Sanctions “Toxify” Nation-State Cyber Operations, But Can’t Stop Them

According to Infosecurity Magazine, a new report from the Royal United Services Institute (RUSI) reveals that cyber-related sanctions alone typically fail to disrupt malicious cyber activities but can “toxify” networks of state-backed actors. The report, published on October 28 and stemming from the first meeting of the RUSI Cyber Sanctions Taskforce in September, involved current and former government officials from the UK, US, and EU discussing sanctions’ role in countering state cyber threats. The research found that while sanctions form a growing part of government deterrence strategies, they’re insufficient alone to disrupt cyber-attacks or espionage campaigns. However, sanctions can alter adversary behavior by forcing underground networks to distance themselves from named actors, complicating operations and making them less rewarding. The report specifically noted the EU’s cyber sanction regime has only designated 17 individuals and four entities since 2019 due to requiring unanimity among all 27 member states. This comprehensive analysis reveals both the potential and limitations of economic pressure in cybersecurity.

The “Toxification” Effect in Practice

The concept of “toxifying” cyber operations represents a sophisticated understanding of how economic pressure works in the digital realm. Unlike traditional sanctions that aim to completely block activities, the toxification effect creates what security professionals call “friction costs” – making every aspect of malicious operations more difficult and expensive. When economic sanctions target key individuals or entities, the ripple effects extend throughout their operational ecosystem. Service providers, cryptocurrency exchanges, and technical suppliers become reluctant to work with sanctioned actors, forcing threat groups to constantly rebuild their infrastructure and relationships. This doesn’t stop determined nation-states, but it significantly increases their operational overhead and reduces their agility.

The Attribution Problem Undermining Sanctions

One critical limitation the report touches on but doesn’t fully explore is the fundamental challenge of attribution in cyberspace. Effective sanctions require confident attribution, but sophisticated state actors excel at obfuscating their involvement through false flags, proxy relationships, and technical deception. The Royal United Services Institute report mentions recent attributions by France and Czechia, but these represent the exception rather than the rule. Many nations remain hesitant to publicly attribute cyberattacks due to intelligence source protection concerns and the political ramifications of accusing other states. This creates a fundamental tension: sanctions require public evidence, but intelligence agencies prefer to protect their methods and sources.

Europe’s Collective Action Problem

The EU’s struggle with cyber sanctions highlights a deeper structural issue in multinational security cooperation. The requirement for unanimity among all 27 member states means that sanctions often represent the lowest common denominator rather than a strategic response. Different nations have varying threat perceptions, economic relationships with targeted countries, and intelligence capabilities. Some European Union members may prioritize maintaining diplomatic or trade relationships over imposing cybersecurity consequences. This fragmentation creates safe havens within the sanctioning coalition itself, allowing malicious actors to route operations through countries with weaker enforcement or different political priorities.

The Critical Private Sector Dimension

Beyond government action, the private sector’s role in sanction enforcement deserves greater emphasis. The report mentions that sanctions affect private sector intermediaries, but this understates their crucial position in the cybersecurity ecosystem. Technology companies, cloud providers, financial institutions, and cybersecurity firms often have better visibility into malicious activities than governments. When these organizations voluntarily withdraw services from sanctioned entities based on their own threat intelligence, they create a powerful complementary enforcement mechanism. However, this also raises concerns about due process and transparency when private companies effectively become sanction enforcers without proper oversight or appeal mechanisms.

Long-Term Strategic Implications

The RUSI findings suggest we’re witnessing the maturation of cyber sanctions as a tool of statecraft, but one with inherent limitations. Looking forward, nations will likely develop more sophisticated approaches that combine sanctions with other instruments. We may see “smart sanctions” that target specific technologies or infrastructure rather than just individuals, or graduated sanction regimes that escalate based on the severity of cyber incidents. The most effective approach will likely involve closer integration between intelligence agencies, law enforcement, diplomatic channels, and private sector partners to create multiple layers of pressure that collectively raise the cost of malicious cyber activities beyond what any single tool can accomplish alone.