Sanctions and cyber conflict, and their market implications.

Diplomacy seems to be at a stand, at least temporarily. Russia stands more-or-less alone, with full support from Syria and Belarus, and some relatively tepid support from China. In general Russia's President Putin is playing an aggressive role Europe hasn't seen since the 1930s. Moscow has formulated a diplomatic position that amounts, if not to an ultimatum, at least to a penultimatum.

Ukraine prepares for renewed Russian cyberattacks (with some help from the EU).

Reuters reports that Ukraine yesterday renewed its warning that it saw signs of renewed cyberattacks against its banks, its defense sector, and government websites. The warning appears to have been based upon indicators and warnings, and not merely a matter of a priori probability. CERT-UA based its assessment on what it observed in dark web chatter. Recent cyberattacks against such Ukrainian targets, which the US, UK, and Australia have attributed to Russia (and to either the GRU or FSB) have been generally regarded as more signaling than sabotage: their goal appears to have been to rattle Ukrainian resolve. Whether any further attacks will follow this pattern or move to more direct disruption remains to be seen.

The EU's Cyber Rapid Response Team has been activated and will deploy to Ukraine. The move, POLITICO says, has been welcomed by Kyiv. Activation was a joint decision of the six states that contribute to the Team: Croatia, Estonia, Lithuania, the Netherlands, Poland and Romania.

POLITICO also reports that the Baltic states (Latvia, Lithuania, and Estonia) are particularly sensitive to, and alert for, signs of Russian cyber operations spilling over against them.

Apparent provocations continue.

The "former defense minister" (note the phrase's implied continuity of government, and the attendant suggestion of established legitimacy) of the soi-disant Donetsk People’s Republic, one Vladimir Kononov, is said to have been the target of an attempted assassination by bomb, the nominally separatist region announced. TASS asserts that one man, not Mr. Kononov himself, but someone going to meet the "former defense minister," was injured in the attempt.

And tactical influence operations have begun.

Old-school psychological operations relied on leaflets, loudspeakers, and radio broadcasts. Ukrainian troops are now reported to be on the receiving end of an updated, new-school variant: text messages and social media posts. Freelance journalist Olga Tokariuk tweeted this report: "Psychological warfare in action: Ukrainian soldiers on the frontline start getting text messages telling them that Russian troops have an order to advance and advising them to flee/surrender. On Telegram, fake 'Ukrainian soldiers' write in broken Ukrainian about demoralized army." Old-school psyops were generally derided, back in the day, as puerile and ineffectual. The new-school version might be more successful: social media and texting have a kind of intimate immediacy a loudspeaker on a helicopter lacks.

A side-note on operations security: soldiers now carry smart phones the way they once carried letters from home.

A different use of intelligence: more public, more focused on preemption, more concerned with operational influence.

MIT Technology Review notes that the US and the UK have, during the recent phases of Russia's hybrid war with Ukraine, been much quicker to attribute cyberattacks to Russian intelligence services. It took only forty-eight hours for the US to announce that it had "technical intelligence" linking the GRU to denial-of-service attacks against Ukrainian banks and government websites. This is a deliberate policy designed to deprive hostile intelligence services of the deniability and cover upon which their operations depend. “I will note that the speed with which we made that attribution is very unusual,” US Deputy National Security Advisor Neuberger said. “We’ve done so because of a need to call out the behavior quickly as part of holding nations accountable when they conduct disruptive or destabilizing cyber activity.” The shift to more overt use of intelligence has been in progress for some time, gaining momentum since GRU and SVR attempts to meddle with US elections in 2016.

Bloomberg also comments on the shift in US policy with respect to the public use of intelligence. In some respects it's preemptive debunking of Russian disinformation, introducing a counter-narrative before the Russian messaging finds its legs. It also serves as an influence operation designed to induce friction into Russian forces at the operational level. When you say, as the US has, that you know Russian forces have received orders to move into the Donbas, you're telling Russian commanders that their communications are compromised. “Vladimir, we’re reading your mail,” is how Bloomberg summarizes the message.

A piece in Lawfire argues that liberal, "rule-of-law" democracies are at an inherent disadvantage with respect to information warfare, since they're loathe to engage in strategic deception and lying propaganda. There's a point to that, of course, but it seems to underestimate the counterfire effect of early debunking. Here's another way to think of influence operations: they amount to marketing in battledress. Why are countries who excel at marketing so often laggards at influence operations? (And contrary to cynical conventional wisdom, marketing and advertising, while they may sell sizzle as much as they sell steak, aren't inevitably or even usually mendacious.) It would seem there's an untapped capability here.

