The anatomy of cyber power¶
Ask where a state’s cyber power sits and the obvious answer is an organisation: a military command, an intelligence service, a government bureau, perhaps a contractor with a government contract behind it. The cases in this series keep making that answer inadequate.
North Korea turns cyber theft into revenue because its access to ordinary finance is constrained. Russia leaves a criminal economy partly intact and reaches into it when useful. China turns a technical market into an extension of state demand. Israel turns military selection into a labour market. The United States makes persistent access into standing government practice. Lithuania distributes capability across institutions and alliances. France keeps the stack national. The European Union builds machinery around capabilities it cannot own. Estonia makes the state itself a digital system. Ukraine shows what happens when cyber becomes inseparable from war.
The differences are substantial, but the cases can still be read through the same relationships. Something creates the demand for capability. Something turns that demand into action. Capability accumulates somewhere, then moves through people, contracts, institutions or alliances. Something limits what it can do. And the capability feeds back into the conditions that produced it.
That is why counting organisations tells only part of the story. Cyber power is not simply something an actor has. It is something produced and reproduced by the relationships around it.
Conditions first¶
The conditions come before the capability, and they are usually not technological.
North Korea needs foreign currency because sanctions constrain ordinary finance. Russia has a large skilled population and a criminal economy that the state has chosen to live alongside rather than suppress. China has industrial policy and a commercial technical market capable of supplying what state programmes require. Iran faces adversaries whose retaliation it cannot afford to absorb. Israel has conscription that sorts a large population, trains it intensively and releases it into civilian life while retaining the ability to call it back. The United States combines scale with global reach and a dense network of alliances. Lithuania has exposure without strategic depth.
The European cases produce different conditions again. France inherits a strategic culture built around the ability to act without another state’s permission. The European Union operates under a constitutional settlement that leaves national security with the member states. Estonia built a state whose essential functions became digital. Ukraine is fighting a war through a society whose government, communications and economy already depend heavily on digital infrastructure.
None of these conditions is cyber in itself. They are fiscal, strategic, demographic, legal or geographic. Cyber capability takes the shape that those conditions make useful.
Mundane mechanisms¶
Between a condition and an operation there is usually no secret ingredient. There is an administrative mechanism.
North Korea needs payrolls, front companies, exchanges and laundering routes to turn stolen assets into money the state can use. Russia needs a degree of tolerance, because a criminal crew that remains outside prosecution is a crew the state can later reach. China uses procurement, contracts and commercial incentives to turn state requirements into work for contractors. The American mechanism is doctrine and standing authority, which turns persistent contact into routine government business. Israel selects people through military service, releases them into the economy and retains a reserve system capable of pulling them back.
Lithuania makes usefulness into a mechanism: a state too small to hoard capability can make itself valuable to larger networks and gain reach through the same relationships. France uses law and doctrine to assign authority and keep the stack national. The Union uses regulation, coordination machinery and sanctions because those are the instruments available to an institution that does not control the national capabilities beneath it.
These mechanisms are strikingly ordinary. Payroll, contract, licence, doctrine, regulation, reserve obligation. They are also where a posture becomes reproducible. A capability can change when the machinery that produces it changes, even when the technology remains the same.
No single container¶
Capability has to accumulate somewhere, but there is no general answer to where.
North Korea comes closest to a conventional container, with a state-directed apparatus that can be traced through bureaux, personnel and government reporting. Israel’s capability accumulates in people and in the companies those people later build. China’s accumulates in a market of contractors whose work can be commissioned, sold and reused. American capability runs across military and intelligence organisations, government agencies, private companies and allied systems.
Lithuania is different again. The network is the concentration. France concentrates capability deliberately, insisting that doctrine, command, intelligence, defence and industrial capacity remain nationally held. The Union does almost the reverse, building coordination machinery around capabilities that remain with the member states.
Estonia puts essential state capability into registries, digital services and the infrastructure that allows them to remain available. Ukraine’s digital infrastructure is now part of the state’s ability to continue functioning during war.
The question “how much cyber capability does this state have?” quietly assumes that capability has a container. In several of these cases, the more useful question is where the capability is distributed and what holds the pieces together.
Capability in transit¶
Capability also has a route.
