Stage Zero: Pre-positioning

February 28th, 2026, Israel and the U.S. launched “Operation Roaring Lion” and “Operation Epic Fury” against Iran¹. Iran began destructive cyberoperations against U.S. critical infrastructure and corporate targets. Iranian-affiliated group Handala began wiping approximately 80,000 Stryker devices via Intune by March 11². CISA released the advisory AA26-097A³ in detail on April 7th. The terrain was already prepared at least since 2023 by CyberAv3ngers as PLCs and other OT components were hijacked and remained undetected.

This wasn’t an escalation. The infrastructure was already in place.

What Cyberspace Actually Is

In 1964, RAND Corporation released “On Distributed Communications: I. Introduction to Distributed Communications Networks”⁴ where the author, Paul Baran, researched how to build networks that survive partial failure, which he called a “survivable network.”

Baran designed it to maintain communications under enemy attack, including nuclear strikes.

ECHELON, a Five Eyes signals intelligence network for intercepting and processing communications, became operational by 1971⁵.

First the infrastructure was built for conflict, then it was instrumented for collection.

President Barack Obama signed PPD-20 in October 2012, authorizing the planning, development, and use of cyber capabilities, including both defensive and offensive operations⁶.

In the modern era post-2018, the U.S. doctrine dictates operating inside adversary networks proactively. Not as a response to a new threat but a formalization of what was already happening⁷.

There is no civilian internet. There is contested terrain that civilians were given access to.

The Pre-positioning Doctrine

Volt Typhoon infiltrated for years inside U.S. critical infrastructure such as water, energy and communications before being disrupted by the FBI⁸. The same happened with “Operation Masquerade”⁹ some months ago, as detailed in the CISA advisory.

CISA used the term “pre-positioning”.

In Geneva, December 2024, Chinese officials indicated that Volt Typhoon was linked to U.S. support for Taiwan¹⁰. Separately, China publicly denies any involvement with Volt Typhoon.

PLA’s Science of Military Strategy, the 2020 edition, calls for paralyzing adversary C4ISR architecture at the earliest stages of a conflict to seize operational initiative¹¹.

The contradiction is the actual doctrine.

On February 28th Iran showed what happens when pre-positioning ends and the destructive phase begins.

Handala claimed 200,000 devices were wiped and 50TB of data stolen. Independent reporting confirmed approximately 80,000 Stryker devices across 79 countries.

Iranian-affiliated actors exploited CVE-2021-22681 across more than 7 states, disrupting PLCs through malicious files and manipulation of data on HMIs and SCADA systems.

Russia’s Sandworm took it further in Ukraine post-2022 as cyberattacks on power grids coincided with missile strikes on critical infrastructure. This is not opportunism but coordination¹².

The states that attribute pre-positioning are also the states that pre-position. Stuxnet, under “Operation Olympic Games” was a joint NSA and Unit 8200 operation against Iran since 2007¹³. NSA was inside Huawei since 2007 (SHOTGIANT)¹⁴, planting backdoors in routers and firewalls sold to third countries. NSA’s TAO/ANT catalog¹⁵ contained more than 100 implant tools including supply chain interdiction, intercepting hardware shipments to install backdoors before delivery.

The Geneva Duality

China’s CVERC released reports denying Volt Typhoon, claiming it is fabricated. They also claim that the CIA’s Marble framework was used by the U.S. to stage false flag operations¹⁶.

Western governments and cybersecurity firms reject this, attributing Volt Typhoon to China.

But in December 2024, in Geneva, China privately indicated Volt Typhoon was linked to Taiwan¹⁰.

Both statements are operational. The public denial is for the international audience. The private confirmation is deterrence.

Neither is true or false. Both are doctrine.

Russia uses a more direct method by denying everything and dismissing it as “frenzied russophobia”, while conducting hybrid operations in real time.

The U.S. accuses other major actors like Russia, China or Iran of pre-positioning while it pre-positions in enemy networks as documented in the previous section.

The UN OEWG spent 21 years negotiating rules, norms, and principles of responsible state behavior in cyberspace. Negotiations occurred while states were pre-positioning against each other without rules¹⁷.

Kaspersky exposed Equation Group (NSA) in 2015, being the only major vendor to do so¹⁸.

Attribution has jurisdiction.

The Bubble

In 1994, the U.S. mandated wiretap backdoors in telecommunications. In 2005, it expanded to ISPs. This was known as CALEA¹⁹.

In 2024, Salt Typhoon used those exact backdoors to compromise more than 9 U.S. telecommunications companies. Millions were tracked in real time²⁰.

The tool built to watch became the tool used to be watched through. This is the consequence of building access into contested infrastructure.

STELLARWIND was a warrantless surveillance program authorized by President George W. Bush after September 11. The NSA collected domestic wiretaps, phone records, and internet metadata without judicial oversight. The legal framework was built after the infrastructure was already operational²¹.

In the EU, Chat Control 1.0 expired and was re-passed in July 2026²². Chat Control 2.0 is next. This occurred the same week the ECB selected 36 providers for the digital euro pilot²³.

