On 24 February 2022, Russia invaded Ukraine. Missiles fell on cities all over the country. More than 100,000 Russian soldiers, with tanks and armoured vehicles crossed the border, starting the largest war on European soil since the Second World War.

A few hours before Russian tanks began rolling into Ukraine, alarm bells began ringing in Microsoft’s Threat Intelligence Center. Microsoft had detected a new malware, aimed at Ukraine’s government ministries and financial institutions. The wiper malware – software developed to erase data on infected machines – was called FoxBlade. Microsoft worked quickly with the Ukrainian government, providing technical advice on how to fight the cyberattack. Within three hours, defences against the malware had been developed.

On the same day, as the invasion was ongoing, members of the Ukrainian government met with representatives of Amazon Web Services. The discussion was about bringing Amazon ‘Snowball devices’ – suitcase-sized data storage units in shock-proof gray containers – into Ukraine to help secure, store, and transfer data to the cloud, so that the physical destruction of hardware and servers within Ukraine would not destroy the data. Together, Ukraine’s and Amazon’s representatives sketched out a list of the data most essential to the Ukrainian state: the population registry, land and property ownership records, tax payment and bank records, education registries, and more.

Two days later, the first set of Snowballs arrived in Ukraine via Poland. Over the next weeks, these Snowball devices became the foundation for the effort to preserve Ukraine’s data. Ukraine’s largest bank, serving 40 per cent of the Ukrainian population, moved all its operations to the cloud. By December 2022, over 10 petabytes of data had been moved to the cloud – equivalent to several times the content of the US Library of Congress.

While Microsoft had helped thwart the Foxblade malware attack, on 24 February another cyberattack disrupted broadband satellite internet access throughout Ukraine. Modems that communicated with US company Viasat’s satellite network went offline. The attack had significant spillovers into other areas and countries, with thousands of wind turbines in Germany going offline, but, most importantly, internet access for many people in Ukraine was cut off. When it became clear that internet connectivity was disrupted for a prolonged period, Mykhailo Fedorov, the Ukrainian Vice Prime Minister tweeted at SpaceX CEO Elon Musk: ‘@elonmusk while you try to colonize Mars — Russia try to occupy Ukraine! While your rockets successfully land from space — Russian rockets attack Ukrainian civil people! We ask you to provide Ukraine with Starlink stations.’

Starlink stations are internet terminals that connect to the thousands of satellites that SpaceX has put into low earth orbit over the last few years. Just hours later, at 11:33pm on 26 February, Elon Musk answered, again via a tweet: ‘Starlink service is now active in Ukraine. More terminals en route.’ Over 30,000 Starlink terminals were delivered to Ukraine in the first 15 months of the war, providing secure communications to the military as well as the government and the public. Starlink has become the backbone of Ukraine’s military communications. Ukrainian forces use it to live-stream drone feeds, correct artillery fire and communicate internally.

Microsoft. Amazon. SpaceX.

In these three stories about the first days of the war, the players – indeed, the heroes – are not states or governments. The protagonists of the stories are companies. Companies providing goods and services that are vitally important to Ukraine’s survival and its war-fighting efforts.

None of them are military companies. This is not a story about Raytheon selling missile defences to the Ukrainian government, Rheinmetall delivering tanks, or Lockheed Martin producing military equipment for the US to give to Ukraine. Amazon, Microsoft, Google, SpaceX, DJI, and many other companies operating in Ukraine, primarily or exclusively produce for the civilian market. Also, none of the firms are founded or headquartered in Ukraine or Russia, the states at war. And yet, these private, civilian companies are playing a crucial role in this war.

Civilian companies go to war. And the balance of power between the private sector and the state is shifting in a fundamental way as a result. Ukrainian soldiers and officials have testified as to the importance of these services in many instances: ‘I’d say the effectiveness of our work without Starlink would drop something like 60 per cent or more,’ a company commander of a Ukrainian mechanised brigade told the Washington Post. Mykhailo Fedorov, Ukraine’s Minister of Digital Transformation, noted that ‘cloud services basically helped Ukraine survive as a state’. And a Ukrainian platoon commander stated: ‘Without Starlink, we would have been losing the war already.’ One can find hundreds of these kinds of quotes, underlining the importance of satellite-based internet connectivity, cloud services, company-provided cyber defences (Google, in particular, is active in this area).

