Deep Dive
Shownotes Transcript
This episode is brought to you by Shopify. Forget the frustration of picking commerce platforms when you switch your business to Shopify, the global commerce platform that supercharges your selling wherever you sell. With Shopify, you'll harness the same intuitive features, trusted apps, and powerful analytics used by the world's leading brands. Sign up today for your $1 per month trial period at shopify.com slash tech, all lowercase. That's shopify.com slash tech.
Ryan Reynolds here from Intmobile. With the price of just about everything going up during inflation, we thought we'd bring our prices down.
down. So to help us, we brought in a reverse auctioneer, which is apparently a thing. Mint Mobile, unlimited premium wireless. How did it get 30, 30, how did it get 30, how did it get 20, 20, 20, how did it get 20, 20, how did it get 15, 15, 15, 15, just 15 bucks a month? Sold! Give it a try at mintmobile.com slash switch. $45 upfront payment equivalent to $15 per month. New customers on first three-month plan only. Taxes and fees extra. Speeds lower above 40 gigabytes each detail.
Hello and welcome to Wednesday's episode of the Battleground Ukraine podcast with me, Saul David, and Patrick Bishop. Today we're talking to cyber expert and friend of the podcast, David Alexander. David is an academic who has helped to develop national cyber policy and operational capability for both the UK government and the Ministry of Defence. We asked David to give us an update on the cyber front of the Ukraine war since we last spoke to him in early January. This is what he told us.
David, you last appeared on the podcast in January, a couple of months ago. You gave us a kind of great assessment of where we'd got to at that point, but obviously quite a bit's been happening since then. Can you give a sort of summary, really, of the cyber front in the Ukraine war since early January? Yes, there's a lot that's been happening in the background, but there haven't really been any major notable events inside Ukraine itself, which...
I think it's fairly indicative of the fact that the Ukrainians have got their foot well and truly upon the neck of the Russian attack efforts, both through their own sterling efforts and also information that they've been provided by Western allies to help them. Part of that is that Ukraine has now been allowed to join the NATO Joint Centre for Advanced Technologies for Cyber Defence, which is our cyber defence knowledge hub and training centre and research centre. And it should be stressed that Ukraine
The terms of reference to that centre are that it is not limited to NATO members only. So just because Ukraine has been allowed to join that does not mean that they're part of NATO, before anybody gets the wrong idea. The fact that also there have been, in the SSCIP, the Ukrainian Cyber Defence Organisation, have said that there have been something like
2,100 incidents that they've detected and reacted to in that time within Ukraine. But the fact that from a cyber point of view, we've seen very little disruption, minimal efforts. There were some attempts to attack the Ukraine information, the news organization, but that was pretty much a failure. Other than that, nothing really to report inside there.
The Russians, however, have not fared so well. People like Anonymous and other organizations have been attacking them with some gusto and vigor. You may have seen reports that there have been fake air raid warnings, both on the radio and over the web, and also only a day or so ago, a fake nuclear attack alert, which has gone out. Now,
The fact that three or four days have passed since the fake missile alert and the Russians are still unable to find and stop the compromise that's allowing Anonymous to do this is rather embarrassing, certainly for the Russians. It shows that they are really not getting a grip of what's happening. We used to call them top three cyber-capable nations, but right now it doesn't look like it. And I think a lot of that is to do with the fact that the organized crime gangs are no longer helping them.
Just to look forward, David, to the possibility of a nuclear conflict. This is something that goes up and down this threat. Does this suggest that in the event of things moving to a very alarming higher level, the West would have the capability to actually preempt a nuclear strike from Russia? Is that a possibility, do you think, with our kind of overreach, our overmatch in cyber capability? Yes.
I think it's probably unlikely. We could probably get some kind of warning that it was coming a reasonable length of time before it happened, but anybody with any sense would keep the control systems that run these nuclear weapons completely separate from the rest of the world. Now, there are people who have put a lot of time and effort into compromising those kinds of systems. It's not impossible.
But I suspect that the systems that work on mobile launches in the field, you're never ever going to be able to stop. You might be able to slow things down. You might be able to limit it, but you're never going to be able to stop it. And although it's not my area of expertise, I'm one of those people who firmly believes that
the prospect of things turning nuclear is very slim indeed. I really don't think it's a major threat personally. Going back to the Anonymous Hacking Collective, David, you mentioned them before, of course, and they are a kind of unofficial outfit that are working on behalf of the Ukrainians.
