1
00:00:00,700 --> 00:00:03,093
- Quite numerous and interesting.

2
00:00:04,260 --> 00:00:06,180
So a little bit about me I guess.

3
00:00:06,180 --> 00:00:09,699
I've been doing something
called Signals Intelligence

4
00:00:09,699 --> 00:00:13,140
or Cyber Intelligence since like '93.

5
00:00:13,140 --> 00:00:15,064
So it's similar to DEFCON, right?

6
00:00:15,064 --> 00:00:20,064
At Fort Meade and at NATO
and NCIS like the TV show.

7
00:00:20,256 --> 00:00:24,780
Couple things, I was in
Estonia for the 2007 events.

8
00:00:24,780 --> 00:00:26,910
I was in Ukraine.

9
00:00:26,910 --> 00:00:29,070
I got to teach a Computer Security Class

10
00:00:29,070 --> 00:00:32,130
at the Red University if
you've ever been there.

11
00:00:32,130 --> 00:00:36,300
I was there in 2014 and
taught a class until 2017.

12
00:00:36,300 --> 00:00:39,300
So during the time I did a book for NATO.

13
00:00:39,300 --> 00:00:43,110
I edited a book, had 20
authors, 20 chapters.

14
00:00:43,110 --> 00:00:45,270
Some of you are probably
in the audience today.

15
00:00:45,270 --> 00:00:50,040
And we looked at events
around the Euromaidan

16
00:00:50,040 --> 00:00:51,960
and hacks at that time.

17
00:00:51,960 --> 00:00:53,970
And there was so many to look at, right?

18
00:00:53,970 --> 00:00:57,393
So the thing was, it was
none of them were decisive.

19
00:00:59,553 --> 00:01:04,553
Computer network operations,
cyber war are probably not,

20
00:01:05,910 --> 00:01:07,530
just because you look at one of them

21
00:01:07,530 --> 00:01:09,090
and it's not overwhelming

22
00:01:09,090 --> 00:01:11,490
doesn't mean all of them
together collectively

23
00:01:11,490 --> 00:01:14,070
aren't quite important to look at.

24
00:01:14,070 --> 00:01:16,860
Anyway, there was military
attacks, cutting cables,

25
00:01:16,860 --> 00:01:19,350
commandeering satellites.

26
00:01:19,350 --> 00:01:22,260
One of the chapters was
written by the Ukraine Cert

27
00:01:22,260 --> 00:01:25,470
and they said that the attack
on the election in 2014

28
00:01:25,470 --> 00:01:27,450
against the presidential
election in Ukraine

29
00:01:27,450 --> 00:01:30,952
was the most sophisticated
thing it had ever unraveled.

30
00:01:30,952 --> 00:01:32,460
Infrastructure of course,

31
00:01:32,460 --> 00:01:35,550
the hackers turned out
the lights on Christmas

32
00:01:35,550 --> 00:01:40,080
in Ukraine in 2015 and
2016 in advertising.

33
00:01:40,080 --> 00:01:44,430
So, in TVs and E-billboards
in both Ukraine and Russia

34
00:01:44,430 --> 00:01:47,259
were hacked and used
for propaganda purposes.

35
00:01:47,259 --> 00:01:49,380
I got to teach at the university there.

36
00:01:49,380 --> 00:01:51,817
And so I used to always ask my students,

37
00:01:51,817 --> 00:01:54,780
"Do you feel like Kremlin propaganda

38
00:01:54,780 --> 00:01:58,110
has invaded your personal
social media space?"

39
00:01:58,110 --> 00:02:00,510
Right and each class I would
ask that for 2 1/2 years,

40
00:02:00,510 --> 00:02:04,050
and every hand would go up every time.

41
00:02:04,050 --> 00:02:05,160
In the diplomatic space.

42
00:02:05,160 --> 00:02:06,160
This is interesting.

43
00:02:07,260 --> 00:02:10,530
US diplomats had their
communications captured

44
00:02:10,530 --> 00:02:14,130
via traditional cigent and
then uploaded to YouTube

45
00:02:14,130 --> 00:02:16,290
and announced on Twitter, right?

46
00:02:16,290 --> 00:02:19,830
So, multifaceted operation,
which shows forethought

47
00:02:19,830 --> 00:02:24,153
and goal-oriented behavior among hackers.

48
00:02:25,590 --> 00:02:29,190
So in this case, in this particular

49
00:02:29,190 --> 00:02:31,950
further invasion of Ukraine in 2022,

50
00:02:31,950 --> 00:02:34,320
the top bullet is from Microsoft.

