentagon created the USCYBERCOM to defend American military networks and attack other countries' systems.
• In June 2012, the New York Times reported that President Obama had ordered a cyberattack on Iranian nuclear facilities.
• In 2014, Barack Obama ordered more cyberwarfare against North Korea's missile program to disrupt test launches.
• On November 24, 2014, the Sony Pictures Entertainment hack released private data from Sony Pictures.
• In 2016, President Barack Obama authorized placing cyber weapons in Russian infrastructure. This was in response to Russia's alleged interference in the 2016 presidential election.
• In March 2017, WikiLeaks published over 8,000 documents about the CIA. These documents, called Vault 7, showed the CIA's ability to hack cars, smart TVs, web browsers, and most smartphone operating systems.
• In June 2023, the Russian Federal Security Service (FSB) accused the National Security Agency and Apple of hacking thousands of iPhones, including those of diplomats.

The United States leads the world in cyberwarfare intentions and capabilities, according to a 2022 report from Harvard University's Belfer Center.

People Who Hack for Money

A cyber mercenary is a person or group that carries out cyberattacks for countries or other groups for payment. Countries might use cyber mercenaries to try and hide their involvement in an attack.

Working Towards Cyber Peace

As cyber operations become a new way of fighting, people are looking for ways to use cyberspace to promote peace. For example, a German civil rights group runs a campaign for cyberpeace. This campaign aims to control digital weapons and surveillance technology. It also works against making cyberspace a military zone.

Ideas for cyberpeace include:

• Policymakers creating new rules for digital warfare.
• Individuals and organizations building secure digital tools and systems.
• Promoting open source software, which is software whose code is openly available.
• Setting up cybersecurity centers.
• Checking the cybersecurity of important infrastructure.
• Sharing information about digital weaknesses.
• Working towards disarmament of digital weapons.
• Using defensive security strategies, decentralization, education, and encryption.

Researchers are also studying cyber peacekeeping and cyber peacemaking. These efforts aim to restore and strengthen peace after both digital and traditional conflicts.

Protecting Against Cyber Threats

Cyber counterintelligence involves finding, stopping, or neutralizing foreign operations that use digital methods. It also includes efforts to understand other countries' digital capabilities and plans.

• In 2009, The Pentagon spent over $100 million in six months to respond to and fix damage from cyberattacks.
• In 2009, US lawmakers pushed for a White House cybersecurity "czar." This person would lead efforts to improve US defenses against cyberattacks.
• After the 2007 cyberwar against Estonia, NATO created the Cooperative Cyber Defence Centre of Excellence (CCD CoE) in Tallinn, Estonia. This center helps improve NATO's cyber defense.
• In 2015, the Department of Defense released an updated cyber strategy. It outlined three cyber missions: maintaining existing digital capabilities, preventing cyberwarfare, and planning for retaliation.

One of the hardest parts of cyber counterintelligence is figuring out who is behind an attack. Unlike traditional warfare, it can be very difficult to identify the attacker in cyberspace.

Making Rules for Cyberspace

The Tallinn Manual, published in 2013, is a study on how international laws apply to digital conflicts. It helps understand how rules of war apply to cyber warfare.

The Shanghai Cooperation Organisation (which includes China and Russia) defines cyberwar to include spreading information that harms other countries' "spiritual, moral and cultural spheres." In 2011, these countries proposed an "International code of conduct for information security" to the UN.

In contrast, the US focuses on physical and economic damage. This difference in views has made it hard to agree on global digital arms control. However, American General Keith B. Alexander supported talks with Russia about limiting military attacks in cyberspace. In 2013, Barack Obama and Vladimir Putin agreed to set up a secure "Cyberwar-Hotline." This line provides direct communication to manage crises from digital security incidents.

A Ukrainian law scholar, Alexander Merezhko, proposed an International Convention on Prohibition of Cyberwar in Internet. He suggests that the internet should be free from warfare and treated as a "common heritage of mankind."

In 2017, Microsoft president Brad Smith suggested global rules for cyberattacks, like a "Digital Geneva Convention." He proposed banning nation-state hacking of civilian economic and political systems. He also said an independent organization could investigate and publicly share evidence of nation-state attacks.

See also