Diplomacy enters a harder, less optimistic phase.

The high-level diplomacy France believed it had arranged between Russia and the US is off. Moscow was ambivalent about a Putin-Biden summit, indicating to French President Macron that it was willing in principle to hold such talks, and then, as TASS was authorized to disclose, moved such talks to the realm of possibility:

"There are no specific plans for a meeting between Presidents Vladimir Putin of Russia and Joe Biden of the United States yet, but it is possible provided that the leaders deem it appropriate, Kremlin Spokesman Dmitry Peskov told journalists on Monday.

'There are no concrete plans in that regard yet,' the presidential press secretary noted speaking of the prospects for a possible Russian-US summit. 'There is the understanding that contacts will be held at the level of foreign ministers. We proceed from the fact that [Russian Foreign Minister Sergey] Lavrov is likely to meet with his US counterpart [Antony Blinken] this week. We also do not exclude contacts between the ministers of Russia and France.'

"'Surely, we do not rule it out, and if necessary, of course, the presidents of Russia and the United States can at any time decide on contacts either by phone or in person. That will be their decision,' Peskov said."

The US isn't playing. Secretary of State Anthony Blinken called off this week's meeting with his Russian counterpart, explaining that Russia's escalation makes the meeting pointless. Newsweek quotes the Secretary as saying, "Now that we see the invasion is beginning and Russia has made clear its wholesale rejection of diplomacy," the talks, which had been planned for Thursday, would be pointless.

TASS had earlier explained that the Minsk Accords were now a dead letter, killed not by Moscow, but by Kyiv with its intransigence and aggressive hostility toward Russia. A solution to the crisis, the Kremlin says, is simple: everyone needs to recognize Russia's annexation of Crimea in 2014 (ratified by plebiscite, just as Germany's annexation of Austria in the Anschluss of 1938 was—Moscow doesn't make the comparison, but it seems apt), the independence of Donetsk and Luhansk (subject to the new "People's Republics'" border negotiations with Kyiv), and the substantial demilitarization of Ukraine. Russian statements ascribe to Ukraine a desire to resume its immediate post-Soviet status as a nuclear power, and they suggest a Western interest in providing Ukraine with tactical nuclear weapons, which is manifestly absurd. And, of course, Ukraine must renounce any prospective membership in NATO, and agree to strict and permanent neutrality.

Ukraine is considering severing diplomatic relations with Russia. That, too, Russia deplores, seeing no grievance that could reasonably motivate such a move by Kyiv.

And, as far as the United Nations are concerned, Foreign Minister Lavrov reacted to the Secretary-General's characterization of Russia's actions as "aggression" by recalling Turtle Bay to what Mr. Lavrov considers a proper understanding of its fundamental principles. "Our colleagues at the UN Secretariat apparently must abide by the decisions adopted by that organization - decisions that are crucial to the implementation of the UN Charter’s principles and goals and decisions that were made unanimously on the basis of consensus, in other words, by all UN member-states without an exception." That is, everybody must agree, and everybody can't be everybody without us.

Western sanctions accumulate (but "incrementally" and "proportionately").

Germany's refusal to certify the Nord Stream 2 pipeline, a move that blocks a substantial increase in Russian sales of natural gas to Europe, was the first and most consequential of the sanctions imposed as the week began. TASS communicated the Kremlin's "regret" over the decision, quoting spokesman Dmitry Peskov to the effect that "This is a purely economic, commercial project, which is also called to become a stabilizing element for the gas market in Europe further to mutual benefit, and both suppliers and consignees of our gas, in the first instance Germany and other European states, are interested in it."

Other sanctions have aimed to reduce Russian access to global financial and capital markets. The Telegraph reports that Britain has imposed what Prime Minister Johnson describes as the "first barrage" in its own sanctions program, singling out five banks and three "high-net-worth individuals," specifically Rossiya Bank, İşbank, General Bank, Promsvyazbank and the Black Sea Bank, and then oligarchs Gennady Timchenko, Boris Rotenberg and Igor Rotenberg. "Any assets they hold in the UK will be frozen," Prime Minister Johnson said. "The individuals concerned will be banned from travelling here and we will prohibit all UK individuals and entities from having any dealings with them." He signaled that other sanctions are being held in reserve. "This is the first tranche, the first barrage of what we are prepared to do and we hold further sanctions at readiness to be deployed alongside the United States and the European Union if the situation escalates still further."

