cyber war in perspective: russian aggression against ukraine Cyber War in Perspective: Russian Aggression against Ukraine Edited by Kenneth Geers This publication may be cited as: Kenneth Geers (Ed.), Cyber War in Perspective: Russian Aggression against Ukraine, NATO CCD COE Publications, Tallinn 2015. © 2015 by NATO Cooperative Cyber Defence Centre of Excellence. All rights reserved. No part of this publication may be reprinted, reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior written permission of the NATO Cooperative Cyber Defence Centre of Excellence ([email protected]). This restriction does not apply to making digital or hard copies of this publication for internal use within NATO, and for personal or educational use when for non-profit or non-commercial purposes, providing that copies bear a full citation. NATO CCD COE Publications Filtri tee 12, 10132 Tallinn, Estonia Phone: +372 717 6800 Fax: +372 717 6308 E-mail: [email protected] Web: www.ccdcoe.org LEGAL NOTICE This publication is a product of the NATO Cooperative Cyber Defence Centre of Excellence (the Centre). It does not necessarily reflect the policy or the opinion of the Centre or NATO. The Centre may not be held responsible for any loss or harm arising from the use of information contained in this publication and is not responsible for the content of the external sources, including external websites referenced in this publication. Print: EVG Print Cover design & content layout: Villu Koskaru ISBN 978-9949-9544-4-5 (print) ISBN 978-9949-9544-5-2 (pdf) NATO Cooperative Cyber Defence Centre of Excellence The Tallinn-based NATO Cooperative Cyber Defence Centre of Excel- lence (NATO CCD COE) is a NATO-accredited knowledge hub, think-tank and training facility. The international military organisa- tion focuses on interdisciplinary applied research and development, as well as consultations, trainings and exercises in the field of cyber security. The Centre’s mission is to enhance capability, cooperation and information-sharing between NATO, Allies and partners in cyber defence. Membership of the Centre is open to all Allies. The Czech Republic, Estonia, France, Germany, Greece, Hungary, Italy, Latvia, Lithuania, the Netherlands, Poland, Slovakia, Spain, Turkey, the United Kingdom and the USA have signed on as sponsoring nations. Austria and Fin- land have joined the Centre as contributing participants. The Centre is funded and staffed by these member nations. Contents Foreword .................................................................................................................8 Key Events .............................................................................................................10 1. Introduction: Cyber War in Perspective | Kenneth Geers, NATO CCD COE / Atlantic Council / Taras Shevchenko National University of Kyiv ................................................13 Strategic Framework 2. Russia and Its Neighbours: Old Attitudes, New Capabilities | Keir Giles, Conflict Studies Research Centre .................................................19 3. Cyber War and Strategic Culture: The Russian Integration of Cyber Power into Grand Strategy | James J. Wirtz, Naval Postgraduate School .....................................................29 4. ‘Compelling Opponents to Our Will’: The Role of Cyber Warfare in Ukraine | James A. Lewis, Centre for Strategic and International Studies (CSIS) ......39 5. The Cyber War that Wasn’t | Martin Libicki, RAND ......................................................................................49 Tactical Viewpoints 6. Revolution Hacking | Nikolay Koval, CyS Centrum LLC ...................................................................55 7. Cyber Operations at Maidan: A First-Hand Account | Glib Pakharenko, ISACA Kyiv .........................................................................59 8. Beyond ‘Cyber War’: Russia’s Use of Strategic Cyber Espionage and Information Operations in Ukraine | Jen Weedon, FireEye ..........................................................................................67 9. Cyber Proxies and the Crisis in Ukraine | Tim Maurer, New America ...............................................................................79 6 Information Warfare 10. Russian Information Warfare: Lessons from Ukraine | Margarita Levin Jaitner, Swedish Defense University ...................................87 11. Missing in Action: Rhetoric on Cyber Warfare | Liisa Past, NATO CCD COE ............................................................................95 12. Strategic Communications and Social Media in the Russia Ukraine Conflict | Elina Lange-Ionatamishvili & Sanda Svetoka, NATO Strategic Communications Centre of Excellence ..............................103 Policy and Law 13. Ukraine: A Cyber Safe Haven? | Nadiya Kostyuk, University of Michigan ......................................................113 14. A Legal Framework for Cyber Operations in Ukraine | Jan Stinissen, NATO CCD COE ....................................................................123 15. The Ukraine Crisis as a Test for Proposed Cyber Norms | Henry Rõigas, NATO CCD COE ...................................................................135 16. Northern European Cyber Security in Light of the Ukraine War | Jarno Limnéll, Aalto University .....................................................................145 The Future 17. What’s Next for Putin in Ukraine: Cyber Escalation? | Jason Healey & Michelle Cantos, Columbia University .............................153 18. Strategic Defence in Cyberspace: Beyond Tools and Tactics | Richard Bejtlich, The Brookings Institution .................................................159 Authors ............................................................................................................... 171 7 Foreword Sven Sakkov Director, NATO Cooperative Cyber Defence Centre of Excellence In mid-January 2014, the Ukrainian Rada passed tough anti-protest regulations that seemed to be designed to nip the emerging anti-government mood in the bud. Over the next months, in the harsh Ukrainian winter, opposition protests escalated and turned bloody. The ensuing turmoil included a runaway President, Russian occupa- tion of Crimea and an armed conflict in Eastern Ukraine. The world held its breath and many expected to see a full-fledged ‘cyber war’. However, although an increase in typical cyber skirmishes was reported throughout the crisis, prominent cyber operations with destructive effects have not yet occurred. The possible reasons for this seemingly low-level employment of cyber attacks in Ukraine characterise the particular role of cyber operations in modern conflicts. The case of Ukraine proves that the use of cyber operations has to be understood in the wider strategic context. In Ukraine we saw – in line with national doctrine – that Russian information warfare both included and relied upon cyber elements. Reported cyber incidents such as defacements, information leaks or DDoS attacks against media or governmental organisations were predominantly in support of the intense Russian information operation against Ukraine and the West. Furthermore, due to the historical interconnectedness of networks and sophisti- cated spyware tools applied by APT groups, it is widely presumed that Russia is actively leveraging the intelligence provided by its effective cyber espionage campaigns for strategic gain. As cyberspace functions as the main medium for disseminating and gathering information, destructive cyber operations hindering information flows in Ukraine would have been unreasonable from the Russian point of view. Another strategic consideration affecting Russian use of cyber attacks is the rel- ative effectiveness of traditional kinetic operations. If we look at the Russian actions in Crimea and the Donbass, there was no practical need to engage in destructive 8 offensive cyber operations to achieve the military objectives. For instance, one of the first targets during the occupation of Crimea was an Internet Exchange Point, which was taken over by Russian special forces in order to assure information superiority by disrupting cable connections with the mainland. In short, the case indicates that kinetic actions might in some circumstances be more effective and less costly than sophisticated cyber operations. This factor is even more relevant in Ukraine, where the infrastructure is often outdated and not highly IT-dependent. Even though highly visible and destructive attacks have not been reported, infor- mation-oriented cyber operations in Ukraine have nevertheless functioned as an essential strategic element of Russian whole spectrum warfare. In brief, the book reflects several mutually reinforcing reasons why we did not witness large-scale or massive cyber attacks with destructive effects: • Espionage and information campaigns conducted through cyberspace trumped other considerations for the Russian side; • It is reasonable to achieve results with less resources and effort involved, i.e. if a cable can be cut physically, there is no need to use sophisticated cyber attacks; • Both sides in the conflict have shown a considerable ability to control the escalation of the conflict. The cyber domain did not witness large- scale warfighting, but neither did the domain of air after the tragedy of MH17; • Ukraine did not offer very lucrative targets for destructive