quite numerous and interesting so a little bit about me I guess I've been doing something called
signals intelligence or cyber intelligence it's like 93 so similar to DEF CON right at
Fort Meade and NATO and NCIS like the TV show a couple things I was in Estonia for the 2007
events I was in Ukraine I got to teach a computer security class at the Red University if you've
ever been there I was there in 2014 and taught a class until 2017 so during the time I did a
book for NATO I edited a book had 20 authors 20 chapters some of you are probably in the audience
today and we looked at events around the Euromaidan and and hacks at that time and there was so many
to look at
right so the thing was it was none of them were decisive you know it's computer network
operations cyber war are probably not you know just because you look at one of them and it's
not overwhelming doesn't mean all of them together collectively aren't quite important to look at
anyway there was military attacks cutting cables commandeering satellites the one of the chapters
was written by the ukraine cert and they said that the
attack on the election in 2014 against the presidential election in Ukraine was the most
sophisticated thing it had ever unraveled infrastructure of course the hackers turned
out the lights in on Christmas in Ukraine in 2015 and 2016 in advertising so in TVs and
e-bill boards in both Ukraine and Russia were hacked and used for propaganda purposes I got
to teach at the University there and so I used to always ask my students do you feel like creating
Kremlin propaganda has invaded your personal social media space right in each class I would ask
that for two and a half years and every hand would go up every time in the diplomatic space this is
interesting uh U.S diplomats had their communications captured via traditional sigint and
then uploaded to YouTube and announced on Twitter right so multi-faceted operation which shows
forethought and uh you know goal-oriented behavior among
hackers so in this case in this particular uh further invasion of Ukraine in 2022 the top
bullet is from Microsoft but Microsoft said they had been watching six Russian APTs which is
synonymous to a nation-state group right that is professional and focused on hacking in eight
malware families that for a year before the invasion were conducting intelligence to support the invasion
right so these things don't happen overnight I mean they are serious investments and then if you
watch them you can you can actually see them and see how they fit into a bigger picture
before so February 24th was the invasion day in January we saw at least 70 uh defacements of
Ukrainian government agencies uh with threatening messages right about what was to come uh Whisper
Gate occurred in in January
um you'll see two examples here of gru and these are both from the White House so these are the
White House saying these are gru or Russian military hackers doing this activity in January
already there were attacks against liquefied natural gas companies both in Ukraine and in the
West and the hackers were paying fifteen thousand dollars per account
on the dark web to gain access to usernames and passwords at LNG companies and then using them to
backdoor into the into the firms and the reason this is important and it shows nation-state
behavior is because after the war started LNG LNG went through the roof and so somebody was
anticipating that right um okay on fix over 10 days prior to February 24th the invasion um things turn
and
um whatever analogy you want to use in traditional military space the weapons shifted to DDoS attacks
against the Ukraine government and the Ukraine government said that they were the largest it had
ever seen for 10 days prior to February 24th so if we look at February 24th um things change again
so the day before the invasion wipers became uh to predominate right and
so these are the these are the weapons these are cyber weapons if you if you want to fire a um code
that is going to you know to help you achieve some kind of uh strategic effect or you hope
it will a wiper is a good candidate right it's you know you delete all the data you
uh destroy the bootloader and then uh you know somebody has you know bricks to deal with and so
this is a shift right just the day before the war uh SMS messages so civilians would get messages
kind of like the ATMs are not working right trying to create panic in the population uh and soldiers
would get an SMS message that said lay down your arms right and uh surrender to the invasion force
uh new wiper February 24th uh and then targeting the ISP uh in the
national ISP in in Ukraine to try and take comms offline social media the Facebook accounts of
uh Ukrainian officers were hacked taken over and then used to try and tell the troops not to show
up for work right to go home or to surrender and then the big via sat attack and that occurred one
hour before the invasion force crossed the border and that was uh you know targeting internet
uh and according to the Ukrainian government had an immediate and substantial impact because the
Ukrainian military and law enforcement used via set so there's lots of examples chiefly in in
March of how the uh the evolution of pro-Russia attacks sometimes they tell you exactly what
they're going to do on March 1st the the Russian government said we're going to go after uh Ukrainian
and not only did wiper code take out Ukrainian media firms but a missile took out the TV Tower
on the same day so so sometimes you have to listen to people and just take what they're saying at
face value and March 3rd there was uh in sumi the town in Northeast Ukraine that Russia absolutely
