Kiev’s power grid was hit by a major cyber attack over the weekend, in what experts say fits into a pattern of recent Russian cyber aggression against Ukraine. Reuters:

Ukraine is investigating a suspected cyber attack on Kiev’s power grid at the weekend, the latest in a series of strikes on its energy and financial infrastructure, the head of the state-run power distributor said on Tuesday.

Vsevolod Kovalchuk, acting chief director of Ukrenergo, told Reuters that a power distribution station near Kiev unexpectedly switched off early on Sunday, leaving the northern part of the capital without electricity.

A Ukrainian security chief said last week that Ukraine needed to beef up its cyber defenses, citing a spate of attacks on government websites that he said originated in Russia. […]

“The purpose of this Ukraine attack: Two options. Either it’s a show of power. Prove to the people of Ukraine that your government cannot protect you,” Mikko Hypponen, Chief Research Officer at F-Secure, told Reuters.

The other option is that there was something else happening at the same time and they needed this to be their cover or somehow to assist another operation to succeed as a result of the power outage, he added.

This is hardly the first time that Ukraine has been caught in the middle of a cyber conflict. A year ago this month, several power companies in western Ukraine suffered blackouts as a result of debilitating attacks; Russia was quickly blamed for what experts claim was the first ever successful cyber attack on a power grid. Other attacks have been reported this month on Ukraine’s treasury and finance and defense ministries.

It seems that these kinds of murky cyber attacks are on the uptick lately, and not only in Ukraine. What is less clear is whether Western policymakers have a meaningful framework for understanding and dealing with them. Cyber warfare does present several unique challenges: for one, such attacks offer a level of plausible deniability that complicates any attempt to hold a state actor accountable, especially if the proximate actors are “hacktivists” not officially tied to the state. Moreover, there is no clear-cut agreement on what constitutes an act of cyber war.

Still, as the Russian security expert Mark Galeotti argues in a recent report on “hybrid warfare,” the logic underpinning Russia’s use of such tactics is not inherently new. The Russians have always preferred a subversive form of warfare that elides easy distinctions and employs unusual means:

From the tsars through the Bolsheviks, the Russians have long been accustomed to a style of warfare that refuses to acknowledge any hard and fast distinctions between overt and covert, kinetic and political, and embraces much more eagerly the irregular and the criminal, the spook and the provocateur, the activist and the fellow-traveler. Sometimes, this has been out of choice or convenience, but often it has been a response to the time-honored challenge of seeking to play as powerful an imperial role as possible with only limited resources.

It is important to keep both these realities in mind: on the one hand, cyber warfare does present a genuinely new threat that will demand creative responses. On the other hand, many of the old rules of geopolitics still apply; cyberspace is just one arena where opportunistic states like Russia can play their usual tricks. This is why Galeotti argues for a modified form of deterrence as the most helpful model to combat Russian information warfare. Until the United States can establish a strong deterrence posture and signal that hostile actors will pay a price for their cyber aggression, states like Russia will continue to take advantage of their enemies’ weaknesses, in Ukraine and elsewhere.