A look at volunteer hackers in the Russia-Ukraine war with unverifiable identities and locations, blurring the line between amateurs and groups linked to states
The hackers have claimed a number of disruptions over the past week, blurring the lines between amateurs and groups linked to governments.
Context & Ripple Effects
The volunteer-hacker wave did not start spontaneously: days into the invasion, Ukraine put out a call for its hacker community to defend critical infrastructure and spy on Russian troops, formalizing a civilian role in cyber conflict. This piece adds the harder question — many of these volunteers are scattered globally with unverifiable identities, so neither side nor outside observers can say who is actually behind claimed disruptions.
The ambiguity cuts both ways because Russia spent years building exactly this kind of deniability: reporting has documented its recruitment of convicted hackers, scientists, and outside firms and the loose alliance between its criminal hackers and intelligence services operating since around 2005. When amateurs and state proxies look identical, every claim of disruption becomes attribution-proof.
First-order effects
- Both governments gain plausible deniability by default: Ukraine's recruited volunteers and Russia's long-cultivated criminal networks are now indistinguishable in the attack record, so claimed disruptions cannot be pinned on either state or punished as state action.
- Defenders of Russian and Ukrainian targets lose the ability to prioritize threats, since an intrusion might be a lone amateur or a state-linked group using amateur cover.
Second-order effects
- Russia's two-decade model of outsourcing operations to criminal hackers — once a distinctive asymmetry — is now being mirrored by Ukraine's open recruitment, pushing both sides toward larger, looser proxy networks rather than in-house military units.
- Governments outside the conflict face pressure to treat any volunteer-claimed attack as potentially state-directed, since unverifiable identities make diplomatic responses to 'civilian' hacks nearly impossible to calibrate.
Third-order effects
- If the pattern holds, wartime cyber mobilization normalizes what was previously off-limits — coverage notes hacking Russian targets was once considered out of bounds by some hackers — eroding the informal norm that kept most cyber conflict state-to-state.
- The structural endpoint is a standing gray zone in which states maintain deniable volunteer surrogates as standard practice, forcing attribution and deterrence frameworks built for named state actors to be rebuilt around unidentifiable collectives.
The trend: Cyber warfare is shifting from identifiable state units toward deniable volunteer-proxy networks, with Russia's criminal-hacker alliance becoming a template both sides now imitate.