OVERVIEW

The IISS Cyber Power Matrix collates examples of state cyber power from 2001 onwards, including:

state-linked operations in cyberspace;
state-linked disinformation operations; and
ownership and supply of submarine cables.

The IISS has also collated a dataset of physical disruptions to submarine cables to demonstrate the vulnerability of this critical element of cyberspace.

This interactive platform allows users to visualise the physical, logical and virtual layers of cyberspace together. This is a live dataset and will be updated monthly.

Strategic Context

Cyberspace underpins the global economy, is fundamental to critical national infrastructure, and facilitates the instant spread of ideas. This connectivity has revolutionised the way states spy, conduct statecraft and exert influence for strategic effect. The states that most effectively defend and utilise cyberspace to enhance national power can be said both to have cyber power and to be cyber powers.¹

As the IISS defined in 2021, cyber power refers to the ability of a state to project power in cyberspace, to achieve strategic objectives and exert influence globally.² Our definition is comprehensive, highlighting dimensions that contribute to a state’s status as a cyber power. A cyber power’s strategy and doctrine would guide a whole-of-nation approach to enhancing cyber capabilities. These strategies would be complemented by a dedicated and significant budget as well as a track record of delivering on previous cyber-power ambitions. They would be implemented through effective cooperation between government, the military and the private sector. Robust situational awareness, often enabled by sophisticated cyber-espionage capabilities, is a vital component of a state’s cyber power.

A cyber power would have a workforce with cyber-relevant skills both inside and outside government, with upskilling incentives and initiatives provided by the government and the private sector, as well as a vibrant domestic digital-technology sector that operates internationally. A cyber-capable state would prioritise sustaining a resilient nationwide network to mitigate the risks that greater connectivity brings, including the ability to conduct defensive operations to remove adversaries from friendly networks when necessary. Internationally, a state’s cyber power is also measured by its ability to shape the rules and norms of cyberspace, including the technical standards for hardware or software and the norms that determine how state behaviour in cyberspace is judged.³
The IISS Cyber Power Matrix captures examples of cyber power worldwide utilising a layered approach that provides a holistic visualisation of national power in cyberspace. It is an interactive platform that seeks to monitor state efforts to enhance national power through cyber power, now and in the years to come.

The Layers of Cyberspace and National Power

To understand how states exert power and influence through cyberspace’s physical and non-physical components, the IISS applies the framework of the three layers of cyberspace – physical, logical and virtual – as outlined in the United Kingdom government’s 2022 National Cyber Strategy.⁴

The physical layer consists of the hardware on which code and data reside such as phones, computers, routers, data centres, terrestrial and submarine fibre-optic cables, cellular radio towers and communications satellites.⁵ Over the past few decades, with an increased reliance on the internet, demand for submarine cables has increased and today they carry an estimated 99% of all internet traffic. The Cyber Power Matrix uses ownership of these cables as an indicator of state power and influence over the physical layer of cyberspace. The IISS has also built a repository of disruptions to submarine cables, whether environmental or man-made, to demonstrate the vulnerability of this critical layer.

The logical layer consists of code, data and operating systems, which are the main interfaces with hardware. The virtual layer is the shared space between virtual users that most people engage with directly, including social-media platforms, email and web pages.⁶ To demonstrate the fullest range of examples of states using cyber power to further national interests, the Cyber Power Matrix captures state-linked cyber operations conducted for intelligence collection, commercial espionage, cognitive effect, defence, disruption, destruction, pre-positioning, surveillance, profit and the spread of disinformation on social media.⁷Some states have prioritised the development of cyber units within the government and military. Others buy in capabilities such as surveillance technologies, or hire or coerce private industry, hacktivists or criminals to carry out operations in the national interest. Some do a combination of both. The Cyber Power Matrix captures state actors as well as non-state actors if there is a suspected state link.

Cyberspace is a domain of everyday state-on-state competition.⁸ The applications of cyber power can amplify and enhance all other instruments of state power and have an effect in other operational environments and domains. State efforts to build and apply cyber power will prove decisive for national power and it is central to today’s US–China great-power competition.

The IISS Cyber Power Matrix is pioneering in its representation of national power at the three layers of cyberspace. Previously, information on state influence at the physical, logical and virtual layers was scattered and disjointed. Through this platform, the IISS seeks to encourage scholarship and debate on the aspects of cyber power as well as the changing nature of competition and conflict.

Endnotes

¹ Marcus Willett, ‘Assessing Cyber Power’, Survival, vol. 61, no. 1, February–March 2019, pp. 85–90; and Marcus Willett, ‘What Is Cyber Power, and Where Is It Going?’, IISS, online webinar, 11 August 2021, https://www.youtube.com/watch?v=go3lU4BC85A.
² IISS, ‘Cyber Capabilities and National Power: A Net Assessment’, 28 June 2021, https://www.iiss.org/en/research-paper/2021/06/cyber-capabilities-national-power/.
³ Other works on cyber power include: Franklin D. Kramer, Stuart H. Starr and Larry K. Wentz (eds.), Cyberpower and National Security (Lincoln, NE: Potomac Books, 2009), pp. 24–42; Joseph S. Nye, Jr, ‘Cyber Power’, Harvard Belfer Center, May 2010, https://www.belfercenter.org/publication/cyber-power; and Julia Voo, Irfan Hemani, Simon Jones, Winnona DeSombre, Daniel Cassidy and Anina Schwarzenbach, ‘National Cyber Power Index 2020: Methodology and Analytical Considerations’, Harvard Belfer Center, September 2020, https://www.belfercenter.org/publication/national-cyber-power-index-2020.
⁴ UK Government, ‘National Cyber Strategy 2022’, 15 December 2022, https://www.gov.uk/government/publications/national-cyber-strategy-2022/national-cyber-security-strategy-2022.
⁵ See Marcus Willett, Cyber Operations and the Responsible Use of Cyber Power, Adelphi 511–513 (Abingdon: Routledge for the IISS, forthcoming 2024); and UK Government, ‘National Cyber Strategy 2022’.
⁶ UK Government, ‘National Cyber Strategy 2022’.
⁷ For an alternative definition of cyber operations see Marcus Willett, Cyber Operations and the Responsible Use of Cyber Power.
⁸ Marcus Willett, ‘What Is Cyber Power, and Where Is It Going?’.

LATEST ANALYSIS

Database updates