51
00:02:34,320 --> 00:02:38,370
But Microsoft said they have
been watching six Russian APTs

52
00:02:38,370 --> 00:02:41,790
which is synonymous a
nation state group, right?

53
00:02:41,790 --> 00:02:44,520
That is professional
and focused on hacking

54
00:02:44,520 --> 00:02:46,290
in eight malware families.

55
00:02:46,290 --> 00:02:48,480
That for a year before the invasion

56
00:02:48,480 --> 00:02:53,480
were conducting intelligence
to support the invasion, right?

57
00:02:53,850 --> 00:02:56,010
So, these things don't happen overnight.

58
00:02:56,010 --> 00:02:58,380
I mean, they are serious investments.

59
00:02:58,380 --> 00:03:01,890
And then if you watch them,
you can actually see them

60
00:03:01,890 --> 00:03:04,323
and see how they fit
into a bigger picture.

61
00:03:05,532 --> 00:03:09,750
So, February 24th was the invasion day.

62
00:03:09,750 --> 00:03:13,474
In January we saw at least 70 defacements

63
00:03:13,474 --> 00:03:16,799
of Ukrainian government agencies

64
00:03:16,799 --> 00:03:19,200
with threatening messages, right?

65
00:03:19,200 --> 00:03:20,642
About what was to come.

66
00:03:20,642 --> 00:03:23,250
WhisperGate occurred in January,

67
00:03:23,250 --> 00:03:26,130
and that's basically wiper malware

68
00:03:26,130 --> 00:03:28,863
targeted against Ukrainian
government agencies.

69
00:03:30,660 --> 00:03:32,670
You'll see two examples here of GRU.

70
00:03:32,670 --> 00:03:34,260
And these are both from the White House.

71
00:03:34,260 --> 00:03:37,140
So, these are the White
House saying these are GRU

72
00:03:37,140 --> 00:03:41,701
or Russian military hackers
doing this activity.

73
00:03:41,701 --> 00:03:44,760
In January already there were attacks

74
00:03:44,760 --> 00:03:47,520
against liquified natural gas companies

75
00:03:47,520 --> 00:03:50,430
both in Ukraine and in the West.

76
00:03:50,430 --> 00:03:53,670
And the hackers were
paying $15,000 per account

77
00:03:53,670 --> 00:03:55,860
on the dark web to gain access

78
00:03:55,860 --> 00:03:59,700
to usernames and passwords
at L&G companies.

79
00:03:59,700 --> 00:04:02,910
And then using them to
backdoor into the firms.

80
00:04:02,910 --> 00:04:04,140
And the reason this is important

81
00:04:04,140 --> 00:04:05,820
and it shows nation state behavior

82
00:04:05,820 --> 00:04:10,820
is because after the war started
L&G went through the roof.

83
00:04:11,040 --> 00:04:14,940
And so somebody was
anticipating that, right?

84
00:04:14,940 --> 00:04:19,940
Okay, so for 10 days prior to
February 24th, the invasion,

85
00:04:20,370 --> 00:04:24,956
things turn and whatever
analogy you wanna use

86
00:04:24,956 --> 00:04:29,430
in traditional military
space, the weapons shifted

87
00:04:29,430 --> 00:04:32,070
to DDoS attacks against
the Ukraine government

88
00:04:32,070 --> 00:04:34,470
and the Ukraine government
said that they were the largest

89
00:04:34,470 --> 00:04:39,333
they had ever seen for 10
days prior to February 24th.

90
00:04:40,200 --> 00:04:44,977
So, if we look at February
24th, things changed again.

91
00:04:45,960 --> 00:04:48,012
So the day before the invasion,

92
00:04:48,012 --> 00:04:53,012
wipers became to predominate, right?

93
00:04:53,160 --> 00:04:54,716
In place of DDoS.

94
00:04:54,716 --> 00:04:57,100
And so these are the weapons.

95
00:04:57,100 --> 00:04:59,220
These are cyber weapons.

96
00:04:59,220 --> 00:05:04,220
If you want to fire a code that
is going to help you achieve

97
00:05:06,930 --> 00:05:11,070
some kind of strategic
effect or you hope it will,

98
00:05:11,070 --> 00:05:13,920
a wiper is a good candidate, right?

99
00:05:13,920 --> 00:05:17,400
You delete all the data,
you destroy the boot loader

100
00:05:17,400 --> 00:05:21,176
and then, somebody has
bricks to deal with.

