White House warns of possible Russian cyberattack

A month into the Russian invasion of Ukraine, one notable aspect of Russian military power has been largely absent from the conflict: its capabilities in cyberspace. Despite widespread expectations that Russia would use the invasion of Ukraine to carry out cyberattacks as part of a broader military operation, this mostly hasn’t come to pass.  

That may be about to change. This week, Biden administration officials warned that they have reason to believe Russia may be about to launch cyberattacks against U.S. critical infrastructure. “The more Putin’s back is against the wall, the greater the severity of the tactics he may employ,” President Joe Biden said. “One of the tools he’s most likely to use in my view, in our view, is cyberattacks.” In a statement on Monday, Biden urged critical infrastructure operators to harden their defenses in preparation of a possible Russian attack.  

The warnings from the White House are based on what Anne Neuberger, Biden’s top cybersecurity adviser, called “evolving threat intelligence, that the Russian government is exploring options for potential cyberattacks on critical infrastructure in the United States.” According to Neuberger, the U.S. government has no evidence of a specific attack but has observed “preparatory activity” that may be the prelude to a cyberattack on U.S. interests.  

Over the past two weeks, U.S. federal agencies, including the Cybersecurity and Infrastructure Security Agency and the Transportation Security Administration, have carried out briefings for private-sector partners in a bid to improve awareness of the possible threat. Following Russia's invasion of Ukraine, the Department of Homeland Security has urged U.S. businesses to assume a “shields up” posture, increasing their cybersecurity vigilance in anticipation of Russian action.  

It’s important to note that in the realm of cyberwarfare, much of the action takes place far from public view. Breaches of digital systems may be taking place on a far greater scale than we are aware, and it may be only after the conflict—if ever—that they come into view. In the cyber domain, we don’t know what we don’t know, and what we don’t know may be most consequential of all. On the other hand, Russian forces have struggled to carry out combined arms operations that integrate air and land power to carry out coordinated attacks. Given these struggles to carry out combined operations, it should perhaps be no surprise that Russian armed forces may be struggling to integrate cyber operations into what was clearly an unrealistic plan of military operations to begin with. 

Intelligence strategy. In the run-up and aftermath of the Russian invasion of Ukraine, Washington has adopted a policy of broadly disclosing intelligence about anticipated Russian actions, and this week’s warnings can be seen in line with earlier disclosures about Russian military activity. As with earlier disclosures, the Biden administration runs the risk of harming its credibility if its warnings do not come true. But so far, U.S. intelligence agencies have proven remarkably successful in correctly predicting Russian moves—a track record that may grant the Biden administration greater leeway in continuing to make disclosures in a bid to head off Russian action.  

Warnings about a possible Russian cyberattack against U.S. infrastructure raise questions about the strategic value of such attacks. Following the invasion, the United States and its allies have implemented a crippling sanctions package against Russia and funneled weapons and supplies into Ukraine to aid a defensive military effort that so far has fought Russian armed forces to a stalemate. The Kremlin has few ways to retaliate against these measures, and a cyberattack against U.S. infrastructure might be one of the few ways for the Kremlin to impose some costs on the United States for its support of the Ukrainian war effort.  

A Russian cyberattack on U.S. infrastructure—especially if it causes disruption in the lives of ordinary Americans—carries major escalation risks. The Biden administration has so far resisted engaging militarily in the conflict, but a destructive Russian cyberattack might grow support in the United States, at least among hawkish voices in Washington, for greater military involvement. Such an attack may also strengthen resolve in Washington to continue to support Ukrainian operations. Both these consequences raise questions about what strategic value the Kremlin could see in a cyberattack on U.S. infrastructure.  

The cyber landscape. While analysts have been disappointed by the scale of Russian cyberoperations, the conflict in Ukraine has been far from devoid of digital breaches. As Russian armed forces launched their invasion on Feb. 24, a high-speed satellite internet provider saw its service in Europe disrupted due to a cyberattack, resulting in what appears to have been a major communication loss for Ukrainian security services just as Russian forces rolled in. Western intelligence agencies are investigating this breach, but no culprit has been identified. If pinned on Russian state-backed hackers, this event would likely qualify as a notable use of a cyberattack as part of an integrated military operation—and may cause analysts to recalibrate their assessments that Russian cyber forces have largely stayed on the sidelines for the invasion of Ukraine. Elsewhere, Belarussian hackers were observed targeting Ukrainian officials and trying to obtain their digital credentials. In the run-up to the invasion, distributed denial of service attacks resulted in service outages for some Ukrainian banks. Cybercriminal groups loyal to Russia have threatened attacks.  