The UK issued a notice ordering Apple to backdoor iCloud encryption²⁴. The Online Safety Act mandates device-level scanning²⁵. The government states these measures should not compromise data privacy, except that Apple pulled encryption for UK users and Signal threatened to leave.

In the U.S., Congress reauthorized Section 702 of the FISA in April 2024 through the RISAA. Section 702 allows the NSA to target non-citizens outside the U.S. without a warrant. This is also used by the FBI for warrantless searches on BLM protesters, journalists, and 19,000 political donors²⁶.

Every legislative surveillance tool is an access point to this contested terrain.

NSA confirmed that adversaries are collecting encrypted traffic for future quantum decryption. Under the NSA’s CNSA 2.0, the year 2030 is a major deadline for algorithm replacement. They know the timeline because they’re running the same program on the other side.²⁷.

Flock deployed 100,000 cameras across more than 5,000 law enforcement agencies as neighborhood security. CBP accessed the network through undisclosed pilot programs²⁸.

A Texas deputy searched 83,345 cameras nationwide for a single case.

Clearview AI claims to have scraped more than 70 billion images and is deployed across more than 2,000 U.S. agencies²⁹.

The facial recognition database exists whether you consented or not.

Palantir integrates ALPR data, facial recognition, financial transactions, comms intercepts, and travel records into one analytical layer³⁰ ³¹.

China’s i-SOON serves a parallel role as a private contractor doing intelligence work for the state³².

CISA has lost roughly 1,000 employees, about a third of its workforce, since early 2025, with an additional $707M budget cut proposed for FY2027³³.

The defense is being defunded while the attacker is documented and active.

Harvest Now, Exploit Later

189 devices inside a German military installation. Personnel at Germany tracked to off-base locations. Individual service members identified through commercial data. None of it came from classified environments, only from data brokers³⁴.

Every bit written to cyberspace will be used against individuals, not based on who they are, but on the value they represent to whoever holds that information.

305 GRU officers were identified through a car registration database. One individual’s exposure cascaded into an entire unit being burned³⁵.

The individual is not a bystander on the network. The individual is being used in real time.

Stage Zero

On this battlefield, there is no front line. Civilians and non-civilians share the same ground.

The civilian bubble exists not because the terrain is safe but because the war hasn’t reached your address yet.

Every state knows this. Every state does this.

The next terrain being prepared is monetary.