101
00:05:21,176 --> 00:05:25,842
And so, this is a shift, right?

102
00:05:25,842 --> 00:05:28,048
Just the day before the war.

103
00:05:28,048 --> 00:05:29,730
SMS messages.

104
00:05:29,730 --> 00:05:32,010
So, civilians would get messages

105
00:05:32,010 --> 00:05:35,460
kind of like the ATMs
are not working, right?

106
00:05:35,460 --> 00:05:38,220
Trying to create panic in the population.

107
00:05:38,220 --> 00:05:41,107
And soldiers would get
an SMS message that said,

108
00:05:41,107 --> 00:05:46,107
"Lay down your arms and
surrender to the invasion force."

109
00:05:46,707 --> 00:05:49,180
New wiper, February 24th.

110
00:05:49,180 --> 00:05:54,180
And then targeting the ISP,
the national ISP in Ukraine

111
00:05:55,890 --> 00:05:58,380
to try and take comms offline.

112
00:05:58,380 --> 00:05:59,800
Social media.

113
00:05:59,800 --> 00:06:03,277
The Facebook accounts
of Ukrainian officers

114
00:06:03,277 --> 00:06:05,140
were hacked, taken over

115
00:06:05,140 --> 00:06:08,850
and then used to try and tell the troops

116
00:06:08,850 --> 00:06:10,260
not to show up for work, right?

117
00:06:10,260 --> 00:06:12,210
To go home or to surrender.

118
00:06:12,210 --> 00:06:14,010
And then, the big Viasat attack.

119
00:06:14,010 --> 00:06:15,210
And that occurred one hour

120
00:06:15,210 --> 00:06:17,730
before the invasion
force crossed the border.

121
00:06:17,730 --> 00:06:22,730
And that was targeting internet
satellite communications.

122
00:06:23,520 --> 00:06:26,190
And according to the Ukrainian
government had an immediate

123
00:06:26,190 --> 00:06:29,726
and substantial impact
because the Ukrainian military

124
00:06:29,726 --> 00:06:33,093
and law enforcement used Viasat.

125
00:06:34,560 --> 00:06:37,350
So, there's lots of
examples chiefly in March

126
00:06:37,350 --> 00:06:42,350
of how the evolution
of pro-Russia attacks.

127
00:06:43,230 --> 00:06:45,420
Sometimes they tell you
exactly what they're gonna do.

128
00:06:45,420 --> 00:06:48,097
On March 1st, the Russian government said,

129
00:06:48,097 --> 00:06:53,097
"We're gonna go after
Ukrainian lies and propaganda."

130
00:06:53,400 --> 00:06:58,140
And not only did wiper code
take out Ukrainian media firms

131
00:06:58,140 --> 00:07:01,320
but a missile took out the
TV tower on the same day.

132
00:07:01,320 --> 00:07:03,150
So, sometimes you have to listen to people

133
00:07:03,150 --> 00:07:06,330
and just take what they're
saying at face value.

134
00:07:06,330 --> 00:07:09,480
In March 3rd, there was in Sumy,

135
00:07:09,480 --> 00:07:13,110
the town in Northeast Ukraine
that Russia absolutely thought

136
00:07:13,110 --> 00:07:18,033
because very Russian language
speaking would be an easy win.

137
00:07:19,020 --> 00:07:21,780
Microsoft said that the
nation state hackers were in

138
00:07:21,780 --> 00:07:26,130
at least a month before there
was a blackout and explosions

139
00:07:26,130 --> 00:07:29,100
in critical infrastructure in that town.

140
00:07:29,100 --> 00:07:33,270
So, March 19th, Industroyer2
we saw again, right?

141
00:07:33,270 --> 00:07:37,285
And again, the White
House says this is GRU,

142
00:07:37,285 --> 00:07:39,690
and it was a failed attempt,

143
00:07:39,690 --> 00:07:43,862
but they said if it had
succeeded, the deletion of data

144
00:07:43,862 --> 00:07:47,732
and the manipulation of
critical infrastructure,

145
00:07:47,732 --> 00:07:51,720
it would've affected 2
million Ukrainian citizens.

146
00:07:51,720 --> 00:07:56,040
And so that's already getting
into strategic territory.

147
00:07:56,040 --> 00:08:00,238
I'll just skip down to June 27th.

148
00:08:00,238 --> 00:08:04,902
The Russian exclave of Kaliningrad, right?

149
00:08:04,902 --> 00:08:07,230
Lithuania said, "We're gonna stop.

