• Cyberattacks are tools of national power, not just tech crimes.
• Modern cyber tactics echo old ones — espionage, sabotage, propaganda.
• Cyberweapons aren't magic bullets; success isn't guaranteed.

Cybersecurity is often presented as a technical problem - patch vulnerabilities, deploy tools, detect intrusions, and keep attackers out. In Code War: How Nations Hack, Spy, and Shape the Digital Battlefield (Wiley), Allie Mellen makes a compelling case that this understanding is far too narrow. Based on cybersecurity attacks of the past 20 years, she may be on to something.

Cybersecurity attacks are not simply digital crimes committed by highly skilled individuals. Increasingly, they are instruments of national power, used by nation states to advance their political, military, economic, and strategic objectives. Mellen is a Forrester Research analyst who covers security operations, nation-state threats, and the use of automation, machine learning, and AI in security tools. She’s written an engaging book meant for individuals, business professionals, and government officials, particularly leaders who need to understand nation-state cyberattacks.

An interesting element of the book is its comparative approach. Mellen focuses particularly on the US, Russia, and China, examining not merely what these countries do in cyberspace, but why they do it. Their approaches reflect their different histories, political systems, military doctrines, and visions of national power.

China views the Internet largely as an extension of state authority and social control. Russia has incorporated cyber operations into a broader hybrid-warfare strategy, combining espionage, disinformation, disruption, and conventional military force. The US, by contrast, must balance national security and offensive capabilities with economic interests, individual freedoms, and an open Internet.

Just this week, Reuters reported that China's state-owned shipping giant COSCO uses concealed equipment on board its ships to spy on military communications near the coastlines of ‌target nations including the US.

The book provides a good overview of some of the most significant cyberattacks, including Stuxnet, WannaCry, NotPetya, attacks against elections, Sony Pictures hack, and cyber operations associated with the war in Ukraine.

Rather than treating these events as isolated technical incidents, she places them within the larger geopolitical contests that produced them. The result is a reminder that attribution alone is not enough. To understand cyberattacks, one must also understand their strategic objective.

The book does a good job of placing these events from their historical perspective. Mellen demonstrates that many supposedly new forms of cyber conflict are actually technological adaptations of much older techniques: espionage, propaganda, sabotage, psychological warfare, and attempts to manipulate an adversary's population. Technology has changed dramatically; human motivations have not.

The chapters on Russia are particularly illuminating. Mellen identifies a recurring combination of disruption, espionage, psychological operations, and destructive malware. The war in Ukraine provides perhaps the clearest demonstration of how these capabilities can operate alongside conventional military power. Cyberwarfare is therefore not necessarily a separate battlefield. It can be another component of the same conflict.

The book is also valuable because, contrary to what the media often portrays, it avoids portraying cyberattacks as magical weapons, as they have limitations. They can be expensive, difficult to conceal, and unpredictable in their consequences. A successful intrusion does not necessarily translate into strategic success. Understanding those limitations is essential for policymakers and business leaders deciding how much attention and money to devote to cyber defense.

The book emphasizes the US, Russia, and China, leaving some important actors comparatively underdeveloped. Namely, Iran and North Korea. While the book does discuss them, and she writes that North Korea’s campaigns to steal cryptocurrency have become a defining feature of its foreign policy, more details on North Korea and Iran would have been valuable.

Code War succeeds because it moves the discussion of cybersecurity beyond passwords, malware, vulnerabilities, and firewalls and into the realm where cyber risk increasingly belongs - geopolitics and national strategy.

Code War is a really good introduction to the increasingly important intersection of cybersecurity and international affairs. It will appeal not only to cybersecurity professionals, but also to executives, policymakers, government officials, and anyone who wants to understand how nations are fighting for power in a world where the battlefield is increasingly made of code.