– It’s a bit surprising that we haven’t seen major Russian cyber activity on critical infrastructure in the West, Lothar Fritsch, professor in the Information Technology Department at OsloMet, told Dagbladet.

Russia’s invasion of Ukraine has left the country now suffering massive sanctions from the West. In addition, the business community and civil society around the world have launched comprehensive, far-reaching boycotts.

Russia may choose to respond to the West with cyber attacks. But so far it’s quiet on that front.

The reason for this is not the lack of Russian capacity, Fritsch said.

He cautioned that several NATO reports have shown that Russia has feared special units that have a high degree of expertise in cyber attacks.

– Some hacker groups may be organized under defense or secret services. We know, among other things, that there are one or two units under the FSB (Russian federal security service), which were shown after the major attack in Ukraine, Fritsch explained.

No longer neutral

Until recently, the internet had been largely a neutral arena in war. But wars so far have revealed that many countries are willing to give up pre-established norms.

Recently, Finland and Sweden, among others, abandoned the principle of neutrality to contribute to arms deliveries.

– Therefore, there is good reason to believe that one would also reject some of the dogmas that the internet is an unshakable and neutral technology, said the professor.

He still believes that there is a large threshold that keeps Russia from keeping their hackers:

– In defense policy, digital attack is considered an act of war. If you attack the digital battlefield, it could trigger this NATO defense case, Fritsch said.

In early March, NATO chief Jens Stoltenberg stated that a cyber attack could trigger Article 5 of the NATO pact. This article states that an attack on a NATO country will be considered an attack on the entire alliance.

Unclear law

Fritsch at OsloMet also points out that the laws surrounding cyber warfare are unclear. There is no clear definition of the type of digital attack that counts as actual warfare.

– This is a gray zone, he concludes.

He was supported by Mass Soldal Lund, professor in the School of Cyber ​​Engineering under Armed Forces College. Lund explains that the assessment of what counts as a military strike is about consequences more than methods.

– If a digital attack carried out by the state or on behalf of the state causes loss of life or substantial material damage, it can be considered an act of war. But that was because of the effect of the attack. That the attack was digital would be secondary.

– Very impossible

Nor is it sufficient for member states to claim to have been exposed to acts of war, Lund explained.

– NATO is based on consensus and it is unlikely that NATO will rally around a full-scale war against Russia based on a digital strike with limited consequences.

Despite the fact that no major cyber-operations have been carried out by the authorities, IT professor Fritsch is aware that several small attempts of cyberattacks by private individuals have been registered in Russia.

He said that, among other things, activity had been observed with simple attack tools. It is not believed to be linked to the Russian authorities, but is used by committed individuals who throw themselves into the conflict.

– Primitive level

Russia has not been spared such small attacks either. The online community Anonymous, a group of well-known private hackers from around the world, initially declared war on Putin.

Among other things, they for a short time took the website of the state media house. However, this attack had a limited effect, the professor believed.

– There are attacks at a very primitive level. If one wants to succeed with a big attack, it takes a lot of time and a lot of resources, he explains and outlines:

In this case, you will have to hack a lot of computers and install specially crafted malicious software, preferably several years in advance to build up sufficient capacity for a malicious attack.