What is their motivation, do you think, in these attacks against Russia, which must be incredibly embarrassing? And, you know, also, to be fair to the ordinary civilian in the street, pretty alarming to Russians, too. Yes, I should think they are, certainly for those people that are witnessing them, because these radio broadcasts are going out in major cities, which are areas that
Putin is probably very keen to keep isolated and insulated from this kind of knowledge because these are the kind of areas where unrest really matters and where it really takes hold. The anonymous group, they are a bunch of hackers and most of the time what they do is for kudos, it's for reputation. Hackers, their reputation is a major currency amongst themselves. The
The more successful you are, the more you can prove that you've been able to hack interesting things, the higher you're standing within that community. And that's a large part of the motivation. Obviously, for the criminals, it's more about the money, although reputation, you know, they quite like to be infamous. But anonymous in this case, they're doing the right thing,
partly for reputation, but I think mostly they're doing it for the right reasons in that the Russians are clearly in the wrong here. And if there's something that Anonymous can do, albeit technically outside the law, they're doing the right thing. And I suspect that law enforcement won't be looking too hard to try and find and stop them. David, you mentioned earlier that the criminal hackers were a big part of the Russian cyber capability, but that's no longer the case. What's happened there?
Well, the organized crime gangs, a lot of them were sitting inside Russia and, to be honest, in some cases inside Ukraine as well. And they were allowed to operate with tacit agreement from the Russian government and political law enforcement organizations on the grounds that they didn't target people within Russia itself. So they only went for foreigners. The quid pro quo was that in times of events like this, they then had to help the Russian state out.
by using their efforts to attack and compromise whichever country was the target of Russian opposition. So they helped target Estonia back in 2007. They helped target Georgia before that invasion. And then, of course, they're involved to start with Ukraine. Now, that model is fine if it's a short war because organized crime gangs, of course, are motivated by money. And we saw quite quickly that
A, as success didn't come, and B, as the war dragged on, the crime gangs fell away from the cyber effort against Ukraine because, obviously, it was affecting their cash flow quite badly. And we've watched...
The levels of cybercrime gradually going back up and up against targets, commercial targets, targets in the West. It's now back to about 60% of the kind of level it was at before. Now, we don't think that means that 40% of the resources are still helping the Russians. They're clearly not. We think that's actually to do with the fact that the sanctions have been put in place and making it much harder for the crime gangs to move money around and get it into Russia.
And that is limiting their business model, which, oh dear, what a shame. There was an announcement back in January, late January, early February, of seven Russian cyber criminals who had been sanctioned by the British government. We believe that is because they were helping to launder money and move money around for the Russian government.
And that would be either to get money into or out of Russia as part of the smuggling operation, trying to bring in supplies, food, luxuries, stuff that could be used for the war effort. The fact that they've been sanctioned, of course, means that their funds can be frozen, their assets can be seized. It makes their life very difficult. But also financially, it means that any money they had in the system they were trying to move around, they've lost access to or they should have lost access to.
David, you mentioned in your recent update to me that the Russians appeared to be trying to reduce the number of channels by which information, and I quote, not to the advantage of the state, can be spread within Russia. And of course, it might also help to reduce the amount of open source intelligence available to those watching from Russia. So do you think these measures have had much success for the Russians?
I think any attempt to do this is quite limited. I mean, the whole point of the internet is that it is resilient to attempts to disrupt and destroy it. It's not quite self-healing. However, it's got to the point where people will find ways to make things happen. They will use various channels, VPNs, to try and contact the outside world, get information from the outside world.
Russia conducted an exercise before the war started where they actually did look at cutting themselves off from the internet to see what would happen. And basically found it made business pretty much impossible. It almost stopped life. We are...
As a global entity, we're pretty much dependent upon it now to make most things happen. So you can't just shut the outside world off. You've got to allow certain amounts of information through. And whilst you might have put a bit of a speed break on what's getting through, it will still get through and it will then get spread through internal channels. There will be people internally who will take that information and they'll pass it on to others.
