The Washington Post - 21.03.2020

A12 eZ Re THE WASHINGTON POST.SATURDAy, MARCH 21 , 2020

The World

AFGHANISTAN

R aid on military base

kills 27 local troops

A t least 27 security personnel
were killed when a military base
was stormed in Afghanistan on
Thursday i n one of the biggest
attacks since a violence-
reduction agreement was signed
between the United States and
the Ta liban last month.
The Afghan government
blamed the attack on the Ta liban,
with whom the United States
signed a peace deal last month
for an eventual pullout of foreign
forces from Afghanistan in
exchange for reduced violence by
the militant group.
Armed Ta liban fighters
stormed a joint military base of
the Afghan National Defense
Forces in the southern province
of Zabul late Thursday,
according to a member of the
provincial council, Haji Atta Jan
Haqbayan.
The clash continued until the
early hours F riday, leaving 27
members of the Afghan forces
dead, Haqbayan said, adding
that the Ta liban fighters left the
area after capturing weapons
and ammunition.
The Ta liban did not respond to
requests for comment.
The Afghan Defense Ministry
also said infiltrators within the
Afghan forces helped carry out
the attack, adding that the
incident was being investigated.
— Reuters

EGYPT

Prominent activist

freed amid pandemic

Authorities released a

prominent political activist

Friday amid calls for Egypt to let

thousands of others go free to

prevent the new coronavirus

from spreading among the

prison population.

Human rights groups say

there are tens of thousands jailed

in Egypt for their political views.

The wife of Shady el-Ghazaly

Harb, a doctor who was at the

forefront of Egypt’s 2011 pro-

democracy protest movement,

wrote on her Facebook page that

he was out after nearly two years

in detention over charges of

insulting President Abdel Fatah

al-Sissi. She posted a picture of

them hugging upon his release.

It was not immediately clear if

Harb’s release was a response to

the campaign calling for s uch

action a mid the pandemic.

— Associated Press

GERMANY

Far-right party presses

radicals to bow out

Leaders of the far-right

Alternative for Germany party

decided Friday to press a radical

faction to dissolve itself after the

country’s domestic intelligence

agency classified it as extremist.

The party leadership called on

the faction, known as “the Wing,”

to declare at a meeting Saturday

that it will dissolve itself by the

end of April, t he DPA news

agency reported.

Last week, the head of the BfV

intelligence agency, Thomas

Haldenwang, said his office had

concluded after more than a year

of examination that the Wing

meets the definition of a “right-

wing extremist movement.”

The move lets authorities u se

covert methods to observe the

group and its estimated 7,

supporters. They make up about

20 percent of the party’s

membership but hold significant

sway over its direction, say

former m embers of the party and

its onetime leader Frauke Petry.

— Associated Press

Killer in Dutch tram attack

sentenced to life: A man who

fatally shot three people a nd

wounded five others on a

Utrecht tram last year was

sentenced to life in prison by a

Dutch court f or what judges

ruled was a terrorist attack.

Turkish-born Gokmen Ta nis, 38,

had shown no remorse and was

fully responsible for his actions,

despite having low intelligence

and a personality disorder, the

judges said. The attack on

March 18, 2019, came just days

after a lone gunman killed 50

people in mass shootings at

t wo mosques in the city of

Christchurch, New Zealand.

Raids in Athens targeted

f ar-left Turkish group: Police in

Greece said r aids carried out

Thursday at two sites in Athens

targeted suspected members of a

far-left Turkish g roup, the

Revolutionary People’s

Liberation Party-Front, o r

DHKP-C, c onsidered a terrorist

organization by Turkey, the

United States and the European

Union. Eleven people a rrested in

the raids were charged Friday

with terrorism-linked offenses.

Founded in the late 1970s as

D ev Sol, the Marxist-Leninist

DHKP-C is believed responsible

for a string of assassinations and

bombings in Turkey.

