The "Whys" of State Hacking: A Multi-Level Analysis of Offensive Cyber Operations: An Exploration within the Maritime Domain

This thesis investigates the strategic, organizational, and relational logics-the ''whys''-that motivate states to plan and execute Offensive Cyber Operations (OCOs). Moving beyond technical forensics and abstract deterrence theory, the research develops an integrated multi-level analytical framework to explain observable variations in state behaviour. The maritime domain, a critical nexus of global trade and digital connectivity, serves as the primary, though not exclusive, empirical laboratory for this comparative analysis.

At the strategic level, the research suggests that state behaviours are, to an extent, distinct and predictable: China operates as a ''Patient Preparer,'' prioritizing long-term persistent access over immediate disruption due to capability-scarcity calculations; Iran acts as a ``Coercive Signaler,'' utilizing OCOs for reactive, escalatory coercion; and Russia exhibits ``Bureaucratic Fragmentation,'' where operational patterns are shaped by inter-agency rivalry among the GRU, SVR, and FSB. These findings emerge from six peer-reviewed publications examining the operations of three major cyber power-China, Iran, and Russia-across 2015-2025. The findings are presented with appropriate epistemic humility, acknowledging reliance on open-source intelligence and the limitations of external analysis of closed state institutions.

At the relational level, the thesis empirically challenges the assumption of ''cyber alliances,'' finding no evidence of operational coordination between strategic partners (Sino-Russian or Sino-Iranian) during major conflicts. This reveals that national interests take precedence over partnership commitments in cyberspace, and that established geopolitical narratives of alliance cohesion do not hold in this domain---underscoring the necessity of cybersecurity-specific analysis to uncover dynamics invisible to traditional International Relations frameworks. Ultimately, this work argues that maritime cyber operations represent the evolution of classical seapower projection and that understanding state hacking requires analyzing the complex interplay of strategic culture, alliance dynamics, and bureaucratic politics.