150
00:08:07,230 --> 00:08:09,510
We're gonna enforce sanctions.

151
00:08:09,510 --> 00:08:12,270
And we're gonna prevent goods and material

152
00:08:12,270 --> 00:08:15,990
from moving through what
is the Baltic territories."

153
00:08:15,990 --> 00:08:18,180
The countries into Kaliningrad.

154
00:08:18,180 --> 00:08:20,017
And so, Killnet came out and they said,

155
00:08:20,017 --> 00:08:23,040
"No, no, no. We're
gonna target Lithuania."

156
00:08:23,040 --> 00:08:26,670
And it's not just random DDoS.

157
00:08:26,670 --> 00:08:30,990
In fact, there is an
emergency system in Lithuania

158
00:08:30,990 --> 00:08:33,666
that's designed for
communications during crises,

159
00:08:33,666 --> 00:08:35,820
and that was also taken offline.

160
00:08:35,820 --> 00:08:38,670
So, somebody knew about that
and knew where to target it.

161
00:08:40,470 --> 00:08:44,580
These three are all candidates
for biggest event of the war

162
00:08:44,580 --> 00:08:46,923
I think in terms of cyber.

163
00:08:46,923 --> 00:08:51,450
Anonymous declares it's war
with the Russian government

164
00:08:51,450 --> 00:08:53,626
on February 24th.

165
00:08:53,626 --> 00:08:55,950
And why is that so important?

166
00:08:55,950 --> 00:08:58,620
Well, it's because anybody
can be Anonymous, right?

167
00:08:58,620 --> 00:08:59,940
And so, what do you think?

168
00:08:59,940 --> 00:09:02,250
Are there nation state hackers

169
00:09:02,250 --> 00:09:05,670
acting as Anonymous almost certainly?

170
00:09:05,670 --> 00:09:09,270
On February 26th, so the
Belarusian Railways hack.

171
00:09:09,270 --> 00:09:10,620
This is fascinating.

172
00:09:10,620 --> 00:09:12,510
Still using windows XP.

173
00:09:12,510 --> 00:09:14,890
But some hackers maybe

174
00:09:16,680 --> 00:09:20,590
with intelligence informed information

175
00:09:22,133 --> 00:09:24,390
went after the logistics.

176
00:09:24,390 --> 00:09:25,650
Because if you see,

177
00:09:25,650 --> 00:09:28,140
here's Moscow, here's Minsk, here's Kiev.

178
00:09:28,140 --> 00:09:30,090
I mean, there's only so
many railways, right?

179
00:09:30,090 --> 00:09:32,340
And so, Russia really
needed to move troops

180
00:09:32,340 --> 00:09:34,958
and war material through Belarus.

181
00:09:34,958 --> 00:09:39,958
But evidently, the train
traffic was paralyzed

182
00:09:41,190 --> 00:09:43,230
according to the Washington post for days.

183
00:09:43,230 --> 00:09:48,000
And this contributed to
the infamous 40-mile convoy

184
00:09:48,000 --> 00:09:51,570
north of Kiev of which
became sitting ducks, right?

185
00:09:51,570 --> 00:09:54,990
For javelins and other weapons.

186
00:09:54,990 --> 00:09:56,400
And then, the Ukrainian SIM card.

187
00:09:56,400 --> 00:10:01,400
So, the Russian strategy failed

188
00:10:01,860 --> 00:10:05,790
to take to Kiev, for example,
in the beginning of the war.

189
00:10:05,790 --> 00:10:07,710
And their communications
were all messed up.

190
00:10:07,710 --> 00:10:10,626
They may have expected
to take Kharkiv and Kiev

191
00:10:10,626 --> 00:10:13,170
and then have those resources available.

192
00:10:13,170 --> 00:10:14,340
But they didn't, right?

193
00:10:14,340 --> 00:10:16,080
So, they had to use Ukrainian SIM cards

194
00:10:16,080 --> 00:10:19,350
which were almost certainly
a massive honey pot

195
00:10:19,350 --> 00:10:23,193
that led to the assassination
of senior Russian officers.

196
00:10:24,660 --> 00:10:27,570
I think this is one of
the big stories here

197
00:10:27,570 --> 00:10:31,050
is that cyber power, it looks a lot more

198
00:10:31,050 --> 00:10:32,880
like what's called soft power

199
00:10:32,880 --> 00:10:34,833
in the international relations space.

200
00:10:35,790 --> 00:10:39,390
And soft power is not
forcing somebody to help you

201
00:10:39,390 --> 00:10:42,030
but they help you because
they want to, right?

