Cyber, Information, and Cognitive Warfare

LESSON METADATA

SECTION 0 — Why This Lesson Exists

Security studies was built on a grammar that assumes kinetic violence, territorial boundaries, identifiable adversaries, and measurable victory. Cyber and information operations break each of these assumptions. An attack may leave no crater; the attacker may be a criminal syndicate renting infrastructure to a state intelligence service; the “battlefield” may be the cognitive space of a population; “victory” may be a shifted election or a corroded trust in institutions. The central puzzle of this lesson is whether the conceptual vocabulary of coercion, deterrence, and sovereignty — developed for industrial-age warfare — can be transposed to domains where effects are non-kinetic, attribution is probabilistic, and the decisive engagement is often invisible. The lesson argues that the vocabulary can be transposed only partially, and that the partial failures are themselves theoretically productive: they reveal assumptions buried in classical security theory that were never made explicit until a domain arose that violated them.

This lesson follows L20 on coercion and L7 on constructivism, and it presupposes L4’s post-positivist turn. Coercion theory, as developed by Schelling and refined by Pape, assumes a sender, a signal, and a receiver who can interpret the signal as costly. In cyber and information domains, the signal is often ambiguous by design; the receiver may not know an operation occurred; and the “cost” is reputational or cognitive rather than material. Constructivism matters because the effects of information warfare are constituted by shared meaning: a disinformation campaign works not by destroying servers but by reshaping what a public believes is true. Post-positivism matters because the analyst’s own categories — “attack,” “war,” “attribution” — are part of the contested terrain, and the linguistic turn reminds us that naming an event as an “attack” is itself a political act with consequences for response. The lesson thus sits at the intersection of three intellectual traditions and forces them into contact with a domain none was built for.

After mastering this lesson, the student will be able to do six things. First, reconstruct the grammar of cyber conflict — offense-defense balance, attribution problems, and deterrence by denial versus punishment — and identify where it holds and where it fractures. Second, analyze critical infrastructure targeting, including ransomware, state hacking, and the blurring of criminal and state action. Third, evaluate information and cognitive warfare as distinct but overlapping phenomena, each with its own mechanism and scope conditions. Fourth, compare five national doctrines — US persistent engagement, Russian reflexive control and information security, Chinese three warfares, EU regulatory, and the African cyber-sovereignty position — reconstructing each from within. Fifth, adjudicate a concrete case, the 2016 US election interference and the 2010 Stuxnet attack, across levels of analysis and perspectives. Sixth, produce a policy memo that distinguishes description, explanation, prediction, and prescription, with explicit falsifiers.

The African perspective is not a regional illustration appended to Western theory; it reframes the lesson’s puzzle. From the vantage of African scholarship — Grovogui’s critique of the international as a Eurocentric construct, Mbembe’s necropolitics, Bayart’s extraversion, Mamdani’s citizen/subject distinction, Rodney’s underdevelopment thesis, and the pan-Africanist tradition of Nkrumah, Nyerere, and Cabral — the digital domain appears not as a neutral technical space but as a new frontier of extraversion and extraction. African states confront cyber operations not only as targets but as jurisdictions whose data, infrastructure, and narratives are governed by foreign platforms and foreign doctrines. The AU Convention on Cyber Security and Personal Data Protection (Malabo, 2014) is not merely a regional implementation of Western norms; it is an assertion that cyber sovereignty includes the right to localize data, to regulate platforms, and to define security in terms of developmental and cognitive autonomy. The African vantage reveals what the other four perspectives occlude: that the “global” cyber order is built on an infrastructure of platforms and standards whose governance is concentrated in a handful of states and corporations, and that “cyber norms” negotiated in New York or Geneva may presuppose a digital capacity that most African states do not possess. Fanon’s analysis of colonial violence and Oyěwùmí’s critique of the universalization of Western categories remind us that the categories of “cyber war” themselves carry a genealogy that is not neutral.

The lesson proceeds through five key ideas. First, the grammar of cyber conflict: offense-defense balance, attribution problems, and deterrence by denial versus punishment. Second, critical infrastructure targeting: ransomware, state hacking, and the blurring of criminal and state action. Third, information warfare: disinformation, election interference, and the manipulation of public opinion. Fourth, cognitive warfare: the weaponization of narrative, the attention economy, and the “brain as battlefield.” Fifth, divergent national doctrines: US persistent engagement, Russian reflexive control and information security, Chinese three warfares, and EU regulatory approaches. These five are not sequential stages but overlapping layers: a single operation — Stuxnet, or the 2016 election interference — typically traverses several, and the analyst’s task is to identify which layer is doing the causal work in a given case.

The lesson insists on three disciplines that run through every section. First, level-of-analysis discipline: every claim must be located at the individual, state, systemic, or transnational level, the four levels established in Lesson 1. Second, perspective discipline: every claim must be reconstructable from at least two of the five perspectives, and the African perspective must be attempted first. Third, epistemic humility: attribution in cyber and information domains is probabilistic, not categorical; the analyst must distinguish what is known, what is inferred, and what is asserted, and must mark the difference between description, explanation, prediction, and prescription. The lesson’s assessments — the worked example, the problem pair, the independent memo — are designed to test these disciplines. The student who masters them will be equipped to analyze not only the cases in this lesson but the forward-linked domains of AI and hyperwar (L54), scientific statecraft (L56), and space and infrastructure (L57), where the same grammar applies with even greater stakes and where the African questions of sovereignty, extraversion, and cognitive autonomy recur with renewed urgency.

SECTION 1 — Pre-Class Priming

1.1 Retrieval warm-up

1. In L20 (coercion), what is the difference between deterrence and compellence, and why is compellence generally considered harder to achieve? (Recall Schelling’s distinction and the problem of assurance.)
2. In L7 (constructivism), how does Wendt’s claim that “anarchy is what states make of it” challenge Waltzian neorealism’s treatment of anarchy as a fixed structural condition?
3. In L4 (post-positivism), what is the “linguistic turn,” and why does it matter for security studies specifically?
4. In L20, what are the two mechanisms of coercion — denial and punishment — and how do they differ in their causal logic and in the information they require from the adversary?
5. In L7, what role do norms play in constructivist IR, and how does a constructivist account of norms differ from a rationalist account of interests?
6. In L4, what is the difference between Erklären (explanation) and Verstehen (understanding), and which traditions in IR privilege which?

1.2 Orientation questions

1. Why might deterrence by punishment fail in cyberspace even if it has been theorized to work in nuclear deterrence? Consider attribution, proportionality, and the problem of thresholds.
2. How does the “brain as battlefield” concept change what counts as a military operation, and what does it imply about who is a combatant?
3. What does the African cyber-sovereignty position add to debates that are otherwise dominated by US, Russian, and Chinese doctrines?
4. Is Stuxnet an act of war, an act of sabotage, or something else — and what hangs on the answer for international law and for deterrence theory?

1.3 Vocabulary pre-teach

• Attribution: the process of identifying the actor behind a cyber or information operation; in practice probabilistic, contested, and often dependent on classified intelligence that cannot be publicly disclosed.
• Deterrence by denial: preventing an adversary from achieving their objective, thereby removing the incentive to attack; in cyber contexts this often means resilience and rapid recovery rather than blocking.
• Deterrence by punishment: threatening retaliation to raise the cost of attack; in cyber contexts complicated by attribution problems and by the risk of escalation.
• Reflexive control (Russian): shaping an adversary’s decision-making by feeding them manipulated information so that they voluntarily choose the action the manipulator desires; a tradition rooted in Soviet military thought.
• Three warfares (Chinese): public opinion warfare, psychological warfare, and legal warfare (lawfare), articulated as a unified doctrine for shaping the information environment.
• Persistent engagement (US): the US doctrine of continuous, proactive operations in cyberspace to disrupt adversaries before they reach US networks, associated with the 2018 US cyber strategy.
• Cognitive warfare: operations targeting the human mind, perception, and decision-making rather than systems or data; the “brain as battlefield.”
• Information security (Russian doctrine): a broad concept encompassing not only technical security but the protection of information space, societal stability, and state sovereignty over information flows.
• Cyber sovereignty: the principle that states have sovereign authority over cyberspace within their territory, including data localization and platform regulation; central to both Chinese and African positions.
• APT (Advanced Persistent Threat): a prolonged, targeted cyber intrusion, typically state-linked, characterized by stealth and persistence rather than immediate destruction.
• Ransomware: malware that encrypts data and demands payment for decryption; the site of the criminal/state blur when state actors tolerate or direct such operations.
• Attention economy: the competition for human attention as a scarce resource, exploited by information and cognitive operations that seek to capture and direct collective focus.

SECTION 2 — LESSON CORE

SECTION 2.1 Learning objectives

By the end of this lesson, the student will be able to: (1) Explain the mechanism by which offense-defense asymmetry and attribution ambiguity jointly produce a distinctive grammar of cyber conflict, including why classical deterrence by punishment is weakened and why deterrence by denial becomes comparatively attractive. (2) Compare deterrence by denial and deterrence by punishment as strategies for cyber conflict, specifying the scope conditions under which each is credible, the kinds of targets for which each is appropriate, and the escalation risks attached to each. (3) Analyze a cyber incident using the four levels of analysis—individual, state, systemic, and transnational—and identify which of the five perspectives (African, Chinese, Russian, Western, UN) best explains its dynamics without forcing the case into a single framework. (4) Evaluate the claim that most cyber operations remain below the threshold of armed conflict, using evidence from state practice, the UN GGE consensus reports, and the observable pattern of public attribution, sanctions, and covert retaliation rather than kinetic response. (5) Apply the concept of attribution ambiguity to design a falsifiable indicator that would distinguish state-sponsored from criminal cyber activity, stating what evidence would confirm, weaken, or refute the indicator and which level of analysis it privileges. These objectives are assessable through short-answer explanations, comparative matrices, case-based memos, and a hinge question that tests whether the student can distinguish description, explanation, prediction, and prescription in cyber-security analysis.

SECTION 2.2 KEY IDEA 1: The grammar of cyber conflict: offense-defense balance, attribution problems, and deterrence by denial versus punishment

Bolded Causal Claim: Cyber conflict has a distinctive grammar because the structural cheapness of offense relative to defense and the endemic ambiguity of attribution jointly weaken classical deterrence by punishment and push states toward deterrence by denial, active defense, and persistent sub-threshold competition.

Mechanism: The first mechanism is the offense-defense balance. In conventional military domains, defense can be advantaged by terrain, fortification, mobilization time, and the physical costs of projection. In cyber operations, the defender must secure every interface, patch every vulnerability, monitor every log, and train every user, while the attacker needs only one exploitable weakness, one stolen credential, or one misconfigured service. This does not mean offense always wins; sophisticated defenders can raise costs through segmentation, redundancy, deception, and rapid patching. But the default asymmetry is structural: the defender’s problem is combinatorial and continuous, while the attacker’s problem is selective and episodic. The second mechanism is attribution ambiguity. Technical forensics can often identify malware families, command-and-control infrastructure, tactics, techniques, and procedures, and sometimes the specific operator. Yet moving from technical indicators to political attribution requires intelligence about intent, state sponsorship, and chain of command that governments rarely disclose in full. The gap between technical and political attribution creates plausible deniability and allows states to operate below the threshold of acknowledged conflict. The third mechanism is deterrence adaptation. Classical deterrence by punishment assumes an identifiable aggressor, a credible threat, and a proportionate response. Cyber ambiguity undermines the first two conditions: if the attacker cannot be named with confidence, retaliation risks misattribution; if retaliation is covert, it may not deter; if it is public and kinetic, it may escalate beyond the original harm. Deterrence by denial therefore becomes attractive because it reduces the expected payoff of attack without requiring certain attribution: resilient systems, backups, segmentation, and rapid recovery make intrusion less useful. But denial alone cannot eliminate espionage, disruption, or reputational damage, so states combine it with punishment threats—sanctions, indictments, diplomatic isolation, covert counter-operations, and occasionally kinetic signaling. The resulting grammar is one of frequent, deniable, sub-threshold activity in which the boundary between peace and conflict is managed rather than clearly crossed. Constructivist and post-positivist work is relevant here because “cyber attack,” “armed attack,” and “critical infrastructure” are not purely technical labels; they are interpreted categories whose meaning is stabilized through practice, law, and discourse. Thomas Rid’s argument that cyber operations are closer to sabotage and espionage than to war captures one side of this debate, while the UN GGE consensus reports attempt to stabilize norms by specifying that international law applies to state cyber activity and that critical infrastructure should be protected. Singer and Brooking’s analysis of the information environment adds that cyber conflict is not only about systems but about attention, narrative, and public perception, which means the grammar includes psychological and political effects even when no physical damage occurs.