You can monitor it. And the Roscomnadzor, which is part of the Federal Service for Communications and Information Technology in Russia, they will be watching what's going on. But they themselves have been compromised. That's another thing. Anonymous hacked them and released a huge amount of their data to show what they're up to. So in many ways, they're on the back foot. They're trying to play catch up, but they're not being very successful.
You mentioned Roskomnodor, the internet watchdog agency, David. Recently, you also mentioned this to me, they announced new laws banning the use of most of the private messaging applications in the Russian government and state agencies. So that's trying to control what people within the state system are actually doing. And presumably this is partly to do with the sort of the telegram messages that are going around, some of which are perceived to be sort of...
at least critical of the war effort. Again, has this had much success, do you think? I doubt it. Undoubtedly, I mean, human nature is such that if there's a channel available, people will use it as a shortcut to transmit information, to communicate with their friends, either officially or unofficially. And...
Those channels, of course, can be monitored. A lot of nations have SIGINT capabilities, which includes cyber. So that kind of information will be hoovered up and analyzed, and you can get a lot of information from it. I've talked in the past about, you know, we have listened into chatter, and chatter is a term we use for a lot of this kind of background information.
literally that goes on across these channels, people talking to each other, not necessarily officially. And what Russia's trying to do is it's trying to stop some of those leaks. It's trying to stop ways in which that information, A, can be leaked to the West, but also could be leaked to people like Anonymous or even their own members of the Russian public. By closing down the more insecure channels, what they're trying to do is limit the damage. Again,
Will people pay attention to it? Will people stop doing it? You can put laws in place. It doesn't mean that people are actually going to listen to it and actually going to do it. And I suspect it will just carry on. Do you know what level of access, David, people have to VPNs in Russia? These, for people who don't know what that is, is a virtual private network, which means you can bypass the kind of controls that the Kremlin is seeking to impose online.
Do we know how easy that is to do? Anybody can do it. It's a question of knowing that they exist and knowing how to find the right tool and make it happen. Now, a lot of effort has been going in to educating the Russians in how to do that. There is a file sharing service called BitTorrent, which is used for pirating movies and CDs and things like this.
And what people have been doing is they've been adding an additional file onto BitTorrent streams going into Russia, which contains information on, A, how to download and install a VPN, and, B, what sites then to look at to get accurate, truthful information about what's happening in the war and what's happening inside Russia. And that, of course, is being spread. So we are doing our best to try and improve the ways that the VPNs can be used to increase access to them. And, of course...
Over time, they eventually reach a critical mass. Enough people know about it. If one person tells two people who then tells four people and so on, very quickly it grows. And the main thing, of course, is you've got to have a computer and you've got to have access to the Internet. So in Russia, a lot of this will be in the more built-up areas. Some of the more remote areas, access is much more difficult, much more sketchy. People don't necessarily have access.
access to kit in their own homes and it's really being able to use this kit in your own home in privacy that makes it possible. You don't want to be sitting in somewhere's public library looking up this kind of information where somebody could be shoulder surfing and seeing that you're looking at stuff you really shouldn't be
David, we've been assuming for many months that there will be cyber attacks from Russia. You've already pointed out that actually they've been relatively ineffective, but there have been one or two moments, like, for example, when a certain number of German airports, their systems, presumably their sort of air control systems were down for a while. Are we right to assume that's probably the Russians or could it be something else? Yeah.
It's one of those, if it looks like a duck and it wobbles like a duck moments where the Germans had a problem where they lost the network connectivity because the classic thing of somebody working on a digging a road up, put a backhoe through a data cable.
And Lufthansa and various other airlines had to very quickly find an alternative route to get themselves back to allow their services to be available to the public once more. Now, the way they did this wasn't necessarily as secure as it would normally be. And so the temporary clutch that they put in place to make it work
was able to be hacked. Now, this incident happened just after the Germans had announced that, yes, they were going to make Leopard tanks available to Ukraine.
And the various, there were a couple of organizations in Russia. There's, there's what they call anonymous Russia and another group who basically claimed that they were the ones that actually did this hack and caused this disruption. Now it, it didn't last very long and it was, it was much more embarrassment value than actually doing any real damage. But it, in terms of who else would stand to gain from actually doing that kind of attack, uh,
Russia is obviously the prime candidate. As the police would say, they're the ones with the method and the motivation to do so.
