WHO CONTROLS HYBRID WARFARE?

Modern conflict does not always begin with an invasion.

It may begin when a municipality loses control of its water pumps. When refrigeration systems fail across supermarkets. When hospitals cannot access laboratory services. When communications networks become unreliable. When fabricated information spreads faster than institutions can respond.

These events may have different causes and perpetrators. But together they reveal the vulnerability of highly interconnected societies.

Hybrid warfare describes the coordinated use of military and nonmilitary instruments to exploit vulnerabilities in an adversary's institutions, infrastructure, economy, and social cohesion. The term names a method, not a new phenomenon: states have long fought below the threshold of open war. What is new is the attack surface. A century of electrification, mechanized water, industrial refrigeration, networked logistics, and platform-mediated public attention has moved the essential functions of civilian life onto systems that can be reached, disrupted, and — in documented cases — operated against, from anywhere in the world.

DSC uses NATO's hybrid-threat framework as a foundational reference for vocabulary and scope. Using a reference is not adopting a position: NATO's institutional framework serves alliance defense, and this investigation distinguishes that institutional position from independent academic and legal analysis throughout. The subject is not alliance policy. The subject is the condition of free societies whose physical and informational infrastructure can be turned against them.

One caution governs everything that follows. A society can be destabilized through the systems that sustain its physical existence and the information environments through which its people understand reality — and precisely because that premise is alarming, this investigation holds a strict line between the documented and the speculated. Not every outage is an attack. Not every attack is part of a campaign. Not every campaign is coordinated. The evidence is presented with that discipline, because an investigation that exaggerates does its adversary's work for it.

Hybrid warfare is best understood not as a single technique but as a doctrine of combination: military and nonmilitary instruments — cyber operations, disinformation, economic pressure, sabotage, political interference, proxy forces, and conventional force — used together, calibrated to stay below the threshold that would trigger open war or unified response.

The vocabulary matters. Cyberwarfare denotes state-conducted or state-directed operations in and through computer networks. Cybercrime denotes economically motivated attack, mostly by criminal groups. Information warfare is the organized contest over narrative and belief; disinformation is its deliberate-falsehood component. Psychological operations and social engineering target human decision-making directly — at scale in the former case, at the level of an individual in the latter. Economic coercion uses trade, finance, or resource dependency as leverage. Infrastructure sabotage attacks the physical layer directly or through the control systems that operate it. Political interference corrupts the processes by which a society governs itself. Proxy actors allow a sponsor to act with plausible deniability. Conventional military operations remain the ceiling of the spectrum — and the umbrella under which the rest proceeds.

States are not the only participants. Criminal networks, mercenaries, private intelligence contractors, ideological movements, and commercial firms all operate instruments within this spectrum, for hire or for their own ends. The distinction between armed conflict and hostile activity below the threshold of war is a live question of international law — one that determines which legal regime, and therefore which remedies, apply.

A boundary the investigation holds throughout: not all misinformation is warfare; not all political advocacy is interference; not all commercial targeting is surveillance-for-a-state; not every cybersecurity incident is an operation. The comparative matrix below identifies mechanisms, possible objectives, civilian consequences, attribution challenges, and relevant safeguards — while the analysis keeps ordinary crime, accident, and advocacy analytically distinct from acts of hybrid war.

02A — COMPARATIVE MATRIX

COMPARATIVE MATRIX — MECHANISMS, OBJECTIVES, CONSEQUENCES, ATTRIBUTION, SAFEGUARDS

The matrix distinguishes mechanisms from objectives and from consequences, and names the attribution challenge and the safeguards specific to each row. No row implies that every incident in its category is hostile; the distinction between warfare and ordinary failure is drawn in the text above.

The matrix is analytical, not a claim that all incidents in a row are warfare. Ordinary crime, accidents, and advocacy occupy the same mechanisms without being acts of war. Attribution challenges differ by mechanism. Criminal ransomware is usually attributed to identifiable groups; influence operations are attributed to institutions with difficulty; sabotage may be deniable by design. Safeguards are preventive, detective, and institutional.

The most consequential development in modern hybrid warfare is the reachability of operational technology: the software layer that moves water, power, refrigeration, trains, and hospital logistics. Information technology processes data; operational technology moves the physical world. When attackers reach the second layer, consequences stop being virtual.

The primer below explains how supervisory control systems, programmable logic controllers, remote access, industrial networks, and dependent software services can influence physical equipment. The case studies that follow are chosen to cover the documented spectrum: state-directed sabotage, officially attributed state operations, criminal ransomware with physical consequences, disputed attribution, and one case included specifically because its initial public narrative collapsed under investigation.

IT, OT, AND THE PATHS BETWEEN

Historically, control systems were isolated. Cost pressure, remote monitoring, vendor support, and efficiency dissolved that isolation. The case studies below show what the new exposure means in practice.

SAFEGUARDS THAT THE RECORD SUPPORTS

• Remove industrial controllers from direct public-internet exposure; use managed, authenticated access paths.
• Segment operational networks from business networks; assume the business side can be breached (Colonial Pipeline, Change Healthcare).
• Maintain and rehearse manual operation — trained people, printed procedures, physical override.
• Constrain vendor and supplier software dependencies; verify updates cryptographically; maintain inventory of exposed devices.
• Report incidents promptly; sector-wide visibility is a public good that individual secrecy destroys.

03 — WHEN CYBERATTACKS BECOME PHYSICAL THREATS

TEN CASE STUDIES IN OPERATIONAL-TECHNOLOGY ATTACK

Each case below follows the DSC evidence block: event date, location, actors or claimed actors, verified events, attribution status, civilian impact, institutional response, unresolved questions, and primary sources. Where primary documentation for a recent case has not yet been assembled, that gap is stated rather than papered over.

The pattern across these cases is not that every outage was an attack, nor that every attack succeeded. The pattern is that the control layer of civilian life is now reachable from networks, and that the consequences arrive through the physical world.

Hybrid operations target minds as deliberately as they target pipes. This section gives the cognitive domain the same investigative weight as the physical one — the same discipline of evidence, and the same refusal to exaggerate.

Physical infrastructure has a control layer; human attention has one too. The systems that allocate visibility — search, feeds, recommendations — decide what a society sees, in what order, and with what emotional framing. Whoever can operate that layer can shape not what people think, but what they think about, whom they trust, and which realities they share.

This investigation keeps two things separate that are often collapsed. Social engineering — the deception of an individual into revealing credentials or performing an action — is a precise, tactical practice, and the first step of most intrusions in Section 03. Influence at the level of public opinion is a different practice with different instruments, targets, and time horizons. They are related — harvested behavioral data improves both — but they are not one concept, and treating them as one blurs both analysis and law.

INSTRUMENTS OF THE COGNITIVE DOMAIN

• Social engineering — deceiving an individual into revealing credentials or taking an action; the entry point for most intrusions in the case studies above.
• Behavioral profiling and data harvesting — assembling inferred models of people from their digital exhaust.
• Psychological targeting — using inferred profiles to select who sees which message.
• Coordinated disinformation — organized campaigns of falsehood across accounts and outlets.
• Identity-based incitement — narratives that mark a group as threat or enemy.
• Algorithmic amplification — engagement-optimizing systems that distribute whatever holds attention, including the inflammatory.
• Coordinated inauthentic behavior — networks of fake or rented identities acting in concert.
• Synthetic media and deepfakes — fabricated audio, image, and video of real people and events.
• Bot networks — automated accounts simulating consensus.
• Information saturation — flooding the space with more claims than any person can verify.
• Erosion of institutional trust — the cumulative effect that outlasts any individual falsehood.

PERSUASION, MANIPULATION, COERCION, INCITEMENT

EVENT DATE

Data collection 2014; public exposure March 2018.

PRIMARY SOURCES

Federal Trade Commission enforcement action and consent order; UK Information Commissioner's Office penalty decision; UK Parliament Digital, Culture, Media and Sport Committee inquiry reports; company and platform public statements.

LOCATION

United Kingdom and United States.

ACTORS OR CLAIMED ACTORS

Cambridge Analytica and its parent SCL Group; Global Science Research and Aleksandr Kogan; Facebook (platform); the Trump campaign as a reported client; whistleblower Christopher Wylie.

VERIFIED EVENTS

A personality-quiz application installed by roughly 270,000 users collected profile information that, through Facebook friend networks, extended to profiles of tens of millions of users — figures up to approximately 87 million were reported by the company and regulators. Profile data was used to build behavioral and personality models and was connected with voter records for political targeting. Facebook suspended Cambridge Analytica in March 2018. The company and SCL filed for insolvency in 2018.

ATTRIBUTION STATUS

CONFIRMED. Corporate conduct was established by regulatory findings and admissions — this is not an attribution question about a state actor.

CIVILIAN IMPACT

Tens of millions of people had information about themselves and their friends taken and repurposed for political profiling without meaningful consent. The case reshaped public understanding of what platform data collection makes possible.

INSTITUTIONAL RESPONSE

The U.S. Federal Trade Commission obtained a record settlement with Facebook including privacy-program and governance requirements. The UK Information Commissioner's Office fined Facebook. UK and U.S. parliamentary committees held hearings, including testimony from the platform's chief executive. Platform permissions were subsequently tightened.

UNRESOLVED QUESTIONS

The full scope of friend-network data harvested across other applications; whether data derivatives persisted after deletion demands; the actual effectiveness of the targeting; whether similar practices continue under newer names and technologies.

STATUS OF CLAIMS

Data acquisition and profiling: CONFIRMED by regulatory findings. Claimed election-influencing capability: ALLEGED — asserted by the company and contested by independent research.

WHEN PERSONAL DATA BECOMES A PREDICTION OF POLITICAL BEHAVIOR, WHO CONTROLS THE INFERRED INDIVIDUAL?

DSC preserves the distinction between the direct perpetrators of atrocities — Myanmar's military and allied forces, documented by the United Nations — and the responsibility of digital intermediaries whose systems facilitated the circulation of incitement. DSC does not suggest that Facebook alone caused the atrocities. DSC equally rejects the converse: that a platform whose systems amplified incitement, ignored warnings, and failed basic moderation for the affected language bears no responsibility. Rohingya communities are treated throughout as affected people with agency, history, and voices — journalists, poets, lawyers, and advocates have documented their own experience — not as illustrations in an argument about technology. No fabricated depictions of identifiable victims appear on this page.

WHEN A PRIVATE PLATFORM DETERMINES THE VISIBILITY OF INFORMATION WITHIN A SOCIETY, WHAT RESPONSIBILITY DOES IT BEAR WHEN THAT INFORMATION CONTRIBUTES TO VIOLENCE?

FICTIONAL SCENARIO — CULTURAL ANALYSIS, NOT HISTORICAL EVIDENCE

EVENT DATE

Novel published 2020; film released 2023.

SOURCE

Rumaan Alam's novel, adapted for film by Sam Esmail.

WHAT THE FICTION DEPICTS

A family vacation home loses internet, television, and phone service in sequence. Livestock and wildlife move unnaturally. Neighbors reveal themselves as strangers. The family's new visitors speak with unsettling certainty: that a coordinated attack is underway, that more is coming, and that survival now depends on people they have just met.

ATTRIBUTION STATUS

FICTIONAL SCENARIO — CULTURAL ANALYSIS, NOT HISTORICAL EVIDENCE.

STAGE ONE — ISOLATION

Communications failures, transportation disruption, and reduced access to reliable information. The population loses the ability to know what is happening.

STAGE TWO — SYNCHRONIZED CHAOS

Covert attacks, misinformation, fear, and the breakdown of confidence in institutions and fellow citizens. The population loses the ability to agree on what is happening.

STAGE THREE — INTERNAL COLLAPSE

The fictional hypothesis that escalating instability could end in civil conflict, political overthrow, or societal breakdown — a society that turns on itself without any external force needing to finish the job.

SYSTEM: Systems inside one domain that a hostile actor could target directly.

POSSIBLE DEPENDENCY: A pathway through which disruption in one domain can propagate into another — potential, not proven.

BREAK POINT: The point where a society chooses redundancy, manual recovery, and human override — the difference between disruption and destabilization.

HYBRID POWER IS THE ABILITY TO MOVE PRESSURE ACROSS DOMAINS — AND THE ABILITY OF ANY ONE DOMAIN TO HOLD DEPENDS ON THE OTHERS.

Ukraine power grid, 2015–2016 (CASE D); NotPetya, 2017; Viasat KA-SAT, 2022 (CASE J)

The most extensively documented state cyber program in the public record. The 2017 NotPetya operation — formally attributed by multiple governments to the Russian military — masqueraded as criminal ransomware while its payload was purely destructive, disabling thousands of companies worldwide, including a global shipping giant, with damages estimated in the billions of dollars.

Coordinated influence operations against democratic elections

The U.S. intelligence community assessed — and a bipartisan Senate committee documented — a Russian influence campaign in the 2016 U.S. election cycle combining hacking, disclosure, and coordinated amplification. European investigations have documented parallel operations.

Sabotage preparations on European territory, 2024–2025 (CASE H)

Polish and other European authorities have documented recruitment of civilians for sabotage and reconnaissance, treating the pattern as state-directed activity below the threshold of war.

