To an extent, you are correct: many countries participate in the cyber-spy/cyber-espionage game. Where, perhaps, you are incorrect is that this is normal. The GRU has lead exceptionally aggressive cyber-attacks on just about everyone, particularly Estonia and Ukraine.

If you're interested in this topic, I'd like to suggest the wondeful (and terrifying) book, Sandworm (https://www.amazon.com/Sandworm-Cyberwar-Kremlins-Dangerous-...) by Andy Greenberg.

That's already deflection. You brought unrelated things to the discussion.

What would you say about https://en.wikipedia.org/wiki/Stuxnet? I'd argue that Stuxnet is an example of cyberattack. Hacking email server to spy on it is rather a spying. If they were forging emails etc, that'd be an attack.

"Where, perhaps, you are incorrect is that this is normal."

So did the NSA and co. on the other side halted their operations, since Snowden uncovered them? That would be news to me.

The NSA is not really a good standard to go by though.

It's "No true Scotsman" fallacy.

Who is that gold standard of intelligence then? Who is sending a courtesy note that they will attempt to hack email server on 14:00 PST on Monday?

No, it's not normal. I really doubt Norway ever made a cyberattack on a Russian (or any other) government institution.

So what do you think, the norwegian intelligence service is doing? Twisting thumbs?

Spying is their craft.

And spying nowdays mostly involves breaching into computersystems, aka cyberattack.

The problem is the ambiguity of the word cyberattack. Because it covers passive reading of classified content (which is classic spycraft and sadly very normal in the realm of politics) as well as offensive disruptive cyberattacks, from slowing a service to physically damaging infrastructure.

>So what do you think, the norwegian intelligence service is doing? Twisting thumbs?

With its 12 million dollar budget and 2000 employees (compared to 170k in Russia on a 3 billion budget, or hundreds of thousands on a 60 billion budget in the US) presumably trying not to get hacked by everyone else

We already see that something is fishy here, and they should have other financing options as well.

15m/2k=$7500/year per person. In Norway. It's not enough even for salaries.

The official budget in 2010 was around a billion kroner with less than 900 employees.

> So what do you think, the norwegian intelligence service is doing? Twisting thumbs?

Russia has a military. Russia uses its military to attack its neighbours and quell domestic insurgence.

Norway also have a military. Does it follow that Norway uses its military to attack its neighbours and quell domestic insurgence?

So you do think, that norwegian intelligence is twisting thumbs?

But not to get misunderstood, no I don't believe what norway is doing is on par with what russia is doing. But I never said that. I just challenged your claim:

"I really doubt Norway ever made a cyberattack on a Russian (or any other) government institution."

Because if the norwegian intelligence service never hacked any government institution then they would be very nice. But then they would be the first nice one of their kind.

There are countries that have military and didn’t have to use it for offensive purposes against another country. Not having it would be foolish because of rogue actors (case in point, Russia).

Similarly, there may well be countries that have intelligence agencies and did not have to use them for offensive purposes. Those agents may be twiddling thumbs, or more likely they may be working to detect and counteract offensive actions of other countries’ intelligence agencies.

> I really doubt Norway ever made a cyberattack on a Russian (or any other) government institution.

IIRC, Norway alerted the US to the Russian hack of the DNC, because they had wormed their way into the video surveillance system at the Russian operations center.

edit: did a quick search and it was the Netherlands, not Norway.

> IIRC, Norway alerted the US to the Russian hack of the DNC, because they had wormed their way into the video surveillance system at the Russian operations center.

Right continent and first letter, but that was the Netherlands, not Norway.

https://arstechnica.com/information-technology/2018/01/dutch...

Let's start with defining terms here. I would argue that spying (e.g. observing) and attack (DDoS, trying to alter data etc) are already different.

Second, you can doubt, but you don't have any evidence that they're not doing this (as well as I don;t have any evidence that they're doing then). Given that Norway is a part of a block that is opposite to Russia, I'd expect that Norway has operations that are targeting Russia.

Often, the only way to spy on a server is to first attack it, and gain an "implant" on it. That's still an attack.

Since proving the negative is impossible, it is sufficient that you don't have any evidence they are doing this. You draw your conclusions from thin air.

Do you doubt that they commit espionage against Russia, or just their technical capability? If the former, then this article might surprise you: https://www.nytimes.com/2019/12/28/world/europe/norwegian-sp...

I think the missing element here is what is being attacked. For a country committed to democracy, an attack on the democratic process is an attack on a core national interest.

I'm not sure Russian decision makers understand the full implications.

How hacking the email server is "an attack on the democratic process"?