Worries build about winter cyber threats in Ukraine
With help from Joseph Gedeon, Lara Seligman and Daniel Lippman
Ukraine and its NATO allies are girding for potential Russian government-backed hacks of electric grids and other critical infrastructure as winter closes in.
It’s a threat that government officials and cybersecurity experts alike are growing increasingly worried about as the Russian ground invasion grinds on and Russian President VLADIMIR PUTIN grows more desperate to gain and hold territory.
Russia has a long history of going after Ukraine’s critical infrastructure in the winter months (even temporarily turning off the lights for millions in Ukraine in attacks in 2015 and 2016).
There’ve already been multiple Russian cyberattacks this year, including one in April in which Russian hackers unsuccessfully launched an attack against Ukrainian energy infrastructure. As winter sets in, letting Europeans freeze could be an attractive option to put pressure on both Ukraine and the NATO alliance.
“The Europeans are hanging together for the moment, but as winter comes and peoples’ babies are cold, and the prioritization of whose babies come first, the calculus might change,” Samantha Ravich, chair of the Foundation for Defense of Democracies’ Center on Cyber and Technology Innovation, said when NatSec Daily asked about the issue at a briefing this week. “Putin absolutely understands how to divide adversaries to get more of what he wants.”
A senior Biden administration official told NatSec Daily they had similar concerns, noting that while Ukraine has done a lot of work to prepare for the cyber onslaught, Russia was likely to see the colder months as an opportunity to squeeze the Ukrainian people further through cyberattacks on key systems.
“We’re at the end of October, winter’s coming,” the official said, who was granted anonymity in order to speak freely. They pointed to the widespread missile strikes on the Ukrainian energy grid in recent weeks as demonstrating Russia’s dedication to making life more difficult for Ukrainians and noted that cyberattacks are likely “supporting” the ground mission.
Ukrainian officials have stressed in recent months that they are expecting a ramp-up in attacks from Russia as the war continues, including a focus on attacking the Ukrainian energy and financial sectors during the winter through kinetic and cyber means.
“I’m totally confident that they are using this time period for preparing for planning of new destructive cyberattacks, which can affect not only Ukraine but our partners as well,” VICTOR ZHORA, deputy chair of Ukraine’s State Service of Special Communications and Information Protection, said of Russian cyber threats at the mWISE conference on a separate panel.
Ukraine is not the only target. The head of Finnish intelligence recently warned that Russia is “highly likely” to turn to cyber threats this winter, and ROBERT M. LEE, CEO of cybersecurity group Dragos, told NatSec Daily that his company has seen evidence of hackers linked to Russia “picking out” critical infrastructure targets in NATO countries.
“For the Finnish to come up and say something like that, they’ve got somebody in the room,” Lee said.
THINK ABOUT CHINA, TOO: NATO Secretary-General JENS STOLTENBERG wants Republicans to consider one thing if they take control of Congress next year: If Ukraine’s aid is slashed, that will only empower China, he told our own LILI BAYER.
“The presence of the United States — but also Canada — in Europe, is essential for the strength and the credibility of that transatlantic bond,” Stoltenberg said.
Ukraine’s military gains against Russia wouldn’t have been possible with support from NATO allies, he said, not to mention that a Russian victory would “be bad for all of us in Europe and North America, in the whole of NATO, because that will send a message to authoritarian leaders — not only Putin but also China — that by the use of brutal military force they can achieve their goals.”
RUSSIA SUBVERTING MOLDOVA: Russia’s Federal Security Service, known as the FSB, is actively working to subvert Moldova’s pro-Western government, the Washington Post’s CATHERINE BELTON reports after looking at a trove of intelligence on the matter.
Belton found that “the FSB has funneled tens of millions of dollars from some of Russia’s biggest state companies to cultivate a network of Moldovan politicians and reorient the country toward Moscow.”