7 killed in Pakistan coal mine

explosion: S even miners were

killed and three injured in an

explosion inside a coal mine in

southwest Pakistan’s Baluchistan

province, a m ining official said.

Shafqat Mahmood, a mine

inspector, said investigators

were w orking to find the cause of

the blast near Degari, a town

about 60 miles east of Quetta,

the provincial capital. Safety

rules are commonly ignored in

the coal mining industry in

Pakistan, leading to accidents

that have killed numerous

workers in recent years.

— From news services

DIGEST

SOe ZeYA Tun/ReuTeRS

A monkey sits on a wire at sunset near Prang Sam Yod temple in Lopburi, Thailand. Normally,

monkeys interact with v isitors to the temple, but the coronavirus has significantly hurt tourism.

BY ISABELLE KHURSHUDYAN

AND SIMON DENYER

moscow — As the Opening
C eremonies at the 2018 Winter
Olympics in South Korea were
starting, an unusually high num-
ber of empty seats remained.
Many who planned to attend in
PyeongChang were unable to
print their tickets.
Behind the scenes, chaos was
unfolding for organizers.
A malware infection had
caused disruptions to the Inter-
net, broadcast systems and the
Olympics website — a crippling
hack that remains unpunished
even as the next Games ap-
proach.
The fate of the To kyo Olympics,
scheduled to begin in late July,
remains in question amid the
coronavirus pandemic. The
Olympic flame arrived from
Greece on Friday. But for cyber -
security experts, the date of the
next Olympiad is less important
than whether they have learned
the lessons from the last one.
The main takeaway: Suspected
state-backed Russian hackers
could be ready for another run at
the Games.
No government has publicly
offered direct digital evidence
pointing to Russia for the
P yeongChang hacks. Russian
o fficials have made no public
comments on the allegations.
But analysts and others assert
that the PyeongChang hacks fit a
pattern of revenge for the ban-
ning of Russia from the Games —
including the upcoming To kyo
Olympics — in a d oping s candal
that has left Russia on the side-
lines of international competi-
tions.
The cybersecurity firm FireEye
and U.S. intelligence officials,
speaking on the condition of
anonymity to discuss sensitive
i nvestigations, have tied the
PyeongChang cyberattacks to
Russia’s military intelligence
s ervice, known as the GRU.
The service has been accused
by Western intelligence agencies
and others of covert acts such as
hacking into Democratic Nation-
al Committee emails in 2016,
crashing part of Ukraine’s electri-
cal grid in 2016 and scrambling
government websites in the
country of Georgia last year.
Two years ago, the GRU was
named in a U.S. indictment for
allegedly hacking into doping
databases during the 2016 Sum-
mer Games in Rio de Janeiro.
“There's a strong chance that
we're going to see the same inci-
dent again [in To kyo],” said John
Hultquist, the director of intelli-
gence analysis at F ireEye. “Russia
is obviously not going to have
learned their lesson because no-
body even bothered to blame
them.”
The To kyo Olympics will have
to safeguard 100 different sys-
tems, said Akira Saka, chief infor-
mation security officer for the
event. Organizers have already
faced some cyberattacks. During
a ticket lottery in September for
Japanese citizens, 6,900 tickets
were purchased through fake
IDs. Those tickets have since
been voided.
“There are vulnerabilities that
are known, but there are also

vulnerabilities that are not evi-

dent,” Saka said. “So we’ve been

sharing all sorts of information

on this with related parties and

government offices and Olym-

pics-related agencies and service

providers.”

Attempts to hack the Olympics

are not new. The 2012 London

Games faced an estimated

165 million hacking attempts, the

event’s chief information officer

said at a cybersecurity confer-

ence in 2013, adding that most

were trivial.

But cyberattacks at the past

two Olympics appeared to be

motivated by the International

Olympic Committee’s sanctions

on Russia.

