iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Cybergames are contests conducted through digital networks in which governments, intelligence services, companies, criminals and ordinary users can all become actors. A company may volunteer support, resist a government demand, comply with lawful data requests, disrupt an operation, or become an unwitting foothold for espionage. The difficult cases are the last two: a business can be helping a state operation without realizing it, and a tool built for one government can later be reused against another.
This framework comes from Oleg Brodt’s analysis, “Cyberspace, Cybergames, and Cyberspies,” published by Dark Reading on September 29, 2021. The incidents below are presented as examples from that analysis, not as newly verified findings.
What are cybergames?
In Brodt’s formulation, cyberspace has become “a global cybergames stage, where all of us are actors.” The phrase describes strategic competition carried out through software, networks, data, devices and online identities rather than only through conventional military forces.
A cybergame can involve intelligence collection, influence, surveillance, sabotage, vulnerability research or legal pressure. The participants do not share the same objectives or level of awareness. A national intelligence service may deliberately exploit a weakness; a technology company may disclose that weakness and stop the campaign; a supplier may unknowingly distribute compromised equipment; and a customer may be caught in the resulting spillover.
#1 Best Overall
The central question is therefore not simply “Which country conducted the hack?” It is also: What role did each company play, did it know about that role, and could the capability be turned against someone else?
The five roles companies can play
| Role | Awareness | Agency | Typical mechanism | Illustrative examples in Brodt’s 2021 analysis | Main spillover risk |
|---|---|---|---|---|---|
| Active assistance | Knowingly involved | Voluntary or paid cooperation | Data access, interception or a deliberately weakened security control | Brodt cites reporting about an alleged NSA relationship with RSA and AT&T assistance with network wiretapping and email access. | A capability created for one intelligence service can expose many other users or be reused by another state. |
| Reluctant participation | Knowingly involved but opposed | Resistance through courts, petitions or policy | Refusal or limitation of requested access | Microsoft is presented as a prominent example of resisting assistance with government cyberwar efforts. | Legal conflict can delay decisions while pressure on the company and its customers increases. |
| Cyber laissez-faire | Usually aware of a legal obligation, but not necessarily of the wider operation | Compliance with compulsory disclosure | Turning over information about intelligence targets | Brodt discusses PRISM-related disclosures and names Apple and Yahoo among companies mentioned in leaked documents. | Customers may not know what data was requested, under what authority, or how it was used. |
| Interference | Knowingly opposed to the operation | Defensive or investigative action | Patch, mitigation, public attribution or exposure of a state-linked exploit | Google is described as mitigating and publicizing zero-day exploitation attributed in the article to a Western state actor; Symantec’s 2010 Stuxnet reporting is cited as an earlier example. | Disclosure can protect victims while also revealing investigative methods or triggering retaliation. |
| Unwitting participation | Unaware or deceived | No intentional cooperation | Compromised software, hardware, accounts or suppliers | SolarWinds and ASUS are used as hacked access points; Cisco and Crypto AG are cited in connection with malicious hardware or supply-chain compromise. | One trusted vendor can distribute access to thousands of downstream organizations. |
How a company can help a government without knowing it
Unwitting participation usually begins with trust. Customers trust a software update, a network appliance, a managed service provider, an employee account or a hardware component. If an attacker compromises that trusted point, the customer’s normal behavior—installing an update, connecting a device or accepting a vendor’s support session—becomes the delivery mechanism.
Compromised software and service providers
Brodt uses SolarWinds as an example of an organization whose legitimate distribution channel was abused to reach its customers. In this pattern, the victim does not have to visit a malicious website or open an obviously suspicious attachment. The attack rides through a product or service the organization already considers legitimate.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Compromised hardware and cryptographic equipment
The analysis also names Cisco and Crypto AG when discussing malicious hardware or supply-chain compromise. Hardware-level manipulation is especially difficult for customers to detect because inspection, replacement and independent verification can be costly, and the device may perform its advertised function while quietly enabling access.