thought because it very Russian language speaking would be an easy win Microsoft said that the the
nation-state hackers were in at least a month before
uh there was a blackout and explosions in critical infrastructure in that town so March 19th in
destroyer 2 we saw again right and again the White House says this is gru uh and it it was a failed
attempt but they said if it had succeeded uh the the deletion of data um and the uh the
manipulation of critical infrastructure it would have affected two million Ukrainian citizens and
so that's already getting an
you know into strategic territory I'll just skip down to uh June 27th the Russian exclave of
Kaliningrad right Lithuania said we're going to stop we're going to enforce sanctions and we're
going to prevent uh goods and materiel from moving through uh what is the Baltic territories
the countries into klinengrad and so kilnet came out and they said no no we're going to target uh
and and it's not just a random DDoS in fact the uh there is an emergency system in Lithuania that's
designed for Communications during crises uh and that was also taken offline so somebody knew about
that and knew where to target it these three are all candidates for for biggest event of the
war I think in in terms of cyber um anonymous uh declares uh it's at war with the Russian government
on February 24th
uh and why is that so important it's be well it's because anybody can be anonymous right and so what
do you think are there nation-state hackers acting as anonymous almost certainly on February 26th so
the the Belarusian Railways hack this is fascinating still using Windows XP uh but some
hackers maybe uh from uh with in you know intelligence informed uh information uh went after
the logistics because if you see here's Moscow here's Minsk here's Kiev I mean there's only so
many Railways right and so Russia really needed to move troops and war materiel through Belarus
um but evidently the uh the trade train traffic was paralyzed according to the Washington Post
for days and this contributed to the infamous 40 mile convoy north of Kiev which became uh sitting
ducks right for javelins uh and and other
uh weapons and then the Ukrainian SIM card so the the Russian uh um strategy failed right to take to
Kiev for example uh in the beginning of the war and their Communications were all messed up they
may have expected to take hard to give in Kiev uh and then have those resources available but
they didn't right so they had to use Ukrainian SIM cards which were almost certainly a massive
honeypot that led to the assassination of senior Russian officers
um I think this is one of the the big stories here is that cyber power it looks a lot more like
what's called soft power in the international relations space um and soft power is not forcing
somebody to to help you but they help you because they want to right and so if you look at from
every everything from IT firms to IT sec firms uh to to the nations including Sweden and Finland
joining up to NATO uh it's been quite incredible
I mean the FBI is providing intelligence USAID has provided provided thousands of emergency devices
for communication uh during the war DOE is helping Ukraine to reorient its entire infrastructure away
from Russia and toward Europe so it's going to be a strategic failure right for for Moscow in that
sense um the shields up website from CISA uh Cyber Command uh in fact Ukraine said last
week that there are Cyber Camp Command uh personnel helping them on a daily basis on the ground in in
Ukraine um the White House announced the preemptive removal of Russian malware around the world before
it could be used the distributed denial of secrets this is going to take years to sort through at
least six million documents have been stolen from Russian networks and uploaded including all kinds
of Russian government agencies so I don't think uh that Russia is getting the same kind of if you
were at blackout yesterday
there's one talk about Chinese apts uh and in one slice of it was Chinese apts that are focused
specifically on targeting Russia and so uh that's not you know the kind of of comradeship that that
you want I think over time in a strategic sense so connectivity I think that the biggest single
event so far was uh zelinski stayed in Kiev and not only that but he has been such a charismatic
genius you know going out
in the middle of the night right um and saying I'm here the defense minister is here Etc so this
connectivity has been incredible and Starlink if you talk to any uh Ukrainian uh thinker will credit
that almost first right so the the there's a Ukrainian equivalent to CISA the SSC IP uh and
their chief just gave a talk in which he said this was it in terms of digital help this was the single
biggest thing uh to keep zelinski's
communicating with uh outside leaders and to keep the art the military still able to conduct
artillery strikes and so it's been used for everything it's high bandwidth it's low orbit
satellites that are difficult to to find and to hack uh for for the adversary there's always
something to hack right so Putin on June 17th was going to give a speech on Russian resilience in
the face of Western uh Western
sanctions and the speech was delayed for a hundred minutes by a DDoS attack in St Petersburg so if you
wonder what you know what Defcon does does it affect the highest levels it absolutely does so
anybody now writing and universities or indeed advising the White House or the Kremlin on strategy
is absolutely going to take you know IT and IT security and computer hacking into effect it has
the most profound uh effect
on deterrence arms control these big issues so both the United States and Russia and this is
interesting because there's at least one person who said we should just knock Russia offline a
