The Washington Post - USA (2022-03-01)

TUESDAY, MARCH 1 , 2022. THE WASHINGTON POST EZ RE A

russia invades ukraine

BY JOSEPH MENN

AND CRAIG TIMBERG

For more than a decade, mili-
tary commanders and outside ex-
perts have laid out blueprints for
how cyberwar would unfold: Mili-
tary and civilian networks would
be knocked offline, cutting-edge
software would sabotage power
plants, and whole populations
would be unable to get money, gas
or refrigerated food.
But while Russia’s invasion of
Ukraine has spawned all manner
of cyberattacks and defenses, few
are playing out t he w ay t he e xperts
thought they would.
As of Monday, five days after
tanks moved into Ukraine, the In-
ternet and other key Ukrainian
infrastructure were still function-
ing, the o utgunned Ukrainian mil-
itary was still coordinating effec-
tively and Russia’s vaunted disin-
formation capabilities were fail-
ing to convince Ukrainians that
resistance is futile.
“We imagined this orchestrated
unleashing of violence in cyber-
space, this ballet of attacks strik-
ing Ukraine in waves, and instead
of that we have a brawl. And not
even a very consequential brawl,
just yet,” said Jason Healey, a for-
mer White House staffer for infra-
structure protection and intelli-
gence o fficer w ho’s n ow a research
scholar on cyber conflict at Co-
lumbia University.
A vastly larger, more powerful
military — one especially feared
for its cyber-military prowess —
has allowed Ukrainians almost
unfettered access to the Internet.
This has h elped them get weapons
to citizens and harness social me-
dia to rally global political support
through direct, emotional appeals
backed by stirring visuals.
Ukraine’s core cyberdefense
has done better than expected be-
cause it focused on the issue after
Russian hackers briefly knocked
out p ower to swaths o f the c ountry
in 2015 and 2016, said David Cow-
an, a veteran cybersecurity ven-
ture capitalist and corporate di-
rector, and because i t has h ad help
from American and European ex-
perts.
“I would have thought that by
now Russia would have been dis-

abled a lot more infrastructure

around communications, power

and water,” Cowan said.

The absence of major disrup-

tions predicted by cyberwar doc-

trine has allowed Ukraine’s presi-

dent, Volodymyr Zelensky, to de-

liver propaganda coups with little

more than a smartphone and a

data link. Images of civilian casu-

alties, the brutal shelling of cities

and a lso s ome Russian losses have

undermined that nation’s claims

of a limited and humane “special

military operation.” A viral audio

clip of Ukrainian soldiers o n a tiny

island t elling a Russian warship to

“go f--- yourself” has become a

defining moment of national re-

sistance.

“It’s become a global participa-

tory thing. Everybody thinks

they’re part of it,” said D oug Mado-

ry, director of Internet analysis f or

Kentik, which tracks global data

flows. “It would be a lot harder to

do all that if there was a blackout.”

Ukraine has not escaped un-

scathed, and some experts warn

that cyberattacks or Internet out-

ages could grow as Russia’s inva-

sion intensifies in the f ace of unex-

pectedly stout resistance.

Russia or its allies already have

deployed software to wipe data off

some Ukrainian computers, in-

cluding border control offices. But

such intrusions are not nearly as

widespread a s in past a ttacks such

as NotPetya, in which fake ran-

somware attributed to the Rus-

sian government caused billions

of dollars in damages, much o f it in

Ukraine.

“I do not think the destructive

malware had an impact of any

significance,” said V ikram Thakur,

head of threat intelligence at

Broadcom’s Symantec division.

Russia also may be holding

back to some extent, for strategic

reasons or because the timeline

for t he i nvasion was so closely h eld

that cyber teams did not know

what to target or when.

An invading army might be ex-

pected to quickly cut backbone

cables or switch them off through

hacks, said Madory, a former Air

Force communications engineer-

ing officer.

But neither has happened. And

Madory isn’t sure why.

