The Hybrid Battlefield
Abstract
The conflict in the eastern Democratic Republic of Congo (DRC) has entered a new phase where armed groups exploit the intersection of physical violence and digital vulnerability. The March 23 Movement (M23) has evolved from a conventional insurgency into a cyber-enabled actor capable of disrupting navigation systems, manipulating mineral supply-chain data, and conducting sophisticated disinformation operations. This digital shift coincides with the expansion of Chinese-built telecommunications infrastructure, creating an environment where critical mineral flows and government data are increasingly susceptible to foreign manipulation. This paper argues that traditional policy tools such sanctions and diplomatic pressure are insufficient for this digitally mediated landscape. It proposes a revamped U.S. strategy focused on cyber capacity building, digital traceability resilience, and direct accountability for regional enablers like Rwanda. Securing these intertwined physical and digital frontiers is essential to safeguarding U.S. economic security and counteracting Chinese strategic influence in Central Africa.
The Hybrid Battlefield: M23’s Fusion of Cyber Tactics and Territorial Control
The Democratic Republic of Congo has faced persistent instability driven by rebel groups, regional conflict, and international economic interests. Among them, the March 23 Movement has played a major role in destabilizing the country since 2012. M23 controls mineral-rich territory containing minerals such as coltan and cobalt, and despite U.S. efforts to curb conflict-mineral purchases, illegal mining and smuggling remain widespread. These minerals feed global technology supply chains, and as firms rely more on digital traceability, blockchain certification, and automated reporting, M23’s territorial control creates data blind spots that let the group manipulate or bypass those systems. This convergence of territorial control, mineral extraction, and Chinese-built digital infrastructure creates cybersecurity risks for the United States by undermining supply-chain visibility, exposing data to foreign surveillance, and obscuring illicit financial flows.
M23 Background
The DRC gained independence from Belgium in 1960 with Patrice Lumumba at its head. His tenure was brief as his government was destabilized, and he was assassinated in 1961 by the Belgian government with help from the United States. Joseph Mobutu soon seized power and by 1965 had consolidated control, renaming the country Zaire. Regional instability deepened in the 1990s after Rwandan Hutu militias implicated in the Rwandan genocide fled into the DRC, prompting Rwanda and Uganda to back Laurent Désiré Kabila’s rebellion. After Laurent-Désiré Kabila’s assassination in 2001, his son Joseph Kabila took power, while corruption and renewed Rwandan-backed insurgencies such as the National Congress for the Defense of the People (CNDP) continued to destabilize the resource-rich Kivu region. A 2009 peace agreement meant to integrate the CNDP into the Congolese army failed, leading to the emergence of M23 in 2012. Although M23 claimed to defend Congolese Tutsi and Kinyarwanda-speaking minorities, it committed widespread violence before being defeated in 2012.
M23 remained dormant for nearly a decade before resuming attacks in 2021. In 2022, the group escalated operations by downing a UN helicopter, seizing Rutshuru, a town located in the North Kivu, raiding bases for weapons, and capturing the Bunagana border crossing to collect illegal taxes. The group later cut access to Route National 2, a key road linking Goma (a city on the border of Rwanda) to surrounding areas, gaining both economic leverage and military advantage. By early 2024, M23 controlled the Rubaya mining region, rich in coltan, and by early 2025, the group had taken Goma, securing major strategic and economic advantages.
M23’s success is closely tied to Rwanda, which benefits from the group’s control of North Kivu and Goma. Since the 1994 genocide, Rwanda has played a major role in the DRC’s politics, security, and economy, while groups such as the Democratic Forces for the Liberation of Rwanda (FDLR) have further deepened regional tensions. Although Rwanda denies backing M23, reporting has repeatedly accused it of providing weapons, resources, and illicit supply routes. At the same time, the Congolese government has allegedly supported the FDLR to counter M23, reinforcing a cycle of proxy conflict that has helped sustain the rebellion. These overlapping relationships have kept tensions between the two countries high and complicated efforts to stabilize eastern DRC.
How M23 Finances Their Movement
M23 finances its campaign through resource exploitation, coercive taxation, and trade-based money laundering. These revenue streams matter to the paper because they also expose the weakness of conventional mineral-governance tools in a digitized supply chain.
After taking Rubaya, M23 gained access to one of the world’s largest coltan deposits. Roughly 120 tons of coltan cross into Rwanda each month, generating substantial revenue for the group. M23 created an administration that issues permits, controls trade and transport, and taxes miners and local businesses, including through practices described as blood-mineral financing. By funneling minerals through Rwanda, M23 makes them appear legitimate and allows them to enter international markets despite ethical sourcing rules. The result is not only greater instability and higher transport and insurance costs, but also a direct threat to digital traceability systems, because physical control over mines and roads lets the group manipulate the data layer attached to mineral extraction. That data-layer vulnerability is the bridge between M23’s financing model and its cyber-relevant effects.
Cyber Warfare
The manipulated data layer described above makes M23’s cyber relevance clearer: the group does not need highly advanced cyber capabilities to create strategic effects when it can combine territorial control, disinformation, GPS disruption, and corrupted supply-chain data. Cyber conflict is expanding across Africa, including among rebel groups such as M23. Although its capabilities are limited compared with more sophisticated actors, the group’s tactics can still be strategically effective when combined with physical violence and territorial control. In July 2024, M23 was accused of disrupting GPS signals in North Kivu during heavy fighting. Because the Congolese Army (in French: Forces Armées de le République Démocratique du Congo or FARDC) increasingly relies on drones and aircraft, even low-end jamming can degrade navigation and targeting. M23 also uses disinformation on social media and WhatsApp to shape perceptions of the conflict and support recruitment.
One recruit later said the videos that drew him in had misrepresented events and mobilized him under false pretenses. This kind of digital manipulation does more than spread propaganda: it shapes recruitment, influences civilian behavior, inflames ethnic tensions, and helps M23 maintain political cover through online narratives rather than battlefield performance alone.
M23’s illegal taxation and control of transport routes deprive the DRC government of revenue, discourage investment, and disrupt regional trade. Scholars show that modern mineral supply chains rely on a digital “data layer” that can be manipulated or bypassed in conflict zones. By moving illicit minerals through Rwanda and blending them into legitimate export channels, M23 corrupts the data feeding blockchain certification and automated reporting tools, turning mineral smuggling into a cyber-relevant attack on supply-chain integrity. This is why traditional diplomatic pressure alone is poorly matched to the problem: the harm is not only territorial or financial, but also informational.
U.S. Policy Past and Present
Because M23’s threat now operates through both physical coercion and digital information systems, U.S. policy must be evaluated against a central question: whether legacy tools can address a conflict in which armed control also produces traceability failure and cyber-relevant data manipulation? U.S. policy toward the DRC has traditionally focused on limiting conflict-mineral flows and pressuring regional actors who enable armed groups. Dodd-Frank’s traceability requirements proved difficult to implement in active conflict zones, and U.S. efforts to curb Rwanda’s involvement relied on conditioned military assistance and targeted sanctions: tools built for a pre-digital era centered on physical smuggling rather than manipulation of digital supply-chain systems.
The current administration has moved toward a business-oriented approach, negotiating mineral-access agreements with both Rwanda and the DRC after a peace framework emerged. While framed as stabilizing, this strategy reflects U.S. interest in securing critical minerals and countering China’s influence. It also risks legitimizing Rwanda’s role in illicit mineral flows and still does little to address the core cyber problem: protecting traceability systems and reducing dependence on Chinese-built digital infrastructure. Without that digital focus, U.S. engagement risks treating M23 as a conventional rebel group even though the paper’s central claim is that its effects now extend into the data systems that govern critical-mineral markets.
US Security Interests
The evolution of the M23 conflict into a cyber-enabled environment creates direct risks for the United States. Secure and transparent mineral supply chains are critical to U.S. technology production, and M23’s ability to manipulate or bypass digital traceability systems threatens that integrity. When illicit minerals are laundered through Rwanda and folded into legitimate exports, the resulting data corruption undermines blockchain-based certification tools and automated reporting systems that U.S. firms rely on, making it harder to determine whether supply chains are financing armed groups.
China’s expanding digital footprint in the DRC amplifies these risks. Chinese firms dominate much of the country’s telecommunications and digital-governance infrastructure, meaning mineral-traceability data increasingly moves through systems outside U.S. control. This reduces U.S. visibility into illicit financial flows, heightens the risk of surveillance or data manipulation, and gives Beijing leverage over systems that underpin global mineral markets.
M23’s cyber-enabled tactics also destabilize the region in ways that affect U.S. interests. GPS jamming can degrade FARDC drone operations, while digital disinformation inflames ethnic tensions, undermines the Congolese government, and raises the risk of wider escalation involving Rwanda and Uganda. If Rwanda’s role in mineral laundering is normalized through poorly structured agreements, the United States risks reinforcing a supply chain that funds M23 while deepening geopolitical competition over critical minerals.
The convergence of armed conflict, fragile digital infrastructure, and global supply chains creates a broader strategic vulnerability for the United States: low-end actors can exploit weak digital environments in conflict zones to manipulate data that feeds directly into U.S. economic and national-security systems.
Recommended Safeguards
The United States should adopt a more cyber-focused approach to eastern DRC, recognizing that M23’s activities now intersect with digital infrastructure, supply-chain integrity, and strategic competition with China. Traditional tools such as sanctions, diplomatic pressure, and mineral-reporting requirements were built for a pre-digital environment and are no longer sufficient. Washington should first invest in stronger digital traceability for critical minerals. Current blockchain-based systems are only as reliable as their data inputs, so resilient verification using geospatial monitoring, satellite imagery, and independent auditing would help identify irregular mineral flows, keep conflict minerals out of U.S. supply chains, and expose the networks that support armed groups. Commercial satellite monitoring already identifies illegal mining and supply-chain anomalies, and adversaries can exploit weak digital environments to manipulate data that feeds into U.S. economic systems. Implementation could proceed through State Department and development-finance programs, private-sector partnerships, and coordination with the EU’s digital due-diligence frameworks.
Second, Washington should expand cyber capacity building with the DRC and regional partners. Training, secure data-management support, and protection for government information systems would reduce openings for data manipulation and communications disruption. This approach is relatively low cost and could be implemented through U.S. cyber advisors, ministry training, a regional training hub, and AFRICOM security-cooperation programs.
Washington should also develop a coordinated strategy to counter China’s growing role in the DRC’s digital infrastructure. Because Chinese firms dominate telecommunications, data centers, and surveillance systems, the United States should offer competitive alternatives through targeted financing, trusted vendors, and regional fiber projects that reduce dependence on Chinese-controlled networks.
The United States should adopt a firmer diplomatic posture toward Rwanda by conditioning engagement on verifiable steps to end support for M23 and stop conflict minerals from moving through Rwandan supply chains. Evidence shows Rwanda facilitates networks that undermine traceability systems, giving Washington grounds to expand sanctions, require digital verification in mineral agreements, and work with the African Union to reduce the risk of legitimizing illicit supply chains.
Finally, the United States should enhance intelligence sharing and regional monitoring to detect cyber enabled disruptions early. M23’s use of GPS jamming, disinformation, and data manipulation shows that even low-end cyber tactics can have strategic effects in fragile environments. This recommendation builds on existing intelligence cooperation in East Africa and requires relatively few resources as implementation could include increasing AFRICOM liaison presence in Kinshasa and Kigali, expanding satellite monitoring of mineral transport routes, sharing cyber threat indicators with regional partners, and supporting early warning systems for GPS interference and information operations.
Conclusion
The conflict in eastern DRC shows how armed groups exploit both physical and digital vulnerabilities to generate revenue, shape political dynamics, and destabilize the region. M23’s territorial control, manipulation of mineral supply chains, and use of low-end cyber tactics illustrate the convergence of traditional insurgency methods with emerging digital disruption. These activities threaten the integrity of global mineral supply chains that the United States relies on for critical technologies. China’s expanding digital infrastructure in the DRC further reduces U.S. visibility into mineral flows and increases the risk of foreign access to sensitive data. Together, these dynamics create a strategic challenge that legacy policy tools cannot address. A U.S. approach that combines cyber capacity building, stronger digital traceability, and calibrated diplomatic engagement offers the most viable path to protecting American interests while supporting long-term regional stability. Confronting these intertwined physical and digital threats is essential to safeguarding U.S. economic and security interests and preventing further erosion of stability in the DRC.