202
00:10:42,030 --> 00:10:44,700
And so if you look at, from everything,

203
00:10:44,700 --> 00:10:49,530
from IT firms to IT Sec
firms to the nations,

204
00:10:49,530 --> 00:10:52,098
including Sweden and
Finland joining up to NATO,

205
00:10:52,098 --> 00:10:53,850
it's been quite incredible.

206
00:10:53,850 --> 00:10:55,740
I mean, the FBI's providing intelligence.

207
00:10:55,740 --> 00:11:00,740
USAID has provided thousands
of emergency devices

208
00:11:00,810 --> 00:11:03,360
for communication during the war.

209
00:11:03,360 --> 00:11:08,360
DOE is helping Ukraine to
reorient its entire infrastructure

210
00:11:09,840 --> 00:11:12,390
away from Russia and toward Europe.

211
00:11:12,390 --> 00:11:14,670
So, it's gonna be a strategic failure

212
00:11:14,670 --> 00:11:16,709
for Moscow in that sense.

213
00:11:16,709 --> 00:11:20,070
The Shields Up website from CISA.

214
00:11:20,070 --> 00:11:21,600
Cyber Command.

215
00:11:21,600 --> 00:11:23,700
In fact, Ukraine said last week

216
00:11:23,700 --> 00:11:26,580
that there are cyber
camp command personnel

217
00:11:26,580 --> 00:11:30,688
helping them on a daily basis
on the ground in Ukraine.

218
00:11:30,688 --> 00:11:33,300
The White House announced
the preemptive removal

219
00:11:33,300 --> 00:11:35,520
of Russian malware around the world

220
00:11:35,520 --> 00:11:37,380
before it could be used.

221
00:11:37,380 --> 00:11:39,000
The Distributes Denial of Secrets.

222
00:11:39,000 --> 00:11:40,740
This is gonna take years to sort through.

223
00:11:40,740 --> 00:11:43,380
At least 6 million
documents have been stolen

224
00:11:43,380 --> 00:11:44,910
from Russia networks and uploaded

225
00:11:44,910 --> 00:11:47,940
including all kinds of
Russian government agencies.

226
00:11:47,940 --> 00:11:51,780
So, I don't think that Russia
is getting the same kind of,

227
00:11:51,780 --> 00:11:53,250
if you were at Black Hat yesterday,

228
00:11:53,250 --> 00:11:55,963
there was one talk about Chinese APTs

229
00:11:55,963 --> 00:11:58,920
and in one slice of it was Chinese APTs

230
00:11:58,920 --> 00:12:02,160
that are focused specifically
on targeting Russia.

231
00:12:02,160 --> 00:12:07,160
And so, that's not the kind
of comradeship that you want

232
00:12:07,691 --> 00:12:11,399
I think over time in a strategic sense.

233
00:12:11,399 --> 00:12:12,840
So, connectivity.

234
00:12:12,840 --> 00:12:15,420
I think that the biggest
single event so far

235
00:12:15,420 --> 00:12:19,350
was Zelensky stayed in Kiev.

236
00:12:19,350 --> 00:12:23,010
Not only that, but he has
been such a charismatic genius

237
00:12:23,010 --> 00:12:26,257
going out in the middle
of the night and saying,

238
00:12:26,257 --> 00:12:27,150
"I'm here.

239
00:12:27,150 --> 00:12:29,070
The Defense Minister's here", et cetera.

240
00:12:29,070 --> 00:12:31,230
So this connectivity has been incredible.

241
00:12:31,230 --> 00:12:35,580
And Starlink, if you talk
to any Ukrainian thinker,

242
00:12:35,580 --> 00:12:37,650
will credit that almost first, right?

243
00:12:37,650 --> 00:12:40,737
So, there's a Ukrainian
equivalent to CISA.

244
00:12:40,737 --> 00:12:45,737
The SSSCIP and their
chief just gave a talk

245
00:12:46,360 --> 00:12:49,830
in which he said, this was
in terms of digital help,

246
00:12:49,830 --> 00:12:51,832
this was the single biggest thing

247
00:12:51,832 --> 00:12:56,832
to keep Zelensky communicating
with outside leaders

248
00:12:57,000 --> 00:13:00,241
and to keep the military still able

249
00:13:00,241 --> 00:13:01,980
to conduct artillery strikes.

250
00:13:01,980 --> 00:13:03,960
And so, it's been used for everything.

