The Hybrid Battlefield: M23 Cyber Warfare And Critical Minerals In The DRC
Abstract
M23 cyber warfare is adding a digital dimension to an already dangerous conflict in the eastern Democratic Republic of Congo (DRC). Armed groups can now exploit the intersection between physical violence, weak digital systems, information operations and vulnerable global supply chains.
The March 23 Movement (M23) has evolved beyond a conventional insurgency. Its territorial advances now intersect with GPS disruption, online disinformation and weaknesses in the digital systems used to track critical minerals.
At the same time, Chinese-built telecommunications and digital infrastructure has expanded across the DRC. That combination creates strategic risks because government information and critical mineral data may pass through infrastructure that sits outside U.S. control or influence.
Traditional tools such as sanctions and diplomatic pressure therefore address only part of the battlefield. This paper argues for a broader U.S. strategy built around cyber capacity, resilient digital traceability, intelligence sharing and accountability for regional actors that enable M23.
For Washington, this is no longer simply a distant insurgency. The physical battlefield in Central Africa increasingly connects directly to the digital systems behind global technology and critical mineral supply chains.
M23 Cyber Warfare And The Hybrid Battlefield
The Democratic Republic of Congo has faced decades of instability driven by armed groups, regional competition and international economic interests. Among those groups, the March 23 Movement has played a major role in destabilizing eastern DRC since 2012.
M23 controls mineral-rich territory containing resources such as coltan and cobalt. Despite U.S. efforts to curb conflict-mineral purchases, illegal mining and smuggling remain widespread.
These minerals feed global technology supply chains. Meanwhile, companies increasingly depend on digital traceability, blockchain certification and automated reporting to understand where those minerals originate.
That creates a weakness.
Physical control of mines, roads and border crossings can create data blind spots. Those gaps can allow armed groups and their partners to bypass or corrupt systems designed to identify illicit minerals.
As a result, territorial control, mineral extraction and digital infrastructure are becoming interconnected security issues. For the United States, the risks include weaker supply-chain visibility, exposure to foreign surveillance and reduced visibility into illicit financial flows.
M23 Background And The Road To The Hybrid Battlefield
The DRC gained independence from Belgium in 1960 with Patrice Lumumba at its head. His tenure was brief. His government was destabilized, and he was assassinated in 1961 by the Belgian government with help from the United States.
Joseph Mobutu soon seized power. By 1965, he had consolidated control and later renamed the country Zaire.
Regional instability intensified during the 1990s. Rwandan Hutu militias implicated in the Rwandan genocide fled into the DRC. Rwanda and Uganda subsequently backed Laurent Désiré Kabila’s rebellion.
After Laurent-Désiré Kabila’s assassination in 2001, his son Joseph Kabila took power. However, corruption and renewed Rwandan-backed insurgencies continued to destabilize the resource-rich Kivu region.
One of those groups was the National Congress for the Defense of the People (CNDP).
A 2009 peace agreement attempted to integrate the CNDP into the Congolese army. However, the arrangement failed and contributed to the emergence of M23 in 2012.
M23 claimed to defend Congolese Tutsi and Kinyarwanda-speaking communities. However, the group committed widespread violence before being defeated in 2012.
M23 remained dormant for nearly a decade before resuming attacks in 2021.
In 2022, the group dramatically expanded its operations. It downed a UN helicopter, seized Rutshuru, raided military bases for weapons and captured the Bunagana border crossing, where it could collect illegal taxes.
M23 later cut access to Route National 2. The strategically important road connects Goma, on the Rwandan border, with surrounding areas.
Control of the route gave M23 both military and economic leverage.
By early 2024, M23 controlled the Rubaya mining region, which is rich in coltan. By early 2025, the group had taken Goma, giving it another major strategic and economic advantage.
Rwanda, M23 And Regional Proxy Conflict
M23’s military success has become closely associated with Rwanda.
Since the 1994 genocide, Rwanda has played an important role in the DRC’s political, economic and security environment. Meanwhile, groups such as the Democratic Forces for the Liberation of Rwanda (FDLR) have deepened tensions between the two countries.
Although Rwanda denies backing M23, reporting has repeatedly accused it of providing weapons, resources, and illicit supply routes.
At the same time, the Congolese government has allegedly supported the FDLR as part of its fight against M23.
These relationships create a dangerous proxy dynamic. They also make the conflict harder to resolve because military operations, mineral interests and regional security concerns overlap.
How M23 Finances Its Operations
M23 finances its campaign through resource exploitation, coercive taxation, and trade-based money laundering.
These revenue streams also expose an important weakness in modern mineral governance.
After taking Rubaya, M23 gained access to one of the world’s largest coltan deposits. Roughly 120 tons of coltan cross into Rwanda each month, generating substantial revenue for the group.