On the other side of the conflict, Ukrainian officials have described their work in the cyber domain as mostly defensive, but Ukrainian volunteers and proxy groups appear to be carrying out cyberattacks against Russian targets. Ukraine’s so-called “IT Army” consists of perhaps as many as 400,000 hackers carrying out attacks against Russian targets, with the encouragement of some within the Ukrainian government. But the actual impact of these attacks so far appear to be fairly minor. That said, earlier this month, a Ukrainian newspaper published a list containing what was claimed to be the personal details of 120,000 Russian servicemembers, a database that, if verified, would likely dent morale among Russian armed forces. Who was behind that leak remains unclear.  

In short, the contours of the cyber conflict in Ukraine are difficult to discern. Both sides are employing cyber tools to some extent, and Russia likely still has escalatory tools at its disposal. As the conflict drags out, the prominence of cyberconflict may take on greater importance, with the Kremlin seeking ways to punish U.S. support for Ukraine. The consequences of that new phase of the conflict are difficult to predict.  

– Elias Groll (@EliasGroll)

Recently on TechStream

Podcasters spread Kremlin biolab disinformation

In recent weeks, Russian officials and state media have seized on a fresh piece of disinformation to justify the invasion of Ukraine: that the United States is funding the development of dangerous biological weapons in Ukraine. This claim, which has no basis in fact, has not been confined to Kremlin propaganda. Popular podcasters in the United States have repeated and promoted it for their own purposes. Amid a reckoning over the role of podcasts in disseminating coronavirus-related misinformation, the promotion of this conspiracy theory by prominent American podcasters is the latest example of how podcasting has become a powerful and largely overlooked vector in the spread of mis- and disinformation. Over a 10-day period in March, 13 popular political podcasters devoted segments in 30 episodes to the false theory that the United States had funded biological weapons research in Ukrainian labs, Jessica Brandt, Valerie Wirtschafter, and Adya Danaditya write.  

Read more  

An education-based approach to curbing CSAM 

In recent weeks, a well-intentioned but misguided effort to curb the spread online of child sexual abuse material (CSAM) has gained steam on Capitol Hill. The so-called EARN IT Act is aimed at forcing technology companies to do more to reduce CSAM on their platforms by exposing them to stripping them of some liability protections. In doing so, the bill would endanger the availability of secure encryption technology and strike a disastrous blow for privacy, human rights, and free speech. The digitally enabled sexual abuse of children is a serious, horrific problem, but addressing it requires a different, more proactive approach. Instead of attacking security systems, policymakers could direct their efforts in a more useful direction: educating children how to be safe online. Investing in childhood education, primary care, adolescent education in consent, community support for ombuds and social work, and appropriate financial incentives for primary caregivers can all help to prevent child sexual abuse, Savannah Sly and Tarah Wheeler write.  

Read more 

What we’re following

Lapsus$. Researchers believe a 16-year-old teenager living at home with his mother in Oxford, England, is the mastermind behind a series of high-profile breaches of major technology companies carried out by the hacking group Lapsus$, Bloomberg reports. Seven teens suspected of being involved with the group have been arrested by London police, but it is unclear whether the Oxford teen is among them. The hacking group has breached the computer systems of a string of high-profile firms in recent weeks, including Microsoft, Nvidia, and, most recently, the authentication firm Okta. The hacking group, thought to include another teenager living in Brazil, has carried out wide-ranging social-engineering, extortion, and credential stealing campaigns in order to gain access to the systems of targeted firms and has brazenly bragged about their exploits online, according to Microsoft. As part of its attack on Microsoft, the group claimed to leak the source code for several high-profile projects, including Bing and Cortana.    