251
00:13:03,960 --> 00:13:05,370
It's high bandwidth.

252
00:13:05,370 --> 00:13:08,460
It's low orbit satellites
that are difficult

253
00:13:08,460 --> 00:13:13,460
to find and to hack for the adversary.

254
00:13:13,770 --> 00:13:15,750
There's always something to hack, right?

255
00:13:15,750 --> 00:13:19,194
So, Putin on June 17th
was gonna give a speech

256
00:13:19,194 --> 00:13:24,194
on Russian resilience in the
face of Western sanctions.

257
00:13:24,990 --> 00:13:27,930
And the speech was delayed for 100 minutes

258
00:13:27,930 --> 00:13:31,230
by a DDoS attack in St. Petersburg.

259
00:13:31,230 --> 00:13:34,260
So, if you wonder what DEFCON does.

260
00:13:34,260 --> 00:13:36,258
Does it affect the highest levels?

261
00:13:36,258 --> 00:13:37,800
It absolutely does.

262
00:13:37,800 --> 00:13:40,050
So, anybody now writing in universities

263
00:13:40,050 --> 00:13:43,890
or indeed advising the
White House or the Kremlin

264
00:13:43,890 --> 00:13:48,890
on strategy is absolutely going
to take IT and IT Security

265
00:13:49,530 --> 00:13:51,180
and computer hacking into effect.

266
00:13:51,180 --> 00:13:55,230
It has the most profound
effect on deterrents,

267
00:13:55,230 --> 00:13:57,180
arms control, these big issues.

268
00:13:57,180 --> 00:14:00,210
So, both the United States and Russia,

269
00:14:00,210 --> 00:14:02,250
and this is interesting
because there's at least

270
00:14:02,250 --> 00:14:04,890
one person who said, we should
just knock Russia offline.

271
00:14:04,890 --> 00:14:08,070
A well known computer security expert.

272
00:14:08,070 --> 00:14:10,087
But both Russia and the
United States have said,

273
00:14:10,087 --> 00:14:15,087
"Look, if you touch my NC3,
we're gonna come after you."

274
00:14:15,143 --> 00:14:18,420
So NC3, nuclear command and control.

275
00:14:18,420 --> 00:14:20,700
So, it's bad enough to
have nuclear weapons.

276
00:14:20,700 --> 00:14:22,589
It's worse to lose them

277
00:14:22,589 --> 00:14:25,410
or feel like you don't
have control of them.

278
00:14:25,410 --> 00:14:29,850
And so, some of these things
are really quite strategic

279
00:14:29,850 --> 00:14:31,920
at the highest level.

280
00:14:31,920 --> 00:14:33,510
Mid-war assessment.

281
00:14:33,510 --> 00:14:37,500
I think from javelins to drones,

282
00:14:37,500 --> 00:14:42,500
the decentralized
networked aspect of warfare

283
00:14:42,510 --> 00:14:44,280
couldn't be overstated.

284
00:14:44,280 --> 00:14:46,575
There's a 15-year-old
kid on those first days

285
00:14:46,575 --> 00:14:49,980
when the Russian tanks
were bearing down on Kiev

286
00:14:49,980 --> 00:14:52,740
and he uploaded what his drone found.

287
00:14:52,740 --> 00:14:53,970
And it led to the destruction

288
00:14:53,970 --> 00:14:57,900
of 20 Russian military vehicles.

289
00:14:57,900 --> 00:15:00,600
So, it provides enormous opportunity

290
00:15:00,600 --> 00:15:03,420
to the attacker and to
the defender, I think.

291
00:15:03,420 --> 00:15:08,184
And so, it gives more power
to people who have IT skills,

292
00:15:08,184 --> 00:15:10,653
IT security skills, hacking skills.

293
00:15:12,600 --> 00:15:14,430
CNA, computer network attack.

294
00:15:14,430 --> 00:15:18,270
You see it just like the
book that we published

295
00:15:18,270 --> 00:15:20,370
at NATO in 2015, which is a free download.

296
00:15:20,370 --> 00:15:23,730
And then, I think also I wrote
a paper for this conference

297
00:15:23,730 --> 00:15:25,230
and it might already be on the website.

298
00:15:25,230 --> 00:15:26,700
I think it might be.

299
00:15:26,700 --> 00:15:28,080
There's 85 sources or so.

300
00:15:28,080 --> 00:15:30,060
So, I tried to pull everything together

301
00:15:30,060 --> 00:15:31,767
from the last few months.