Among them is ILAN SHOR, a Moldovan opposition party leader in exile in Israel. He has helped organize anti-government rallies, and the two main Moldovan pro-Russia television stations are managed by his associate. The U.S. imposed sanctions on him and others Tuesday for assisting Russia’s “persistent malign influence campaigns” in Moldova.
Shor, however, denies supporting Russia’s aims in the European country. “We are an absolutely independent party which defends only the position of Moldovan citizens,” he told Belton.
KIM’S BACK AT IT: North Korea fired two ballistic missiles toward the sea on Friday, marking its first ballistic weapons launch in two weeks as nuclear tensions ramp up between the authoritarian regime and South Korea and its allies, the Associated Press’ HYUNG-JIN KIM and KIM TONG-HYUNG report.
The launches were detected on the country’s east coast and flew roughly a distance of 140 miles with an altitude of 15 miles, Seoul military officials said in a statement, calling it another “grave provocation” from the northern adversary.
Use of a nuclear weapon “will result in the end” of North Korean leader KIM JONG UN’s regime, according to the U.S. National Defense Strategy released Thursday. “There is no scenario in which the Kim regime could employ nuclear weapons and survive.”
ELECTION VIOLENCE CONCERNS IN BRAZIL: As the final round of presidential elections approaches this weekend, many worry that the President JAIR BOLSONARO’s supporters could turn violent, Brazil’s former Secretary of Justice PEDRO ABRAMOVAY told NatSecDaily.
“The big fear right now is that his supporters are being encouraged to be violent,” Ambramovay told Joseph, citing reports that the election will be rigged against the current president. “I think what we could see from tomorrow on is violence and reactions from his supporters. And because he has a lot of support within the police, then we don’t know what will happen.”
Polling shows liberal ex-President LUIZ INÁCIO “LULA” DA SILVA with a slight lead over Bolsanaro, whose poll numbers have steadily climbed in the past year. Election results are expected to come in Sunday night.
DRINKS WITH NATSEC DAILY: At the end of every long, hard week, we like to highlight how a prominent member of Washington’s national security scene prefers to unwind with a drink.
Today, we’re featuring Estonian Prime Minister KAJA KALLAS. We asked Kallas, our first head of government in this section (!), about her imbibing practices following our Wednesday interview. Here’s what she said: “A warm cup of tea in a cozy armchair reading a good book.”
We couldn’t extract any more details, like what kind of tea or book is her favorite — or what kind of alcohol she drinks when she’s in such a mood. But it’s hard to argue with Kallas’ fall-and-wintery vibes.
Terviseks, prime minister!
IT’S FRIDAY. WELCOME TO THE WEEKEND: Thanks for tuning in to NatSec Daily. This space is reserved for the top U.S. and foreign officials, the lawmakers, the lobbyists, the experts and the people like you who care about how the natsec sausage gets made. Aim your tips and comments at [email protected] and [email protected], and follow us on Twitter at @alexbward and @mattberg33.
While you’re at it, follow the rest of POLITICO’s national security team: @nahaltoosi, @woodruffbets, @politicoryan, @PhelimKine, @BryanDBender, @laraseligman, @connorobrienNH, @paulmcleary, @leehudson, @AndrewDesiderio, @magmill95, @ericgeller, @johnnysaks130 and @Lawrence_Ukenye.
‘DIRTY BOMB’ SEARCH PARTY: Inspectors from the U.N. will head to two locations in Ukraine where Russia claimed without evidence that activities related to the production of “dirty bombs” were occurring, the Associated Press’ EDITH LEDERER reports.
The inspection should be done “in days — very fast,” U.N. nuclear chief RAFAEL GROSSI said Thursday, outlining the trip to Institute for Nuclear Research of the National Academy of Sciences in Kyiv and Vostochniy Mining and Processing Plant in a letter to Security Council members.
Inspectors visited the nuclear research institute in Kyiv last month, “and no undeclared nuclear activities or materials were found there,” Grossi said. This time around, inspectors will look at whether the fuel at the locations has been reprocessed to extract nuclear material.
GET OUT OF ABUJA: The State Department has ordered the departure of diplomats’ families from the Nigerian capital of Abuja amid growing threats from Boko Haram, a terrorist group.
“On October 27, 2022, the Department ordered the departure of family members of U.S. government employees from Abuja due to heightened risk of terrorist attacks,” reads the alert.
Boko Haram has long been a persistent threat in Nigeria, but attacks in Abuja are rare. Nigeria’s security services say they are taking all “necessary precautions” to prevent an attack on government buildings, places of worship or other public areas.
THE BIG FOUR: A new report suggests that the federal government needs to undertake a series of actions to better protect U.S. networks against cyber warfare threats posed by Russia, China, Iran and North Korea — the biggest threats to the U.S. in cyberspace, Maggie reports in Morning Cybersecurity (for Pros!).
Experts at the Foundation for Defense of Democracies laid out the top threats posed by the four nations in a report examining the “attack on America’s future” posed by cyber-enabled economic warfare. The report recommends that the U.S. intelligence community improve resourcing and personnel to counter this type of warfare, which involves using cyberattacks to take down critical infrastructure. The authors also strongly pushed for the development of a “continuity of the economy” plan in the case of a massive cyberattack, something the Cybersecurity and Infrastructure Security Agency was tasked with putting together by the 2021 National Defense Authorization Act. That effort has since stalled.
The report focused particularly on Russia, and theorizes that the world may see increased use of Russian cyber-enabled economic warfare aimed at Ukraine and its allies as a means to “seek revenge and regain parity.”
MORE AID FOR UKRAINE: The Pentagon on Friday announced the latest package of military aid for Ukraine, valued at up to $275 million. This is smaller than the previous packages we’ve seen — the last few have been on the order of $600 – $700 million — but includes much of the same capabilities: additional ammunition for the High Mobility Artillery Rocket Systems; 500 precision-guided 155 artillery rounds; 2,000 155 mm rounds of remote anti-armor mine systems; more than 1,300 anti-armor systems; 125 Humvees; small arms and more than 2.75 million rounds of small arms ammunition.
The package also includes a new capability: four satellite communications antennas, according to spokesperson Sabrina Singh. The systems will provide Kyiv an additional communications capability at a time when Russia is increasingly targeting Ukraine’s infrastructure and electrical grids, she said. They are not Starlink antennas, but are not intended to serve as a substitute for a service like Starlink, Singh noted.
TRACKING WEAPONS: The State Department announced plans Thursday to better track weapons sent to Ukraine over fears Russian forces could use them to create a false-flag attack by Ukrainian forces, our friends in Morning Defense (for Pros!) report.
“Pro-Russian forces’ capture of Ukrainian weapons ― including donated materiel ― has been the main vector of diversion so far and could result in onward transfers,” the plan reads. “Russia probably will also use these weapons to develop countermeasures, propaganda, or to conduct false-flag operations.”
The State Department is working with Kyiv to clear remains from explosives to allow forces to better track and secure U.S.-donated weapons.
The effort comes as Russia continues to accuse Ukraine of detonating a dirty bomb on its own soil.
SADLY, IT’S NOT ALIENS: Remember all those UFO sightings that the government couldn’t explain last year? Well, we hate to break it to you, but most objects mistaken for alien spacecraft are probably surveillance technology from other countries, weather balloons or clutter flying in the sky. Snooze.
That’s according to officials familiar with a classified Pentagon document on the matter that’ll be delivered to Congress by Monday, per The New York Times’ JULIAN BARNES. It includes an update to a report made public last year that said most unidentified aerial phenomena (government speak for UFOs) couldn’t be explained. It originally included 144 sightings between 2004 and 2021, mostly from military personnel.
Chinese drones and surveillance technology are believed to make up some of the sightings, with the country’s goal to learn more about how military pilots are trained in the U.S., the officials said. But there’s no single explanation for all the sightings, and the Pentagon will not “rush to conclusions in our analysis,” said SUE GOUGH, a Defense Department spokesperson.
MORE NDAA ABORTION DEBATES: The Pentagon’s plan to pay for servicemembers’ travel expenses for seeking abortions could further complicate the Senate’s plans to finalize the NDAA when debate begins after the midterm elections, our own CONNOR O’BRIEN and LAWRENCE UKENYE report.
Republicans, who assailed the policy following the DoD’s announcement, could use the annual defense bill to block efforts to finance troops’ looking to travel for the procedure.
“With all of the challenges we face globally, DoD needs to make our national security their top priority,” said Sen. ROGER MARSHALL (R-Kan.).
Lawmakers will have a tight window in November and December to compromise and pass a bill that can reach President Biden’s desk.
ACTUALLY, IT’S BIPARTISAN: Sen. LINDSEY GRAHAM (R-S.C.) believes another “robust” Ukraine aid package will be passed by the end of the year, saying that continued support for Ukraine is favored by most in his party.
“To my Republican colleagues who don’t want a blank check, that’s fine, I’ll be glad to sit down with you to make sure the money goes where it should go,” Graham said, referring to House Minority Speaker KEVIN MCCARTHY’s comments about slowing aid to Ukraine if the GOP takes control of Congress. “But I promise you the majority of Republican senators are fully committed to seeing this through.”
The South Carolina lawmaker’s comments came during a virtual discussion with Ukrainian President VOLODYMYR ZELENSKYY and Sen. RICHARD BLUMENTHAL (D-Conn.). Continued aid to the country is crucial, he said, because if Ukraine falls, “there goes Taiwan, and the war continues in Europe.”
“When it comes to Putin’s invasion of Ukraine, you either pay now, or you pay later,” he said.
DRAG SHOWS DON’T ADVANCE NATIONAL SECURITY: Former National Director of Intelligence JOHN RATCLIFFE argues that the State Department cultural grant funding for drag performances in Ecuador doesn’t advance U.S. national security, he writes with CLIFF SIMS in The Wall Street Journal.
“These are grade-school antics, not the projection of American power,” they wrote. “When the U.S. has issues with foreign leaders, it should deal with them through adult diplomacy. Instead, our diplomatic efforts under President Biden, a self-styled foreign-policy expert, could be summed up as ‘anyone I don’t like is Putin.'”
The former intelligence director claimed that U.S. efforts to promote “woke ideology” confuses allies and comes at the expense of helping them counter Putin.
— JOHN PICARELLI is now a director of counterterrorism at the NSC. He most recently was deputy assistant secretary for counterterrorism and threat prevention at DHS.
— Sen. JOHN BARRASSO, Newsweek:End China’s ‘Developing Country’ Advantage
— SAMUEL CHARAP and MIRANDA PRIEBE, Foreign Affairs: Don’t Rule Out Diplomacy in Ukraine
— DREW HINSHAW, JOE PARKINSON and ARUNA VISWANATHA, The Wall Street Journal: Inside the Secret Prisoner Swap That Splintered the U.S. and China
— The Atlantic Council, 8:30 a.m.:“Conference on the future of the US-Pakistan relationship”
— The Carnegie Endowment for International Peace, 10 a.m.:“Carnegie Connects: Nukes, Protests, and Iran With ROBERT MALLEY”
— The Institute of World Politics, 10 a.m.: “The Intersection of Human Rights Crimes and National Security”
— The German Marshall Fund of the United States, 2 p.m.:Germany’s New Security Outlook: What Zeitenwende Means for the Transatlantic Partners
Have a natsec-centric event coming up? Transitioning to a new defense-adjacent or foreign policy-focused gig? Shoot me an email at [email protected] to be featured in the next edition of the newsletter.
Thanks to our editor, Heidi Vogt, whose first words to us when she took over this newsletter were “winter is coming.”
And we thank our producer, Kierra Frazier, whose warmth thaws the chill.