“Is it following the playbook? I

don’t know if we have the right

playbook,” Madory said. “So far

the Internet is still up.”

“You need t o develop access and

know how those targets are going

to fit into the overall plan of the

campaign,” said Trey Herr, direc-

tor of the Cyber Statecraft Initia-

tive at the Atlantic Council.

He and other experts point to

several possible explanations,

starting with the possibility that

the Russians thought Ukraine

would fall so quickly that it wasn’t

necessary to damage systems they

would want operational once an

occupation began. Disabled tele-

communication systems — or

ones that are bombed — can re-

quire costly, time-consuming re-

pairs.

It’s also possible that the Rus-

sians themselves needed a func-

tioning telecommunications sys-

tem, including high-speed data

links, for their own communica-

tions. Images from Ukraine have

shown R ussian soldiers appearing

to use smartphones. Modern mili-

taries typically have sophisticated

radios for battlefield communica-

tions, but glitches might have

forced reliance on Internet-based

systems instead.

Finally, there are downsides to

using even the most sophisticated

cyberweapons. A system shut

down by a hacker can’t be used for

ongoing intelligence gathering,

typically a high priority in war-

time. Even destroyed computers

can be r eplaced s ometimes w ith-

in just a few hours.

“If I wipe a bunch of their com-

puters today, I can’t d o that t omor-

row,” said Jake Williams, a former

National Security Agency hacker,

now on the faculty of the informa-

tion security r esearch g roup IANS.

“A big question is: When do you

pull the trigger?”

The best time, he said, is typical-

ly at the beginning of a conflict,

when depriving victims of the

ability to detect attacks and com-

municate with the outside world

can be demoralizing.

Many experts said they expect-

ed more serious cyberattacks to

come in the next few weeks, in

Ukraine and elsewhere.

“Putin has not initiated signifi-

cant retaliation yet for any U.S.,

E.U., NATO sanctions, probably

because he is too busy dealing

with the surprising level of Ukrai-

nian resistance a nd f ailures by the

Red Army,” said Richard Clarke,

the first White House cyber coor-

dinator and author of one of the

first books on cyberwarfare.

“We still believe retaliation, in-

cluding cyberattacks, is coming.”

But f or now, U kraine has rallied

to its side a stunningly broad,

hodgepodge alliance to fight back

on the Internet.

Tech savvy cabinet member

Mykhailo Fedorov successfully ap-

pealed to Tesla founder Elon Musk

to distribute Starlink satellite In-

ternet terminals that would with-

stand cellular network disrup-

tions, and he asked PayPal and

credit card companies to stop pro-

cessing payments in Russia.

More surprisingly, Fedorov wel-

comed the contributions from ac-

tivist hackers, f orming a volunteer

“IT Army” and urging it to hack

Russian government and com-

mercial sites.

Existing cyber activist net-

works have taken up the cause

with glee. One of the m ost popular

Twitter accounts promoting the

loose Anonymous movement,

YourAnonNews, has been suggest-

ing unorthodox tactics to its more

than 7 million followers, such as

leaving business reviews on

Google maps that pass along to

ordinary Russians banned infor-

mation about events in Ukraine.

Though some covert govern-

ment operatives could be using

the cover of Anonymous to con-

tribute to attacks, one of the ac-

count’s administrators said it was

not working directly with any offi-

cials.

On Monday, some Russian

news sites were hacked a nd b riefly

defaced with calls for Russia to

pull back.

Even the most widely expected

alliance, between the R ussian gov-

ernment and organized criminal

ransomware groups that have

long been tolerated o r encouraged

there, are not following the script.

The ransomware gang Conti

was first out of the gate with a

public comment, declaring that it

was loyal to Russia and that it

would respond to any attacks on it

with renewed penetration of U.S.

critical infrastructure.

But like many Russian-speak-

ing crime groups, Conti has mem-

bers in Ukraine, some of whom

objected fiercely, said Dmitry S mi-

lyanets, a former Russian hacker

who analyzes the gangs for secu-

rity company Recorded Future.

The pushback prompted a re-

vised statement that Conti was

beholden to no government. But

one angry participant in the

group’s closed chats still leaked

more than a year’s w orth of private

discussions that named victims

and included drafts of payment

demands.

“That leak will destroy Conti,”

Smilyanets said.

Forecasts of c yber onslaught don’t play out as expected

REUTERS

The absence of major disruptions predicted by cyberwar doctrine has allowed Ukraine’s president,

Volodymyr Zelensky, to deliver propaganda coups with little more than a smartphone and a data link.

BY ELIZABETH DWOSKIN

AND CAT ZAKRZEWSKI

Facebook and TikTok said Mon-
day that the companies would shut
down access to Kremlin-controlled
media sites RT and Sputnik in Eu-
rope, setting the stage for retalia-
tion from Russia.
In blocking Russian state media
in the region, the companies are
complying with requests from the
European Union and individual
governments there to punish the
media outlets for sharing misinfor-
mation and propaganda about
Russia’s invasion of neighboring
Ukraine.
Facebook’s announcement
came in a tweet from its president
for global affairs, Nick Clegg. Tik-
Tok confirmed its decision to The
Washington Post late Monday.
Clegg’s announcement came af-
ter Facebook disclosed late Sunday
that it had disrupted a Russian
disinformation operation target-
ing Ukraine, one of the first official
confirmations of such a campaign
since the invasion of Ukraine last
week. In addition, it said it blocked
efforts by a hacking group that in
recent days attempted to compro-
mise the accounts of prominent
Ukrainians.
Facebook has been contending
with escalating efforts by Russian
authorities to slow down or block
people from using its services in
Russia in recent days. Russia an-
nounced that it was placing limits
on users’ abilities to access Face-
book in retaliation for Facebook
clamping down on Russian state-
controlled media services. Face-
book said the Russian government
retaliated because Facebook had
fact-checked misinformation pub-
lished on state-owned media pages
on its site. Facebook then blocked
Russian state-controlled media
outlets from running advertising,
as has YouTube, which belongs to
Google.
The European Commission said
over the weekend that it would ban
Russian state outlets, adding to
pressure on social media compa-
nies. Facebook has also faced de-
mands from its employees to fur-
ther restrict state-owned media,
according t o a person familiar with

the discussions who spoke on the

condition o f anonymity to describe

sensitive matters. Former execu-

tives have also chimed in on Twitter

to ask the company for an outright

ban.

YouTube and Twitter did not re-

spond to immediate requests for

comment about whether they

would also ban Russian media in

Europe.

Twitter said Monday that it

would begin adding labels to

tweets containing links to Russian

state media websites. The labels,

which include an orange exclama-

tion point, will be automatically

applied to any tweet that includes a

link from designated Russian state-

affiliated media websites. The com-

pany will also stop recommending

tweets with these links and block

them from appearing in its “Top

Search.”

Channels and accounts con-

trolled by Russian government-

sponsored media services such as

RT and Sputnik command tens of

millions of followers around the

globe, and Russia sees them as crit-

ical for spreading information that

bolsters the government’s priori-

ties. RT’s channel has more than

7 million followers on Facebook.

Banning these channels is likely

to provoke further retaliation by

Russia, experts say, which could

include initiating a complete shut-

down of social media services that

dissidents and others rely on to

communicate with one another,

particularly during times of crisis.

The influence operation Face-

book said it disrupted involved

40 accounts and pages on Face-

book and its photo-sharing service

Instagram that pretended to be as-

sociated with news outlets in the

Ukrainian capital of Kyiv.

The small operation, Facebook

said, ran a handful of websites mas-

querading as independent news

outlets and published claims about

the West betraying Ukraine and

Ukraine being a failed state. The

accounts had fewer than 4,500 fol-

lowers on Facebook and Instagram

combined.