It is not just a story about software, about the cyber realm, about the internet, about the areas that seem removed from the fighting and the frontline. Civilian companies are not just providing the cloud, but also what is in the clouds. Drones have played a crucial role in this war.

Which types of drones are dominating? Who builds them? It is not the Reaper drone, built by US military contractor General Atomics. Ukraine does not have any of them. Neither is it the Turkish-made Bayraktar TB2 drone. Ukraine did use the TB2, a mid-sized armed drone at the beginning of the war; the TB2 played an important role in fighting back the Russian convoy aimed at Kyiv. If there is an ‘iconic weapon’ of the first two years of this war, it is the DJI Mavic 3 drone.

To most readers, the DJI Mavic will look familiar – you are likely to have seen them in a park, in the neighbourhood, or maybe readers have such a drone or a similar model at home. It is a drone anyone can buy in a store or online for a few thousand dollars. Hundreds of thousands of DJI drones (not solely the Mavic model) are flying in the skies over Ukraine. Both sides, Ukraine and Russia, use them. (Over recent months, first-person-view drones, some of which have produced by other Chinese firms, have grown in importance. It has slightly reduced the significance of the Mavic.) These drones are being used for surveillance of the enemy, to verify if friendly troops are hidden correctly and to follow individual vehicles or people. They are being modified to drop bombs or become a weapon themselves. They were not, however, designed to be military equipment. They are consumer goods, produced by DJI Technology, a Chinese company based in Shenzhen, or similar China-based firms.

It should be noted that the war in Ukraine is still about tanks and artillery. The deliveries of heavy ‘classical’ weapons from the United States, from Germany, and other countries are crucially important to Ukraine’s survival. But the importance of new technologies is growing steadily in this war – and, crucially, these new capabilities tend to be developed and manufactured by private, and, at least initially,  civilian companies. They provide goods and services, not because their governments told them to, but because they wanted to, for political or business reasons. Such companies are providing goods and services that governments and militaries do not have, not even the US military.

Of the roughly 10,000 satellites that orbit around the planet, about half of them belong to SpaceX. Soon it will have thousands more. The few satellites that the Pentagon has itself are being put into orbit by SpaceX rockets. No one can offer satellite-based internet connectivity like SpaceX. Of the hundreds of thousands of drones in Ukraine, a significant portion are produced by DJI, and a few other civilian drone manufacturers. Militarily speaking, they are not the best possible system for the Ukrainians to use. No state can churn out a comparable number of drones, especially not at the prices the Chinese firms offer. The cyber realm is basically owned by private firms. The US military may have had an important role in the beginning of the internet, but its elements, its infrastructure, its architecture is made up of private companies. The United States Department of Defence has its own cloud – but it runs on Amazon servers. Most western countries might have cyber branches in their military – but they do not come near the capabilities of Google or Microsoft.

It appears likely that this phenomenon will only grow in importance in the future. Further developments may pertain to the use of the advertising technology ecosystem for surveillance and reconnaissance by the military and intelligence community. As journalist Byron Tau, author of the book Means of Control: How the Hidden Alliance of Tech and Government Is Creating a New American Surveillance State, writes: ‘The advertising technology ecosystem is the largest information gathering enterprise ever conceived by men. And it wasn’t built by the government.’

We are increasingly living in a world, in which not only the most important technological breakthroughs are happening in the private sector (think ChatGPT), but one in which capabilities immediately needed for warfare are in the hands of the private sector. The primary responsibility of the state – to keep its citizens secure – is now increasingly dependent on goods and services that only companies have. While these companies still need to be headquartered somewhere geographically, they increasingly consider themselves as international, not linked – and responsible – to one state.

States are increasingly taking note of this development. Many are uneasy about it, but only few have begun to act. Taiwan is one example. In October 2023, the Taiwanese president pledged $1.3 billion to develop a satellite internet network made and controlled entirely from Taiwan. Put simply, Taiwan is trying to build an alternative to SpaceX’s Starlink.