M23 also established an administrative structure that issues permits, controls trade and transport, and taxes miners and local businesses. Some observers describe these practices as blood-mineral financing.
Minerals can then move through Rwanda and enter legitimate international markets despite ethical sourcing requirements.
The consequences extend beyond the battlefield.
Conflict increases transport and insurance costs. More importantly, control over mines and transportation routes gives armed groups opportunities to compromise the information attached to mineral extraction and movement.
In other words, controlling the rock can mean controlling the record.
That data vulnerability connects M23’s financing model directly to the digital security of global supply chains.
M23 Cyber Warfare: GPS Disruption And Disinformation
The conflict’s digital dimension does not require M23 to operate like a sophisticated nation-state hacking group.
Instead, M23 cyber warfare demonstrates how territorial control, electronic warfare, disinformation and corrupted supply-chain information can produce strategic effects when combined with conventional violence.
In July 2024, authorities accused M23 and Rwanda of disrupting GPS signals in North Kivu during heavy fighting.
Subsequent UN reporting documented GPS jamming and spoofing in and around territory controlled by M23 and the Rwanda Defence Force. The interference affected military, civilian and humanitarian aviation.
That distinction matters.
The Congolese Army — Forces Armées de la République Démocratique du Congo (FARDC) — increasingly relies on drones and aircraft. GPS jamming or spoofing can therefore disrupt navigation, surveillance and targeting without requiring an attacker to compromise a conventional computer network.
M23 also uses social media and WhatsApp to influence perceptions of the conflict and support recruitment.
One recruit later said videos that influenced him had misrepresented events and mobilized him under false pretenses.
Digital manipulation therefore produces real-world effects.
It can shape recruitment, alter civilian behavior, intensify ethnic tensions and provide political cover for armed operations. The smartphone has effectively become another contested piece of terrain.
M23 Cyber Warfare And Critical Mineral Data
The cyber dimension also reaches directly into global mineral markets.
M23’s illegal taxation and control of transportation routes deprive the DRC government of revenue. They also discourage investment and disrupt regional trade.
Researchers have shown that modern mineral supply chains depend on a digital “data layer” that actors can manipulate or bypass in conflict zones.
That creates a fundamental problem for blockchain and other digital traceability systems.
Blockchain can protect a record after someone enters information. It cannot magically prove that the original information was true.
If illicit minerals move through Rwanda and become mixed with legitimate exports, false or incomplete source information can enter certification systems. Automated reporting can then faithfully preserve bad data.
The critical cyber lesson is straight forward: digital trust collapses when the physical source of the data cannot be trusted.
Mineral smuggling can therefore become more than a customs or financial crime. It can undermine the integrity of the information systems that companies and governments use to make supply-chain decisions.
U.S. Policy And M23 Cyber Warfare
Because M23 operates across physical and digital environments, U.S. policy must address both.
Historically, Washington focused heavily on conflict-mineral flows and pressure against governments or organizations that enabled armed groups.
Dodd-Frank’s traceability requirements proved difficult to implement in active conflict zones.
Earlier U.S. efforts to curb Rwanda’s involvement also relied on tools such as conditioned military assistance and targeted sanctions.
The Trump administration has since pursued a broader diplomatic and economic strategy.
The United States helped broker the Washington peace process between Rwanda and the DRC, while the resulting framework links regional stability with economic integration and critical mineral supply chains.
A peace framework emerged, alongside stronger U.S. interest in strategic mineral access and reducing dependence on Chinese-controlled supply chains.
However, diplomacy has not eliminated the security problem.
Washington has subsequently used sanctions against actors it says support M23 or facilitate illicit mineral flows. That combination of diplomacy, economic incentives and enforcement illustrates how complicated the conflict has become.
The unresolved digital challenge remains significant.
Any durable strategy must protect mineral traceability systems, communications infrastructure and government data while improving the ability to verify what happens on the ground.
Otherwise, policymakers risk treating M23 as a conventional rebel organization when its strategic effects extend far beyond captured territory.
Why M23 Cyber Warfare Matters To U.S. Security
The evolution of the conflict creates several direct risks for the United States.
First, secure mineral supply chains matter to American technology and defense industries. M23’s ability to bypass or compromise digital traceability threatens the integrity of those supply chains.
When illicit minerals move through Rwanda and enter legitimate exports, corrupted provenance data can undermine blockchain-based certification tools and automated reporting.
U.S. companies may then struggle to determine whether their supply chains indirectly finance armed groups.
Second, China’s expanding digital footprint adds another strategic dimension.
Chinese firms have a major role in the country’s telecommunications and digital infrastructure.
Consequently, mineral-traceability and government data can travel through infrastructure outside direct U.S. influence. That creates concerns about surveillance, resilience, data access and strategic dependence.
Third, electronic warfare and information operations can intensify the physical conflict.
GPS jamming can disrupt FARDC and civilian aviation. Meanwhile, digital disinformation can inflame ethnic tensions, undermine the Congolese government, and increase the danger of wider regional escalation.
The larger lesson extends well beyond the DRC.
Low-cost actors operating inside fragile digital environments can influence information that eventually enters U.S. economic and national-security systems.
The battlefield may be thousands of miles away. The compromised data may not be.
Recommended Safeguards Against M23 Cyber Warfare
The United States should treat eastern DRC as both a physical security challenge and a digital resilience problem.
Sanctions, diplomatic pressure and mineral-reporting requirements remain useful. However, they cannot solve the problem alone.
Strengthen Digital Traceability For Critical Minerals
Washington should invest in stronger digital traceability for critical minerals.
Blockchain systems remain only as reliable as the information entered into them. Therefore, digital records should incorporate independent verification.
Geospatial monitoring, satellite imagery and independent auditing could identify irregular mineral movements and expose networks supporting armed groups.
Commercial satellite monitoring already offers ways to identify illegal mining and supply-chain anomalies.
Meanwhile, adversaries can exploit weak digital environments to manipulate information that eventually reaches U.S. economic systems.
The United States could support these capabilities through State Department programs, development financing and private-sector partnerships. It could also coordinate with the EU’s digital due-diligence frameworks.
Expand Cyber Capacity Building In The DRC
Washington should also expand cyber capacity building with the DRC and regional partners.
Training and secure data-management programs could improve protection for government systems. They could also reduce opportunities for communications disruption and information manipulation.
Potential measures include U.S. cyber advisors, government ministry training, regional cyber training facilities and AFRICOM security-cooperation programs.
These measures would require fewer resources than many conventional security interventions while addressing weaknesses that increasingly influence battlefield and economic outcomes.
Reduce Strategic Dependence On Chinese Digital Infrastructure
Washington should develop a coordinated response to China’s expanding role in DRC digital infrastructure.
Where Chinese companies dominate telecommunications, data centers or surveillance technology, the United States should offer competitive alternatives through targeted financing, trusted technology providers and regional fiber projects.
The objective should not simply be replacing one foreign supplier with another.
Instead, Washington should promote resilient infrastructure, transparent procurement and diversified networks that reduce strategic dependence on any single foreign provider.
Hold Regional Enablers Accountable
The United States should tie engagement with Rwanda to measurable and independently verifiable commitments concerning M23 and illicit mineral flows.
Evidence indicates that networks operating through Rwanda can undermine traceability systems.
Washington therefore has grounds to use targeted sanctions where appropriate, require digital verification within mineral agreements, and cooperate with the African Union to reduce the risk of legitimizing illicit supply chains.
Verification will be essential. Agreements cannot protect mineral supply chains if governments cannot independently verify what crosses the border.
Expand Intelligence Sharing And Electronic-Warfare Monitoring
Finally, the United States should improve intelligence sharing and regional monitoring for cyber-enabled and electronic-warfare threats.
GPS jamming, disinformation and supply-chain manipulation show how relatively inexpensive capabilities can generate strategic consequences.
Implementation could include increasing AFRICOM liaison presence in Kinshasa and Kigali.
Washington could also expand satellite monitoring of mineral transport routes, share cyber threat indicators with regional partners, and support early-warning capabilities for GPS interference and coordinated information operations.
M23 Cyber Warfare Shows How The Battlefield Has Changed
The conflict in eastern DRC demonstrates how modern armed groups can exploit physical and digital vulnerabilities at the same time.
M23’s territorial control, mineral exploitation and information operations already have consequences beyond the immediate battlefield. GPS disruption and weaknesses in mineral traceability add another layer to that threat.
For the United States, the critical issue is not whether M23 possesses the cyber capabilities of a major nation-state.
It does not need them.
An armed group that controls a mine, a road or a border crossing can compromise the integrity of digital systems without ever breaching a server. If false provenance enters a trusted supply-chain platform, technology can make the bad information more efficient rather than more accurate.
China’s expanding role in the DRC’s digital infrastructure adds another strategic concern. At the same time, American dependence on secure critical-mineral supplies connects instability in Central Africa with U.S. economic and national security.
The response therefore cannot stop at sanctions or peace agreements.
Cyber capacity building, independently verified mineral traceability, resilient digital infrastructure, intelligence cooperation and accountable regional partnerships must operate together.
The hybrid battlefield is no longer defined by where the shooting happens. It is defined by where the consequences travel — through networks, data, supply chains and ultimately into the technologies the rest of the world depends on.
The broader lesson is clear: when physical control determines what enters the digital record, cybersecurity starts long before the data reaches the network.
Editor’s Note: This article was originally published by Small Wars Journal and is republished by Cyber News Live with the author’s permission.