DSA. European policymakers are expected to unveil this week the final version of the Digital Services Act (DSA), the European Union’s landmark competition bill which would place new rules on so-called “gatekeeper” platforms, or those that serve large audiences online. The law aims to force greater interoperability among major technology platforms and to open up markets that are currently dominated by a handful of firms to greater competition.  

Pegasus. Israeli officials blocked Ukraine from acquiring a powerful mobile spyware system made by NSO Group out of fear that it would anger Russia, the Washington Post reports. Ukraine had sought to acquire Pegasus, NSO Group's flagship software for turning mobile phones into surveillance tools, but Israeli officials prevented the move in order to preserve Israel’s relationship with Russia, which was collaborating with Israel in its fight against Islamist militant groups in Syria. The revelation highlights the way in which access to NSO Group’s software became a foreign-policy tool of the Israeli government.  

Facial recognition. A senior Ukrainian official said that the country’s armed forces are using facial-recognition technology built by Clearview AI—which controversially built a massive facial-recognition system by scraping photos of individuals from social media profiles without consent—to identify Russian casualties on the battlefield. Identifications made by Clearview are then used to inform the relatives of the dead Russian soldier that their family member has died, Mykhailo Fedorov, Ukraine’s digital transformation minister told Forbes. The use of such a system may be an effective tool for Ukraine in its ongoing efforts to win the information war against Russia, but informing Russian families of battlefield casualties using an untested, often inaccurate technology also raises major human-rights concerns. 

Russia. Russian authorities blocked access to Google News for internet users in the country, the latest move by the Kremlin to control Russian internet users' access to information amid the ongoing invasion of Ukraine. The move further isolates Russian internet users from the global web.  

App stores. Google said it is piloting a system to offer alternative billing methods for Spotify users, allowing them to use a payment processor not tied to Google's App Store. The move represents a major development in app developers' efforts to end Google and Apple’s control of in-app payments, which allow the companies to take a major cut of all transactions. The two companies' control over app payments has emerged as a major concern for antitrust regulators, and Google’s move may signal the end of an era in the two companies' dominant position for app payments.  

Misinfo. A new media law set to take effect in Australia by the end of this year will empower regulators there to compel technology companies to hand over data on how they handle misinformation on their platforms. Global technology companies have mostly succeeded in resisting attempts to turn over data related to misinformation, but amid growing calls for greater transparency for online platforms, governments are taking stronger measures to compel disclosure.  

 
Police data collection. Police in Minnesota are relying on an app called Intrepid Response to collect and share data on journalists and others encountered at protests. The app is geared toward quickly collecting and sharing data but with unclear restrictions on what happens to that data once it’s collected, the MIT Technology Review reports.  
 

Drones. Ukraine is demanding that the Chinese consumer drone maker DJI block Russia from using a device sold to law enforcement that allows drone pilots to be located. With drone pilots in Ukraine volunteering in the fight against Russian forces, drone operators there have come under fire, with some believing that they were located using a device known as the Aeroscope. Ukrainian officials want DJI to block Russia from using that device, though it’s unclear whether Russia actually has access to it and is using it on the battlefield.  

Health data. Breaches of personal health data sharply increased in 2021, Politico reports. Last year, hackers breached the health records of nearly 50 million Americans, a three-fold increase compared to three years earlier. Some three-quarters of the breaches were caused by hacking. The increase is thought to be driven by the move toward digital record-keeping during the pandemic and a growth in remote work, which has caused more health care workers to use their personal devices, increasing avenues for attack.   

Reports we’re reading

Yandex. Wired examines the consequences of the Russian invasion and ensuing sanctions on Russia’s largest search engine, Yandex.  

Public opinion. A new Pew Research Center poll finds that Americans’ openness toward AI and human enhancement are tempered by how they are used and constrained.  

Knowledge production. A new paper by scholars Alice Marwick and William Clyde Partin examines how followers of the QAnon conspiracy theory construct belief in the theory.  

A final point

$6.9 billion

— Estimated losses from cybercrime last year, according to the FBI’s 2021 Internet Crime Report. 

Google and Microsoft provides financial support to the Brookings Institution, a nonprofit organization devoted to rigorous, independent, in-depth public policy research.