The EU has, according to the AP, sanctioned the three-hundred-fifty-one members of the Duma who voted for recognition of Donetsk and Luhansk, and also twenty-seven other Russian institutions and individuals from the defense and banking sectors. (President Putin himself was not among them.)

And the US introduced further sanctions beyond those already imposed Monday that prohibited US persons from doing business with the two Ukrainian provinces Russia is seeking to detach. The newest measures are designed to punish Russian oligarchs and impede Moscow's ability to sell sovereign debt. Administration officials say they're holding more (and more severe) sanctions in reserve, but, the Telegraph reports, critics call the limited measures "appeasement." S&P Global records informed speculation that the incremental approach may be at least in part motivated by concerns about economic blowback.

Bloomberg quotes a US Treasury Department source as calling the US sanctions "incremental," and EU members who moderated the sanctions Europe imposed described their approach as "proportionate." Both Europe and the US appear to be holding their most severe sanctions in reserve against what some are describing as a "full-scale invasion," that is, a military operation aimed at the conquest and subjugation of Ukraine as a whole. The sanctions so far imposed seem unlikely to deter further Russian intensification of its hybrid war; the Western allies may have forfeited what deterrence theorists call "escalation dominance." Bloomberg quotes an Atlantic Council senior fellow, Brian O'Toole, to that effect: “We must wait to see if the U.S. will impose the impact they’ve promised for further aggression and how that is defined. I fear at the moment that Putin may not think the West has the stomach to follow through.” The New York Times offers reason to think Russia may be more resilient in the face of sanctions than Western governments might hope: Putin's been saving up for this day since he invaded Crimea in 2014.

The Guardian has a roundup of pessimistic takes on the prospect of sanctions succeeding either as deterrent or influence. Forbes speaks with various experts who think the US sanctions so far announced do too little. They offer advice on what the sanctions should have been and might yet be:

• In a cold-blooded calculation, sanctions should hurt the broader Russian population, not just the oligarchs.
• Where sanctions do hit the oligarchs, they must do so in ways that immediately affect their finances.
• Mr. Putin's personal wealth should be attacked wherever possible.
• Russia should be more rigorously excluded from global finance. In particular, it should be denied access to the SWIFT funds transfer system.

For what it's worth, some rusticated politicians in both the US and the UK are second-guessing their governments' policies during the crisis. Former US President Trump says the invasion of Ukraine would never have happened on his watch. In the UK, former Labour leader Jeremy Corbyn deplores Russian troop movements but leaves small doubt about where the blame lies, denouncing British policy for having played a "provocative role" in the crisis. (Mr. Trump's take on events is overdetermined by familiar self-confidence and amour-propre, in addition to whatever substantive critique he may have. In any case, the White House didn't think much of the characterization of Mr. Putin's gradualism as "genius." Also for what it's worth, former US National Security Advisor John Bolton thinks that, while President Biden isn't handling the crisis well, President Trump wouldn't have done much better. Mr. Corbyn's would seem to have its roots in the old left. He's long shown a Russophilia that seems inexplicable except as a nostalgic transfer of sentimental allegiance from the old Soviet Union to post-communist Russia.)

Economic effects of the crisis may have a significant cyber dimension.

Russia has warned that countries imposing sanctions will themselves face the economic consequences of their actions, and the US has acknowledged that the sanctions may well have consequences for the West as well as for Russia, likely to be felt in energy and raw material prices. Forbes sees looming inflationary pressure across a range of commodities, and reports concerns that such pressure would soon manifest itself in equities markets.

The hybrid war against Ukraine, especially the most recent Russian encroachments into the Donbas, have had a predictably adverse effect on global economic conditions. The Washington Post summarized yesterday's indicators at market close: "The Dow Jones industrial average slumped 482.57 points, or 1.4 percent, to close at 33,596.61. The broader S&P 500 index dropped 1 percent, or 44.11 points, to land at 4,304.76. The tech-centric Nasdaq fell 1.2 percent, or 166.55 points, to settle at 13,381.52." Markets typically respond sharply to bad news, and then partially correct themselves. This appears to have happened in Russian markets, which would be expected to be unusually sensitive to international sanctions and their attendant odium. Russian stocks and the ruble did indeed fall, but, according to Bloomberg, have now stabilized as speculators come to an assessment of sanctions' probable effects.

