The jury is still out on the success and failure of the United States, NATO, and Russian offensive cyber capabilities against each other in the conflict over Ukraine. Cyber warfare is one of the many toolkits in this systemic level competition over who will maintain the strategic advantage and importance in the world. It carries essential lessons for all states, especially those in fragile conflict regions like South Asia.

The role of cyber warfare in modern conflicts is now inevitable. The parties involved in the Ukraine conflict project their cyber capabilities as purely defensive. Who is on the offensive depends on the vantage point and whether the claimant can identify and provide undeniable proof about the perpetrator(s).

Attribution is complex, and any pot can call any kettle black. Efforts have been made to provide cyber support to Kyiv against Russia despite Ukraine not being granted NATO membership. Unlike Finland, which does not conflict with Russia, Ukraine cannot be admitted because the Atlantic powers will be treaty-bound to enter a direct war with Russia. Fighting a proxy war is comparatively inexpensive rather than testing Russian thresholds in a direct war under the NATO flag. There have been instances of cyber capabilities shared with Ukraine by the United States and other NATO countries, with attribution complexities.

Under the inherent security of Pakistan, Pakistan must ensure its cybersecurity regarding the economy and defense. New Delhi has several cooperation agreements with the United States that cover cyber and ancillary capabilities. Pakistan will not be as lucky. However, if reports about Ukraine’s indigenous cyber-defense are correct, these may apply in reinforcing Pakistan’s cybersecurity architecture. The following examples show that Ukraine has little indigenous defensive capability and offers a good testing ground for all ‘technological haves.’ First, during 2015-2017, Ukraine faced three exceptional cyber-attacks that resulted in two electrical power disruptions and the NotPetya attack. Post-2018, the United States helped Ukraine, and its long-term investment in cybersecurity proved critical improvements that led to the country’s current strong cyber defense posture in the war.

Second, amidst the invasion, Ukraine ran an emergency cloud migration that was critical to the country’s cybersecurity and digital resilience. The data migration to Amazon Web Services (AWS) cloud platform has produced wide-scale improvements in Ukraine’s overall cybersecurity and resilience. The importance of migration was worthwhile when its data center was hit. No data was lost because backups were made. It will be a safe option for any other state, like Pakistan, to develop similar capabilities indigenously.  Third, the pre-war preparation of Ukraine for cybersecurity helped in resilient national internet and IT architecture. It is due to the market availability of the IT workforce, cyber professionals, and network engineers. This human-resource element has worked with its allies to deal with cyber threats. Fourth, the United States is sharing command and control data to gain the tactical edge and prepare for cyber war, primarily to ensure the security of the cyber domain during the Ukraine crisis. The top priority is connectivity security with the sets of internet protocols to the multiple ways through gateways.

Besides Ukraine, the United States is working against China by forming new frameworks of partnerships such as the U.S.-India joint initiative, the Initiative on Critical and Emerging Technologies (ICET). It binds the two countries to share knowledge among various fields, including AI, cyber, space, high-performance computing, quantum, and other critical emerging technologies.

The strategic repercussions of ICET on China and Pakistan will be long-term, including in the cyber domain. On the contrary, India has ambitions that encompass its national interests. It needs advanced technologies from the United States to increase its economic and military capabilities. India’s focus on bolstering its cyber capabilities, including China and Pakistan, may have strategic implications. However, it is important to consider India’s varied motivations and interests in pursuing advancements in the cyber domain. Considering these dynamics, five conclusions can be drawn.

First, Pakistan must prepare itself in the cyber domain and invest properly indigenously and with trusted friends. Indigenization should be the priority, and the next/ simultaneous priority should be an integrated approach to strengthening the cyber paradigm with AI-enabled tools that utilize advanced technologies. Second, in the absence of cyber-related arms control measures with India, Pakistan needs to build defensive capabilities architecture to curb pre-emptive attacks from India or any other unknown actor due to the opaque nature of the cyber domain. Third, a cyber resilience capability calls for data backup and storage. Pakistan needs to acquire an authentic digital space cloud system, but more importantly, it should have its data storage cloud system. Fourth, Pakistan must develop a thriving and motivated human resource for the cyber domain in the country.

And most importantly, there is a dire need for an enduring cyber strategy. Pakistan may elevate and expand its cyber warfare strategy and its implementation because self-help is the element of the survival of the fittest. This is the era of the Fourth Industrial Revolution. It is said that “data is the new oil,” implying that he who holds (manages) the data holds the world!