UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 7.5 Free with a free account
State-Sponsored Digital Warfare and Long-Term Infiltration Campaigns
Ethics in Technology · Chapter 7: Hackers, Cyber Warfare, and the Global Battle for Digital SecuritySection 7.5 · lesson 32 of 11616 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: How the United Kingdom’s Data Protection Laws Safeguard Personal Information →← Politically Motivated Digital Attacks Designed to Create Fear and Disrupt SocietiesNext lesson: How the United Kingdom’s Data Protection Laws Safeguard Personal Information →
In this lesson
Espionage, sabotage, collateral harm, and international rules.
- Distinguish state objectives from an armed-conflict classification
- Trace the source’s APT lifecycle and dwell-time concept
- Compare Stuxnet, NotPetya, and SolarWinds
- Evaluate attribution, civilian protection, and legal thresholds
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,918 words). Read along, or search it.
Chapter 7
State Operations and Persistent Intrusions
States use digital operations for intelligence, military advantage, political pressure, disruption, and sometimes physical sabotage. State involvement does not automatically make every operation part of a war. We therefore distinguish objectives, technical effects, responsibility, and the applicable legal framework. This lesson explains persistent threats, sustained objectives, and hidden access inside a target. We trace a seven-stage intrusion model, focusing on opportunities for defenders to detect and respond. We then compare Stuxnet, NotPetya, and SolarWinds, three campaigns with substantially different goals and effects. Their lessons concern industrial control, destructive spread, and the trust placed in software suppliers. Each also raises questions about civilians, vulnerability retention, attribution, and escalation. Finally, we examine existing international law, voluntary norms, and the independent Tallinn Manual project. These sources differ in authority, and states disagree about thresholds and interpretations. Analysis must remain careful, even when technical damage is severe and publicly visible.
State Objectives
A State-Backed Operation Does Not Automatically Mean War
A state operation serves national objectives, directly or through actors whose relationship with the state requires evidence. Cybercrime commonly pursues money, while hacktivism commonly serves political or social causes. These distinctions can blur when states tolerate, protect, or employ criminal groups for their own purposes. Critical infrastructure includes systems supporting power, water, health care, finance, transport, and communications. Operations involve intelligence gathering, disruptive interference, or physical sabotage, with different legal consequences. Many occur in a gray zone below armed conflict, rather than a clearly declared war. In twenty sixteen, NATO recognized cyberspace as an operational domain for its defense activities. Digital operations can remain hidden, obscure responsibility, and affect systems far from the intended target. Conventional warfare also obscures responsibility and harms civilians, so the comparison is not absolute. Estonia's two thousand seven disruptions highlighted connected-service dependence, while Russian state responsibility remained disputed. Tallinn's defense center opened the next year, although planning had begun before those attacks.
Advanced Persistent Threat
Capability and Sustained Objectives Matter More Than a Particular Tool
An advanced persistent threat combines capability, sustained objectives, and an organized adversary with resources. Advanced capability may include sophisticated exploits, adaptation, and careful use of available tools. It does not require every intrusion to involve a previously unknown vulnerability. Persistent means continuing toward an objective, maintaining access or returning after defenders remove an initial foothold. That differs from an opportunistic attacker simply moving to an easier target after encountering resistance. Threat emphasizes intent and organizational capacity, often linked to a state but not defined solely by nationality. Security firms assign numbered labels and nicknames to activity clusters they investigate. Those labels may overlap imperfectly, because firms observe different evidence and use different tracking conventions. In twenty thirteen, Mandiant's APT one report assessed a link to China's military Unit sixty-one three ninety-eight. The report illustrated detailed attribution by a named investigator, with an evidentiary basis to evaluate. A label does not independently prove who directed every intrusion associated with similar activity.
Intrusion Lifecycle
Defenders Can Detect Activity at Multiple Stages
The lifecycle begins with reconnaissance, when the adversary studies a target and its environment. Initial compromise establishes entry, followed by a foothold that supports continued access. Privilege growth concerns expanded authority, while lateral movement reaches additional systems inside the environment. Maintaining presence allows activity to continue, potentially while defenders remain unaware of the intrusion. The mission involves stealing information, disrupting services, or sabotaging equipment, depending on the objective. Privilege, movement, and persistence stages may repeat, rather than forming one simple pass through the diagram. Campaigns can overlap or omit stages, so the model is a teaching aid. Defenders can look for unusual identity use, internal access patterns, and unexpected persistence or data activity. Monitoring only the initial entry overlooks important opportunities to detect activity already inside the network. Dwell time measures compromise to discovery, under the investigator's stated definition. Removing one visible component may leave another foothold, making coordinated investigation and response essential.