Cyber operations against Western targets are considered likely, the Wall Street Journal notes, and policymakers and the security industry advise businesses to take prudent steps to protect themselves. Moody's Investors Service has taken a look at the cyber implications of the crisis, which it sees as central to assessing credit quality. Its analysts have concluded that attacks on critical infrastructure are a high risk, in terms of consequence, vulnerability, and likelihood. "Critical infrastructure is a likely target of cyberattacks amid ongoing Russia–Ukraine tensions for two reasons. First, the Russian government has a history of launching cyberattacks on critical infrastructure, according to a wide spectrum of cybersecurity experts; and second, these types of attacks are typically more damaging for a country than are attacks on other targets." The report explains the probable forms such attacks on critical infrastructure might take:

"Ukraine has been a testing ground for Russia’s cyber capabilities for at least the past decade, with critical infrastructure a frequent target. Critical infrastructure sectors include food and agriculture, energy, healthcare, emergency services, chemicals, dams, financial services, information technology, nuclear reactors, transportation systems, and water and wastewater systems. According to cybersecurity experts and government officials around the world, Russia stepped up cyberattacks against Ukraine in 2013-14 when protests led to the ouster of a government that was close to the Kremlin. These attacks escalated against the backdrop of military action in Crimea and eastern Ukraine. The most well-known of these cyberattacks, attributed to Russia's military foreign intelligence agency (GRU), targeted Ukraine's energy grid in December 2015. The attack caused hours-long blackouts in Kyiv and western Ukraine. A year later, a similar attack cut power to customers in parts of Kyiv. That outage lasted only an hour, but cybersecurity experts believe malware used in the attack was capable of causing additional damage that could have led to physical harm and equipment destruction."

What about the risks cyberattacks might pose to credit quality? Moody's Investors Service finds corporations notably more exposed than governments, which enjoy large, diversified economies and financial resources that cushion the shock of any particular incident and in general render them more resilient. To date, their analysts say, they've seen only limited risk to government credit quality. That, however, could change under certain circumstances:

"For sovereigns [that is, states], the credit implications of a significant cyberattack would most likely be reflected in higher susceptibility to event risk through the political risk channel. A major cyberattack could also weaken a sovereign’s credit profile by exposing a weaker institutions and governance strength framework. If an attack were to significantly damage critical infrastructure for a long period of time, that could detract from a sovereign's economic strength. Also, a sovereign's fiscal strength could worsen if a cyberattack results in very high financial costs for the government. For regional and local governments (RLGs), the main impact of a major cyberattack would likely be on economic fundamentals and financial performance, given the smaller size of RLGs compared with sovereigns."

The report also sees NotPetya as providing an example of the way in which a cyberattack would in all likelihood not remain confined to a specific geographical region. In the case of NotPetya, for example, large multinationals became channels through with malware delivered as the payload in a maliciously modified Ukrainian tax preparation software package spread well beyond the initial points of infestation. Not only were the multinationals themselves affected, but their customers were as well. Moody's writes, "the Federal Reserve Bank of New York identified 233 customers of the eight companies shown in Exhibit 2 that were exposed to the NotPetya attack through their supply chains. The New York Fed found that the affected downstream customers recorded significantly lower profit relative to similar but unaffected firms as a result of the cyberattack, drew down credit lines with banks, and terminated their business relationship with the affected multinationals."

Nor should businesses count on being able to transfer the risk of cyberattack to their insurance carriers. Cyber exclusion clauses are growing increasingly common, cyber coverage has tended to migrate away from more traditional lines of coverage to cyber-specific policies (which generally offer lower coverage limits). Such policies now commonly have war or hostile action exclusions, and insurance associations have developed and shared model exclusion clauses.

What does the wisdom of markets tell Moody's? That the big risk lies in cyberspace: "Heightened tensions between Russia (Baa3 stable) and Ukraine (B3 stable) are raising the risk of more frequent and severe cyberattacks against Ukraine and potentially other targets. Our baseline expectation is that geopolitical tensions will remain high in the region but not escalate into an outright military conflict given the economic and military costs that Russia would incur. Nonmilitary aggressive measures such as cyberattacks remain highly likely."