well-known computer security expert um but both Russia and the United States have said look if
you touch my nc3 you know we're going to come after you uh so nc3 nuclear command and control
so it's bad enough to have nuclear weapons it's worse to lose them uh or feel like
you don't have uh control of them and so so some of these things are really quite uh strategic at
the highest level mid-war assessment I think the the um you know from javelins to drones the
decentralized networked uh aspect of Warfare couldn't be overstated uh there's a 15 year old
kid on those first days uh when the Russian tanks were bearing down on Kiev and he uploaded what his
drone found and it led to
the destruction of 20 Russian military vehicles so it provides enormous opportunity to the attacker
and to the defender I think and so it gives more power uh you know to people who who have
IT skills IT security skills hacking skills um CNA computer network attack you see it just like
just like the the the book that we published at NATO in 2015 which is a free download and then I
think also I wrote a paper uh for this
conference and it might already be on the website I think it might be there's 85 sources or so so I
tried to pull you know everything together from the last few months um there's plenty of examples
of CNA uh and I would say it depends on who if you're the one being attacked it is a very big
deal if you're Colonial Pipeline it's a very big deal if you're the United States of America or for
your Ukraine you'll survive it you know um but you know it depends on your perspective and so I think
probably than CNA in this particular war is C and D computer network defense um because one of the
things that Russia did over the last eight years was prepare for this war and I think one of the
things that Ukraine and and NATO did over the past eight years is prepare for this war uh and
so from you know from traditional uh you know political probably not enough traditional military
hardware but in terms of getting the hackers ready
I think it was probably done um yeah so the European Union had a crisis team we've seen
cybercom on the ground there uh Etc so I think that one of the ways you can see is attribution
it's so much quicker and more accurate uh than than some people have been surprised by that I
think but actually I think attribution um while I was at the Pentagon 20 years ago
we're started putting everything in all these attribution buckets right and so there was
already some sense that you knew who the bad guys were because they're going after torpedoes or
they're going after submarines um it's a sort of a political question of whether or not you want
to release this information of course the White House has been very proactive at releasing
information to harm Russian strategy to some serious effect the cloud so I have also spent a
lot of time in the United Kingdom uh and I know that the Ukrainians have been asking the Estonians
over the past some years for a lot of help and so the the head of the ssscip said that backing
up the country has been critical he said you know our agencies are backed up in safe locations and
so this was uh you know what he pointed to as is key to getting through the war and then not only
though has the war been a
disaster for Ukraine it's a disaster for Russia so even the coolest company in Russia yandex has
lost thousands of employees including its CEO to the war so in terms of hackers Russia is going to
be bleeding hackers right now and it's going to take years to replace that talent so some final
questions I think you know one of one of the big questions that all the analysts are asking is have
we seen um cyber war in its
first form uh in this case I think probably because of the the defensive efforts of the
West maybe not but the question is out there why if if Russia has more in terms of cyber firepower
why wouldn't they use it I mean their backs are against the wall their strategies failed
um Putin is trying to hang on to power and why why wouldn't they fire any cyber weapons they have
maybe we've seen the extent of cyber war uh at least at least for now and of course uh China
Beijing is is watching this very closely because they're trying to take lessons for uh for Taiwan
for Ukraine I think connectivity and the soft power nature has has has been more important
than CNO or computer network operations um just zelensky staying in in Kiev and
communicating with the parliaments of the world has been key at the strategic level and at the
tactical level you saw that even in the as of stall steel plant even in the darkest days of
the attacks on the plant the troops there were still in contact with their families how is that
possible right that's incredible you would you you know so connectivity has proven surprisingly
resilient so if you want to prepare for you for you or your Enterprise or your
country right you can you can make investments in connectivity redundancy out of band communications
that sort of thing um and then I think that's the end of my talk and and I'm I'm I'm all of us are
wondering is will the the diplomacy hold and that's to include digital uh right I think uh you
know over time will will attention get uh diverted from Ukraine and I think one of the reasons it
won't is because the ukrainians are fighting for their very lives and so there's no there is no
choice there's no question about what they're going to do and I think zelensky is a once in
once in a generation communicator and we're going to see more of him and and and that uh Ukraine is
is benefiting immensely from that thank you so much for your time and I'm willing to take any
questions I think outside
you