OPINION — The US is taking a more active role in the ongoing cyber war between Russia and Ukraine on the side of the Kiev government.
On May 14, the US Agency for International Development (USAID) announced the award of a four-year, $38 million contract to provide cyber security for critical infrastructure in Ukraine to DAI Global, LLC, a Bethesda, Md., based development firm with projects in 90 countries around the world.
As background for the contract, USAID said that Russia, having occupied Crimea and been supporting rebels fighting in eastern Ukraine, “is prosecuting a broader campaign of ‘hybrid warfare’ in Ukraine, in which cyberattacks play a key role.”
It said pro-Russia or Russia-supported groups since 2014 have mounted cyberattacks on Ukraine’s power grid and financial system as well as during presidential elections. They were “targeted and timed to destabilize the country and decrease domestic — and international — confidence in Ukraine’s ability to deliver basic services and security.”
In these attacks, some of which were multiyear campaigns, the Kremlin used “the latest information technologies to direct coordinated efforts aimed at inciting social division, disseminating propaganda, and violating the sovereignty and territorial integrity of Ukraine in cyberspace.”
The USAID contract is not the first cyber aid supplied by the US to Ukraine.
After hackers shut off power to 100,000 customers in Kiev in 2016, Congress passed legislation which encouraged greater cooperation between the US and Ukraine and included a promise that the US will support the Ukrainian government when or if requested.
In 2017, the Army Cyber Institute at West Point sent a group to Ukraine to study the Ukrainian military’s experiences with information operations, cyber and electronic warfare in their fight against Russian irregular forces and their allies operating within Ukraine’s eastern border.
In the resulting report, the West Point team authors said, “We argue that the conflict in Ukraine serves as a testing ground for a new, more complex and dynamic form of hybrid warfare for which the United States Army and Department of Defense must be prepared. Developing a robust and detailed understanding of the conditions that enabled this style of warfare and how Russia has exploited those conditions in Ukraine will serve to inform strategists and decision-makers of the measures that must be taken to prevent, or counter future uses.”
While the West Point team collected information helpful in alerting the Pentagon, it also recognized that the Russian military too was using Ukraine as a learning environment for its own troops in use of hybrid warfare tactics, techniques and procedures.
Overall, the authors concluded, "A failure to continue to learn lessons from this conflict will limit the ability to respond when future incidents of hybrid warfare arise.”
Reading that, one must recall the Spanish Civil War of 1936-1939, where Hitler’s Nazi Germany army held a dress rehearsal for tactics employed at the beginning of World War II.
The US military has taken Ukraine’s fight seriously. With Russia’s interference in the 2016 US presidential election in mind, U.S, Cyber Command sent a defense team to Ukraine prior to the 2018 mid-term congressional elections. They studied cyber threats in Ukraine and worked on network defenses. “Our operations allowed us to identify and counter threats as they emerged to secure our own elections and prevent similar threats [from] interfering in those of our partners and allies,” Gen. Paul Nakasone, then head of Cyber Command, later told Congress.
The US began cybersecurity discussions with Ukraine back in 2017, pledging $10 million toward what became this year’s DAI contract. Subsequent conferences included FBI and Ukraine’s Cyber Police and Prosecutor General’s Office whose subsequent cooperation led to the arrest and extradition to the US of cybercriminals who had operated against American citizens for years in Ukraine.
In January 2020, following the House of Representatives impeachment of President Trump, and before the Senate trial, Ukrainian authorities asked the FBI to assist in investigating Russian hackers’ attack on the Ukrainian gas company Burisma, which had gained notoriety in the US for having had Hunter Biden, former-Vice President Joe Biden’s son, on its board of directors. That attack, traced to the same Russian GRU unit identified as operating during the US 2016 election, took place in November 2019, in the midst of the investigation of President Trump’s alleged pressuring of Ukraine’s President Volodymyr Zelensky.
Among the Burisma subsidiaries attacked was Kvartal 95, the Ukrainian television production company founded by Mr. Zelensky. This attack appeared to have been aimed at obtaining email correspondence of Ivan Bakanov, the company’s former leader whom Zelensky named head of Ukraine’s Security Service last June.
At a conference with Ukrainian government officials in the US Embassy in Kiev on May 3, 2020, Acting Deputy Chief of Mission Joseph Pennington announced the USAID cyber program which was developed in concert with relevant Ukrainian agencies and stakeholders.
The Ukraine government has already introduced restrictions on the public’s internet activities, which some of its citizens have criticized as censorship.
For example, in 2017 Ukraine banned Russian internet sites and services saying they were spreading Russian disinformation. One was VK, a popular Russian social media platform analogous to Facebook. According to the website The Daily Signal, run by the Heritage Foundation, “Prior to the 2017 ban, about 12 million Ukrainians used it each month—representing roughly 29% of Ukraine’s overall population.”
Concern about VK arose in 2014 after Russia’s agency for counterintelligence, the Federal Security Service, demanded information on Ukrainian VK users who had participated in the Orange revolution against the then pro-Moscow government. VK’s then-ownership refused and shortly thereafter control of VK went to two investors “allied with Russian President Vladimir Putin,” according to The Daily Signal.
Another issue arising out of the Ukrainian government’s own cybersecurity efforts is the allegation that “Ukraine’s own cybersecurity institutions participated in cyberattacks and supported the amendment of the Law on Prevention of Corruption to block public access to key public records,” according to USAID’s own analysis of the situation.
That meant, the USAID analysis said, engagement with Ukrainian cybersecurity institutions required careful risk analysis in the context of the USG’s [U.S. government’s] ongoing work...to reduce corruption through increased transparency and accountability in Ukraine’s public sector.”
DAI’s job is “to strengthen the resilience of Ukraine’s critical infrastructure from cyberattacks by establishing trusted collaboration between key cybersecurity stakeholders in the government, private sector, academia, and civil society,” according to USAID. To do that, DAI in Ukraine will develop new cybersecurity talent, expand the capacity of existing talent, and aid in creating a resilient cybersecurity industry in that country.
Meanwhile, Russian cyberattacks continue.
Yesterday, Ukraine’s SBU website reported, “Using social media, Russian special services and agent networks of trolls, instructed by Russian special services, called for violating quarantine restrictions and holding protests.”
The SBU website commented, “The activity of the Russian special services and the intelligence networks under their control is currently increasing. They try to use any information to cause chaos and panic.”
Read more expert-driven opinion, insights and analysis in The Cipher Brief