Detection and Interpretation
A Median Describes a Sample, Not a Promise of Timely Discovery
Mandiant reported a historical median dwell time of four hundred sixteen days for twenty eleven. The twenty twenty-six report described investigations during the previous year, with fourteen days overall. That overall median was much shorter than the older measure, but does not guarantee rapid detection everywhere. In the same recent report, cyber-espionage incidents had a median of one hundred twenty-two days. North Korean information-technology-worker incidents also had a median of one hundred twenty-two days. These differences show why sample categories matter, alongside the overall statistic. Incident-response observations are not a census of every intrusion, including those never discovered or investigated. Changes in case mix and detection methods also complicate a simple comparison across years. Even a short undetected period can allow substantial harm, depending on access and the attacker's objective. Organizations need prevention and visibility, alongside containment, investigation, recovery, and checks for remaining access. Use the statistic to understand a dated sample, rather than predict one organization's outcome with certainty.
Stuxnet, Discovered 2010
Software Can Change a Physical Process While Concealing Its Effects
Stuxnet, discovered in twenty ten, targeted industrial control systems associated with Iran's Natanz uranium-enrichment facility. Its sabotage changed centrifuge operation, while concealing abnormal behavior from operators. This linked malicious software to physical equipment, illustrating consequences beyond stolen files or an unavailable website. The campaign used multiple previously unknown flaws, and removable-media pathways could reach isolated systems. Being disconnected from the internet did not remove every possibility of unauthorized code reaching equipment. The malware spread beyond its intended setting, leading to discovery and analysis. A research assessment suggested roughly one thousand centrifuges may have been damaged in the earlier period. That was an estimate, rather than a complete public accounting of every affected machine. The course source describes widely reported American and Israeli involvement, without official confirmation. Distinguish that reported sponsorship from the technical evidence explaining what the software did. The central lesson is physical-process sabotage, alongside the difficulty of containment and attribution.
NotPetya, 2017
A Destructive Operation Can Spread Far Beyond Its Intended Geography
NotPetya spread in June twenty seventeen, initially through a compromised update to M.E.Doc accounting software. The campaign affected Ukraine, then reached organizations and operations far beyond the intended geography. Its ransom-style demand concealed destructive behavior, without a workable recovery path through payment. Shipping, pharmaceuticals, delivery, and food businesses suffered disruption, along with health-related operations. The White House described worldwide damage in the billions, emphasizing the enormous collateral consequences. The American and British governments, with allies, attributed the attack to Russia's military in February twenty eighteen. That is an official attribution, which should be identified as such rather than treated as a logo-based inference. The incident also led to insurance disputes about exclusions for hostile or warlike action. In twenty twenty-three, a New Jersey appellate court rejected the cited exclusions for Merck's policies and circumstances. That decision did not determine every insurance contract, or universally classify the incident under the law of war. Technical behavior, official attribution, insurance wording, and international legal thresholds are separate questions.
SolarWinds, Disclosed 2020
Trusted Distribution Can Become the Route Into a Customer
SolarWinds illustrates a supply-chain compromise, using trusted distribution to reach customers of a software supplier. Attackers inserted malicious code into Orion updates, which customers installed as legitimately signed software. A valid signature could authenticate distribution, without proving that the content itself was harmless. The campaign was disclosed in December twenty twenty, following investigation. SolarWinds initially estimated that fewer than eighteen thousand customers might have installed affected product versions. The number exposed to an update differed from the smaller set selected for deeper follow-on intrusion. High-value government and technology targets illustrate the apparent intelligence-gathering objective, rather than indiscriminate destruction. In April twenty twenty-one, American authorities attributed the campaign to Russia's Foreign Intelligence Service. The case showed that a strong perimeter does not eliminate risks inherited through trusted suppliers. Defenses must consider supplier practices, internal monitoring, identity use, and coordinated investigation of possible continuing access. Distinguish installation, exposure, confirmed activity, and the campaign's objective when describing its reach.