Scope Conditions: The claim that cyber conflict has this distinctive grammar holds under several conditions. First, target systems must be complex, networked, and partially opaque to their owners; simple or air-gapped systems reduce the offense-defense asymmetry. Second, the attacker must have time, access, and intelligence; opportunistic intrusions differ from strategic campaigns. Third, attribution must require classified or sensitive intelligence that cannot be fully shared, which is common in state-on-state cases but less so when criminal infrastructure is seized and analyzed publicly. Fourth, political leaders must demand high confidence before authorizing retaliation, which is typical in democracies and in nuclear-armed states but not universal. The claim weakens when an operation causes physical destruction or loss of life, because such effects push the incident toward the legal category of armed attack and make punishment deterrence more credible. It also weakens when a defender possesses overwhelming counter-cyber capability or when an attribution coalition shares enough intelligence to remove plausible deniability. Finally, the offense-defense balance is not technologically fixed; automation, zero-trust architectures, artificial intelligence, and software supply-chain reform can shift costs toward the defender, although adversaries adapt in turn. Deterrence by punishment is more credible for high-end destructive attacks where attribution eventually becomes politically unavoidable; deterrence by denial is more relevant for espionage, disruption, and low-level coercion where the expected damage is below the threshold that would justify escalation.

Observable Implications: If this grammar is operative, several patterns should be observable. States should experience frequent intrusions without kinetic retaliation; public attribution statements should vary in confidence and often be accompanied by sanctions, indictments, or diplomatic protests rather than military force; governments and firms should invest heavily in resilience, backup, segmentation, and incident response; private companies should function as frontline defenders and sometimes as intelligence partners; states should engage in “naming and shaming” to shape norms even when they cannot punish; and adversaries should carefully manage effects to avoid crossing thresholds that would trigger armed response. One should also observe covert retaliation, threshold management, and diplomatic efforts to define prohibited targets, especially through the UN GGE and OEWG processes. Conversely, if classical deterrence by punishment were fully effective, one would expect fewer acknowledged intrusions, clearer red lines, and more frequent kinetic or overtly coercive responses to cyber operations. The CSIS record of significant cyber incidents and the growing number of state-linked advanced persistent threat groups are consistent with a grammar of persistent sub-threshold competition, though such counts must be interpreted cautiously because they reflect reporting capacity, definitional choices, and political willingness to disclose incidents.

Perspective Note (five traditions in brief): The African perspective, treated here as primary, begins from the position that cyber conflict is not only an interstate deterrence problem but a sovereignty, development, and inequality problem. Many African states enter the digital domain with infrastructural dependence, limited domestic cybersecurity capacity, and exposure to both state and criminal actors; the offense-defense asymmetry is therefore compounded by asymmetries in technology, finance, and expertise. From this vantage point, deterrence by punishment is often unavailable because retaliatory capacity is limited and because attribution requires resources that are unevenly distributed. The African Union Convention on Cyber Security and Personal Data Protection, adopted in Malabo in 2014, reflects a regional effort to harmonize cybercrime law, data protection, and electronic commerce, but implementation remains uneven. African scholarship and policy discourse frequently frame cyber sovereignty in terms of data localization, control over critical information infrastructure, and protection against digital extractivism, rather than in terms of great-power deterrence. The African perspective also highlights that global cyber norms developed in UN forums may not reflect the priorities of states whose immediate concerns are capacity building, cybercrime, and the protection of nascent digital economies. It therefore sees the grammar of cyber conflict as shaped by historical inequalities in knowledge production and technological ownership, and it insists that resilience and denial strategies must be accompanied by equitable access to attribution tools, training, and infrastructure. Chinese perspectives emphasize cyber sovereignty, state control over information infrastructure, and “active defense,” interpreting the offense-defense balance through the lens of domestic stability and regime security as much as interstate competition. Attribution is often treated as politically constructed by Western actors, and deterrence is linked to the ability to control information flows within national borders. Russian perspectives draw on an information-security doctrine that treats the information sphere as a domain of conflict in which technical and psychological operations are inseparable; reflexive control traditions emphasize shaping an adversary’s perceptions and decisions rather than merely destroying systems. Attribution skepticism is pronounced, and deterrence is less about credible punishment than about controlling narratives and maintaining strategic ambiguity. Western perspectives, especially in the United States, have developed deterrence frameworks, attribution coalitions, and persistent engagement doctrines, while also generating self-critique: operations such as Stuxnet demonstrated that cyber weapons can proliferate, that effects can escape intended targets, and that offensive advantage may be temporary. Western analysis tends to privilege technical attribution, legal categories, and alliance coordination, sometimes underestimating how its own offensive operations shape adversary doctrines. The UN perspective, expressed through the GGE consensus reports of 2013, 2015, and 2021 and the OEWG process, seeks to apply international law to cyberspace, articulate norms of responsible state behavior, and build confidence through transparency and capacity building. It treats attribution as a state responsibility but acknowledges practical limits, and it aims to reduce escalation by clarifying that states should not target critical infrastructure or interfere with emergency services. Its strength is multilateral legitimacy; its limitation is that consensus language often papers over disagreements about sovereignty, self-defense, and the threshold of armed attack.

SECTION 2.3 KEY IDEA 2 — Critical Infrastructure Targeting: Ransomware, State Hacking, and the Blurring of Criminal and State Action

Bolded Causal Claim: Targeting critical infrastructure through cyber means converts latent digital access into coercive leverage, but only where operational technology is networked, poorly segmented, and backed by fragile recovery capacity; the blurring of criminal ransomware and state-sponsored intrusion makes attribution and response categorization systematically ambiguous, so that the same technical event can be read as crime, espionage, or act of war depending on the interpretive frame applied.

Mechanism: The mechanism proceeds in four linked stages. First, digitization of operational technology (OT) in power grids, water treatment, hospitals, and financial clearing systems creates attack surfaces that were historically air-gapped; as industrial control systems (SCADA) are connected to enterprise IT networks for efficiency and remote monitoring, the boundary between information systems and physical process control erodes. Second, initial access is typically achieved through commodity techniques—phishing, unpatched vulnerabilities, compromised credentials, or supply-chain insertion—rather than bespoke exploits, which means the same intrusion kit serves criminals and intelligence services alike. Third, once inside, the attacker faces a choice between immediate monetization (ransomware encryption, data exfiltration for sale) and pre-positioning for strategic effect (logic bombs, wiper malware, or sustained access for future disruption). Fourth, and most consequentially, the criminal market provides a laundering layer: states can purchase access from brokers, task criminal groups, or simply allow criminal operations to proceed in their jurisdiction, gaining plausible deniability while the victim state struggles to classify the event. The blurring is not merely tactical deception; it is structural, because the global cybercrime economy—ransomware-as-a-service, initial access brokers, bulletproof hosting—has industrialized capabilities that were once the monopoly of intelligence agencies. When a hospital is encrypted by LockBit or a pipeline is shut down by DarkSide, the technical forensics may point to a criminal affiliate, while the geopolitical context suggests state tolerance or direction. This ambiguity is the mechanism’s core product: it degrades the victim’s ability to invoke legal categories (crime versus armed attack), complicates alliance consultation, and slows decision cycles. The 2021 Colonial Pipeline incident illustrates the chain: a compromised password led to ransomware deployment by a criminal group operating from Russian territory, forcing a fuel shortage across the US East Coast and triggering a federal emergency declaration, even though the group was not formally state-directed. The 2017 NotPetya attack, initially disguised as ransomware but functioning as a wiper, caused an estimated ten billion dollars in global damage and demonstrated how destructive code could be released through a software supply chain, blurring criminal, state, and terrorist modalities. Ukraine’s 2015 and 2016 power-grid intrusions showed the strategic variant: attackers used spear-phishing and legitimate remote-access tools to open breakers, causing blackouts, while simultaneously jamming customer service lines to delay recovery. In each case, the mechanism’s leverage derives not from the sophistication of the exploit but from the victim’s dependency on the targeted system and the time required to restore it.

Scope Conditions: The mechanism operates where four conditions converge: (a) high dependency on a single digital system with limited manual fallback; (b) weak network segmentation between IT and OT environments; (c) a criminal or state ecosystem capable of developing and deploying the payload; and (d) a legal and political environment in which the victim cannot quickly determine attribution and therefore cannot calibrate response. It is weaker where infrastructure is air-gapped, where redundant manual procedures exist, where strong cyber hygiene and patching discipline prevail, and where international cooperation on takedowns and indictments is effective. It is also weaker against targets with high resilience investment, such as financial clearinghouses with real-time backup systems. Conversely, it is strongest against municipal water systems, regional hospitals, and mid-sized energy distributors in jurisdictions with limited cybersecurity capacity—a pattern that explains why ransomware disproportionately affects developing-country infrastructure and local governments in wealthy states alike.

Observable Implications: If the mechanism holds, one should observe: rising ransomware incidents against infrastructure sectors tracked by CSIS and ENISA; increasing convergence between criminal tooling and state APT tradecraft; a growing gap between incident frequency and successful prosecution; and states investing in resilience and manual fallback rather than purely in perimeter defense. One should also observe diplomatic friction when states demand that other states suppress criminal groups operating from their territory, as in US-Russia exchanges after Colonial Pipeline. A further implication is that deterrence by punishment—threatening retaliation—becomes less credible when the attacker is a criminal proxy, because the target state cannot clearly identify a state adversary to punish without risking escalation or misattribution.

Perspective Note (five traditions in brief): The African perspective, reconstructed from within, treats critical infrastructure targeting as inseparable from questions of digital sovereignty and developmental vulnerability. African scholarship and policy discourse—drawing on the AU Convention on Cyber Security and Personal Data Protection (Malabo, 2014), the work of scholars such as Aning and Danso on African security governance, and the broader tradition of dependency critique associated with Rodney and Nkrumah—emphasize that African states face a double bind: their infrastructure is increasingly digitized through foreign vendors and cloud providers, yet their defensive capacity and legal frameworks lag, making them attractive targets for both criminal ransomware and state pre-positioning. From this vantage point, the blurring of criminal and state action is not an abstract legal puzzle but a lived condition in which African hospitals, power utilities, and financial systems are disrupted by actors whose interests are opaque and whose accountability is nil. The Malabo Convention’s push for data localization, harmonized cybercrime laws, and regional cooperation reflects an insistence that infrastructure protection is a sovereignty issue, not merely a technical one, and that external powers’ offensive operations in African digital space reproduce colonial patterns of extraction and vulnerability. African analysts also note that the global ransomware economy exploits African underinvestment in cybersecurity workforce development, turning the continent into both a target and an unwitting transit zone. The Chinese perspective frames critical infrastructure protection through the doctrine of cyber sovereignty and the “three warfares” (public opinion, psychological, legal), treating foreign targeting of Chinese infrastructure as a sovereignty violation while asserting the state’s right to regulate its information space; it emphasizes defensive resilience and the integration of civilian and military cyber defense under party-state coordination. The Russian perspective, rooted in information security doctrine, treats infrastructure vulnerability as part of a broader information confrontation in which Western states are seen as the primary threat; it emphasizes state control over domestic networks and the legitimacy of preemptive defensive measures, while its own operations abroad are framed as responses to Western aggression. The Western perspective, dominant in NATO and US doctrine, centers on deterrence by denial and punishment, attribution confidence, and the application of international law to cyber operations; it has developed frameworks for identifying state responsibility and has invested heavily in resilience, but it has also been criticized for underestimating how its own offensive operations—such as Stuxnet—legitimize adversary targeting of infrastructure. The UN perspective, expressed through the GGE consensus reports of 2013, 2015, and 2021 and the OEWG process, seeks to establish norms that states should not target critical infrastructure or interfere with emergency services, and it promotes confidence-building measures and capacity building; its strength is multilateral legitimacy, while its limitation is that consensus language often papers over disagreements about sovereignty, self-defense, and the threshold of armed attack.

SECTION 2.4 KEY IDEA 3 — Information Warfare: Disinformation, Election Interference, and the Manipulation of Public Opinion

Bolded Causal Claim: Information warfare achieves strategic effects not by destroying infrastructure but by degrading the epistemic and social foundations of democratic decision-making, exploiting platform architectures and cognitive biases to reshape public opinion at low cost; its power lies in the asymmetry between the cost of producing false or polarizing content and the cost of verifying and countering it.

Mechanism: The mechanism operates through a chain of amplification and contamination. First, content is produced—often by state-linked actors, troll farms, or automated networks—that is designed to exploit existing social cleavages, emotional triggers, and identity commitments rather than to persuade through evidence. Second, this content is injected into information ecosystems through multiple channels: fake personas on social media, compromised or complicit influencers, state media outlets, and encrypted messaging applications. Third, platform algorithms, optimized for engagement rather than accuracy, amplify emotionally resonant content, creating feedback loops in which false or misleading narratives reach audiences far beyond their originators’ direct reach. Fourth, the content is laundered through repetition across channels, so that a claim originating in a troll farm appears to be independently corroborated when it surfaces in mainstream media or political discourse. Fifth, the cumulative effect is not necessarily to change specific votes but to erode trust in institutions, media, and electoral processes, and to polarize publics so that collective action becomes harder. Singer and Brooking (2018) describe this as the weaponization of the social media age, in which the battlefield is the feed and the ammunition is attention. Pomerantsev (2019) emphasizes that modern propaganda does not require belief in a single truth; it thrives on cynicism, confusion, and the collapse of shared epistemic standards. The mechanism is cheap because it leverages existing infrastructure—platforms, influencers, partisan media—rather than requiring the attacker to build its own. It is deniable because content can be attributed to organic users, and because the line between foreign interference and domestic political speech is legally and practically murky. The 2016 US election interference, attributed to the Russian Internet Research Agency and military intelligence (GRU), exemplifies the chain: thousands of fake social media accounts, targeted advertising, and hacked document releases were used to amplify divisive content, attack specific candidates, and depress turnout among targeted demographics. Similar patterns have been documented in European elections, the Brexit referendum, and COVID-19 information environments, where state and non-state actors exploited uncertainty to amplify conspiracy theories and undermine public health measures.

Scope Conditions: The mechanism is strongest where (a) information consumption is concentrated on algorithmically curated platforms with weak content moderation; (b) media literacy and institutional trust are already low; (c) political polarization creates receptive audiences for identity-affirming falsehoods; and (d) legal frameworks struggle to distinguish foreign interference from protected speech. It is weaker where public broadcasting is strong, where platform regulation is robust, where media literacy education is widespread, and where political culture is less polarized. It is also weaker against targets with high social cohesion and strong institutional legitimacy. The mechanism does not require the attacker to control the narrative entirely; partial success—sowing doubt, amplifying existing divisions—is often sufficient and is harder to counter than outright fabrication.

Observable Implications: If the mechanism holds, one should observe: documented state-linked disinformation campaigns tracked by EU DisinfoLab and similar monitors; increasing investment by states in counter-disinformation units and platform regulation; a widening gap between the speed of false content spread and the speed of correction; and declining trust in media and electoral institutions in targeted societies. One should also observe that countermeasures—fact-checking, takedowns, labeling—often reach smaller audiences than the original false content, and that some interventions backfire by amplifying the very claims they seek to debunk. A further implication is that information warfare blurs into domestic politics, as foreign narratives are adopted and amplified by domestic actors for their own purposes, making attribution and response even more complex.

Perspective Note (five traditions in brief): The African perspective, reconstructed from within, frames information warfare as a continuation of older struggles over narrative sovereignty and epistemic justice. African scholarship—drawing on Fanon’s analysis of colonial propaganda and psychological domination, Cabral’s emphasis on culture as a terrain of struggle, and contemporary work by scholars such as Tamale on decolonial knowledge production—insists that African publics have long been targets of external information manipulation, from colonial-era propaganda to Cold War covert operations and, more recently, to digital disinformation campaigns during elections and public health crises. From this vantage point, the manipulation of public opinion is not a novel threat invented by Russian or Chinese actors; it is a persistent feature of asymmetric power in which African information spaces are treated as battlegrounds by external powers with limited accountability. African analysts emphasize that platform algorithms, trained on Western data and optimized for Western engagement patterns, often misclassify African political speech, amplify sensational content, and underinvest in local-language moderation, creating structural vulnerabilities that foreign and domestic actors alike exploit. The AU and regional bodies have responded with frameworks for election observation and media regulation, but capacity constraints and the cross-border nature of digital platforms limit effectiveness. African scholars also caution against importing Western counter-disinformation models that may not fit local media ecologies, where radio, WhatsApp, and community networks often matter more than Twitter or Facebook, and where “disinformation” can become a label used by incumbents to suppress dissent. The Chinese perspective treats information warfare as an extension of the “three warfares” doctrine, emphasizing public opinion warfare, psychological warfare, and legal warfare as integrated instruments of statecraft; it frames Western media dominance as a form of information hegemony and justifies state control over domestic information space as defensive sovereignty. The Russian perspective, rooted in reflexive control theory, treats information as a battlespace in which the goal is to shape the adversary’s decision-making by manipulating their perception of reality; it distinguishes between information-technical and information-psychological security, and it frames its own operations as defensive responses to Western information aggression. The Western perspective, dominant in NATO and US doctrine, has increasingly recognized information warfare as a strategic threat, investing in counter-disinformation, platform regulation, and resilience; it emphasizes attribution, transparency, and the defense of democratic processes, but it has also been criticized for over-securitizing speech, for inconsistent application of standards, and for underestimating how its own information operations abroad have eroded credibility. The UN perspective approaches information warfare through the lens of human rights, freedom of expression, and the GGE/OEWG processes; it seeks to balance security concerns with protections for speech, and it emphasizes capacity building and multilateral norms, though consensus on defining and prohibiting information interference remains elusive.

2.5 KEY IDEA 4 — Cognitive warfare: the weaponization of narrative, the attention economy, and the ‘brain as battlefield’

Bolded Causal Claim: Cognitive warfare is best understood as a distinct strategic domain in which adversaries seek to alter the cognitive processes—perception, attention, memory, judgment, emotion, and identity—through which individuals and collectives make sense of political reality; its causal force arises from the interaction between technologically amplified narrative environments and pre-existing cognitive vulnerabilities, producing effects that can outlast discrete information campaigns and reshape the conditions under which political choice, consent, and resistance become possible.

Mechanism: The mechanism is not simply the transmission of false claims but the manipulation of the cognitive infrastructure through which claims are evaluated. Human beings reduce complexity through narrative; they rely on heuristics, social cues, identity-protective reasoning, and emotional salience. Cognitive warfare exploits these features by shaping what becomes thinkable, memorable, urgent, or trustworthy. Several channels matter. First, narrative seeding and repetition can make a frame cognitively available, so that even skeptical audiences must process it. Second, emotional priming—especially fear, anger, humiliation, and moral disgust—can narrow attention and reduce deliberative capacity. Third, identity fusion can bind information processing to group belonging, so that contradictory evidence is experienced as an attack on the self. Fourth, cognitive overload can degrade judgment by flooding the information environment with competing, contradictory, or decontextualized claims. Fifth, epistemic fragmentation can erode shared standards of evidence, making collective action and institutional trust harder to sustain. The attention economy is central to this mechanism because commercial platforms optimize for engagement, and engagement is often maximized by content that activates threat, outrage, or novelty. Algorithmic curation, recommendation systems, microtargeting, and influencer networks can therefore amplify adversarial narratives without requiring direct state control of media. In this sense, the “brain as battlefield” metaphor points to a strategic effort to shape the environment in which cognition occurs, not to a literal neuroscientific takeover. The intended effect may be belief change, but it may also be more subtle: altered salience, increased uncertainty, cynicism, self-censorship, polarization, or the normalization of a particular threat narrative. Pomerantsev’s (2019) account of information environments in which “nothing is true and everything is possible” captures one variant of this logic: the goal is not always persuasion but the degradation of the capacity to distinguish signal from noise. Singer and Brooking (2018) similarly emphasize that contemporary conflict operates through the manipulation of attention and emotion in networked publics. Heickerö (2022) is usefully read as part of the broader effort to treat cognitive effects as a strategic problem rather than merely a communications problem. The mechanism is therefore relational: it depends on the interaction between adversary operations, platform architectures, social identities, institutional credibility, and the psychological state of the target population.

Scope Conditions: Cognitive warfare is most likely to be effective where digital platforms are the primary mediators of political information; where institutional trust is already low; where social identities are polarized or ethnically, religiously, or regionally salient; where media ecosystems are fragmented; where crisis, war, pandemic, or economic shock increases cognitive load; and where regulatory capacity over platforms and data is weak. It is less likely to produce durable effects where public-service media are strong, where media literacy and civic education are widespread, where platform accountability is enforceable, where social cohesion is high, and where counter-narratives are credible because they come from trusted local actors rather than distant authorities. The mechanism also requires adversary capacity: intelligence services, troll farms, bot networks, data brokers, sympathetic influencers, diaspora networks, or criminal proxies. Scope conditions include not only target vulnerability but adversary resources and the absence of friction in the information environment. A further scope condition is temporal: cognitive effects often accumulate slowly and are difficult to isolate from ordinary political disagreement, which means that short-term campaigns may produce noise rather than strategic change. There are also important counterarguments. Citizens are not passive recipients; they interpret, resist, mock, and repurpose narratives. Backfire effects can occur when audiences perceive manipulation. Measurement of cognitive change is methodologically difficult, and claims about “brainwashing” often overstate adversary power while understating human agency. The “brain as battlefield” frame can also become self-fulfilling: by treating publics as manipulable, governments may justify paternalistic information control, surveillance, or the securitization of speech. Thus the theory’s strongest version is not that cognition can be reliably hacked, but that strategic actors can systematically alter the conditions of attention and trust in ways that bias political outcomes over time.

Observable Implications: If cognitive warfare is occurring at a strategically significant level, one should observe not only the circulation of false or misleading content but changes in attention allocation, emotional tone, trust metrics, polarization indices, policy salience, and decision-making speed. Indicators include coordinated inauthentic behavior, anomalous engagement patterns, synchronized narrative emergence across platforms, shifts in search trends, increased cynicism toward institutions, and the normalization of conspiratorial or dehumanizing frames. Defensive responses—cognitive security programs, resilience training, platform moderation, strategic communications, and “pre-bunking”—are themselves observable implications, because they indicate that states and platforms treat cognition as a security domain. However, attribution is harder than in conventional cyber intrusion: cognitive effects are diffuse, long-term, and entangled with domestic politics. A false claim may be amplified by foreign actors, domestic elites, commercial incentives, and genuine grievance simultaneously. Therefore, observable implications must be assessed with care: evidence of foreign amplification is not by itself evidence of strategic effect, and evidence of polarization is not by itself evidence of foreign causation. The most defensible implication is that cognitive warfare should be evaluated through longitudinal, multi-method research that distinguishes exposure, belief, attitude, and behavior, rather than through single-event metrics such as virality or engagement.

Perspective Note (five traditions in brief):
African (primary): The African perspective is primary because cognitive warfare in African contexts cannot be separated from longer histories of epistemic violence, colonial categorization, and racialized knowledge production. Fanon’s analysis of colonialism’s psychological damage, Cabral’s insistence that culture is a terrain of struggle, Nyerere’s emphasis on collective consciousness and ujamaa, and Mamdani’s distinction between citizen and subject all suggest that cognition and political identity have long been battlegrounds. Mbembe’s work on necropolitics and commandement, Bayart’s analysis of extraversion, and Grovogui’s critique of international legal hierarchies further show how external powers have shaped African political imagination through categories, institutions, and narratives. Oyěwùmí’s critique of colonial gender categories, Tamale’s decolonial feminist scholarship, and the work of Aning and Danso on African security governance highlight that cognitive security is inseparable from questions of knowledge sovereignty and institutional legitimacy. From this vantage point, contemporary digital cognitive operations—during elections, conflicts, pandemics, or protests—interact with legacies of low institutional trust, ethnicized politics, externally funded media, and platform infrastructures owned outside the continent. The African perspective cautions against importing “brain as battlefield” metaphors that treat African publics as uniquely manipulable; instead, it emphasizes agency, vernacular media, community resilience, and the need to decolonize data and narrative infrastructures. It also insists that cognitive warfare be analyzed not only as foreign interference but as a continuation of struggles over who has the authority to define reality.
Chinese: The Chinese perspective tends to frame cognitive and information effects through the lens of social stability, party-state legitimacy, and “discourse power,” treating narrative management as an extension of sovereignty and governance; it emphasizes the threat of Western ideological penetration and the need for “positive energy,” while often occluding internal dissent, minority voices, and the coercive dimensions of domestic information control.
Russian: The Russian perspective embeds cognitive effects within information security doctrine and the tradition of reflexive control, treating the adversary’s decision-making process as a legitimate target and emphasizing managed pluralism, strategic ambiguity, and the erosion of Western epistemic authority; it contributes a sophisticated understanding of perception management but occludes democratic accountability, transparency, and the distinction between legitimate persuasion and covert manipulation.
Western: The Western perspective frames cognitive warfare as a threat to democratic cognition, institutional trust, and decision-making, emphasizing attribution, platform governance, media literacy, and resilience; it has also generated important self-critique regarding its own psychological operations, covert influence, and the market-driven attention economy that creates vulnerabilities, though it often underestimates how its own information practices abroad have eroded credibility.
UN: The UN perspective approaches cognitive warfare through human rights, freedom of expression, information integrity, and capacity building, seeking to protect vulnerable groups while avoiding the conflation of dissent with cognitive attack; it emphasizes multilateral norms and development, but consensus on defining and prohibiting cognitive interference remains elusive, and enforcement capacity is limited.

2.6 KEY IDEA 5 — Different national doctrines: US (persistent engagement), Russian (reflexive control, information security), Chinese (three warfares), EU (regulatory).

Bolded Causal Claim: National doctrines in cyber, information, and cognitive warfare are not merely tactical preferences but constitutive frameworks that define what counts as conflict, where thresholds lie, who may act, and what victory means; divergent doctrines therefore produce not only different operational styles but incompatible understandings of escalation, sovereignty, and legitimacy, making cross-doctrinal deterrence, attribution, and norm-building inherently difficult.

Mechanism: Doctrine operates as a mechanism by shaping five variables: conceptualization of the domain, organizational division of labor, legal authorities, target sets, and signaling practices. The US doctrine of persistent engagement, associated with US Cyber Command’s 2018 strategic shift, treats cyberspace as a domain of continuous competition below the threshold of armed conflict; it emphasizes “defending forward,” imposing costs, disrupting adversary operations in their own networks, and maintaining initiative. Its underlying assumption is that passive defense is insufficient and that advantage goes to the actor that can operate continuously and impose friction on adversaries. The Russian doctrine of information security treats information as a strategic resource and the information space as a domain of sovereignty; it combines legal control over domestic information, strategic ambiguity abroad, and the tradition of reflexive control, which seeks to shape an adversary’s decision-making by manipulating the information on which decisions are based. The Chinese doctrine of the “three warfares”—public opinion warfare, psychological warfare, and legal warfare—integrates narrative, perception, and law into military and political strategy; it is closely tied to cyber sovereignty, “winning without fighting,” and the pursuit of “discourse power.” The EU approach is less a warfighting doctrine than a regulatory and resilience framework: it emphasizes norms, rights, platform accountability, cyber diplomacy, and the protection of democratic processes, drawing on instruments such as data protection, digital services regulation, and coordinated attribution. The mechanism of divergence is rooted in regime type, strategic culture, technological capacity, and historical experience. The United States, as a liberal hegemon with global alliance commitments, tends to frame the problem as competition and deterrence. Russia, perceiving encirclement and regime insecurity, tends to frame it as information security and strategic defense. China, as a party-state pursuing development and legitimacy, tends to frame it as sovereignty and narrative control. The EU, as a post-national regulatory polity, tends to frame it as governance, rights, and resilience. These frameworks produce different escalation ladders: what Washington may classify as competition, Moscow may classify as aggression, and Brussels may classify as a regulatory violation. They also produce different attribution practices: the US often names and shames; Russia often denies and proxies; China often emphasizes sovereignty and non-interference; the EU often coordinates multilateral statements and sanctions. The mechanism is therefore not only operational but epistemic: doctrines determine what evidence counts, what thresholds matter, and what responses are legitimate.

Scope Conditions: Doctrinal effects are strongest where states have the capacity to implement them, where institutional path dependence locks in particular organizations and legal authorities, and where threat perceptions align with doctrinal assumptions. They are weaker where practice diverges from doctrine, as it often does: states may adopt rhetorical doctrines while relying on proxies, criminal networks, or covert action; bureaucratic politics may distort implementation; and technological change may outpace doctrinal revision. Doctrines may also converge around shared interests, such as the protection of critical infrastructure or the avoidance of catastrophic escalation, even where broader frameworks remain incompatible. A further scope condition is alliance structure: US doctrine is shaped by NATO and partner capacity; EU doctrine is shaped by member-state diversity and legal harmonization; Russian and Chinese doctrines are shaped by centralized party-state control. Counterarguments include the claim that doctrine is epiphenomenal to material interests and power asymmetries; that states borrow and hybridize doctrines; that “doctrine” often serves as post-hoc rationalization for opportunistic behavior; and that the most important drivers of cyber and information conflict are technological and economic rather than doctrinal. These counterarguments do not eliminate doctrinal effects but suggest that doctrine should be treated as a variable that mediates interests rather than as an independent cause.

Observable Implications: If doctrines shape behavior in the ways theorized, one should observe persistent patterns in organizational structure, legal framing, target selection, and public attribution. Observable indicators include the creation and empowerment of dedicated commands and agencies, such as US Cyber Command, Russia’s information operations structures, China’s strategic support and cyber units, and EU bodies such as ENISA and the European External Action Service’s strategic communications teams. One should also observe differences in escalation management: the US emphasis on cost imposition and forward defense; Russian use of proxies, ambiguity, and reflexive control; Chinese integration of legal and public-opinion campaigns; and EU emphasis on regulation, resilience, and multilateral coordination. Doctrinal divergence should also produce misperception risks: US actors may interpret Russian or Chinese operations as unprovoked aggression; Russian actors may interpret US internet dominance and platform power as existential threats; Chinese actors may interpret Western media and NGO activity as ideological penetration; EU actors may interpret both security threats and rights violations in the same events. The observable implication for analysts is that cross-national comparison must be doctrinally literate: the same technical act—such as a network intrusion or a disinformation campaign—may be categorized, justified, and responded to differently depending on the doctrine through which it is interpreted. The strongest test of doctrinal influence is not whether states invoke doctrine in speeches but whether doctrine predicts organizational behavior, legal thresholds, and escalation choices across cases.

Perspective Note (five traditions in brief):
African (primary): The African perspective is primary because African states are not merely objects of great-power doctrines but actors navigating among them, often adopting elements of cyber sovereignty from Chinese and Russian frameworks, rights and regulatory language from Western and EU frameworks, and multilateral norms from the UN, while facing severe capacity constraints. African scholarship—particularly Aning and Danso on security governance, and broader traditions of postcolonial state analysis—highlights that doctrines designed for great powers may be ill-fitting for states whose primary concerns include development, human security, institutional capacity, and regional stability. The AU Convention on Cyber Security and Personal Data Protection (Malabo, 2014) represents an attempt to craft an African doctrine that combines sovereignty, cooperation, and rights, but implementation remains uneven. From the African vantage point, doctrinal pluralism is both an opportunity and a risk: it allows African states to avoid a binary choice between great powers, but it can also produce fragmentation, dependency, and the importation of ill-suited security logics. African perspectives also emphasize that doctrine must be evaluated by its effects on ordinary people—whether it protects critical infrastructure and personal data, whether it enables or suppresses dissent, and whether it strengthens regional cooperation. This vantage reveals what great-power doctrinal debates often occlude: the question is not only how states compete in cyberspace but how security frameworks can be made accountable to populations with limited leverage over global platforms and powerful states.
Chinese: The Chinese perspective presents its doctrine as a defense of cyber sovereignty, development, and social stability, emphasizing non-interference, state control over information infrastructure, and the legitimacy of managing domestic discourse; it contributes an alternative to Western liberal norms and a focus on digital development, but it occludes human rights, minority protections, and the coercive dimensions of information control.
Russian: The Russian perspective presents information security doctrine and reflexive control as responses to perceived Western information dominance and regime insecurity, emphasizing sovereignty, strategic ambiguity, and the manipulation of adversary decision-making; it contributes a critique of unipolar information power but occludes democratic accountability, transparency, and the distinction between state security and regime security.
Western: The Western perspective presents persistent engagement, deterrence, and attribution as necessary responses to continuous competition, emphasizing initiative, alliance coordination, and the defense of democratic processes; it contributes technical capacity and institutional frameworks, but it occludes its own offensive and covert practices, the market-driven vulnerabilities of its information ecosystem, and the risk of escalation through forward operations.
UN: The UN perspective presents doctrine through the language of norms, capacity building, and multilateral consensus, emphasizing that state behavior should be constrained by agreed rules and that developing states need support; it contributes a forum for dialogue and a baseline of expectations, but it occludes enforcement, power asymmetries, and the fact that major powers often treat norms as instrumental rather than binding.

2.7 FIVE PERSPECTIVES IN DEPTH

2.7.1 African Perspective (PRIMARY)

The African vantage point on cyber, information, and cognitive warfare begins from a premise that the other four perspectives tend to treat as peripheral: that the “cyber” domain is not a virtual space hovering above material reality but is physically embedded in colonial geographies of cable routes, server locations, platform ownership, and data-extraction circuits. From this position, the central puzzle of the lesson is not how states deter one another in a new domain but how sovereignty is exercised over infrastructures that were never designed for African control, and how cognitive warfare reproduces racialized hierarchies of whose knowledge counts as knowledge. The African perspective is therefore not a regional application of Western deterrence theory or Chinese sovereignty doctrine; it is a distinct epistemic and political project rooted in the experience of colonial domination and its digital afterlives.

The theoretical lineage runs through several interconnected traditions. Fanon’s analysis of colonial psychological warfare in The Wretched of the Earth (1961) and Black Skin, White Masks (1952) established that colonialism operates not merely through force but through the systematic destruction of the colonized’s capacity to name their own reality—a process that anticipates contemporary cognitive warfare with disturbing precision. For Fanon, the colonizer’s project is to make the colonized internalize a narrative of their own inferiority; the “brain as battlefield” is not a twenty-first-century innovation but the foundational condition of colonial rule. Cabral’s Return to the Source (1973) extended this by insisting that culture is the terrain on which liberation is won or lost, and that the struggle for sovereignty is inseparable from the struggle over narrative and meaning. These insights frame the African approach to information and cognitive warfare: the manipulation of public opinion and the weaponization of narrative are not novel techniques but continuations of a longer history of epistemic violence, now mediated by digital platforms rather than colonial presses.

Rodney’s How Europe Underdeveloped Africa (1972) and Nkrumah’s Neo-Colonialism: The Last Stage of Imperialism (1965) provide the materialist backbone. Rodney demonstrated that underdevelopment is not a natural condition but a produced one, the result of systematic extraction; Nkrumah showed that political independence without economic control produces neocolonialism, in which sovereignty is formal but substance is hollow. Applied to the digital domain, these arguments yield the concept of digital neocolonialism: African states may possess flags and constitutions, but the data generated by their populations flows through undersea cables landing in European and North American hubs, is stored on servers owned by foreign corporations, is processed by algorithms trained on non-African data, and is monetized by platforms headquartered elsewhere. The extraction has shifted from minerals to data, but the structural logic—value generated in Africa, captured elsewhere—persists. Nyerere’s Ujamaa (1968) and his broader philosophy of self-reliance frame the normative counter-position: digital sovereignty requires not merely regulation but the development of indigenous capacity, from cable infrastructure to data centers to platform governance.

Mbembe’s work, particularly On the Postcolony (2001) and Necropolitics (2019), adds a crucial dimension. Mbembe argues that the postcolony is characterized by a “commandment” that operates through the production of subjects who are simultaneously included and excluded, governed through technologies of surveillance and spectacle. His concept of necropolitics—the power to determine who may live and who must die—extends to the digital domain in the form of algorithmic governance, predictive policing, and the weaponization of information against marginalized populations. Mbembe’s more recent formulation of the “becoming black of the world” suggests that the techniques of domination historically applied to African populations are now being generalized globally through digital surveillance and cognitive warfare. From this vantage, the “brain as battlefield” is not a metaphor for a new kind of conflict but the universalization of a condition that African populations have long endured. The African perspective thus reveals what the Western framing of cognitive warfare as unprecedented obscures: that the weaponization of narrative and the manipulation of consciousness have deep colonial roots, and that the digital merely accelerates and scales pre-existing logics of domination.

Mamdani’s Citizen and Subject (1996) and Neither Settler Nor Native (2020) illuminate how digital identity systems reproduce colonial categories. Mamdani’s central argument—that colonial rule bifurcated the state into a “civil” sphere for citizens and a “customary” sphere for subjects—finds a digital analogue in contemporary biometric and digital ID systems. Kenya’s Huduma Namba, Nigeria’s National Identification Number, and similar programs across the continent create populations of “data subjects” whose legibility to the state is mediated by foreign technology providers and whose data is vulnerable to both state abuse and external extraction. The citizen/subject distinction is reproduced in digital form: those with robust digital identities access services and rights; those without are rendered invisible or, worse, targeted. Mamdani’s framework suggests that data governance in Africa is not merely a technical challenge but a continuation of the colonial project of making populations legible for control.

Oyěwùmí’s The Invention of Women (1997) contributes an epistemological critique that is essential to understanding cognitive warfare. Oyěwùmí demonstrated that the category “woman” as a social classification was not a universal discovery but a colonial imposition, produced through the translation of Yoruba social organization into European gender categories. The implication for digital governance is profound: the categories embedded in datasets, algorithms, and platform architectures—gender, race, ethnicity, religion—are not neutral descriptors but historically constructed classifications that carry colonial epistemologies. When these categories are operationalized in content moderation, targeted advertising, or disinformation campaigns, they reproduce and amplify colonial ways of seeing. The African perspective thus reveals that cognitive warfare is not only about manipulating what people think but about imposing the very categories through which thought is structured.

Tamale’s Decolonization and Afro-Feminism (2020) extends this by insisting that decolonization must be intersectional and that digital justice requires attention to whose voices are amplified and whose are silenced. Tamale’s framework suggests that the attention economy, which rewards engagement and outrage, systematically disadvantages African feminist and decolonial voices while amplifying sensationalist and divisive content. The “brain as battlefield” is thus also a gendered and racialized battlefield, in which the cognitive load of navigating misinformation falls disproportionately on populations already marginalized by colonial and patriarchal structures.

Bayart’s The State in Africa (1993) and his concept of extraversion provide a political-economy lens. Bayart argued that African states are not simply weak or failed but are “extraverted”—oriented toward external patrons and resources rather than domestic constituencies. In the digital domain, extraversion manifests as African elites who broker access to data, telecom licenses, and surveillance contracts with foreign powers, creating a political economy of digital dependency. The blurring of criminal and state action that characterizes cyber conflict globally is, in the African context, intensified by the fact that state and non-state actors are often entangled in networks of patronage and rent-seeking. Ransomware attacks on African hospitals and government systems, for instance, may involve actors with connections to political elites, making attribution and response doubly difficult.

Aning and Danso’s work on African security governance highlights the institutional gap between continental frameworks and national capacity. The African Union’s Peace and Security Council and the AU Convention on Cyber Security and Personal Data Protection (Malabo, 2014) represent attempts to construct a collective security architecture for the digital domain. Yet the Malabo Convention has been ratified by only a handful of states and has not entered into force, reflecting both capacity constraints and the political difficulty of harmonizing 54 national legal systems. Aning’s analysis suggests that African security governance is characterized by a persistent gap between normative ambition and operational capacity—a gap that external powers exploit. The AU framework contributes a vision of collective digital sovereignty, but its occlusion is the reality that most African states lack the technical, legal, and institutional capacity to implement it.

Grovogui’s Sovereigns, Quasi Sovereigns, and Africans (1996) and his subsequent work on regimes of sovereignty provide the theoretical foundation for understanding African cyber sovereignty claims. Grovogui argues that sovereignty is not a fixed legal status but a practice that is continually performed and contested, and that African states have historically been denied full sovereignty by a Eurocentric international order. In the digital domain, this means that African sovereignty claims—data localization, platform regulation, the Malabo Convention—are not merely technical policy choices but assertions of political subjectivity against a system that has historically treated African states as quasi-sovereign. Grovogui’s framework suggests that the African perspective on cyber sovereignty is not a defensive reaction to Western or Chinese dominance but an active project of reconstituting sovereignty on African terms.

The African perspective’s contribution to the five key ideas of this lesson is substantial and distinctive. On the grammar of cyber conflict, it reveals that the offense-defense balance is not a technical property of systems but a function of capacity asymmetry: African states cannot deter by punishment because they lack the offensive capacity and the attribution capability; their realistic option is deterrence by denial—resilience—but this requires investment that most states cannot afford. On critical infrastructure, it shows that the blurring of criminal and state action is intensified where state capacity is weak and criminal networks are entangled with political elites. On information warfare, it demonstrates that Africa is not merely a target but a theater in which multiple external powers—Russia, France, China, the United States—compete for influence through information operations, and that disinformation in African elections and conflicts often serves external geopolitical agendas. On cognitive warfare, it insists that the “brain as battlefield” is continuous with colonial psychological warfare and that the categories through which digital systems classify populations carry colonial epistemologies. On national doctrines, it presents the AU Malabo framework as an alternative doctrinal tradition—one oriented toward collective sovereignty, capacity building, and the regulation of external platforms rather than toward offensive operations or deterrence.

What the African perspective occludes is equally important. It may overstate the coherence of a unified “African” position when 54 states have divergent interests, capacities, and alignments. It risks justifying authoritarian information control under the banner of sovereignty, as when governments invoke “cyber sovereignty” to justify internet shutdowns during elections or protests. The low ratification of the Malabo Convention reflects not only external obstruction but also genuine political will gaps and capacity constraints among African states themselves. And the perspective may understate the agency of African populations in navigating, resisting, and repurposing digital technologies—African tech ecosystems, from Nairobi’s “Silicon Savannah” to Lagos’s fintech sector, demonstrate that digital dependency is not total. Nevertheless, the African vantage point contributes something the other four perspectives cannot: a demonstration that cyber, information, and cognitive warfare are not new domains of conflict but new modalities of an old struggle over sovereignty, knowledge, and the right to self-determination, and that any framework that treats them as unprecedented risks reproducing the very hierarchies it claims to analyze.

2.7.2 Chinese Perspective

The Chinese perspective on cyber, information, and cognitive warfare is organized around the concept of cyber sovereignty (wangluo zhuquan), which Xi Jinping articulated in his 2015 address at the World Internet Conference in Wuzhen and which has since become the organizing principle of Chinese internet governance. Cyber sovereignty asserts that states have the right to govern the internet within their territorial borders, to regulate data flows, and to determine the rules of digital engagement—a position that directly challenges the Western multistakeholder model and that resonates with African sovereignty claims even as it serves Chinese strategic interests. The 2016 Cybersecurity Law, the 2021 Data Security Law, and the 2021 Personal Information Protection Law constitute a legal architecture that treats data as a national strategic resource and that mandates localization, security review, and state oversight of critical information infrastructure.

The doctrinal foundation is the “three warfares” (san zhan): public opinion warfare, psychological warfare, and legal warfare. Originating in PLA political work doctrine and formalized in the 2003 and 2010 political work regulations, the three warfares represent an integrated approach to information operations that treats the cognitive, legal, and media dimensions as inseparable. Public opinion warfare seeks to shape domestic and international narratives; psychological warfare targets adversary morale and decision-making; legal warfare exploits international law and norms to constrain adversary action and legitimize Chinese positions. This doctrine is distinctive in its explicit integration of military and non-military means and in its treatment of information as a battlespace coequal with land, sea, air, and space. The PLA Strategic Support Force, established in 2015, and its successor the Information Support Force, established in 2024, institutionalize this integration.

The Chinese perspective contributes several elements that the other traditions understate. First, it offers a state-centric model of internet governance that treats digital infrastructure as a matter of national security rather than commercial convenience, a framing that has gained traction among developing states. Second, it provides a holistic view of information operations that does not separate “cyber” from “information” from “cognitive” warfare but treats them as a continuum—a view that aligns with the lesson’s own integration of these domains. Third, the Digital Silk Road and Huawei’s global infrastructure investments represent a material strategy for extending Chinese influence through the ownership of digital infrastructure, a form of structural power that operates below the threshold of traditional conflict.

The perspective’s occlusions are significant. China’s sovereignty rhetoric is asymmetric: it demands respect for its own information space while conducting extensive operations in others’. Attributed operations include APT41, Salt Typhoon (targeting US telecommunications), and Volt Typhoon (pre-positioning in US critical infrastructure). The Great Firewall and associated censorship apparatus demonstrate that cyber sovereignty, in practice, serves domestic political control as much as national security. The Chinese perspective also tends to frame Western accusations of Chinese hacking as hegemonic attempts to maintain information dominance, a move that deflects substantive engagement with evidence. On the five key ideas, China emphasizes defense and sovereignty while denying offensive intent; treats critical infrastructure protection as a national security priority; integrates information and cognitive warfare through the three warfares doctrine; and presents its approach as a model for developing states, contrasting with both US persistent engagement and EU regulatory frameworks.

2.7.3 Russian Perspective

The Russian perspective is rooted in a distinctive intellectual tradition that treats information not as a domain of conflict but as the substance of conflict itself. The 2016 Information Security Doctrine and its 2021 update define information as a strategic resource and identify threats not only to technical systems but to “spiritual and moral values,” cultural identity, and historical memory. This framing reflects a holistic conception in which cognitive, informational, and technical dimensions are inseparable—a view that predates and arguably anticipates Western “cognitive warfare” discourse.

The doctrinal lineage runs through reflexive control (refleksivnoe upravlenie), a concept developed by Soviet military theorists including Vladimir Lefebvre and formalized in the work of the Russian military. Reflexive control denotes the manipulation of an adversary’s decision-making process by shaping the information environment in which decisions are made—feeding false or misleading information that leads the adversary to choose actions favorable to the manipulator. This is, in essence, a theory of cognitive warfare developed decades before the term entered Western strategic discourse. The Gerasimov article of 2013, often (somewhat misleadingly) termed the “Gerasimov doctrine,” articulated a vision of “new generation warfare” in which non-military means—including information operations, economic pressure, and political subversion—could achieve objectives previously requiring military force, and in which the boundary between war and peace is deliberately blurred.

Russian practice reflects this doctrine. The Internet Research Agency’s operations during the 2016 US election, GRU units 26165 and 74455 (Fancy Bear and Sandworm), and the NotPetya attack of 2017 demonstrate a pattern of operations that exploit attribution ambiguity, leverage criminal and proxy networks, and target the cognitive dimension of adversary societies. The 2019 Sovereign Internet Law (Runet) and the associated technical infrastructure for isolating the Russian internet represent the defensive complement to this offensive posture—a recognition that information sovereignty requires both the capacity to project and the capacity to withstand.

The Russian perspective contributes a genuinely distinctive element: the insistence that information warfare is not a subset of cyber warfare but the broader category, of which technical cyber operations are one component. This inverts the Western framing, which tends to treat information operations as an application of cyber capability. The Russian view also emphasizes the moral and cultural dimension of conflict— the idea that adversary societies can be destabilized through the erosion of shared values and social cohesion—a dimension that Western technical frameworks often neglect. On the five key ideas, Russia rejects the “cyber war” framing in favor of “information war”; exploits attribution ambiguity as a strategic asset; treats disinformation and election interference as legitimate tools of statecraft; understands cognitive warfare through the lens of reflexive control; and presents its doctrine as a comprehensive alternative to Western deterrence frameworks.