But the fact that that's the best kind of attack they can do, embarrassment value only, shows that they're really not being very effective. I think the state is trying to focus its efforts on Ukraine, although they are looking elsewhere. There was a formal warning issued by the UK's National Cyber Security Centre of an intelligence campaign that had been launched by Russia and another one by Iran yesterday.
where they're looking to compromise people like journalists and politicians and other people working on looking at Ukraine and Russia and the cyber aspects and just the general sanctions and warfare scenario. So the Russians do have some capability there.
But the fact that the world's focus is turned upon them and the cyber, no, protective monitoring capability, as we call it, is also turned upon them, means that the chances of actually achieving any, I think, major disruption in terms of cyber outside of Russia is pretty low.
This episode is brought to you by Amazon Prime. From streaming to shopping, Prime helps you get more out of your passions. So whether you're a fan of true crime or prefer a nail-biting novel from time to time, with services like Prime Video, Amazon Music, and fast, free delivery, Prime makes it easy to get more out of whatever you're into or getting into. Visit Amazon.com slash Prime to learn more.
Feel your max with Brooks Running and the all-new Ghost Max 2. They're the shoes you deserve, designed to streamline your stride and help protect your body. Treat yourself to feel-good landings on an ultra-high stack of super-comfy nitrogen-infused cushion that takes the edge off every step, every day. The Brooks Ghost Max 2. You know, technically, they're a form of self-care. Brooks, let's run there. Head to brooksrunning.com to learn more.
Welcome back. Well, the next thing we wanted to know was what David thought about the overall air situation. This is what he told us. David, can we move on to something that's of great interest to our listeners? We get lots of questions about the role of conventional air power in this conflict, or rather the absence of conventional air power. We don't see many fast jets in the air. Helicopters have really kind of
faded from the kind of general battlefield picture. You're a former fast jet pilot yourself. Can you give us an idea of what has been happening there? Why we're not seeing this sort of conventional air power being used in the way one might have expected to at the beginning? And another thing that fascinates our listeners is the
you know, the way that drones have moved to the forefront of the air battle and whether they are indeed the future, whether we won't actually see fast jets in the picture in wars to come. Yes. I think a lot of the fact that we haven't seen much coming out of Russia is partly to do with the state of their maintenance, the state of their readiness of their aircraft, how long they can spend in the air. I mean, certainly in my day, the
The briefings we got were that the kind of avionics and the engines the Russians were using had very short lives. They needed replacing far more quickly than the kind of engines that we developed and used in the West. Their pilots don't get the flying hours, don't get the level of training. Therefore, they're not as skilled as they would like to be. And certainly nowhere near as skilled as we are.
Add to that the fact that we rapidly supplied some fairly good man-pad systems, the man-portable air defence systems, shoulder-launched surface-to-air missiles. Russians took some fairly high casualties both of helicopters and of some of the fast jets, the ground attack aircraft, especially that were in the wrong place at the wrong time. And they suffered some quite heavy losses. And if you look at the number of aircraft they lost, it's quite significant.
And that's made it very difficult for anything that flies to live near the forward edge of the battle area. The Ukrainians, they've got older technology. They're really brave. They've had some great training from the West. Their pilots are quite skilled and they do what they can. However, the kind of radars and air defense missiles that they have on those aircraft aren't necessarily...
the right kind of technology you need to identify and engage Russian targets at longer ranges. So that has meant that obviously they've been trying to keep their aircraft, preserve them, make sure that they've got them for if they do need them.
But because the Russians haven't been flying much into Ukrainian airspace, there hasn't been much need for the Ukrainians to have big combat air patrols that are sat there waiting for something to appear. A lot of it's been, as we've seen, these amazing clips of helicopters flying, virtually touching the ground, a nap of earth flying, flying along roads and such like, in such a position where they are protected and it's much harder to shoot them down.
So I think that's why we haven't seen much in the way of air activity, because both sides have made it very difficult to stay alive. I mean, the Russians have got the S-300 system, which is meant to be a very good air defence system. However, the number of missiles they've got, we know, is an issue. In terms of the drones question, I mean, you had a question the other day from a listener talking about, well, why use F-16s when you could use drones instead?
And there are things we know that drones can do very well. They've been used in a lot of places. They're great for taking out individual vehicles. We've even seen them used to take out a Taliban leader on his balcony in Afghanistan. However,
They don't have the situational awareness that a pilot sitting in a seat flying along does. They don't spot things the way he does. They can't make the rapid decisions that he does. There is a reason why modern air forces still have more ground attack aircraft with seats in them than they have drones.
We haven't yet reached the point where a drone is that capable. And also, you don't see any drones that are currently being used in the air defense role. So drones don't have those advanced radar systems, those advanced missile systems that we get on fighter aircraft. So drones
I think it's going to be – there are some demonstrators flying in the States now that are showing great promise, but they are just demonstrators. They're probably 10 years away from drones being used in an air defense role. You're still going to have –
a person sat in a seat flying something with a loud lever that's going to be doing air defense until that point. So, yeah, drones have a great role in ground attack, but they don't yet have a role in air defense. And that's the F-16 that people have been talking about,
it can do both jobs. It can do air defence or it can do the ground attack role. So it will fulfil a role that drones just can't, but it would also give you a better capability to launch terminal guided munitions, either laser designated or JDAM weapons using GPS to try and engage targets. So I think it's something that,
the Ukrainians do need to have personally, because achieving air superiority, whereby you can guarantee...
The safety of your aircraft in the skies is something that's going to be very important. And the Russians, as we've seen, more and more of their ground-based air defence systems are being destroyed. The AFVs have got cannon and guided missile systems on them. They're being taken out. In fact, those in some ways, if you can make those a priority target, that would be great.
Back in my day, the Russians had a really formidable air defence capability that was tracked and wheeled and could move forward with the troops that were attacking.
And the idea was that helicopter gunships would actually go in and take out the air defense systems, then leaving your fixed-wing aircraft to go in and take out the armor with a much lower risk of being shot down by those air defense systems because the helicopters already killed them. So there is a tactic there that you need to use where you neutralize the air threat and then you go in with your own ground attack aircraft and start attriting his ground forces.
Going back to cyber for a second, David, and to lighten the mood possibly, you kind of hinted in one of your earlier messages to me that we, that is you and I and Patrick, might all be potential targets for a bit of cyber disruption. In what form could that take? I don't think necessarily disruption. In the case of us, it would be a case of
trying to eavesdrop on our communications to find out what we know and who's telling us. Yeah. Where are we getting our information from that? So doing some traffic pattern analysis to try and figure out who's, who's connected to whom, who's telling people what that's probably what they're more interested in. They might try and set up fake social media accounts, um, to discredit us possibly. Um,
One of the reasons why I don't have a social media presence is so that that can't be done and I can't be hacked. But I think you'll find it's not so much likely that you're going to be attacked and have your systems wiped. It's more a case of they'll just try and covertly find out what you know and how you found it out. Okay. Patrick, any last questions? I mean, one thing we'd both like to know, David, is you've already talked about this kind of
dwindling capability that the Russians seem to have to disrupt in the cyber sense. Do they have any arrows left in their quiver? Do they have anything that they can pull out that might surprise us, do you think? It's possible they still have some stuff they haven't used. The danger is that cyber attacks have a way of spreading, unlike a conventional kinetic weapon system where you can fairly precisely target it and say this shell is going there.
Once you put an attack out on the Internet, it can spread much faster than you think. A classic example would be the old Stuxnet worm, which was designed to attack one particular Iranian enrichment plant and ended up spreading right the way around the world pretty quickly. And the trouble is, if Russia launches a cyber attack of real power,
there is a risk that it could end up inadvertently spreading into NATO systems or systems in NATO countries. And if they do that, they risk triggering Article 5. We have, though, Article 5 is the one that says an attack on one NATO country is an attack on all NATO
And NATO has publicly declared that a cyber attack counts as an Article 5 item. And this is covered in things like the Tallinn Manual, which is the manual that looks at the rules of cyber warfare. So like you have the Geneva Convention or the San Remo Manual on War at Sea, the Tallinn Manual covers cyber war. And that could potentially give NATO the justification to say, right, this is now a war that we can get involved in.
Whether they want to or not is another question. But it's a bit of an issue of brinkmanship. Is Russia prepared to take that risk and cross that line? And so far, the fact that they haven't done so shows us that right now the answer is no. So potentially they possibly could. Will they? No.
Probably not. Okay, David. Once again, that was absolutely brilliant. We're really grateful for your contributions and they really do add massive value to the podcast. Thanks so much. Yeah, you're welcome. I said, I genuinely listen to every show and it's nice to be able to give something back.
Well, I have to say, Patrick, at the end of a discussion with David, it does fill you with a little bit more confidence in some aspects of this war. It's great to hear, frankly, that this vaunted capability that the Russians were supposed to have in cyber warfare has been overestimated. You could say the same thing about their conventional forces. And they've obviously tried to attack both the
Ukrainians and its Western partners with little success. And we've got to the stage where we can relax, relatively speaking, at least as far as cyber attacks are concerned. Yeah, it's good to hear him say that we've got the upper hand in this very important department of
modern warfare. And he really brought that home to me, how important it is in our just, you know, the business of living these days, the internet generally, he said, you know, he made it sound like, you know, it's like an organ of the body. It's like your heart or your lungs or something. If you don't have it, if it's not functioning, then the state can't live. So I think the fact that we're actually in this enviable position of serious overmatch is
is something to give everyone hope. It's also encouraging to hear, frankly, that whatever the Russians try in terms of controlling information, both within the state and also the population generally, that actually it's almost impossible, as you say, to cut off this kind of living, breathing organism that is the internet. And if people want to get information, they are going to get it. And I think in the long term, both you and I feel that the more sort of genuine information the Russians get,
the more likely they are to turn against support for this war. Yes, it's an interesting question, isn't it? I mean, part of one thinks that any information coming from outside Russia is probably going to be treated with suspicion. But historically speaking, people do thirst for information if they're under the boot of an oppressive power. I'm thinking about France during the occupation period, 1940 to 1944, where...
The most listened to radio program was not Radio Paris, but the BBC broadcasting from London played an incredibly important role. So I'd rather have this image when we were talking about VPNs of this being the kind of 21st century equivalent of huddling around the wireless, you know, in 1943 or something and, you know, fiddling with a knob and hearing London calling. Let's hope that is the case.
Yeah, you asked me an interesting question about air power. And it did set us straight a little bit, didn't it? I mean, we talked about this a little bit on the last podcast. But it's interesting to think that, yes, drones have their place. But actually, fighters with people in them are so much more than just attack
weapons. They're air defense too. They have this extraordinary radar capability, but they also have someone sitting in them, a human, who can make those instant decisions. And of course, a drone will have a camera and the operator's got to... But he's not a fully trained pilot, is he? What we've seen from the Ukrainians is they've got a lot of guys who've just become drone operators, but they're not sort of skilled in all the vital elements of air power. So
Making it pretty clear to us, the most cogent argument I've heard for the fact that the Ukrainians really do need F-16s, this is the sort of penknife that can do everything. It can attack and defend. It's got extraordinary capabilities. And given that it's a Watt,
40 years old now, Patrick. It's amazing, isn't it? Some of the kit that we've built. And also his point that even in the days when he was flying, Russian pilots were never as well trained. Their kit wasn't as good. Their engines burnt out too quickly. And you suspect not a lot's changed since then.
Yeah, I mean, it does again underline the fundamental inefficiency of the Russian military at every level. You'd think that something like fast jets, having the men to fly them, the training, the maintenance, all the rest of it would be absolutely the top of your priority list if you're meant to be a serious military power. But like everything in Russia, it seems to be
you know, extremely badly managed, probably riddled with corruption as well. So, yeah, once again, grounds for hope. And final fascinating point made by him about, you know, does Russia have anything left in its locker? Well, it might have something left, said David, but is it going to use it, you know, a serious attack on NATO computer systems with the threat that if it does that, it could actually bring NATO into the conflict? And, you know, and David said, well, you know,
he suspects they wouldn't do that. So going back to my original point, I think we can rest fairly easily in our beds as far as the cyber warfare is concerned. Of course, it's just a question of defeating Russia militarily now for the Ukrainians. Okay, well, that's all from us. Do join us next Friday for another episode of News Analysis and Comment. And then the following Wednesday for our weekly interview with a star guest. Goodbye.