Seventy-four per cent espionage, twenty-eight per cent money

The catastrophe that kept not arriving

For two decades the public argument was dominated by a scenario: a sudden strike that would darken cities, empty accounts and stop hospitals, delivered without warning by a hostile government. It was described in testimony, in strategy documents and in a great many conference talks, and it was used to justify budgets, agencies and legislation.

It did not happen. Destructive operations have occurred, some of them serious, and they have stayed inside limits that look remarkably stable in hindsight: mostly confined to active conflicts, mostly reversible, mostly stopping short of the casualties that would invite a response nobody wanted. That restraint is not evidence of goodwill. It is evidence that the actors involved calculated the same way everybody else does, and found escalation unattractive.

Meanwhile the thing that did happen was almost too quiet to report. Continuous collection, in every direction, at a scale that makes the word campaign misleading — access obtained and held in telecommunications, energy, government and the suppliers of all three, sometimes for years, frequently with no observable use. Prepositioning is the ugly word for it, and it is the least dramatic activity in this field and probably the most consequential.

Which explains the change in vocabulary this archive records. The word cyberwar accounts for about 18% of this subject across the first half of the period and roughly 16% across the second, while the coverage of state activity itself did not fall. The predictions were not wrong about capability. They were wrong about incentive, and about how boring the real thing would look.

Are you a target, or a route?

The question organisations ask is whether a government is interested in them, and for most of them the answer is no. Around 15% of external actors in breach data are state-affiliated and espionage is the motive in roughly 12% of breaches, which leaves a very large majority whose problems are ordinary and whose spending on this subject would be better placed elsewhere.

The better question is what you can reach. Suppliers, law firms, accountants, recruiters and small technology companies are attacked constantly, not for their own information but because they hold credentials, documents or network access belonging to somebody who is a target. A twelve-person firm with a maintenance connection into a utility is a state-actor target and does not feel like one, and the feeling is the problem.

Where that applies, the useful measures are unglamorous and identical to the rest of the discipline. Reduce what your access permits, so that a compromise of your systems does not deliver theirs. Keep logs long enough to answer questions about four months ago, because that is the interval these intrusions run at and most retention periods are shorter. Use a factor that cannot be relayed, since patient social engineering defeats everything softer.

And treat the long, friendly approach as the threat it is. Months of professional contact ending in a request that seems reasonable is the documented pattern in a quarter of espionage cases, and it survives every technical control because nothing malicious happens until the person decides to help. The defence is a culture where checking an unusual request is normal, which cannot be purchased and takes years.

The layer nobody planned

Between the state and the keyboard there is now an industry. Companies sell intrusion capability, exploit brokers pay for flaws and resell them, and firms offering surveillance as a product have customers in dozens of countries. None of this was designed; it emerged because building this capability is expensive and buying it is not, and because a supplier can serve many governments with the same engineering.

The effect on the map is to flatten it. Capability that once required a large national programme is available to states with no such programme, and to some organisations that are not states at all. The tidy picture of a handful of sophisticated actors, still the organising assumption of most threat briefings, is an artefact of an era when the barrier to entry was construction rather than purchase.

It also confuses everything downstream. When capability is bought, its fingerprints say more about the vendor than the customer, and two unrelated governments running the same purchased tooling look like one actor to anybody analysing the technique. Attribution built on tradecraft was always inference; against a shared supply chain it becomes inference about the wrong party.

For a defender the consequence is a lowered bar to assume. The question is not whether an adversary sophisticated enough to use a purchased zero-day would bother with you, because the cost of that adversary has fallen to something a mid-sized organisation could afford. Planning around who could plausibly reach you was always weak; it is now closer to arbitrary.

The costume that keeps being worn

A word that once described something real has become the standard disguise. Hacktivism meant people with a grievance and modest skills defacing a website or knocking it offline for an afternoon, and it still occasionally means that. What it mostly denotes now is a persona: a freshly created account, a manifesto of a paragraph, a flag, and an operation whose competence sits some distance above the stated cause.

The disguise is worn because it works on several audiences at once. It gives the sponsoring government deniability that is thin but sufficient, since disproving it requires publishing intelligence. It gives journalists a narrative with a motive already attached. And it lowers the perceived seriousness of the event, because an organisation attacked by activists reads the incident as a nuisance rather than as the reconnaissance it may have been.

Two tells recur without ever being conclusive. The first is a mismatch between the claimed grievance and the target list, where the stated cause explains three victims out of nine and the remaining six share a supplier or a sector instead. The second is capability arriving fully formed: an account created a fortnight ago, using techniques that take years to develop, with none of the clumsy early attempts that genuine amateurs leave behind them.

For a victim organisation the useful posture is to ignore the costume entirely. The claim on a channel is the least reliable evidence available, it costs nothing to make, and acting on it means letting the attacker choose how seriously you take them. Investigate what was touched and how, treat the stated motive as marketing, and let anybody with better information than yours argue about the flag.

The same caution applies in reverse, and it is the harder half. Dismissing a defaced page or a brief flood as theatre is usually correct and occasionally expensive, because a noisy nuisance is a reasonable way to occupy a response team while something quieter proceeds elsewhere. The discipline is to treat the visible event as an event rather than as an explanation: log what it touched, then go and look at whatever nobody was watching while everybody watched the website. A response team is small, and its attention is the scarcest resource in the building. That makes the attention itself a target, and no product defends it. The only defence is a written rule that somebody keeps looking at the quiet places while the loud one is handled, which sounds obvious, costs nothing, and is abandoned within the first hour of almost every incident anybody has ever run. Writing the name of the person who holds that job, before the day arrives, is the cheapest single improvement available to a response plan, and the one most consistently left out of them.