Russia-Ukraine: cyber war-2014

The crisis in Ukraine was the largest battlefield in cyberspace after Russia's cyber attacks on Estonia in 2007 and Georgia in 2008. Russia managed to derail almost all of the government sites of Ukraine, and also managed to take control of all the Internet and telephone communications lines before entering troops in the Crimea. The Russian special forces, managed to bring down all the important communication systems through direct physical actions with them.

Cyberspace is an integral part of Russia's military strategy and foreign policy towards the countries of the former Soviet Union. Access to information systems of diplomatic, state and military organizations, for many years, gives Russia a huge advantage in predicting the tactics and thinking of its neighbors.

The largest military cyber attack, was the attack of the State Intelligence Directorate (GRU) on the armed forces of Ukraine, as the BBC news agency reports. According to the law enforcement agencies of Ukraine, Russia has collapsed almost all communication systems of the Ukrainian armed forces. Smaller attacks have been revealed in relation to news resources and social networks. As the agency suggests, a similar style and set of actions was performed by Russia before the military operation in Georgia, which suggests that the operation to send troops to the Crimea was carefully planned in advance.

The head of the Security Service of Ukraine, Valentin Nalevaychenko, in particular, acknowledged that a powerful attack was made on the mobile communications of the members of the government of Ukraine, in order to neutralize and disrupt communications between government agencies. As the Ukrainian corporation Ukrtelecom reported, armed people with no identifying marks penetrated its facilities and destroyed optical fiber blocks, which in turn led to a communication collapse. Despite this, according to the agency, experts say that Russian forces are holding relatively low-key actions and are capable of more global cyber attacks.

Former senior CIA special operations officer Marty Martin said larger attacks would be carried out by Russia if the conflict escalated. “Sometimes it is more useful to leave some communication channels working so that you can monitor and control them, rather than completely collapse them and deprive yourself of sources of intelligence,” says Martin. In fact, as the expert says, no one in the world, including the CIA, is still able to assess the cyber capabilities of Russian services, since there has not yet been a large-scale conflict with its participation. An additional obstacle for Western intelligence agencies in determining “friend or foe” and who is on which side is the fact that both sides communicate in almost the same language, write scripts using similar rules and often attack each other from similar IP addresses.

Paul Rosenschweig, founder of cybersecurity consultancy Red Branch Consulting, argues that Russia is quite strong in cyberspace but cautions against overestimating cyberspace as the site of major future wars over ground operations if things get out of hand. "Cyber ​​strikes won't do much damage when the tanks come in," Paul said.

According to Dmitry Alperovich, director of the Californian company CrowdStrike, there is incredible activity in Ukrainian cyberspace. In particular, according to him, both in Russia and on the territory of Ukraine, opponents of the Putin regime are subject to constant surveillance by intelligence services, including monitoring their movements; however, the specialist refused to disclose the names of the “victims.” Dmitry also stated that despite the fact that both Ukrainian and Russian hackers came from the “same school,” the difference in the capabilities of the intelligence services of Russia and Ukraine is significant. Russia, according to him, ranks first in the world in its cyber capabilities, while Ukraine “...doesn’t even rank third.”

Another expert in this field, director of the Atlantic Council on Cyber ​​Statecraft and former White House cyber security adviser during the Bush administration, Jason Harley, argues that today we are witnessing a different approach to cyber warfare against on the Russian side than in the conflicts in Georgia and Estonia. Moscow, according to him, applied a higher level of “hands-on attacks” in the Ukrainian case. It's old school Cold War, as Harley states. Physical contact with cyber equipment in hostile territory is an old and not ineffective method of Russian intelligence services, dating back to the times of the Soviet Union and in the near future, we will see more large-scale operations using such means.”

In the case of Ukraine, the Russian special services did not present any difficulty at all to penetrate any military or strategic object on the territory of Ukraine, since all of this equipment and facilities were built almost by the same specialists when it was one state and the Russian special services preserved all necessary documents and maps of the location of all important objects in the entire former Soviet Union. Also, many specialists who participated in the construction of these objects live in Russia today. Thus, Harley says, any kind of intervention or sabotage on the territory of the former USSR can be stopped quickly and effectively by the Russian special services, which makes such attempts practically meaningless.

Today, all cyber attacks are mainly based on remote tools, such as denial-of-service (DDoS), while when it is possible to physically penetrate and chop or control Internet communications nodes, remote attacks lose any effect.

On March 14, in the skies of Crimea, Russian armed forces managed to intercept and take possession of an American reconnaissance and attack drone, as reported by the Russian Interfax agency. After interception, the Russians managed to land him at one of their naval bases located in Crimea. The MQ-5B drone, judging by its side markings, was part of the 66th American Military Intelligence Brigade with its main location in Bavaria. Footage of Russian soldiers holding a drone appeared in the media, with US military markings clearly visible. According to the technological department of the Russian armed forces, Rostec, the American brigade was deployed to the Ukrainian Kirovograd in early March, from where drones carry out reconnaissance raids over Ukraine, Crimea and the Russian border regions. According to some reports, the American reconnaissance brigade is armed with 18 MQ-5B drones. “This is the second case of interception of an American UAV over Crimea,” the report notes.

Thus, Russia's intervention on the territory of Ukraine opened another Pandora box. Russia has returned to the ways of the “old school”. Russia uses effective tactics of cyber warfare, combining remote attacks with physical, direct influence on them, certainly on the spot, by penetrating communication centers and installing the necessary high-tech equipment.

According to Western experts, no one doubts that Russia has drawn its conclusions from cyber attacks on Georgia and Estonia and has significantly improved its capabilities. Therefore, no one can be clear with the accuracy and knowledge of what her capabilities in this area are. But today, the main problem is that cyberspace is unorganized by any rules of warfare and the moment when a party regards a large-scale cyber attack as a potential attack, and due to the lack of its cyber security tools, can shoot in response, is not far a real rocket.

Author: Simon Tsipis, employee of the Institute for the Study of National Security (Israel).