In November 2018, the United States military did something quietly extraordinary: it cut off the internet access of a Russian company that had been trying to meddle in the American midterm elections. That company, the Internet Research Agency in St. Petersburg, had become infamous for its role in a disinformation campaign during the 2016 presidential race. Using fake social media accounts, false personas, and targeted advertising, it reached as many as 126 million Americans on Facebook, with the goal of provoking and amplifying political and social discord. US government officials later said the operation against the agency was the first offensive cyber-campaign designed to thwart interference in an American election. It was carried out by a joint task force at the National Security Agency and US Cyber Command, both part of the Department of Defense. The United States is not alone in creating military units dedicated to computer network operations—actions that use devices, programs, and techniques to create effects through cyberspace. Dozens of countries now have such forces, as tracked by the Council on Foreign Relations’ Cyber Operations Tracker. At first glance, this seems like a textbook case of cyber warfare. But if you scratch the surface, the details get messy. What exactly counts as “cyber” warfare? Who gets to wage it? Is it only governments, or can private companies and irregular actors be part of the fight? And when does an online action cross the line from influence to an act of war? These questions are not academic. They shape how states respond to threats, what laws apply, and how ordinary people understand the digital conflicts unfolding around them. The 2018 operation against the Internet Research Agency is a perfect window into that evolving reality. It shows that the old vocabulary of war—front lines, soldiers, declarations—does not fit neatly into the world of fiber-optic cables and social media algorithms. It also shows that cyber operations are not always about destroying things; sometimes they are about protecting democratic processes from slow, corrosive attacks.
The first complication is that countries do not agree on what cyber warfare actually is. For the United States, cyber operations are often seen as a distinct military domain, with specialized units, clear rules, and a sharp line between peacetime and wartime activities. Russia, by contrast, rarely uses the word “cyber” at all, except when describing foreign approaches. Russian strategists, like their Chinese counterparts, think in terms of information warfare—informatsionnaya voyna in Russian. That is a much broader concept. It includes not only hacking and network attacks, but also disinformation, propaganda, psychological operations, and political subversion. In this view, all state instruments—military, intelligence, diplomatic, media, even private companies—can be used together to achieve national objectives without necessarily crossing into formal war. This is why a private company like the Internet Research Agency could be seen in Moscow as a legitimate tool of state power. It was not an army unit, but it did not need to be. The Russian conception of information warfare is a whole-of-state effort, and the distinction between peace and war is far less clear-cut than it is in American strategic thinking. For the United States, this blurring is deeply unsettling. It means that an adversary can wage war without declaring it, using tools that look like ordinary speech and commerce. It also means that the response cannot be left solely to the military; it requires a broader national effort. This conceptual gap is one of the reasons cyber conflict is so hard to manage. When one side thinks of a troll farm as an act of war and the other thinks of it as just another form of political competition, they are not even speaking the same language.
The second complication is that cyber warfare, as it actually happens, rarely resembles the dramatic “digital Pearl Harbor” that people once feared. Instead, it is characterized by persistent low-level skirmishing that is woven into broader political struggles. Both the United States and Russia were careful to stay below the threshold of an “act of force” as defined by international law and the UN Charter. Neither side wanted to trigger a legal or military escalation. But that did not mean they were passive. The US response to the Internet Research Agency included not just the cyber operation itself, but also criminal indictments and sanctions—a reminder that cyber incidents do not have to be answered only with cyber means. This idea is sometimes called “persistent engagement”: intense, ongoing skirmishing that is part of a wider spectrum of statecraft, rather than a single, weapon-like strike. It is also worth noting that carrying out these operations takes serious resources. This is not something a lone hacker in a basement can do. State-backed cyber units have budgets, infrastructure, and technical expertise. The Internet Research Agency itself was not a military organization, but it was supported by the Russian state and operated with political purpose. So while the term “cyber warfare” might evoke images of missiles and power grids going dark, the reality is more often a grinding, low-grade conflict involving propaganda, influence operations, and legal maneuvers, all designed to gain advantage without crossing the line into open conflict. This does not make it less dangerous; it just makes it harder to recognize and respond to, because the most important battles are often invisible to the public until after they are over.
