President Donald Trump and Russian President Vladimir Putin’s first meeting later this week comes against the backdrop of a cyberattack thought to be linked to Russia that largely wreaked havoc in Ukraine. This latest cyberattack, which spread globally, offers yet another potent example of the way the Kremlin has treated its neighbor as a testing ground for elements of Russian national power, according to experts.
“It’s very clear that the Russians are using and have used Ukraine to find, to test, to fine-tune, to see what works,” Doug Wise, former Deputy Director of the Defense Intelligence Agency, said.
Last week’s malware attack was not an isolated incident, Mark Simakovsky, senior fellow with the Atlantic Council's Patriciu Eurasia Center, said, and it hit at a particularly precarious time for Ukraine.
“It is part of a concerted overt and covert campaign to weaken Ukraine and the confidence in the current government, particularly because Ukraine faces a heightened period of stress as the U.S. and Russia get together in Hamburg to discuss Ukraine’s future,” he said.
The Trump administration’s policy toward Russia is murky, and there is little known about Trump’s upcoming encounter with Putin. CNN has reported that Trump will focus on Ukraine and Syria during his chat with Putin on the margins of the G-20 meeting in Hamburg. But National Security Adviser H.R. McMaster told reporters last week, “there's no specific agenda. It's really going to be whatever the President wants to talk about.”
Moscow has a “multifaceted set of objectives” — stoking instability in Ukraine, warning other states against closer ties to the West, attempting to fracture NATO, and showing strength to the Russian people, to name a few — and its array of actions in Ukraine also provide “the collateral benefit of the ability to test applying all of this in an integrated fashion,” according to Wise.
“Both Syria and Ukraine have served as an exceptionally useful testing ground” for Russia, Wise said, and have shown to potential adversaries that the application and integration of Moscow’s elements of national power — diplomatic, political, economic, intelligence, military, and the cyber element that crosscuts through all of those — is not a theoretical prospect.
The significant question that then arises from Russian efforts like those taken in Ukraine is, “What are we willing to do in the face of obvious Russian ruthlessness, and what message do the Russians take from that to embolden them to do other things in other places?” Wise said.
“And what of our allies and those countries that are relatively neutral on this issue — what message are they taking from our behavior?” he added.
Ukrainian authorities point the finger at Russia over last week’s cyberattack, with the country’s security service the SBU saying it has proof that links the strike to Moscow. The lack of any real effort to obtain financial payments suggests the ransom demand was merely a cover, according to the SBU. Attribution after a cyber incident is very difficult and Russia has been known to use proxies. Ukraine was the country most affected by the malware, dubbed NotPetya, which struck the day before Ukraine’s Constitution Day.
This is not the first time that Russia has been linked to cyberattacks that have hit Ukraine. In 2014, ahead of Ukraine’s presidential election, hackers infiltrated and took the country’s central election computers offline in an effort to disrupt and undermine the legitimacy of the vote. Operations were restored, but the effort by shadowy, pro-Russian hacking collective CyberBerkut to manipulate the vote-tallying system was a troubling sign of how cyberattacks could be used to influence elections. Ukraine also fell victim to power grid cyberattacks in 2015 and 2016.
Moscow, meanwhile, has also been very active outside of the cyber realm with its neighbor, with fighting ongoing in eastern Ukraine since Russia’s military intervention in 2014 and with the annexation of Crimea that year. In Ukraine, as well as with Russian military involvement in Syria, a “collateral but not primary benefit has been to test not only the use of all the elements of Russian national power, but fundamentally be able to integrate it,” Wise noted.
Along with the aspects of conventional warfare at play in the east from Russian-backed separatists, Moscow is waging what experts describe as hybrid warfare against Ukraine.
“There’s an active war in Ukraine that Russia is a part of, and Russia has been willing to utilize all tools — military, cyber, active measures — to achieve its objectives, which are to fundamentally undermine Ukraine’s sovereignty, attack Ukrainian institutions, and undermine the confidence Ukrainians have in their leadership,” Simakovsky said.
The morning of the recent cyberattack, a car bomb killed a high-ranking Ukrainian military intelligence official. Ukraine has faced a spate of successful and attempted high-profile assassinations in the past year, violence that could spell more instability that potentially upsets the country’s internal politics and anti-corruption efforts. The Kremlin denies any involvement.
“It looks like a kind of concerted effort to destabilize Ukraine and to bring the war to a different segment of the population. When a government is proven incapable of protecting its citizens no matter where they are — in Kiev, in western Ukraine — from things like car bombs and assassins on the streets, it starts to cause questions in the minds of the population as to the actual strength and efficacy of the government,” said Hannah Thoburn, a research fellow at the Hudson Institute focusing on Russian and Ukrainian politics.
In addition to targeted assassinations in Ukraine, Thoburn noted “every now and then in some Russian speaking areas, you’ll get bombs that go off and are not meant to kill anyone. You’ll see in Kharkiv, Odessa, places like that, and they’ll be in the middle of the night in a trashcan, just to sort of throw people off.”
And look for the conflict in Ukraine to likely heat up this summer, Thoburn noted, pointing to the flares in fighting during July and particularly August in recent years.
Trump met Ukrainian President Petro Poroshenko in late June for a low-key, informal get-together that the White House said was about discussing “support for the peaceful resolution to the conflict in eastern Ukraine and President Poroshenko's reform agenda and anticorruption efforts." There was no mention in the readout of Russia or U.S. sanctions.
That day, the Treasury Department announced existing sanctions against Russia tied to Russian actions in eastern Ukraine and Crimea would not be lifted until Russia honors its obligations under the Minsk Agreements and ends its occupation of the peninsula, respectively.
The U.S. Senate, meanwhile, has proposed a bill that would codify President Barack Obama’s executive orders on sanctions in law as well as additional sanctions measures against Russia, which the House must take up.
Trump has long pushed for warmer U.S. relations with Russia and as a candidate suggested he would look at easing sanctions on Moscow. Since entering office, he has sought to discredit investigations tied to Russian interference in the 2016 election and has taken no actions to try to deter further election hacking by the Kremlin. Furthermore, he avoided explicitly endorsing NATO’S Article 5 that calls for members to come to the defense of another if attacked until finally doing so on June 9.
What is happening and being tested on the ground and in the cyber realm in Ukraine should be of deep concern to the U.S., Wise noted. “The Russians take messages from all this,” Wise said. “And don’t ever forget, the Russians have many adversaries, but they only have one enemy — and that’s us.”
Mackenzie Weinger is a national security reporter at The Cipher Brief. Follow her on Twitter @mweinger.