Israeli expertise can move from military unit to veteran to start-up to product and back into military service through reserve mobilisation. Chinese capability can move from a state requirement to a contractor and then into another market. Russian capability can move between criminal enterprise and state tasking without requiring a clean institutional boundary between the two.
Lithuania sends capability outward into European rapid-response teams and regional defence arrangements, while allied teams can move inward when Lithuania needs assistance. Ukraine has moved government data and services into foreign infrastructure. Estonia has maintained copies of critical state data outside the country. France’s sovereign cloud arrangements rely on foreign technology beneath French operation. The Union’s sanctions, regulations and coordination mechanisms move decisions across twenty-seven national systems without moving the underlying national capabilities into Brussels.
Movement changes the meaning of ownership. A person can carry capability from a state into a company and back again. A contract can carry it from a government requirement into a commercial service. An alliance can make one state’s capability available to another without transferring ownership. A cloud platform can make a foreign technology part of a national system without making the system foreign in the legal sense.
The busiest cyber systems are often the ones in which “whose capability?” has no simple answer.
Limits are part of the form¶
Every form has a limit, but the limits differ because the conditions differ.
Iran’s limit is the risk of provoking a response it cannot absorb. Its repertoire therefore favours effects that can often be denied, reversed or disowned, although Albania and the later conflicts show how uncertain that calibration can become.
North Korea’s activity produces unusually extensive external scrutiny through indictments, sanctions and international reporting. The same monitoring that makes the apparatus visible also changes the conditions under which it operates.
The Union’s limit is sovereign consent. A collective decision can depend on twenty-seven governments agreeing to it. France’s limit is the floor beneath its sovereign stack: hyperscale cloud, advanced semiconductors and allied intelligence remain outside complete national control.
The American limit is harder to see. Its doctrine is visible, but much of the activity that would most directly test its offensive posture is not. What outsiders can observe is therefore systematically different from the whole apparatus.
The limit is not simply a fence around the capability. It comes from the same condition that produced the capability. Sanctions make North Korean theft necessary and make it legible. Strategic autonomy builds France’s stack and exposes its dependence on foreign foundations. Standing authority makes American contact routine while leaving the most consequential uses of that authority difficult to observe.
The constraint is part of the architecture.
The return path¶
The relationship does not run in one direction. Capability changes the condition that produced it, and the changed condition produces more capability.
North Korean theft helps finance the state while reinforcing the sanctions environment that makes external revenue necessary. Russian tolerance preserves a pool of people and organisations the state can later use. Israeli veterans create companies, and those companies alter the civilian market into which the next cohort is released. Lithuanian usefulness deepens its alliance relationships, and those relationships increase the reach that makes Lithuania useful.
France’s investment in autonomy creates institutions and industries that make further autonomy easier to justify. The Union’s coordination produces interoperability and trust, which can make further cooperation possible. Estonia’s digitalisation makes the state easier to operate across distance and, at the same time, makes digital resilience part of national resilience. American persistence changes what adversaries learn, and their adaptation changes the environment in which the American apparatus operates.
The result is not necessarily a deliberate strategy. A system can reproduce itself without anyone deciding that it ought to. Once the capability has altered the condition around it, the original arrangement can become self-reinforcing.
Where categories stop¶
The boundaries around these systems are as revealing as the systems themselves.
Russia sits across the boundary between state and crime. China between state and contractor. Israel between military and market. The United States between peace and war. Lithuania between national capability and alliance network. France between sovereignty and dependence. The European Union between national authority and collective action. Estonia between state and infrastructure. Ukraine between cyber and war.
Some boundaries are deliberately maintained. France keeps defensive and offensive cyber missions institutionally separate. The Union keeps national security with the member states. Others become porous because the system works through them.
This is why the actor is often the wrong unit of analysis. A state can be the legal owner of a capability without being its sole source, operator or destination. A contractor can perform state work without becoming part of the state. A network can exercise capability without anyone in the network owning the whole. A digital infrastructure can become part of the state without looking like a state institution.
The cases therefore do not resolve into a larger list of cyber actors. They point in the other direction. Cyber power appears wherever conditions, mechanisms, accumulation, movement, limits and feedback hold together long enough to produce an effect.
Sometimes that arrangement has a name. Sometimes it has a flag. Sometimes it has a contract, a market, an alliance or a piece of infrastructure.
The name is useful. It is not the system.