302
00:15:31,767 --> 00:15:34,826
There's plenty of examples of CNA.

303
00:15:34,826 --> 00:15:37,020
And I would say it depends on who,

304
00:15:37,020 --> 00:15:39,630
if you're the one being
attacked, it is a very big deal.

305
00:15:39,630 --> 00:15:42,540
If you're a colonial pipeline,
it's a very big deal.

306
00:15:42,540 --> 00:15:45,450
If you're the United States of
America or if you're Ukraine,

307
00:15:45,450 --> 00:15:50,450
you'll survive it, but it
depends on your perspective.

308
00:15:51,090 --> 00:15:55,800
And so, I think bigger story
than CNA in this particular war

309
00:15:55,800 --> 00:15:58,630
is CND, computer network defense

310
00:15:59,640 --> 00:16:02,100
because one of the things that Russia did

311
00:16:02,100 --> 00:16:05,190
over the last eight years
was prepare for this war.

312
00:16:05,190 --> 00:16:08,370
And I think one of the things
that Ukraine and NATO did

313
00:16:08,370 --> 00:16:10,871
over the past eight years
is prepare for this war.

314
00:16:10,871 --> 00:16:15,840
And so, from traditional political,

315
00:16:15,840 --> 00:16:19,560
probably not enough
traditional military hardware,

316
00:16:19,560 --> 00:16:23,310
but in terms of getting the hackers ready,

317
00:16:23,310 --> 00:16:25,023
I think it was probably done.

318
00:16:26,610 --> 00:16:30,120
Yeah, so the European
Union had a crisis team.

319
00:16:30,120 --> 00:16:33,480
We've seen Cybercom on the
ground there, et cetera.

320
00:16:33,480 --> 00:16:38,480
So, I think that one of the
ways you can see is attribution.

321
00:16:40,200 --> 00:16:44,250
It's so much quicker
and more accurate than,

322
00:16:45,187 --> 00:16:47,580
some people have been
surprised by that, I think.

323
00:16:47,580 --> 00:16:49,660
But actually, I think attribution

324
00:16:51,630 --> 00:16:53,490
while was it the Pentagon 20 years ago,

325
00:16:53,490 --> 00:16:54,810
we started putting everything

326
00:16:54,810 --> 00:16:57,390
in all these attribution buckets, right?

327
00:16:57,390 --> 00:16:59,160
And so, there was already some sense

328
00:16:59,160 --> 00:17:01,410
that you knew who the bad guys were

329
00:17:01,410 --> 00:17:03,270
because they're going after torpedoes

330
00:17:03,270 --> 00:17:05,373
or they're going after submarines.

331
00:17:06,420 --> 00:17:08,790
But it's a sort political
question of whether or not

332
00:17:08,790 --> 00:17:10,710
you want to release this information.

333
00:17:10,710 --> 00:17:13,050
Of course, the White House
has been very proactive

334
00:17:13,050 --> 00:17:17,250
at releasing information
to harm Russian strategy

335
00:17:17,250 --> 00:17:19,860
to some serious effect.

336
00:17:19,860 --> 00:17:20,693
The cloud.

337
00:17:20,693 --> 00:17:22,828
So, I have also spent a
lot of time in Estonia.

338
00:17:22,828 --> 00:17:26,923
And all of Estonia is backed
up in the United Kingdom.

339
00:17:26,923 --> 00:17:29,370
And I know that the
Ukrainians have been asking

340
00:17:29,370 --> 00:17:32,400
the Estonians over the past
some years for a lot of help.

341
00:17:32,400 --> 00:17:35,550
And so, the head of the SSSCIP

342
00:17:35,550 --> 00:17:39,601
said that backing up the
country has been critical.

343
00:17:39,601 --> 00:17:44,601
He said, "Our agencies are
backed up in safe locations."

344
00:17:44,850 --> 00:17:47,640
And so this was what he pointed to

345
00:17:47,640 --> 00:17:51,390
as key to getting through the war.

346
00:17:51,390 --> 00:17:54,780
And then, not only has the war
been a disaster for Ukraine,

347
00:17:54,780 --> 00:17:56,370
it's a disaster for Russia.

348
00:17:56,370 --> 00:17:59,593
So, even the coolest
company in Russia, Yandex,

349
00:17:59,593 --> 00:18:01,650
has lost thousands of employees

350
00:18:01,650 --> 00:18:04,347
including its CEO to the war.

351
00:18:04,347 --> 00:18:06,111
So, in terms of hackers,

352
00:18:06,111 --> 00:18:08,850
Russia is gonna be
bleeding hackers right now

353
00:18:08,850 --> 00:18:12,033
and it's gonna take years
to replace that talent.

354
00:18:13,350 --> 00:18:14,550
So, some final questions.

355
00:18:14,550 --> 00:18:16,420
I think one of the big questions

356
00:18:16,420 --> 00:18:21,420
that all the analysts are
asking is have we seen cyber war

357
00:18:22,350 --> 00:18:25,890
in its fullest form in this case?

358
00:18:25,890 --> 00:18:29,340
I think, probably because
of the defensive efforts

359
00:18:29,340 --> 00:18:33,161
of the West, maybe not, but
the question is out there.

360
00:18:33,161 --> 00:18:38,161
If Russia has more in
terms of cyber fire power,

361
00:18:38,520 --> 00:18:39,720
why wouldn't they use it?

362
00:18:39,720 --> 00:18:41,340
I mean, their backs are against the wall.

363
00:18:41,340 --> 00:18:42,843
Their strategies failed.

364
00:18:43,770 --> 00:18:45,810
Putin's trying to hang onto power.

365
00:18:45,810 --> 00:18:50,810
And why wouldn't they fire any
cyber weapons they have now?

366
00:18:52,260 --> 00:18:53,280
It's a very good question.

367
00:18:53,280 --> 00:18:55,740
So, maybe we've seen the extent

368
00:18:55,740 --> 00:18:59,250
of cyber war at least for now.

369
00:18:59,250 --> 00:19:03,720
And of course, China, Beijing
is watching this very closely

370
00:19:03,720 --> 00:19:08,613
because they're trying to
take lessons for Taiwan.

371
00:19:10,200 --> 00:19:13,935
For Ukraine, I think connectivity
and the soft power nature

372
00:19:13,935 --> 00:19:16,440
has been more important

373
00:19:16,440 --> 00:19:19,397
than CNO or computer network operations.

374
00:19:19,397 --> 00:19:23,304
Just Zelensky staying in
Kiev and communicating

375
00:19:23,304 --> 00:19:26,340
with the parliaments of the world

376
00:19:26,340 --> 00:19:28,740
has been key at the strategic level

377
00:19:28,740 --> 00:19:30,390
and at the tactical level

378
00:19:30,390 --> 00:19:35,390
You saw that even in the,
as of stall steel plant.

379
00:19:35,430 --> 00:19:39,390
Even in the darkest days of
the attacks on the plant,

380
00:19:39,390 --> 00:19:42,090
the troops there were still in
contact with their families.

381
00:19:42,090 --> 00:19:44,100
How is that possible, right?

382
00:19:44,100 --> 00:19:45,453
That's incredible.

383
00:19:46,560 --> 00:19:50,340
So, connectivity has proven
surprisingly resilient.

384
00:19:50,340 --> 00:19:53,280
So if you wanna prepare
for you or your enterprise

385
00:19:53,280 --> 00:19:56,702
or your country, you can make investments

386
00:19:56,702 --> 00:20:01,260
in connectivity redundancy,
out of band communications.

387
00:20:01,260 --> 00:20:02,253
That sort of thing.

388
00:20:03,150 --> 00:20:05,300
And then I think that's
the end of my talk.

389
00:20:07,079 --> 00:20:08,130
And all of us are wondering,

390
00:20:08,130 --> 00:20:10,830
will the diplomacy hold?

391
00:20:10,830 --> 00:20:13,320
And that's to include digital, right?

392
00:20:13,320 --> 00:20:18,320
I think over time will attention
get diverted from Ukraine?

393
00:20:19,290 --> 00:20:20,940
And I think one of the reasons it won't

394
00:20:20,940 --> 00:20:24,840
is because the Ukrainians are
fighting for their very lives.

395
00:20:24,840 --> 00:20:28,920
And so, there's no choice.

396
00:20:28,920 --> 00:20:31,320
There's no question about
what they're gonna do.

397
00:20:31,320 --> 00:20:34,774
And I think Zelensky is a once
in a generation communicator

398
00:20:34,774 --> 00:20:36,810
and we're gonna see more of him

399
00:20:36,810 --> 00:20:41,810
and that Ukraine is benefiting
immensely from that.

400
00:20:42,270 --> 00:20:43,560
Thank you so much for your time

401
00:20:43,560 --> 00:20:45,576
and I'm willing to take any
questions, I think outside.

402
00:20:45,576 --> 00:20:49,326
(audience applauding loudly)