Given the threat to Taiwan, it has been a close observer of the war against Ukraine. Taiwan has taken note of the importance of a reliable internet connection during war. Relying on Starlink is less obvious for Taiwan than it might be for Ukraine, or other countries. Because Elon Musk, who has been so personally involved in providing Ukraine with internet connectivity to fight against Russia, might see a confrontation between China and Taiwan differently than a confrontation between Russia and Ukraine. In the past, Musk has made comments endorsing the Chinese Communist Party’s stance on Taiwan. More importantly, Tesla, Musk’s other firm, is highly dependent on the Chinese market, which is its largest market outside the United States, and home to one of Tesla’s largest gigafactories (for which it got a special concession from the Chinese state). ‘What if we relied on Starlink and Musk decided to cut down because of pressure from China, because he has China’s market at stake?’, a Taiwanese think tanker told the New York Times.

This is not solely theoretical consideration. In July 2023, the New York Times revealed that the Ukrainian armed forces had to change their operations because of Musk’s decisions on when and where internet connectivity via Starlink was available. Namely, Elon Musk decided that Starlink would not cover Crimea, making an attack by the Ukrainian military there difficult to impossible.

Private companies have their own interest. It might be their bottom line, it could be the political views of their boards, or the CEO. Who are companies loyal to? In the blogpost in which he described Microsoft’s efforts in Ukraine, Microsoft’s president Brad Smith noted: ‘It’s important to note that we are a company and not a government or a country.’ And in his latest book he writes: ‘Governments serve constituents who live in a defined geography, such as a state or nation. But tech has gone global, and we have customers virtually everywhere.’ Loyalties are unclear.

There are thus new dependencies and new vulnerabilities for states. Ever since the Sputnik shock of the 1950s, a substantial part of technological advances has come out of state – and indeed from military funded laboratories and entities. DARPA, the research agency of the United States Department of Defense is responsible for many of the technologies that shape our life today, from the internet, to GPS, and Teflon. Today, the direction of travel has reversed – groundbreaking technological developments are taking place in the private sector, and the military gets them later. The challenge for the state, which no longer can guide developments as it used to, is obvious.

This also represents a challenge for private companies. Firms should be preparing for the possibility that their products and services may be used in a future conflict. Russia’s aggression and violations of international law made it easy for firms to decide which side to support. In future confrontations, things may not be so clear cut – especially if there are commercial interests on both sides.

Furthermore, private companies need to prepare for their products, and potentially even their staff, becoming targets in future conflicts. The cyberattack on Viasat that led to SpaceX’s involvement is a case in point. Russia has already declared that it considers private satellites to be legitimate targets for retaliation in wartime.

Firms cannot control who uses their products and for what purposes. DJI suspended operations in both Russia and Ukraine two weeks into the war. And yet, hundreds of thousands of their drones are used on both sides in the war, their operating system jailbroken to change the location data it broadcasts.

The war in Ukraine is highlighting a development that has been in the making for years, but is now reaching the limelight. In many areas that are vitally important for military operations, capabilities are no longer being built and provided by states, or state-funded/single-customer companies. Rather, they are being developed, and provided by private companies for which states, and militaries, are just one customer. New technologies are being developed for civilian use, meaning that they will not be made in a way that is necessarily suited for military use (for example, with more robust hardware, or systems that are specifically shielded against interference and sabotage). Furthermore, companies have become more international, or globalised. The big ‘American’ technology firms have huge numbers of employees and branches outside the US, and many of them have as many or even more customers outside the US than inside. It seems appropriate, therefore, to question their attachment to the original home state. This is not primarily about loyalty, but rather about democratic accountability. CEOs, boards, and other leaders of private companies are not elected democratically by citizens. Their interests may align with those of states – but this is not automatic, as their responsibility is to shareholders, not governments.

All this means that we are living through a change in the balance of power between states and the private sector. For states this poses a challenge as to which capabilities they want to try and build themselves (cloud? Satellite-based internet connectivity?). Companies must also realise that this changed landscape does not only provide them with more power, but also creates more risks. A new era is dawning which might change the way wars are fought forever.