Comparison and Ethics
Purpose, Reach, and Civilian Risk Must Be Assessed Together
The three cases differ substantially, even though each involved sophisticated digital activity and difficult attribution questions. Stuxnet highlights physical-process sabotage, while NotPetya highlights destructive spread and severe collateral disruption. SolarWinds highlights trusted distribution and selective espionage, rather than the same mission as either destructive campaign. An ethical assessment should therefore examine purpose, foreseeable effects, available alternatives, and the people bearing risk. Weak attribution can produce retaliation against the wrong actor, escalating conflict instead of resolving it. Retaining a secret vulnerability may preserve an offensive capability, while leaving other software users exposed. The leakage or reuse of offensive tools illustrates why shared weaknesses can create broad risks. Not every propagation pathway is identical, so avoid reducing an entire campaign to one leaked exploit. Private companies operate much critical infrastructure, placing civilians and businesses directly within the consequences. Their defense costs and service disruption remain important, even when a state describes another country as its target. Ask whether the operation can be contained, and whether its anticipated gains justify its foreseeable human costs.
International Framework
Existing Law and Voluntary Norms Have Different Sources of Authority
International law applies to cyberspace, a principle affirmed through United Nations discussions of state conduct. Application remains contested in detail, especially for operations below conventional armed-conflict thresholds. In twenty fifteen, experts agreed on eleven voluntary norms of responsible behavior, later endorsed by the General Assembly. These address cooperation, harmful critical-infrastructure activity, incident-response teams, and knowing use of territory for harmful operations. They encourage protection of services that people depend on, alongside assistance and responsible handling of incidents. The norms are political commitments, rather than a dedicated treaty governing cyber warfare. Endorsement does not itself turn every voluntary norm into a binding international obligation. Some covered conduct may nevertheless violate a separate, independently applicable legal rule. The distinction between legal obligations and political commitments matters for evaluating compliance and accountability. Disagreement about a threshold does not create a legal vacuum, or establish that every operation is permissible. Likewise, citing a norm alone does not settle the legal classification of a specific incident.
Tallinn Manual
Expert Interpretation Helps Analysis Without Binding States
The Tallinn Manual is independent expert scholarship explaining how existing international law can apply to cyber operations. The twenty thirteen edition addressed cyber warfare, while the twenty seventeen edition expanded coverage to peacetime. Tallinn Manual two point zero contains one hundred fifty-four rules, with commentary on their interpretation. It is not a treaty, nor an official position of NATO, its defense center, or a government. Sovereignty concerns state authority, but states disagree about the precise standalone rule for remote cyber activity. Use-of-force analysis considers scale and effects, alongside the relevant United Nations Charter framework and exceptions. An armed attack concerns a higher threshold, with other conditions governing self-defense under Article fifty-one. Due-diligence questions concern harmful activity from territory, while its customary-law status in cyberspace remains disputed. Where the law of armed conflict applies, distinction, proportionality, precautions, and civilian protection remain important. An essential service or hospital does not lose protection merely because computers are involved. The manual supports reasoning and comparison, while disagreement and its nonbinding status limit what it can establish.
Review and Application
Separate Technical Harm, Attribution, and the Legal Response
NATO has explained that a serious cyberattack could lead to consideration of its collective-defense clause. The assessment is case by case, rather than an automatic response to every hostile digital incident. Each ally takes the action it deems necessary, under the treaty's requirements and applicable law. Espionage, a prohibited use of force, and an armed attack remain different classifications. A supply-chain technique alone does not determine which threshold, if any, the facts satisfy. For the worked review, imagine an update exposing many customers but deeper intrusion affecting only selected targets. Separate installations from confirmed activity, and identify whether the objective was intelligence gathering or destruction. Then assess responsibility, civilian effects, applicable law, and a proportionate response supported by evidence. Explain persistence through sustained objectives and continuing access, rather than requiring one tool in every case. Explain why a dated median does not promise a fixed detection time for one organization. Finally, distinguish a binding legal rule from a voluntary norm and an independent expert interpretation.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About State-Sponsored Digital Warfare and Long-Term Infiltration Campaigns
What is an advanced persistent threat (APT)?
What was Stuxnet?
What was the SolarWinds hack?
What is the Tallinn Manual?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →