How Partnerships, People, and Technology are Working Together to Secure Ukraine’s Digital Assets
As winter retreats in Europe, Ukraine and Russia are poised to begin a new phase of the ground war that has continued for 14 months.
Ukrainian President Volodymyr Zelenskyy visited troops near the front lines as they prepare to receive new shipments of weapons from allies and Western partners. He also met with the head of NATO, Jens Stoltenberg, who visited Kyiv on Thursday and pledged that Ukraine’s “rightful place” is in the military alliance.
“Let me be clear, Ukraine’s rightful place is in the Euro-Atlantic family,” Stoltenberg said in a press conference. “Ukraine’s rightful place is in NATO.”
Meanwhile, cyberattacks and information assaults continue to play a major role in Russia’s offensive. In a video fireside chat hosted by Billington CyberSecurity on Thursday, Illia Vitiuk, head of the department of cyber and information security of the security service of Ukraine (SSU), gave an update on the types of attacks he and his team have been addressing since 2015 and how that experience has made Ukraine more resilient to cyber incidents.
“Attacks on our power plants and distribution centers have risen a few times,” Vitiuk said. “But due to experience, we were able to block them. We installed telemetry sensors. We had our security information and event management systems installed, and our security operational sensors operating together.”
Prior to the ground invasion, Ukraine dealt with major attacks by Russia on its critical infrastructure in 2015 and 2016 that disrupted electric service to residents. One of those previous incidents impacted more than 250,000 people. Since then, physical assaults and blackout measures have affected electric grid service for Ukrainians, but Vitiuk said only one cyberattack—so far—has been successful against an energy distribution company.
“So, 25,000 people were without electricity for three hours,” he explained. “They tried to use wipers and attacked a number of our power plants. Luckily, we didn’t let that happen.”
Partnerships
While Ukraine has its own security services and an experienced cyber workforce, partnerships have been crucial to its ability to build a more resilient infrastructure and ward off cyberattacks.
After the 2015 and 2016 assaults on Ukraine’s electric grid, the U.S. government stepped in and provided resources from the FBI, CIA, and Cyber Command to assist the Ukrainian government in its resilience efforts.
“They came to Ukraine—they deployed a team in the beginning of 2022—to define objects of critical infrastructure that were under risk of severe cyberattacks,” explained Vitiuk, who said they then worked to inspect those infrastructure targets and problems. “They left us specialized equipment, which helped because [this infrastructure] was under serious attack up to the beginning of the invasion.”
Additionally, private companies have offered assistance to Ukraine. Microsoft, Amazon, Cisco, and others have provided information and reports about tactics and possible victims of cyberattacks to the Ukrainian government. At 11:00 a.m. on 24 February 2022, for instance, Vitiuk said the phone rang and it was a representative from cybersecurity firm Mandiant calling to provide assistance to Ukrainian officials to help counter cyberattacks. The information provided from those resources was immediately put into action to help protect Ukrainian government ministries from cyberattacks, Vitiuk added.
Microsoft and Amazon also allowed the Ukrainian government to move its databases into their cloud infrastructure for free.
“This was extremely important up to the beginning of the invasion because no one knew if this city or that city would be surrounded,” Vitiuk says, meaning database storage on the ground in Ukraine could be compromised. “Moving these databases and information to the cloud was extremely important.”
Another technology company has also provided aid to Ukraine: Clearview AI. Vitiuk said the company made its facial recognition service available to the Ukrainian government, for free. It’s been using it to identify Russians and conspirators—called spotters—who have been involved in war crimes.
“They granted us this software free of charge. For us that was extremely important because at that moment, it was someone supporting us. Someone trusts that we are about to win,” Vitiuk said, adding that it was important from a software, hardware, and psychological perspective.
As the war continues, Vitiuk explained that it is increasingly important for Ukraine to secure additional resources—including money—to help protect critical infrastructure from cyberattacks. He’s proposed a patronage program to NATO where an ally or private company could sponsor a particular ministry and work with that ministry to inspect its security status and help address problems.
“This is a big program, and I understand that due to the bureaucracy in NATO it takes time to make decisions,” he added. “We need to help our objects of critical infrastructure and we need to make it happen quickly. It’ll make it easier to do the job we’re doing.”
Technology
Along with developments in cybersecurity capabilities, Vitiuk also explained that Ukraine is using a variety of technology tools to assist in its battle against Russia. For instance, it’s doing a lot of work to counter uncrewed aerial vehicles (UAVs) since Russia has been using these systems to attack Ukrainian troops and infrastructure.
“We are creating our own army of drones,” Vitiuk said. “It’s important how it will be operated, and AI will likely be used there.”
Ukraine is also hacking cameras in occupied areas—as well as in Russia—to take information from the camera, analyze it with AI, and understand where troops, weapons, and vehicles are moving.
“We take information from satellites and compare it, and we have a product that’s important to our intelligence to understand how our enemy might act with regular military forces,” he said, adding that AI has helped Ukrainian officials make decisions so it can be “more effective, even with less forces and less weapons than the enemy has.”
Another core component of Ukraine’s defense effort is countering disinformation campaigns to spread Russian propaganda inside and outside of Ukraine. This effort has led to the conviction of more than 600 people for different crimes connected to working against the information security of Ukraine, Vitiuk said. Officials have also worked to block hundreds of Telegram channels that were being used to spread disinformation, as well as approximately 500 YouTube channels.
“Our task is to convey the truth to people—to people here in Ukraine, to our international partners, and to Russians even,” he said. “It is always easier to say the truth—to tell the truth—than tell lies.”
Looking Forward
As the war continues, Vitiuk said that he is most concerned about attacks on Ukraine’s energy sector and Ministry of Infrastructure assets—such as railroads.
And while Russia may be larger, and more powerful in some ways than Ukraine, Vitiuk said the Ukrainian patriotic spirit has been ignited to extreme levels, especially for those who have volunteered to help defend Ukraine’s critical infrastructure.
“This is a war against evil and we need to win it together as soon as possible,” he added.