Hijacked online identities
Not every supply-chain operation targets code or equipment. Brodt describes Facebook disrupting an Iran-linked campaign that used fake profiles to lure defense contractors to infected websites. Here, the platform’s reach and users’ assumptions about who they were speaking with formed part of the attack path.
Why state cyber tools create “double-edged” risk
The opening example in Brodt’s article concerns an alleged Juniper Networks backdoor reportedly installed to provide NSA access and later abused by a Chinese-sponsored group. The lesson is broader than that allegation: a weakness introduced for one government’s access does not remain under that government’s control forever.
Once a vulnerability, bypass or secret key exists, it can be discovered, copied or independently rediscovered. A feature intended for national-security collection can therefore become an avenue for criminal theft, espionage by another state or attacks on ordinary customers. This is the “spillover” problem: the original operator may gain access, but everyone who relies on the affected technology inherits the risk.
Free tools Windows power users keep installed
One-click scans. No signup required.
What the five roles mean for accountability
Voluntary cooperation
When a company knowingly builds access or supplies intelligence, responsibility turns on authorization, oversight and disclosure. Brodt’s discussion of RSA and AT&T illustrates why customers and lawmakers ask whether cooperation was voluntary, legally compelled, narrowly targeted or concealed.
Resistance and legal compulsion
Microsoft’s example shows that a company can contest a government request rather than treat every demand as a technical instruction. The practical boundary between resistance and compliance depends on the applicable law, the jurisdiction, the data involved and the company’s ability to challenge the order.
Defensive disclosure
Google’s and Symantec’s examples show another accountability route: identify the activity, mitigate the vulnerability and inform users or the wider security community. Public attribution is not the same as judicial proof, so readers should distinguish a company’s technical assessment from a final finding by a court or government investigation.
Unwitting compromise
A compromised vendor is not automatically a willing participant. Investigators must separate the attacker’s actions from the supplier’s security failures, the supplier’s knowledge at the time and any later decisions about notification, remediation and transparency.
How supply chains pull ordinary businesses into espionage
Supply-chain risk is the multiplication effect of trust. A single supplier may serve many organizations, so an intrusion at that supplier can provide a larger and less visible reach than attacking each customer separately.
- Build systems: An attacker inserts malicious code before a product is released.
- Updates: A legitimate update channel distributes altered software.
- Third-party services: A provider’s credentials or remote-management tools open access to customers.
- Hardware: Components, firmware or manufacturing processes contain hidden functions or tampering.
- Human networks: Fake identities and compromised accounts persuade people to visit hostile sites or disclose information.
Companies can reduce, but not eliminate, this exposure by keeping an inventory of suppliers and privileged connections, limiting vendor access, verifying software provenance and update signatures, separating critical networks, monitoring unusual administrative activity, and requiring prompt incident notification in contracts. These measures address the path of compromise; they cannot prove that a supplier was never targeted or that a sophisticated intrusion is impossible.
Best Value
Questions to ask when a company appears in a state cyber operation
- Was the company aware? Evidence of attacker access is not evidence of company consent.
- What was the mechanism? Separate data disclosure, interception, cryptographic weakness, exploit use, platform manipulation and supply-chain compromise.
- What authority applied? Distinguish a court order or statutory duty from a secret arrangement or voluntary assistance.
- Did the company resist or disclose? Look for litigation, petitions, technical mitigations, customer notices and public reporting.
- Could the capability be reused? Ask whether another government or criminal group could exploit the same weakness.
- Who bears the downstream risk? Map the customers, users and suppliers that rely on the affected product or service.
Why attribution and blame remain contested
Brodt concludes that cyber-spying capabilities are becoming a global commodity and that reciprocal accusations involving the United States, China, Russia and their companies are pushing the “blame game” out of control. Attribution is difficult because attackers use compromised infrastructure, stolen credentials, rented services and copied tools. A company may identify a campaign as consistent with a state-linked group without being able to establish, publicly and conclusively, who ordered it.
That uncertainty does not make the incident harmless. It means readers should keep three statements separate: what was technically observed, what investigators infer about the operator, and what a government or court has formally established.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