According to the U.S. indict-

ment, two Russian spies took

separate trips to Rio and targeted

the routers for wireless Internet

access at a hotel chain where

anti-doping officials were stay-

ing. The hackers used that breach

to post private information about

noteworthy U.S. athletes, includ-

ing tennis stars Serena and Venus

Williams, four-time gymnastics

gold medalist Simone Biles, and

women’s basketball standout Ele-

na Delle Donne.

“A new level of despicable ac-

tion,” said Travis Ty gart, the chief

executive of the U.S. Anti-Doping

ready in some sense,” said Andy

Greenberg, author of “Sand-

worm: A New Era of Cyberwar

and the Hunt for the Kremlin's

Most Dangerous Hackers.”

“These hacking and leaking

operations preceded the 2018 di-

rect sabotage of the Olympics.

And maybe they’re now a harbin-

ger of a repeat of that sabotage

operation, too,” he said.

Two wings of GRU hackers —

Unit 26165 and Unit 74455 —

have been identified by U.S. pros-

ecutors as key branches of Mos-

cow’s cyber corps. Unit 26165,

often referred to as Fancy Bear or

APT28, was tied to the hacking of

the Democratic National Com-

mittee, while Unit 74455, or Sand-

worm, worked in a support role,

creating fictitious personas on-

line to release the stolen data,

Hultquist said.

But Unit 74455 also has a

reputation for large-scale disrup-

tive attacks, including two in

Ukraine that targeted the elec-

tricity grid and caused people to

lose power for hours. It is also the

unit FireEye has tied to the 2018

Olympics hack.

Perhaps more sophisticated

than the attack itself was the

degree of deception — “false

flags” p lanted in the code to make

it look like North Korea was

behind it.

Craig Williams, a senior tech-

nical leader at C isco’s Talos threat

intelligence division, believes t he

nature of the 2018 Winter Games

hack, which his team named

“Olympic Destroyer,” was in part

a response to Western intelli-

gence agencies calling out Russia

for the 2017 NotPetya cyberattack

in Ukraine — considered one of

the most costly cyberattacks in

history.

The malware that hit the

P yeongChang Olympics was rid-

dled with the digital equivalent of

fake signatures on a document,

he said, designed so that attribu-

tion would be especially difficult.

Ta los stopped short of blaming

Russia for “Olympic Destroyer,”

but pointed out there were simi-

larities between that hack and

two others that governments

have already tied to the GRU.

“It's not uncommon with cyber-

attacks for no one to take credit for

them, but this was one for which it

seems like the only real point of it

would be to send a message to the

Olympics that if you ban us, if you

continue to investigate us for dop-

ing, then you’ll pay a price,” G reen-

berg said.

[email protected]

Denyer reported from Tokyo.

Tokyo Games brace for a Russian cyberattack

Suspected Kremlin-backed hackers struck the Olympics in South Korea in 2018. Now, Japan fears it could be next.

eugene HOSHIKO/ASSOCIATeD PReSS

Japan celebrated the arrival of the Olympic flame from Greece on Friday with a flyover ceremony at the Matsushima Air Base in Higashimatsushima.

Agency, one of the groups target-

ed.

Reached for comment, the IOC

responded that “maintaining se-

cure operations is our focus, and

in line with best practices for

cybersecurity, we cannot com-

ment on our policies.”

That the GRU was allegedly

caught in 2016 hasn’t seemed to

deter it.

Microsoft announced in Octo-

ber that Russian hackers linked

to the GRU again targeted at l east

16 international sporting and

a nti-doping organizations, just

before the World Anti-Doping

Agency announced that Russia

faced another Olympics ban for

attempting to mislead its investi-

gators.

“The pattern is repeating al-

JAe C. HOng/ASSOCIATeD PReSS

Visitors in masks tour the newly opened Japan Olympic Museum in

Tokyo in late February. The fate of the Tokyo Games, set to begin in

late July, remains in question amid the coronavirus pandemic.