U.S. water infrastructure, 2023–2024 (CASE E)

U.S. agencies assessed the CyberAv3ngers group as affiliated with the Islamic Revolutionary Guard Corps — one of the clearest official attributions in the water-sector record. Iran has denied involvement in the 2026 European incidents (CASES A–B), where attribution remains reported or disputed.

Pre-positioning in U.S. critical infrastructure (Volt Typhoon disclosures, 2023–2024)

U.S. agencies publicly assessed that a state-sponsored Chinese group had pre-positioned inside U.S. critical-infrastructure networks — water, energy, communications — not for immediate attack but for potential future disruption in a crisis. The Chinese government denies the assessment. The finding reshaped U.S. critical-infrastructure defense planning.

North Korean state cyber activity

United Nations expert-panel reporting has documented large-scale state-directed cyber theft, including against financial institutions and cryptocurrency infrastructure, as a source of state revenue under sanctions.

Where a state denies involvement — Russia regarding Ukraine and Viasat, Iran regarding the French refrigeration allegations — DSC presents the denial alongside the attribution. Denial is a fact about the accused, not evidence against the attribution; the evidentiary weight rests on the underlying records.

A government's alleged conduct must not be attributed indiscriminately to its citizens or ethnic communities. Russian speakers, Iranian diaspora communities, and Chinese students abroad have all faced suspicion because of their states' conduct. Collective blame is both unjust and analytically false: most victims of these governments' repression are their own citizens.

CONFIRMED

SolarWinds supply-chain compromise, 2020: attackers inserted a backdoor into updates of widely used infrastructure-management software, reaching thousands of organizations including U.S. federal agencies. The U.S. government attributed the operation to a Russian foreign-intelligence service. One supplier became a single point of compromise for a nation.

CONFIRMED (NON-ADVERSARIAL)

2024 global software-outage: a single defective update from one cybersecurity vendor disabled millions of Windows systems worldwide within hours — hospitals, airlines, broadcasters, banks. No adversary was involved. The concentration itself produced the systemic event.

OFFICIALLY ASSESSED

Foreign-vendor risk: governments have restricted specific foreign vendors' software and hardware in sensitive systems after assessments of state access — decisions that are themselves consequential for cost, competition, and alliance politics.

REPORTED

AI-generated disinformation at scale: commercial AI-image and AI-text tools have been documented in influence campaigns by researchers and platform takedown reports since 2023.

CONFIRMED (REGULATORY)

Synthetic voice in political robocalls: in early 2024, a cloned voice was used in an AI-generated robocall campaign discouraging participation in a U.S. primary; the U.S. regulator subsequently ruled that AI-generated voices in robocalls violate existing telemarketing law and imposed penalties.

REPORTED

Voice cloning and consumer fraud: cloned-voice scams are a documented, growing consumer-fraud category.

REPORTED

AI-assisted phishing: security firms document measurable productivity gains for attackers using generative tools to draft lures at scale.

REPORTED

Automated propaganda production: platforms and researchers have attributed takedowns to networks using generative tools for text and imagery across languages.

LAWFUL COORDINATION: agencies briefing platforms on specific foreign covert-influence operations, with documented legal process.

CONSTITUTIONALLY SUSPECT: informal, undocumented government pressure on platforms to suppress lawful political speech — whatever the target's nationality or ideology.

PROPORTIONATE OVERSIGHT: targeted, audited, judicially reviewable investigation powers.

DISPROPORTIONATE: bulk collection, discriminatory enforcement, or surveillance normalized by emergency rather than justified by evidence.

CIVIC MACHINA — A PROPOSED CIVIC AI ARCHITECTURE

Civic Machina is DSC's proposed civic AI architecture: AI systems that are publicly accountable, transparent, and governed in the public interest — designed so that the intelligence layer of civic information and infrastructure belongs, in a meaningful sense, to the public it serves.

In the hybrid-warfare context, its relevance is direct: public-interest information verification, accountable civic intelligence, resilience mapping, and citizen-controlled digital infrastructure are research directions that could give democratic societies an information and infrastructure layer they can trust without surrendering it to either state surveillance or corporate monopoly.

Civic Machina is a proposed architecture under development — not a deployed or proven security system. DSC states its status in those terms everywhere it appears.

A society is not digitally sovereign if it cannot protect its essential systems, independently verify information, or preserve the rights of its people when those systems are threatened.