The occlusions are equally significant. The defensive rhetoric of “information security” masks extensive offensive operations. The attribution ambiguity that Russia exploits is not merely a technical feature but a deliberate strategy of plausible deniability. The moral framing of information security—protecting “spiritual values”—serves to justify domestic censorship and the suppression of dissent. And the reflexive control tradition, while theoretically sophisticated, can overstate the controllability of adversary decision-making and understate the resilience of democratic societies.

2.7.4 Western Perspective

The Western perspective is characterized by a tension between two impulses: the desire to establish rules and norms for a domain that resists regulation, and the temptation to exploit the domain’s offensive potential. This tension is visible in the evolution of US doctrine from the restrained “cyber deterrence” frameworks of the 2010s to the more assertive “persistent engagement” and “defend forward” posture articulated in the 2018 US Cyber Command vision and the 2023 National Cybersecurity Strategy. The Western debate has been shaped by a series of influential interventions: Rid’s argument in “Cyber War Will Not Take Place” (2013) that cyber operations are better understood as sabotage and espionage than as war; Libicki’s analysis of the offense-defense balance and the difficulties of deterrence in cyberspace; and Singer and Brooking’s LikeWar (2018), which documented the weaponization of social media.

The Western perspective’s distinctive contributions include a robust technical and institutional capacity for attribution—exemplified by Mandiant’s 2013 APT1 report, which publicly attributed Chinese military hacking, and by subsequent US indictments of GRU officers. It includes NATO’s recognition of cyberspace as a domain of operations (2016) and the development of cyber-specific legal frameworks, from the Tallinn Manual to the EU’s NIS2 Directive, GDPR, Digital Services Act, and AI Act. The EU regulatory approach represents a distinctively European contribution: treating digital governance as a matter of market regulation and rights protection rather than purely military competition.

The Western self-critique is an essential component of this perspective. The Snowden revelations of 2013 exposed the scale of US and allied offensive cyber and surveillance operations, undermining claims to moral high ground. Stuxnet (2010) demonstrated that the United States and Israel had already crossed the threshold of using cyber weapons against critical infrastructure. The market-driven vulnerabilities of the Western information ecosystem—platform business models that reward engagement over accuracy, the concentration of infrastructure in private hands, the outsourcing of content moderation—represent structural weaknesses that adversaries exploit. Pomerantsev’s This Is Not Propaganda (2019) documented how the Western information environment’s openness, once considered a strength, has become a vulnerability.

On the five key ideas, the Western perspective centers on the grammar of cyber conflict (Rid, Libicki), treats critical infrastructure protection as a priority (CISA, sector-specific regulation), addresses information warfare through election security and platform governance, approaches cognitive warfare through the lens of the attention economy and platform regulation, and distinguishes between US persistent engagement and EU regulatory frameworks. Its occlusions include its own offensive practices, the escalation risks of forward operations, the market-driven vulnerabilities of its information ecosystem, and the tendency to frame Western norms as universal while exempting Western practice.

2.7.5 UN Perspective

The UN perspective presents doctrine through the language of norms, capacity building, and multilateral consensus. The framework rests on three pillars: the application of existing international law to cyberspace, the development of voluntary norms of responsible state behavior, and confidence-building measures and capacity building. The Group of Governmental Experts (GGE) produced consensus reports in 2013 (A/68/98), 2015 (A/70/174), and 2021 (A/76/135), establishing eleven voluntary norms—including that states should not conduct ICT activity that damages critical infrastructure, should not use proxies, should respond to requests for assistance, and should protect critical infrastructure. The Open-Ended Working Group (OEWG), established in 2018 and operating through 2021 and 2021-2025, broadened participation to include all UN member states, addressing the criticism that the GGE’s limited membership (initially 15, later 25 states) lacked legitimacy.

The UN perspective contributes a forum for dialogue that includes developing states, a baseline of expectations that even adversarial states have endorsed, and a capacity-building agenda that addresses the asymmetry in technical and institutional capacity. The 2015 GGE report’s affirmation that international law, including the UN Charter and international humanitarian law, applies to state use of ICTs was a significant achievement, establishing that cyberspace is not a lawless domain. The norms on critical infrastructure and on not using proxies provide reference points for assessing state behavior.

The occlusions are substantial. The norms are voluntary and lack enforcement mechanisms. The consensus requirement means that reports reflect the lowest common denominator, and the 2021 GGE failed to reach consensus on key issues, leading to the OEWG process. Power asymmetries mean that major powers treat norms as instrumental—endorsing them rhetorically while conducting operations that violate them. The capacity-building agenda, while valuable, risks treating symptoms (lack of capacity) rather than causes (structural inequality in the global digital economy). And the UN framework has been slower to address information and cognitive warfare than technical cyber operations, reflecting the difficulty of defining and regulating influence operations without impinging on legitimate expression.

On the five key ideas, the UN perspective affirms that existing international law applies to cyberspace (grammar), establishes norms on critical infrastructure protection (infrastructure), addresses information operations through norms on proxies and on not interfering in internal affairs (information warfare), has less developed frameworks for cognitive warfare (cognitive), and presents a normative baseline rather than a national doctrine (doctrines). The UN perspective’s value lies not in its enforcement power but in its provision of a shared vocabulary and a forum in which the other four perspectives must engage, however instrumentally.

SECTION 2.7.6 Comparison Matrix

SECTION 2.8 WORKED EXAMPLE (I do)

Case: Russian interference in the 2016 United States presidential election as a study in information operations

The 2016 US election is best understood not as a single cyberattack but as a layered information operation in which hacking, leaking, social-media manipulation, and narrative amplification were combined to shape perception, deepen polarization, and erode confidence in democratic institutions. The case matters for this lesson because it sits at the intersection of the five key ideas: it uses the grammar of cyber conflict without fitting neatly into war; it targets critical infrastructure only indirectly; it is a paradigmatic information-warfare case; it operates in the cognitive domain; and it reflects a distinctive national doctrine, Russian reflexive control, rather than a universal model of cyber conflict. The appropriate analytical task is to explain how the operation worked, why it was effective, and which perspective best captures its significance without collapsing into either alarmism or dismissal.

Levels of analysis

At the individual level, the operation exploited cognitive and social vulnerabilities rather than technical weaknesses in voting machines. Citizens encountered emotionally charged content through social-media feeds, group identities, and partisan media ecosystems. The mechanism was not simply persuasion in the classical sense but activation: content designed to resonate with pre-existing grievances, identities, and suspicions. Microtargeting, algorithmic amplification, and the use of seemingly authentic personas lowered the cost of reaching susceptible audiences. Individuals were not merely passive recipients; they became distribution nodes when they shared, commented, and argued. This is why the operation could be effective even where no single message was decisive: it worked cumulatively, through repetition, emotional salience, and the erosion of shared epistemic standards. Singer and Brooking’s (2018) discussion of “like war” is useful here because it captures the way attention, virality, and platform incentives turn individual engagement into strategic effect.

At the state level, the operation must be situated in Russian state objectives and in the structure of the US political system. Russian military and intelligence traditions, including reflexive control, treat information as a means of shaping an adversary’s decision-making without requiring conventional military confrontation. The aim was not necessarily to install a predetermined outcome by direct vote manipulation, but to weaken the adversary, exploit internal divisions, and reduce the legitimacy of the incoming administration. The US state, for its part, faced a dilemma: attribution was technically and politically complex, responses risked escalation, and the most damaging effects were occurring inside a privately governed information environment. The state level therefore reveals a governance gap: democratic states depend on platforms they do not control, while adversaries can exploit that dependence. Pomerantsev (2019) is relevant because his work on propaganda emphasizes that modern information operations often succeed not by convincing everyone of a lie but by creating confusion, cynicism, and the sense that all narratives are equally manipulative.

At the systemic level, the case reflects the post-Cold War US-Russian rivalry, the absence of agreed cyber norms, and the difficulty of applying deterrence to information operations. Traditional deterrence assumes identifiable attacks, clear attribution, and proportionate response. Information operations blur these assumptions: they are continuous, often plausibly deniable, and can be framed as journalism, activism, or ordinary political speech. The systemic consequence was not a direct military confrontation but a crisis of confidence in democratic procedures and in the legitimacy of electoral outcomes. This is consistent with Rid’s (2013) argument that much of what is called cyber war is better understood as sabotage, espionage, or subversion; the 2016 case is subversion through information rather than war in the Clausewitzian sense. The systemic level also shows how norms of non-interference, affirmed in UN processes, are strained when operations are conducted through proxies, platforms, and deniable actors.

At the transnational level, the case cannot be explained by states alone. The Internet Research Agency, GRU-linked hacking, WikiLeaks releases, and platform algorithms formed a transnational chain. Data, personas, and narratives moved across borders faster than institutions could respond. Social-media platforms functioned as transnational infrastructures with their own incentives, moderation capacities, and business models. This level reveals that information warfare is not merely state-to-state competition; it is mediated by corporate platforms, technical standards, and global communication networks. The transnational dimension also explains why purely national responses are insufficient: even a well-defended state can be affected by content generated, amplified, and monetized elsewhere.

Mechanism

The mechanism combined three channels. First, hacking and leaking: GRU-linked actors compromised Democratic National Committee and campaign-related accounts, and selected materials were released through intermediaries at politically sensitive moments. The strategic value lay less in the content’s novelty than in timing, framing, and the creation of a sustained scandal narrative. Second, social-media manipulation: the Internet Research Agency created fake personas and groups, amplified divisive content, organized online and sometimes offline events, and exploited platform recommendation systems. Third, narrative laundering: information moved from hacked material to partisan media, social networks, and mainstream coverage, making state-originated content appear organic. The operation’s power came from interaction effects: hacked material gave credibility to conspiracy narratives; fake personas gave scale to fringe claims; platform algorithms rewarded outrage; and polarized audiences did much of the distribution themselves. Deterrence by punishment was weak because attribution was delayed and because the operation’s effects were diffuse. Deterrence by denial was also weak because the target was not a network to be hardened but a public sphere to be influenced. This is a key reason the case challenges the standard grammar of cyber conflict: the decisive effects were cognitive and political, not technical.

Perspective reconstruction

The African perspective, reconstructed on its own terms, begins from the observation that information warfare is not a novelty invented in the North Atlantic but a long-standing feature of imperial and post-colonial politics. African scholarship on sovereignty, extraversion, and the colonial state—associated with Grovogui, Bayart, Mamdani, Rodney, and others—suggests that control over information has always been central to domination, from colonial propaganda and radio to Cold War coups and contemporary digital extraction. From this vantage, the 2016 US election is not an unprecedented rupture but a visible instance of techniques that have long been tested in weaker states: the manipulation of perception, the exploitation of institutional fragility, and the use of external actors to shape domestic outcomes. The African perspective also highlights asymmetry: African states and societies are often treated as objects of information operations, data extraction, and platform experimentation, while great powers discover vulnerability only when operations reach their own capitals. It further insists that African agency matters: journalists, civil society, and regional institutions have developed practices of verification and resistance that are not captured by Northern security frameworks. The Malabo Convention and debates over data localization express an attempt to reclaim digital sovereignty, but they also reveal a tension between state control and citizen protection. What the African perspective contributes is a longue durée and a decolonial critique: it shows that the “crisis” of 2016 is partly a crisis of Northern exceptionalism, in which techniques long normalized in the global South are suddenly recognized as threats when they affect great powers. What it can miss, if taken alone, is the specific tradecraft of the Russian operation and the particular vulnerabilities of the US electoral and media system.

The Chinese perspective interprets the case through information security and cyber sovereignty. It tends to see the US as simultaneously the architect and victim of an open information order: American platforms dominate global communication, while American political institutions proved vulnerable to manipulation. From this view, 2016 demonstrates the dangers of unmanaged information flows and justifies state-led governance of the information space. The Chinese perspective contributes an awareness of platform power as geopolitical power, but it occludes the difference between protecting citizens and protecting the state, and it can treat all foreign information influence as equivalent to subversion.