The third complication is legal and domestic. Even when a state like the United States identifies a clear threat, its own laws and institutions can make it difficult to respond. In 2018, the US was not formally at war with Russia, and the Internet Research Agency was a civilian organization, not a military target. Under traditional rules, US Cyber Command would have needed special authorization to go after it. That authorization came in the form of a 2017 presidential order that gave Cyber Command greater freedom to conduct offensive operations below the level of armed conflict. Without that order, the operation would likely have been legally impossible. This is a reminder that cyber warfare is not just a matter of technology; it is also a matter of domestic politics, legal interpretation, and bureaucratic process. The US operation was also notably contained. It disrupted the Internet Research Agency’s activities, but it did not try to destroy it entirely or launch a broader campaign against Russian infrastructure. Why? Because Washington was worried about escalation. If the US hit too hard, Moscow might retaliate in some other way, perhaps triggering a larger confrontation between nuclear-armed great powers. So the operation was calibrated to send a message and degrade the immediate threat, while leaving room for de-escalation. This is the strange logic of cyber conflict: even as states race to build offensive capabilities, they often use them with great caution, precisely because the consequences of overstepping are so unpredictable. The 2018 operation was therefore not a sign of American dominance in cyberspace, but rather a careful move in an ongoing game of geopolitical chess.
What did the Internet Research Agency actually achieve? It did not change vote counts or hack voting machines. If it had, that might have constituted an act of aggression under international law. Instead, it targeted something more subtle: the relationship between individual voters and the democratic process. By spreading divisive content, it sought to make Americans distrust each other, distrust the media, and distrust the integrity of the election itself. Even if no ballot was altered, the damage was real. Confidence in democracy was eroded, and the online environment became more toxic. This points to a new kind of challenge for governments and citizens alike. How do you protect individuals from malicious actors who are not trying to blow up a building, but rather to manipulate their emotions and beliefs? The answer is not straightforward. It involves not only technical defenses, but also media literacy, social media regulation, and a more resilient public sphere. This case also shows that cyber conflict is becoming more prevalent and more mundane than the specialized practice of “cyberwarfare” suggests. It is not an exotic, futuristic battlefield. It is a daily reality, unfolding in comment sections, news feeds, and targeted advertisements. The 2018 operation was a response to that reality, but it also raises uncomfortable questions: if a state can legally shut down a foreign company’s internet access, what limits should apply? Who decides where the line between influence and interference lies? These are not just military questions; they are democratic ones, and they will only become more urgent as technology continues to evolve and as more aspects of our lives move online.
Looking ahead, it is clear that the race for cyber superiority is already underway. Just as the twentieth century saw nations compete for air superiority and nuclear superiority, the twenty-first century will increasingly revolve around who can dominate cyberspace. But this is not a race that can be won simply by building more powerful weapons or recruiting more hackers. The case of the Internet Research Agency shows that the most effective cyber operations are often those that exploit human vulnerabilities—our biases, our anger, our trust in familiar faces—rather than technical weaknesses. That makes cyber conflict deeply political, cultural, and psychological. It also means that the rules of the game are still being written. States have not yet agreed on a common definition of cyber warfare, or on when an online action crosses the line into armed aggression. International norms are emerging, but they are fragile and contested. For ordinary people, the takeaway is both unsettling and empowering: the digital world we inhabit is a contested space, and we are not just spectators but participants. Our ability to question what we see online, to resist manipulation, and to demand accountability from both governments and tech companies will shape what cyber conflict looks like in the years to come. The 2018 operation against the Internet Research Agency was a landmark moment, but it was only the beginning of a long, messy struggle to humanize the digital battlefield.