The company said the network

had ties to two media organiza-

tions in the Crimean region, a part

of Ukraine that Russia has occu-

pied since 2014. The organizations,

NewsFront and SouthFront, have

both been under sanctions from

the U.S. government for trying to

sow disinformation during the

2020 U.S. election on behalf of the

Russian government. The U.S. gov-

ernment has said the organizations

have ties to Russian intelligence

services and had pushed false nar-

ratives about fraud in the 2020

election and about the coronavi-

rus. Facebook took action against

the services in 2020 for sowing

disinformation.

Facebook also said it had noti-

fied its counterparts at Twitter and

YouTube because it said it discov-

ered that the disinformation net-

work had also operated on their

services, as well as on Telegram and

the Russian platforms Odnoklass-

niki and VK.

Facebook said it had also taken

action against a hacking group

called Ghostwriter, which had suc-

cessfully targeted the Ukrainian

military, j ournalists and other pub-

lic officials. The group typically tar-

gets people by sending malicious

links to their emails and hoping

they click on them, allowing the

group to take over their social me-

dia profiles.

Facebook said it had detected

attempts to get the compromised

social media accounts to post You-

Tube videos portraying Ukrainian

troops as weak and surrendering to

Russia.

NetBlocks, the civil society

group that monitors Internet traf-

fic worldwide, reported late Sun-

day that Facebook had been severe-

ly restricted by Russian Internet

providers, making it so that con-

tent either no longer loads or loads

extremely slowly, the group said.

People can use special software to

bypass some of the restrictions,

NetBlocks said, but most people do

not have access to it.

On Sunday, Facebook’s former

chief security officer, Alex Stamos,

called on tech companies to take a

stronger stance against Russian

state media in response to the E.U.

ban.

“Time is running out for Face-

book, YouTube, Twitter and TikTok

to ban RT/Sputnik using their own

justifications,” he tweeted. “Better

they set a reasonable global stan-

dard on authoritarian state media

than end up allowing these outlets

in the U.S. but not the E.U.”

Google is also facing internal

pressure. Multiple employees post-

ed on a popular internal forum

over the weekend asking the com-

pany to block Russian state-run

channels on YouTube worldwide.

The company has only done so

inside Ukraine itself, after the

Ukrainian government asked it to.

Gerrit De Vynck contributed to this

report.

Platforms ban Russian state media

Facebook, TikTok block

Kremlin-linked sites in

Europe on E.U. request

WE BRING THE SHOWROOM TO YOU!

*Off er valid on 3 Day Blinds brand products only, excluding shutters and special orders. Buy 1 qualifying window covering and

receive the 2nd qualifying window covering of equal or lesser value at 50% off! Off er excludes installation, sales tax, shipping and

handling. Not valid on previous purchases or with any other off er or discount. Off er Code BGXB. Expires 04/30/22. State Contractor

and Home Improvement Licenses: Arizona 321056. California 1005 986. Connecticut HIC. 0644 950. New Jersey 13VH09390200.

Oregon 209181. Pennsylvania PA107656. Te nnessee 100 20. Washington 3DAYBDB842KS. County Licenses: Nassau County,

NY H01073101. Rockland County, NY H-12401-34-00-00. Licensed through Great Windows Services, LLC: Virginia 270517 2678.

West Virginia WV061238. Various City Licenses Available Upon Request. © 2022 3 Day Blinds LLC.

Call To Schedule

or visitwww.3DayOff er657.com

1-855-754-

Custom Blinds, Shades,

Shutters & Drapery

HURRY!LimitedTimeOffer

!

on Custom Blinds,

Shades & Drapery

Buy 1 Get 1

5050

OFF

%

OFF

%

*

In-Home Design

Consultation

FREEFREE

PLUS

Ask us what we are doing to keep you safe.

Personalized Experience | Fast Service | Trusted Brand

WeDESIGN,WeMEASURE,WeINSTALL,You RELAX!®

Call

Today &

SAVE!

SAVINGS

You’ll Love!

Motorized ShaMotorized Shades Ades Availablevailable