Ukraine and the disappearance of the cyber domain

Ukraine, and cyber as a thread through war rather than a domain beside it

Ukraine’s cyberwar is told three ways, and all three miss the same thing. There is the cyberwar that wasn’t: the catastrophic Russian first strike everyone expected in February 2022, which did not come, after which cyber was quietly marked overrated. There is the volunteer epic: an IT Army raised by hashtag, hacktivists swarming Russian sites. And there is the operations catalogue: NotPetya as prologue, the Viasat modems bricked on invasion morning, wave after wave of wipers, the lights going out in Kyiv. Each is real. Each answers the question “did cyber matter?”. What Ukraine shows is not cyber’s score. It is the disappearance of the scoreboard.

Elsewhere cyber stayed distinguishable from the conflict it served. Here, in arguably the first large interstate war fought by two deeply digitised sides, cyber has soaked so completely into intelligence, electronic warfare, targeting, drones, logistics and information that “cyber operation” stops being a clean unit of anything. The boundary that dissolves is the last one left: not between the state and its crime, its market, its network or its infrastructure, but between cyber and the war it is fought inside.

The war as substrate

The substrate is a full war on a society built of software, and it did not begin in 2022. Russia took down parts of Ukraine’s power grid in December 2015 and again in 2016; in 2017 NotPetya, launched through a Ukrainian tax-software update, wiped its way across Ukraine and then the world. By the 2022 invasion, both the war and the country it was fought over ran on digital systems end to end, and the systems and the war had stopped being two things.

Cyber as a thread, not a domain

Watch what cyber is actually used for, and it is rarely a battle of its own. A wiper wipes to disable and disrupt, not to win a cyber-engagement. An intercepted signal becomes coordinates for a drone or a gun. A hacked camera becomes a targeting feed; a compromised phone, a geolocation. The state’s digital-government app, Diia, grew a channel for citizens to report Russian positions, turning a benefits portal into a sensor. Commercial imagery, machine learning and cyber-collected data resolve into a single targeting picture that no one calls “cyber” because it is just the picture. Cyber has stopped being conducted by a cyber command against cyber targets and become one input among many into the war’s decision-and-effect chain. That is not cyber falling short. It is cyber ceasing to be a separate place where things happen.

The actors dissolve too

Ask who conducts Ukraine’s cyber and the answer comes apart the way the domain does. Uniformed services and intelligence agencies; a volunteer IT Army summoned by a government minister; Western intelligence handing over what it sees; Starlink terminals keeping the whole thing connected; Microsoft and other cloud firms defending Ukraine’s state data in the cloud, a government data centre having been an early target of Russian missiles; commercial imagery firms; hacktivists on both sides. “Who did the cyber” is as unanswerable as “was it cyber”, and for the same reason. No single hand, and now no single domain.

The fused loop

A diagram of effects for Ukraine's cyber posture in war, drawn as one reinforcing loop with cyber threaded through it and an open strategic edge. All-source sensing raises the targeting and decision picture; the picture raises effect, kinetic and cyber; and effect yields new sensing. The three loop edges run in the same direction, so the loop is reinforcing, marked R and read clockwise. Cyber operations is drawn not as a stage in the loop but as a thread through it, feeding both sensing and effect, by human intervention. A dashed open edge leaves effect toward a decisive strategic outcome and does not close: whether this fusion decides the war is unresolved. And there is no node or edge for a separable cyber war, an absence the loop leaves open, because cyber's contribution runs through the other domains and cannot be isolated. An increase in all-source sensing raises the targeting and decision picture. An increase in the targeting and decision picture raises effect, by human intervention. An increase in effect raises all-source sensing. An increase in cyber operations raises all-source sensing, by human intervention. An increase in cyber operations raises effect, by human intervention.

Seen as effects, the war runs one loop and cyber runs through it. All-source sensing feeds a targeting and decision picture; the picture drives effect, kinetic and cyber together; effect yields new sensing; and round again, a reinforcing cycle marked R. Cyber sits in the diagram not as a stage in that loop but as a thread through it, feeding both the sensing and the effect, because that is what it does, an input at several points rather than a link in the chain. A dashed edge runs off it toward a decisive outcome and does not close: whether all this fusion wins wars is unanswered. And there is no box in the picture for “the cyberwar”, because its contribution runs through the other domains and cannot be pulled out.

The cyberwar that wasn’t

Careful assessments hold that cyber underdelivered as a strategic weapon: no decisive standalone blow fell, and some read Russia’s cyber and kinetic operations as poorly coordinated rather than smoothly fused. Take that at its strongest and it is an objection about the coordination of fires: whether a cyber effect landed on a target in step with a kinetic one, aimed at the same targets on occasion and timed together rarely. Separability is a different question, whether cyber was a battle of its own, fought against cyber targets for cyber outcomes, or an input to effects produced elsewhere. Collection, not fires, was most likely the main business of Russian cyber, and the fires that did fall did nothing a kinetic weapon could not; badly timed inputs are still inputs. The step from “cyber underdelivered” to “cyber stopped being a domain” is an interpretation, not a settled finding.

Fog, and what the record cannot hold

The record has blind spots. It was assembled while the war continued and kept changing; attribution is at its worst; and both sides run information operations, which means claims about cyber are themselves sometimes cyber-enabled. The fusion shows in the shape rather than the ticker, in the structural fact of cyber fused with the conduct of war rather than in any week’s tally of intrusions. And whether the fusion is as total in a war that is not existential, in a country not built of software, the record cannot yet say. Ukraine is where the boundary has gone furthest, not proof that it goes everywhere.

The last line

So the last line goes. The search began with the actor behind the cyber, and kept finding something else: a treasury turned inside out, a boundary kept open, a market of contractors, a repertoire under a lid, a labour market, a standing apparatus, a mesh with no centre, a stack held whole, a machine with no operator, a state that had become its own infrastructure. Each was a form, and the form kept refusing to sit still as a thing an actor simply has. Ukraine is where the last container gives way. There is no cyber to point at here, separate from the war, because the record can no longer find the line between them. The unit of analysis was never the actor, and in the end it was not even the domain. It was only ever the substrate, and the shape it takes when someone has to use it.