The boundaries move¶

Each of the eleven states, from North Korea to Ukraine, is organised around a boundary. Its cyber power appears in what it does with that boundary: preserves it, crosses it, puts a price on it, distributes itself across it, regulates it, or allows it to disappear.

The boundaries differ, but they fall into a small number of recurring forms.

Six forms recur.

Preserve¶

Some boundaries are kept precisely because keeping them produces capability.

France’s most revealing choice is a wall. Defence of the nation’s systems is kept apart from military action, intelligence and judicial response. ANSSI, the national defender, remains on the defensive side, structurally separate from the bodies that penetrate other people’s networks.

The separation is part of the country’s sovereignty model. A defender can be trusted by critical operators and allies partly because it is not also their spy.

Iran preserves a different boundary: the level of effect beyond which retaliation becomes harder to contain. Operations can produce disruption, intimidation or destruction while remaining deniable, reversible or politically manageable. The threshold has failed at times, but it has held often enough to shape the repertoire.

The European Union preserves the boundary between national ownership and collective action. Its machinery coordinates capabilities that remain national rather than creating a European capability above them.

A boundary does not have to be broken to produce a cyber strategy. Sometimes the strategy is the preservation.

Cross¶

Other states make the boundary permeable.

Russia crosses state and crime in both directions. A criminal enterprise can be protected, tasked, ignored, and later subjected to enforcement when the political circumstances change. The crossing is not an accidental weakness in the system. It gives the state access to capability without requiring ownership of the organisations that provide it.

North Korea crosses the boundary between cyber operations and regime finance more completely. Cyber theft is not a separate activity that happens to generate money. It is one route through which the state acquires revenue, alongside fraud, forced labour and arms sales. The operation is selected for what it yields.

The United States crosses peace and war by doctrine. Cyber operations can continue below the threshold of armed conflict, under standing authorities and recurring government processes. The crossing becomes routine rather than exceptional.

Crossing the boundary is therefore not necessarily escalation. It can be the mechanism that makes the capability available in the first place.

Price¶

China places the boundary between state and contractor inside the transaction.

The state supplies requirements and targets. Contractors supply access and intrusion. A purchase order separates the two, while prices, contracts and disputes expose the relationship between them. The operator’s incentives can extend beyond the original requirement, because access acquired for one customer may have value elsewhere.

The state therefore does not need to own the capability to shape it. It can buy it.

Israel puts a different price on the boundary between military and market. Veterans leave with training and networks, companies turn that expertise into products, and the state regulates what leaves the country through export controls rather than preventing the labour from leaving in the first place.

In both cases, capability crosses an organisational boundary through a commercial mechanism. The state has not necessarily lost control of it. It has chosen a different place to exercise control.

Distribute¶

Lithuania spreads the boundary between state and alliance until it becomes part of the capability itself. Teams are led for the Union, a regional centre is shared with allies, findings circulate, and partner forces can operate on Lithuanian networks.

The capability does not sit entirely on one side of the boundary. It is produced by the relationship across it.

The European Union takes the same principle to continental scale. Twenty-seven national capabilities contribute to shared situational awareness, coordinated response and collective political action. The Union adds machinery without absorbing the national capabilities into a single European command.

Distribution changes the question of ownership. The more the capability depends on the relationship, the less useful it becomes to ask which side possesses it.

Regulate¶

A boundary can also remain intact because rules govern its crossings.

The Union’s principal instrument is regulation: incident reporting makes events comparable, product requirements apply before goods enter the market, and sanctions turn national attribution into collective political action without requiring a European intelligence service.

Israel regulates the military-market boundary through export licensing. The United States regulates the peace-war boundary through standing authorities, congressional notification and rules of engagement. Operations can cross the boundary repeatedly because the rules define when and how the crossing is permitted.

Regulation does not eliminate a boundary. It turns the boundary into a procedure.

Dissolve¶

The final form is different. The boundary ceases to be useful.

Estonia has worn away the distinction between the state and the infrastructure through which it operates. A flaw in an identity-card chip can become a state emergency. A copy of government registries held abroad can become part of state continuity. The systems are not simply infrastructure supporting the state. They are part of what the state is.

Ukraine pushes the same movement into war. Signals become coordinates. Cameras become targeting feeds. Commercial satellites become military infrastructure. Government applications can become sensors. Cyber-derived information enters the same operational picture as electronic warfare, drones, intelligence and conventional reconnaissance.

The question is no longer whether an action belongs to cyber. The categories around it have become more useful than the category itself.

Dissolution is the rarest of the six forms. Estonia and Ukraine are also unusual cases because the thing being defended is inseparable from the system doing the defending.

The six moves¶

Preserve, cross, price, distribute, regulate, dissolve.

They are not stages. A state can use several at once. The United States crosses the peace-war boundary while regulating it. The Union preserves national ownership while distributing capability and regulating the common market. Iran preserves a threshold while building instruments designed to cross it without making the crossing fully attributable.

The useful question is therefore not simply where a state draws its boundaries.

It is what the boundary does.

A boundary can keep capability inside, let it pass, turn its passage into a transaction, distribute it across relationships, govern its crossings, or cease to separate the things at all.

Read a state through its actors and the result is a roster.

Read it through its boundaries and the roster becomes an arrangement.

That arrangement is where the cyber power is.