25 January 2025

The Forgotten War: Ransomware and Cyber Conflict Studies

Sara Seppanen & Jamie MacColl

Hostile cyberattacks on hospitals, energy infrastructure, and strategic ports. Retaliatory offensive cyber operations carried out by Five Eyes members. Ransomware bears many of the hallmarks of the kind of cyber conflict long imagined by academics, military planners, and policymakers, albeit one waged primarily by law enforcement agencies and financially motivated criminals rather than cyber commands. Indeed, the FBI recently announced that its agents have conducted over 30 disruption operations against ransomware criminals in 2024 alone, emphasising the importance of ransomware as a strategic challenge.

Despite this, scholars of cyber conflict largely overlook ransomware. This leaves policy debates about ransomware poorer. Given the increasing use of offensive cyber operations and other tools of statecraft in counter ransomware strategies, more scholars should seek to interrogate the assumptions and concepts that underpin their implementation.

Ransomware in cyber conflict studies

Historically, strategic studies has focused on cyber competition and conflict in interstate relations. Academics are split between framing cyber operations as an intelligence contest or using the US-driven lens of persistent engagement. This literature has successfully tempered inflated expectations about one-off, strategically decisive cyberattacks, and helped re-orient policymaking and the study of cyber conflict towards an approach focusing on the cumulative effects of campaigns. However, these debates remain narrowly tailored to state-centred dynamics.

No comments: