State-sponsored hacktivism is a complex topic, not only for the terminological limitations, but also due to the political implications that come with it. The concept is linked to hacktivism, which is the use of computer hacking techniques (either meant to disrupt, modify or hinder a computer system or similar devices) aimed at promoting a socio-political message. As Denning notices, on an international level hacktivism has brought two main challenges. First, responsibility of states to prosecute hacktivists that are operating on domestic land, but against foreign countries. Second, the state-sponsored component, where the line among state and hacktivists’ responsibility gets extremely blurry. It is this second aspect that appears to be particularly interesting and concerning at the same time.

State-sponsored hacktivism: When states puts the mask on

The origins of hacktivism are partially rooted in the hacking community and partially taken from traditional activism. The state, or better the government, is not really contemplated as actor, rather it is often the target of activists and hacktivists’ operations. Therefore, if a state does not seem to be an actor, what is state-sponsored hacktivism?

Lucas argues that state-sponsored hacktivism is made of “weapons and attacks in the cyber domain intended to produce political effects similar to those usually sought as the goal or objective of a conventional use of force by states against one another”. It is a form of ‘soft-war’ that many nation-states are now using to get around the limits imposed by international law.

Denning’s approach is slightly different, but definitely recognizes that this peculiar form of hacktivism has become an appealing cyber alternative for armed attacks and a tool of national power able to “challenge international relations and international law”.

Both the authors consider clear examples of state-sponsored hacktivism the 2007 cyber-attacks campaign against Estonia, the North Korean attack on Sony picture, Stuxnet and the Fancy Bear’s Olympic Games operation. In all these cases, nation-states put on the hacktivists mask to avoid responsibility, redirect attribution and finally (as it happened) get away with it.

State-sponsored hacktivism: When the mask is too tight

Unfortunately for the state, the mask is often too tight. State-sponsored hacktivism should be interpreted as a form of hacktivism, and not as a new tool of cyber warfare. Hacktivism, with all its critical and illegal actions, remains a spontaneous, though organized, form of protest, developed by individuals who decide to take a different path to express their disappointment and to promote a change in society. It is possible to discuss whether the methods are correct, if the end justifies the means, if the message makes sense. But it has to be agreed that hacktivism by definition remains a free-of-constraints initiative, and it should be treated (if so) as a personal criminal action where the individual is the focus. Therefore, when trying to identify the essence of state-sponsored hacktivism, we should refer to operations planned and launched by individuals who try to influence the political situation of another state (or more states), exploiting the direct or indirect support of a nation-state that shares the same interests. The sponsored element provided by a nation-state, which is central to this discussion, might take different forms: either the government could directly support the hacktivists with tools and knowledge (suggesting targets and providing intel) or it could indirectly avoid to ‘point a finger’ protecting hacktivists from prosecution, should they be discovered. What the nation-state cannot do is address hacktivists’ operations, force them to act in a certain way, or even worse create internal task forces disguised as hacktivists, but in the end fully embedded in the state apparatus.

Conclusion: Remove the mask

We should be clear on one final point: both Denning and Lucas are right in saying that what they call state-sponsored hacktivism presents several problems of attribution and interesting challenges for the international law experts. And they are right in pointing out how the process develops and how the state becomes a sort of ‘non-state’ actor. What I suggest here is that we should avoid to name this process hacktivism. Allowing states to hide behind the mask of political influence by calling any political interference hacktivism, is a dangerous path to follow and it might unintendedly create an even more unclear situation. We should place state-sponsored hacktivism where it belongs, in a consolidated and long history of social and political protest, and we should force the nation-states to remove the mask and call their actions with the right name: state-hacking. In the end any state’s action is political. Stressing the hacktivist part will not help to solve the riddle, but it will make it worse.