The Russian perspective treats the case as an example of reflexive control and strategic competition in the information domain. It would emphasize that information has always been contested, that Western states conduct their own influence operations, and that the US response reflects an inability to accept vulnerability. This perspective contributes a theory of how perception can be shaped without direct coercion, but it occludes accountability, denies or minimizes state responsibility, and normalizes the erosion of democratic trust as an acceptable instrument of policy.

The Western perspective frames the case as an attack on democratic self-determination and as evidence that deterrence frameworks are inadequate for information operations. It contributes attribution, legal accountability, and institutional reform, including election-security measures and platform scrutiny. Its self-critique is important: Western states have conducted information operations, surveillance, and covert action, and platform business models amplified the harm. What it can miss is its own tendency to treat 2016 as exceptional rather than as part of a broader pattern of global information manipulation, and to underweight the role of domestic inequality and polarization in making the operation effective.

The UN perspective frames the case as a violation of sovereignty and non-interference, even where operations are conducted through proxies and digital means. It contributes a normative baseline and a forum for dialogue, including GGE and OEWG processes that affirm existing international law applies to cyberspace. Its limitation is enforcement: norms without verification and consequence may be acknowledged rhetorically while being ignored operationally. The UN perspective also struggles to define where legitimate international persuasion ends and prohibited interference begins, especially in an era of global media and diaspora politics.

Explicit adjudication

No single perspective fully explains the 2016 case. The Russian perspective best explains the operational logic: reflexive control, deniability, and the strategic use of information to shape adversary decision-making. The Western perspective best explains the harm: the damage to democratic legitimacy, the need for attribution, and the inadequacy of deterrence. The transnational analysis best explains the mechanism: the operation succeeded because state tradecraft was amplified by platform architecture and by domestic polarization. The African perspective best explains the global significance: it situates the case within a longer history of information domination and reveals the double standard by which great powers recognize as crisis what weaker states have long endured. The Chinese perspective best explains the structural power of platforms but overreaches when it equates openness with vulnerability and state control with security. The UN perspective provides the necessary normative vocabulary but lacks the capacity to adjudicate competing claims.

On balance, the strongest explanation is a layered one: Russian doctrine supplied intent and method; transnational platforms supplied reach and amplification; US domestic polarization supplied susceptibility; and weak norms supplied impunity. The Russian perspective is therefore the best single account of why the operation took the form it did, but it is the least adequate account of its legitimacy and consequences. The African perspective is the best corrective to Northern exceptionalism, yet it is less precise about the specific tradecraft. The Western perspective is indispensable for accountability but risks overstating novelty and understating complicity. The most defensible conclusion is that 2016 was not an anomaly in cyber conflict but an illustration of how information operations exploit the gap between technical security, cognitive vulnerability, platform governance, and international law.

SECTION 2.9 PROBLEM PAIR (We do)

Case: The 2010 Stuxnet attack on Iran’s Natanz facility — how does it fit or break the grammar of cyber warfare?

Tasks

1. Level of analysis. Identify the level or levels at which Stuxnet operates using the Lesson 1 framework (individual, state, systemic, transnational). Explain why a malware operation that crosses all four levels strains that framework, and specify which level you think is analytically decisive for explaining the operation’s success.

2. Offense-defense balance. Reconstruct the argument about whether Stuxnet demonstrates offense dominance in cyber conflict or the opposite. Draw on Rid (2013) and the grammar of cyber conflict (attribution problems, deterrence by denial versus punishment). Specify the scope conditions under which your conclusion holds.

3. Attribution and deterrence. How was Stuxnet attributed to US and Israeli actors, what evidentiary basis supported that attribution, and what does the case imply for deterrence by punishment? Distinguish between technical attribution, political attribution, and legal attribution.

4. Theory fit. Evaluate whether Stuxnet is better understood as cyber warfare, sabotage, or coercion (L20). For each candidate theory, state which scope conditions Stuxnet satisfies and which it violates. Adjudicate on the basis of evidence.

5. Five-perspective reconstruction. In 3–5 sentences each, reconstruct how the African (Malabo Convention sovereignty concerns), Chinese (cyber sovereignty, three warfares), Russian (information security doctrine, reflexive control), Western (persistent engagement, self-critique), and UN (GGE norms) perspectives would each interpret Stuxnet.

6. Falsification. State what evidence would have to emerge to overturn the consensus that Stuxnet was a state operation, and explain what such evidence would imply for the “blurring of criminal and state action” thesis and for the state-centric grammar of cyber conflict.

Model Answer

The Stuxnet operation against Iran’s Natanz enrichment facility in 2010 is the canonical case that both confirms and complicates the grammar of cyber conflict. At the level of analysis, Stuxnet is irreducibly transnational: the malware was designed in one jurisdiction, propagated through global supply chains and removable media, executed against Iranian industrial control systems, and attributed—through forensic analysis and investigative reporting—to a US-Israeli joint program. This transnationality strains the Lesson 1 framework because the operation’s causal chain cannot be localized to a single state actor; the “state” that acted was a coalition operating through intelligence agencies, private contractors, and commercial software vendors. The individual level matters too: the operation required engineers who understood Siemens Step 7 and centrifuge physics, meaning that human capital, not just code, was the scarce resource. The analytically decisive level is transnational, because the operation’s feasibility depended on globalized supply chains and cross-border technical expertise that no single state could monopolize.

On the offense-defense balance, Stuxnet cuts both ways. Rid (2013) argues that cyber operations are closer to sabotage than to war, and Stuxnet’s extended development cycle, its need for zero-day exploits, and its dependence on physical access via infected removable media all suggest that offense is expensive and contingent rather than dominant. Yet the operation succeeded in destroying roughly one-fifth of Iran’s centrifuges while remaining covert for over a year, which suggests that a well-resourced attacker can achieve strategic effects with plausible deniability. The scope condition for offense dominance appears to be resource asymmetry: states with advanced signals intelligence and industrial-control-system expertise can penetrate air-gapped networks, but this is not a generalizable capability. Deterrence by denial—hardening Natanz’s network segmentation—was partially effective in that Iran eventually detected the intrusion, but only after significant damage. Deterrence by punishment was unavailable to Iran in 2010 because attribution was uncertain and retaliation options were limited; Iran’s later cyber operations against Saudi Aramco and US financial institutions can be read as delayed, imprecise punishment, illustrating the temporal lag that weakens cyber deterrence.

Attribution of Stuxnet rested on code similarities to other operations, the use of stolen digital certificates, and investigative journalism rather than on any state admission. This matters for deterrence theory: punishment requires that the target know who attacked it, and Stuxnet’s attribution was probabilistic and contested for years. The operation thus supports the claim that attribution problems are structural in cyber conflict, not merely technical gaps awaiting better forensics.

Whether Stuxnet is cyber warfare, sabotage, or coercion depends on definitional scope. As warfare, it lacks the violence that Clausewitzian frameworks require; Rid (2013) would classify it as sabotage. As coercion, it fits the logic developed in L20: it was designed to degrade Iran’s bargaining position in nuclear negotiations by raising the cost of enrichment, and it was accompanied by diplomatic pressure. The strongest fit is with sabotage-plus-coercion: a covert operation intended to alter an adversary’s cost-benefit calculus without triggering armed conflict. It breaks the “war” framing because no state acknowledged it and no kinetic response followed.

The five perspectives diverge sharply. The African vantage, informed by the AU Convention on Cyber Security and Personal Data Protection (Malabo, 2014), would read Stuxnet as a precedent for violating sovereignty through code: if a state can destroy another’s infrastructure remotely, then data localization and sovereign control over critical information infrastructure become security imperatives rather than merely economic preferences. The Chinese perspective, articulated through the “three warfares” doctrine and cyber sovereignty, would emphasize that Stuxnet demonstrates the need for national control over information infrastructure and would likely support Iran’s position that the operation violated sovereignty. The Russian perspective, grounded in information security doctrine, would treat Stuxnet as evidence that Western states weaponize information technology while framing their own operations as defensive; reflexive control would suggest that the operation aimed to shape Iranian decision-making about the nuclear program. The Western perspective, particularly the US doctrine of persistent engagement, would read Stuxnet as a successful application of “defend forward” logic—disrupting threats before they materialize—while its self-critical strand would note that the operation’s eventual discovery and the proliferation of its techniques into later malware illustrate the blowback risks of offensive cyber operations. The UN perspective, reflected in the GGE consensus reports (2013, 2015, 2021), would stress that Stuxnet occurred in a normative vacuum: the GGE’s later affirmation that international law applies to cyberspace was partly a response to operations like Stuxnet, and the 2021 report’s emphasis on critical infrastructure protection reflects the lesson that covert sabotage of nuclear facilities threatens international stability.

Falsification of the state-operation consensus would require evidence that a non-state actor—criminal, terrorist, or corporate—developed and deployed Stuxnet independently. Such evidence would not merely revise attribution; it would undermine the “blurring of criminal and state action” thesis by showing that the operation was criminal rather than state-sponsored, and it would force a re-evaluation of whether the grammar of cyber conflict is state-centric at all. Absent such evidence, Stuxnet remains the boundary case that defines the field: an operation that was strategic in effect, covert in execution, and ambiguous in legal status.

SECTION 2.10 INDEPENDENT MEMO (You do)

(a) Case description. In December 2020, a supply-chain compromise of the SolarWinds Orion network management platform was disclosed, affecting an estimated 18,000 organizations including multiple US government agencies and Fortune 500 companies. The intrusion, attributed by US intelligence to Russia’s Foreign Intelligence Service (SVR), had persisted undetected for approximately nine months, during which attackers accessed email systems and, in some cases, moved laterally into classified networks. The operation involved no destructive payload; instead, it was a sustained espionage campaign conducted through a trusted software update channel. The case raises questions about whether supply-chain compromise constitutes warfare, espionage, or something in between, and about the adequacy of existing deterrence frameworks when the attacker’s objective is intelligence collection rather than disruption. It also tests the limits of attribution: the US government formally attributed the operation to Russia, but attribution rested on intelligence community assessment rather than on publicly verifiable forensic evidence, and no state has been held legally accountable.

(b) Required memo headings (use as prompts):

• Mechanism: Identify the causal mechanism linking the SolarWinds compromise to its strategic effects. Specify the level of analysis at which the mechanism operates, the scope conditions under which it functions, and what would have to be true for the mechanism to fail.

• Perspective reconstruction: Reconstruct how each of the five perspectives (African, Chinese, Russian, Western, UN) would interpret the SolarWinds case. For each, state what it contributes and what it occludes.

• Historical analogue: Identify one historical case (pre-2010 or non-cyber) that shares the mechanism you identified, and specify the respects in which the analogy holds and breaks down.

• Falsifiers: State at least two pieces of evidence that, if they emerged, would overturn your central claim about the case. Explain what each would imply for your mechanism and for the broader theory.

(c) Self-check: Before submitting, verify that you have distinguished description (what happened), explanation (why it happened), prediction (what will happen next), and prescription (what should be done) as four separate operations, and that no section conflates them.

SECTION 2.11 HINGE QUESTION

Question: Which of the following best captures the central theoretical lesson of the Stuxnet case for the grammar of cyber conflict?

A. Stuxnet proves that cyber offense is always dominant because malware can destroy physical infrastructure.

B. Stuxnet demonstrates that attribution is impossible in cyberspace, making deterrence by punishment permanently unworkable.

C. Stuxnet shows that cyber operations can achieve strategic effects only under narrow scope conditions—high resource asymmetry, physical access, and extended preparation—while remaining legally and politically ambiguous.

D. Stuxnet confirms that cyber warfare is simply a new domain of conventional war governed by existing jus in bello rules.

Distractor diagnoses:

• A is wrong because it overstates offense dominance. Stuxnet required an eighteen-month development cycle, zero-day exploits, stolen digital certificates, and physical access via removable media. Offense was expensive and contingent, not automatic; the case supports Rid (2013) in showing that cyber operations are closer to sabotage than to war, and that offense dominance holds only under conditions of extreme resource asymmetry.

• B is wrong because it conflates difficulty with impossibility. Attribution of Stuxnet was probabilistic and contested for years, but it was eventually achieved through forensic analysis and investigative reporting. The case supports the claim that attribution problems are structural, not that they are insurmountable; deterrence by punishment is weakened and delayed, not permanently unworkable.

• C is correct. Stuxnet achieved strategic effects (destruction of roughly one-fifth of Iran’s centrifuges) only under narrow scope conditions: advanced signals intelligence, industrial-control-system expertise, physical access, and an extended preparation period. It remained legally and politically ambiguous because no state acknowledged it and no kinetic response followed, illustrating the gap between strategic effect and legal status that defines the grammar of cyber conflict.

• D is wrong because it ignores the central debate. Rid (2013) argues that cyber war will not take place, and the UN GGE process (2013, 2015, 2021) has struggled to establish that existing international law fully governs cyber operations. Stuxnet’s covert, unacknowledged character and the absence of a kinetic response demonstrate that cyber operations do not map neatly onto conventional war’s legal and political categories.

SECTION 2A — DATA LAB

Table 1 — Significant cyber incidents by target category and suspected actor type (CSIS chronology, 2005–2024; indicative patterns, not exhaustive counts)

Data note: CSIS-style chronologies are event-driven and Western-reporting heavy; absence of an incident is not evidence of absence, and attribution labels often reflect intelligence assessments rather than adjudicated findings.

Table 2 — Disinformation campaign estimates and themes (EU DisinfoLab and adjacent platform/government reporting; indicative ranges)

Data note: Reach estimates are not comparable across platforms; “impressions” are not beliefs, and takedown counts measure enforcement capacity as much as campaign scale.

Table 3 — State-linked and state-adjacent APT ecosystem (MITRE ATT&CK groups, vendor reporting, and public indictments; qualitative mapping)

Data note: APT labels are vendor conventions; clusters merge, split, and rebrand. Public attribution is politically consequential and should be treated as evidence, not as a neutral fact.

Five numbered analysis questions

1. Trend. How has the distribution of significant cyber incidents shifted between 2005 and 2024—from espionage and data theft toward disruption, extortion, and influence operations—and what mixture of technological change, criminal business models, and geopolitical rivalry best explains that shift?
2. Level of analysis. Using the four levels (individual, state, systemic, transnational), which level best explains the 2010 Stuxnet attack on Natanz, and which level is most often underweighted in popular accounts of cyber warfare?
3. Perspective reconstruction (all five). Reconstruct one incident—such as a ransomware attack on a hospital or an election-interference operation—from the African, Chinese, Russian, Western, and UN vantage points: what does each perspective render visible, and what does it occlude?
4. Interpretation. Does the blurring of criminal ransomware and state-linked hacking strengthen deterrence by punishment, weaken it, or transform it into a problem of attribution and jurisdiction?
5. Limitation. What are the three most serious validity threats in CSIS incident chronologies, EU DisinfoLab campaign estimates, and APT taxonomies, and how would you triangulate across them without overstating certainty?

SECTION 3 — DUAL-CODED VISUAL ANCHOR

Visual 1 — “The grammar of cyber conflict” (hand-drawn on A4 or whiteboard)

• Shapes to draw: Draw a large rectangle as the “conflict space.” Inside it, draw a horizontal axis labeled “Attribution confidence” (low on the left, high on the right) and a vertical axis labeled “Escalation risk” (low at the bottom, high at the top). Draw a diagonal dashed line from lower-left to upper-right labeled “Attribution gap.”
• Zones: In the lower-left, draw a shaded oval labeled “Deterrence by denial (resilience, patching, redundancy).” In the upper-right, draw a shaded oval labeled “Deterrence by punishment (retaliation, sanctions, counter-operations).” In the middle, draw a hatched band labeled “Ambiguity zone: plausible deniability.”
• Labels to place: “Stuxnet (high capability, contested attribution),” “Hospital ransomware (criminal/state blur),” “Election interference (narrative, not kinetic),” “Attribution threshold,” “Escalation ladder.”
• Perspective overlay: Annotate the left side with “African: sovereignty and capacity gaps”; the top with “Russian: information security and reflexive control”; the right with “Western: deterrence and attribution”; the bottom with “Chinese: cyber sovereignty and three warfares”; and the center with “UN: GGE norms and OEWG process.”

Visual 2 — “Blurring of criminal and state action” (hand-drawn Venn diagram)

• Shapes to draw: Draw three overlapping circles. Label the left circle “State intelligence / military cyber units,” the right circle “Criminal ransomware and fraud networks,” and the bottom circle “Proxy, patriotic, or tolerated hackers.”
• Overlap labels: Label the center intersection “Plausible deniability / shared tooling / shared infrastructure.” Label the state-criminal overlap “State tolerance or direction.” Label the state-proxy overlap “Patriotic mobilization.” Label the criminal-proxy overlap “Access-as-a-service / initial access brokers.”
• Arrows and notes: Draw arrows from the center to four boxes labeled “Attribution problem,” “Jurisdiction problem,” “Escalation control,” and “Victim harm.” Add a small box labeled “Ransomware-as-a-service (RaaS)” pointing into the criminal circle.
• Perspective overlay: Annotate the state circle with “Russian/Chinese: information security and sovereignty”; the criminal circle with “Western: law enforcement and sanctions”; the proxy circle with “African: capacity and legal harmonization gaps”; and the center with “UN: norms against harmful ICT activity.”

Visual 3 — “Cognitive warfare funnel: the brain as battlefield” (hand-drawn funnel with feedback loops)

• Shapes to draw: Draw a wide funnel at the top narrowing to a point at the bottom. At the top, draw a cloud labeled “Attention economy (platforms, algorithms, outrage).” In the upper-middle, draw a box labeled “Narrative injection (disinformation, memes, leaks).” In the lower-middle, draw a box labeled “Emotional salience and identity threat.” At the bottom, draw a circle labeled “Belief and behavior change.”
• Feedback loops: Draw curved arrows from the bottom circle back to the top cloud labeled “Polarization increases engagement” and “Distrust increases susceptibility.” Draw a side arrow from the narrative box to a small box labeled “Policy response / counter-narrative.”
• Labels to place: “Reach ≠ persuasion,” “Algorithmic amplification,” “Micro-targeting,” “Cognitive load,” “Resilience and media literacy,” “Democratic trust.”
• Perspective overlay: Annotate the top with “Chinese: information dominance and three warfares”; the middle with “Russian: reflexive control and active measures”; the bottom with “Western: deterrence, resilience, and platform governance”; the side arrow with “UN: human rights and information integrity”; and the feedback loops with “African: digital sovereignty, data localization, and AU cyber norms.”

SECTION 4 — CORNELL NOTES

Source log: Rid (2013); Singer and Brooking (2018); Pomerantsev (2019); Heickerö (2022); UN GGE consensus reports (2013, 2015, 2021); AU Convention on Cyber Security and Personal Data Protection (Malabo, 2014); CSIS significant cyber incident chronology; EU DisinfoLab reports; MITRE ATT&CK group documentation.

Summary: Cyber, information, and cognitive warfare are best understood as overlapping domains with distinct mechanisms: technical exploitation, infrastructure disruption, narrative manipulation, and attention capture. Their effects depend on attribution uncertainty, doctrinal framing, and the social context of the target. African, Chinese, Russian, Western, and UN perspectives disagree not only about solutions but about what counts as the primary threat. The 2016 US election case shows that major strategic effects can occur without physical destruction, while Stuxnet shows that physical effects can occur without declared war.

SECTION 5 — FEYNMAN COMPRESSION

1. Explain without jargon. Cyber warfare is when states or state-like actors use computers to spy, break things, steal money, or change what people believe. Information warfare is when they use stories, leaks, and fake accounts to shape public opinion. Cognitive warfare is when they target how people pay attention and what they trust. The hard part is knowing who did it, deciding how to respond, and avoiding escalation.
2. Mark gaps. I am unsure where criminal ransomware ends and state warfare begins; I also tend to treat “disinformation” as persuasion even though reach does not prove belief change. I need to keep separate: access, effect, attribution, and political outcome.
3. Reread verification. Rechecking the sources confirms that Rid (2013) warns against inflating cyber war; Singer and Brooking (2018) emphasize normalization; Pomerantsev (2019) emphasizes industrialized deception; Heickerö (2022) helps compare doctrines; and the UN GGE reports (2013, 2015, 2021) frame norms rather than enforcement.
4. Analogy with explicit limits. Cyber conflict is like burglary in a neighborhood where the burglar can wear many disguises: better locks help (denial), but catching and punishing the burglar requires evidence (attribution). The analogy fails because digital tools can be copied instantly, effects can cascade across borders, and “locks” are often maintained by private companies rather than police.
5. Rewrite. Cyber, information, and cognitive warfare are distinct but interacting mechanisms—technical access, infrastructure disruption, narrative manipulation, and attention capture—whose strategic meaning depends on attribution, doctrine, and social context. Deterrence by denial and deterrence by punishment are not interchangeable; the former works under uncertainty, while the latter requires credible attribution. National doctrines differ in what they treat as the battlefield: systems, information environments, or cognition itself. The African perspective adds that sovereignty, capacity, and data governance are not secondary issues but central to how cyber conflict is experienced and regulated.

SECTION 6 — SPACED-REPETITION FLASHCARDS

SECTION 7 — METACOGNITIVE CALIBRATION

7.1 Confidence audit table (scored 0-100)

7.2 Three-question debrief

1. Which concept did I explain most confidently, and what evidence supports that confidence rather than familiarity?
2. Where did my explanation collapse into description of events rather than identification of mechanism?
3. Which perspective did I underweight, and what evidence or case would force me to revise my adjudication?

7.3 Error-log table

SECTION 8 — CHEATSHEET

SECTION 9 — REVIEW SCHEDULE

• R1 — Within 24 hours: Reconstruct the five key ideas from memory without notes; then check against the lesson and correct gaps in the error log.
• R2 — Within 72 hours: Redraw the three visual anchors from memory and explain Stuxnet using the four levels of analysis.
• R3 — Within 1 week: Write a short memo on the 2016 US election case, including perspective reconstruction for all five traditions and an explicit adjudication.
• R4 — Within 2 weeks: Analyze the CSIS and EU DisinfoLab data, identifying one trend, one anomaly, and one limitation for each dataset.
• R5 — Within 1 month: Teach the distinction between cyber warfare and information warfare to a peer, then update the confidence audit and error log.

SECTION 10 — COMPLETION CHECKLIST

• I can define offense-defense balance and name two scope conditions.
• I can explain why attribution is both technical and political.
• I can distinguish deterrence by denial from deterrence by punishment.
• I can explain how ransomware blurs criminal and state action.
• I can distinguish cyber warfare from information warfare.
• I can define cognitive warfare and explain the attention-economy mechanism.
• I can compare US persistent engagement and Chinese three warfares.
• I can explain Russian reflexive control as a doctrinal tradition.
• I can summarize the EU regulatory approach.
• I can state what the UN GGE reports do and do not enforce.
• I can explain the African perspective on cyber sovereignty and Malabo 2014.
• I can apply the four levels of analysis to Stuxnet.
• I can reconstruct all five perspectives on the 2016 US election case.
• I can identify at least one falsifier for a major claim in this lesson.
• I can distinguish description, explanation, prediction, and prescription in my memo.
• I have updated my confidence audit and error log.
• I can explain one limitation of the CSIS or EU DisinfoLab data.
• I can state the core claim of Rid (2013) and one major critique of it.

FURTHER READING (Optional)

• Cyber war debate: Rid (2013), Cyber War Will Not Take Place.
• Information operations: Singer and Brooking (2018), LikeWar.
• Propaganda and cognition: Pomerantsev (2019), This Is Not Propaganda.
• Cyber operations and legal thresholds: Heickerö (2022).
• UN cyber norms: UN GGE consensus reports (2013, 2015, 2021).
• African cyber governance: African Union Convention on Cyber Security and Personal Data Protection (Malabo, 2014).
• Incident data: CSIS Significant Cyber Incidents (2005-2024).
• Disinformation estimates: EU DisinfoLab campaign reports and datasets.
• Doctrinal comparison: US, Russian, Chinese, and EU cyber and information-security doctrine documents.
• Critical infrastructure and ransomware: Case studies of state-linked and criminal cyber operations against infrastructure.

End of Lesson 24. Say Next when you are ready.