The Soufan Center (2026) - “Cyber Operations as Iran’s Asymmetric Leverage” - https://thesoufancenter.org/intelbrief-2026-march-17/ ↩
Krebs on Security (2026) - “Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker” - https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/ ↩
CISA (2026) - “Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (AA26-097A)” - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a ↩
RAND Corporation (1964) - “On Distributed Communications: I. Introduction to Distributed Communications Networks (RM-3420)” - https://www.rand.org/pubs/research_memoranda/RM3420.html ↩
European Parliament (2001) - “Report on the existence of a global system for the interception of private and commercial communications (ECHELON interception system)” (A5-0264/2001) - https://www.europarl.europa.eu/doceo/document/A-5-2001-0264_EN.html ↩
The Guardian (2013) - “Obama orders US to draw up overseas target list for cyber-attacks” - https://www.theguardian.com/world/2013/jun/07/obama-china-targets-cyber-overseas ↩
U.S. Department of Defense (2018) - “Summary: Department of Defense Cyber Strateg y 2018” - https://dodcio.defense.gov/Portals/0/Documents/Library/CyberStrategy2018.pdf ↩
CISA (2024) - “PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)” - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a ↩
Lumen Black Lotus Labs (2026) - “FrostArmada: Forest Blizzard DNS Hijacking” - https://www.lumen.com/blog-and-news/en-us/frostarmada-forest-blizzard-dns-hijacking ↩
The Wall Street Journal / CPO Magazine (2024) - “WSJ: China Admitted to Volt Typhoon Cyber Attacks in Secret Meeting” - https://www.cpomagazine.com/cyber-security/wsj-china-admitted-to-volt-typhoon-cyber-attacks-in-secret-meeting/ ↩ ↩²
PLA Academy of Military Science (2020) - “Science of Military Strategy (战略学)” via FPRI (2025) - “China’s Cyber Playbook for the Indo-Pacific” - https://www.fpri.org/article/2025/08/chinas-cyber-playbook-for-the-indo-pacific/ ↩
Google Threat Intelligence / Mandiant (2023) - “Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology” - https://cloud.google.com/blog/topics/threat-intelligence/sandworm-disrupts-power-ukraine-operational-technology ↩
The New York Times / David E. Sanger (2012) - “Obama Order Sped Up Wave of Cyberattacks Against Iran” - https://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave-of-cyberattacks-against-iran.html ↩
The New York Times / David E. Sanger and Nicole Perlroth (2014) - “N.S.A. Breached Chinese Servers Seen as Security Threat” - https://www.nytimes.com/2014/03/23/world/asia/nsa-breached-chinese-servers-seen-as-spy-peril.html ↩
Der Spiegel / Jacob Appelbaum et al. (2013) - “Shopping for Spy Gear: Catalog Advertises NSA Toolbox” - https://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-doors-for-numerous-devices-a-940994.html ↩
China’s National Computer Virus Emergency Response Center / CVERC (2024) - “Volt Typhoon III: Unraveling Cyberespionage and Disinformation Operations” - https://www.cverc.org.cn/head/zhaiyao/futetaifeng3_EN.pdf ↩
UNIDIR (2026) - “Unpacking the United Nations Open-Ended Working Group on ICT in the Context of International Security (2021-2025)” - https://unidir.org/publication/unpacking-the-united-nations-open-ended-working-group-on-ict-in-the-context-of-international-security-2021-2025/ ↩
EFF (2015) - “Russian Researchers Uncover Sophisticated NSA Malware” - https://www.eff.org/deeplinks/2015/02/russian-researchers-uncover-sophisticated-malware-equation-group ↩
EFF (2024) - “The Salt Typhoon Hack Shows There’s No Security Backdoor That’s Only for the ‘Good Guys’” - https://www.eff.org/deeplinks/2024/10/salt-typhoon-hack-shows-theres-no-security-backdoor-thats-only-good-guys ↩
Congressional Research Service - “Salt Typhoon: Telecommunications Sector Cyberattack” - https://www.congress.gov/crs-product/IF12798 ↩
NSA Inspector General (2009) - “Working Draft: NSA IG Report on the President’s Surveillance Program (STELLARWIND)” (ST-09-0002, declassified 2013) - https://upload.wikimedia.org/wikipedia/commons/4/4a/Nsa-ig-draft-report.pdf ↩
Euronews (2026) - “Chat Control 1.0 passed the European Parliament, through the back door” - https://www.euronews.com/next/2026/07/10/chat-control-10-passed-the-european-parliament-through-the-back-door ↩
European Central Bank (2026) - “ECB selects 36 payment service providers for digital euro pilot” - https://www.ecb.europa.eu/press/pr/date/2026/html/ecb.pr260714~8cd07d9d45.en.html ↩
BBC News (2025) - “Apple pulls data protection tool after UK government security row” - https://www.bbc.com/news/articles/cgj54eq4vejo ↩
BBC News (2023) - “Signal would ‘walk’ from UK if Online Safety Bill undermined encryption” - https://www.bbc.com/news/technology-64584001 ↩
Brennan Center for Justice (2026) - “Section 702 of the Foreign Intelligence Surveillance Act (FISA): 2026 Resource Page ” - https://www.brennancenter.org/our-work/research-reports/section-702-foreign-intelligence-surveillance-act-fisa-2026-resource-page ↩
NSA / Department of Defense (2022) - “Commercial National Security Algorithm Suite 2.0 FAQ” - https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSI_CNSA_2.0_FAQ_.PDF ↩
EFF (2025) - “EFF’s Investigations Expose Flock Safety’s Surveillance Abuses: 2025 Year in Review” - https://www.eff.org/deeplinks/2025/12/effs-investigations-expose-flock-safetys-surveillance-abuses-2025-review ↩
BuzzFeed News (2021) - “How A Facial Recognition Tool Found Its Way Into Hundreds Of US Police Departments, Schools, And Taxpayer-Funded Organizations” - https://www.buzzfeednews.com/article/ryanmac/clearview-ai-local-police-facial-recognition ↩
The Intercept (2017) - “How Peter Thiel’s Palantir Helped the NSA Spy on the Whole World” - https://theintercept.com/2017/02/22/how-peter-thiels-palantir-helped-the-nsa-spy-on-the-whole-world/ ↩
U.S. Congress / Goldman, Wyden, Velázquez (2026) - “Letter to DHS/ICE: Oversight of Palantir Data Surveillance Contracts” - https://goldman.house.gov/media/press-releases/goldman-wyden-velazquez-demand-answers-ice-use-palantir-developed-technologies ↩
SentinelOne / SentinelLabs (2024) - “Unmasking I-Soon: The Leak That Revealed China’s Cyber Operations” - https://www.sentinelone.com/labs/unmasking-i-soon-the-leak-that-revealed-chinas-cyber-operations/ ↩
Cybersecurity Dive (2025) - “CISA workforce cut by nearly one-third so far” - https://www.cybersecuritydive.com/news/cisa-departures-trump-workforce-purge/749796/ ↩
Lawfare (2025) - “Data Brokerage and the Third-Country National Security Problem” (citing WIRED/Netzpolitik.org/BR investigation) - https://www.lawfaremedia.org/article/data-brokerage-and-the-third-country-national-security-problem ↩
Bellingcat (2018) - “305 Car Registrations May Point to Massive GRU Security Breach” - https://www.bellingcat.com/news/2018/10/04/305-car-registrations-may-point-massive-gru-security-breach/ ↩