Support 110 years of independent journalism.

NSA cyber chief: Even the good hactivists are problematic

Rob Joyce discusses the ethical implications of online vigilantes in the Russia-Ukraine war.

By Sarah Dawood

Since the Russia-Ukraine conflict broke out, war on the ground has been brutal and catastrophic. Cyber warfare has been comparably insignificant, and projections about mass online shutdowns have not materialised.

However, there has been some intervention from hostile state actors. Just last week, the Foreign, Commonwealth and Development Office (FCDO) announced that Russia was “almost certainly” behind a major cyber operation targeting the US commercial communications and internet satellite company Viasat, which happened an hour before the invasion on 24 February.

After months of analysis, the UK government’s National Cyber Security Centre (NCSC) has now attributed the hacks to the Russian state. While the primary target was the Ukrainian military, the attacks also impacted Ukrainian Viasat customers, and caused disruption to wind farms and internet users across central Europe. Additionally, the NCSC has ascertained that Russia was also behind an earlier attack on the Ukrainian government on 13 January, which involved defacing government websites and the deployment of destructive malware.

Interestingly, global sanctions on Russia have caused ransomware attacks to decrease since March, noted Rob Joyce, cyber security director of the US National Security Agency (NSA), at the NCSC’s CyberUK conference in Wales this week. Sanctions have made it harder for criminals to organise attacks and move money in the West, he said.

But cyber threats do not only come from hostile states. Speaking in a panel discussion, Joyce highlighted the rise of cyber vigilantes – lone actors on both sides of the conflict who are taking matters into their own hands to infiltrate and destroy their enemy’s systems.

While activism in support of Ukraine might seem commendable, Joyce warned that such an approach is not conducive to ethical behaviour. “You want to sit back and root for the folks who are trying to do noble things but it is problematic,” he said. “We are trying to hold bad actors accountable in other nations [and] we have to be good international citizens in the cyber arena.”

Abigail Bradshaw, head of the Australian Cyber Security Centre (ACSC), said that roughly 300,000 hactivists related to the Russia-Ukraine conflict have been identified so far, and added that the extent of cyber vigilantism has “taken [government] by surprise”.

There is an “extreme unpredictability” associated with these exploits that make it difficult to attribute, contain and stop them, she said. Hactivism can also impact regular citizens quite significantly, due to “spillover” onto non-primary targets (such as with the Viasat campaign) and breaches on public tools like Google Maps, impeding people’s ability to travel and infiltrating personal location data.

Content from our partners
Resolving the crisis in children’s dentistry
Planetary perspectives: how data can transform disaster response and preparation
How measurement can help turn businesses’ sustainability goals into action

Some hactivists do not act alone and have the advantage of an organisation behind them, making them even more of a threat. Perhaps the best-known is Anonymous, the pro-Ukraine collective that has vowed to keep attacking Russia until its aggression stops. The group’s actions have caused Russia to become the most hacked country in the world in 2022 so far, with breaches affecting 3.5 million people, according to research from virtual private network (VPN) provider Surfshark.

But hactivist collectives exist on both sides. Conti, a group of pro-Russia ransomware cyber criminals, have now “restyled themselves as political activists”, said Jonathan Hope, senior technology evangelist at cyber security firm Sophos, who spoke in another session at CyberUK on ransomware.

Vigilantes can be more ruthless and chaotic than other cyber criminals, he noted, as they destroy data for the sake of it rather than for financial gain, meaning victims are less likely to get their information back. “They’re hacking for ‘Mother Russia’ with no checks, controls or balances,” Hope said. “It’s a tool, a weapon to destroy data.”

The rise in such sporadic hacking makes it ever more important that governments secure and stress-test their critical national infrastructure, said Juhan Lepassaar, executive director of the European Union Agency for Cyber Security.

He said that the UK has done “great work” in securing its telecoms sector, and other industries and countries need to follow suit. “It pays off to build a framework where you stress-test the most critical sectors in society. [The sectors should be] incentivised to do it themselves.”

There was consensus that both organisations and individuals need to be encouraged to undertake basic steps in cyber security. Joyce said that attitudes are changing, albeit a little late – intelligence agencies have focused on counter-insurgency and terrorism for the past two decades, he said, which has caused cyber defence to fall by the wayside.

“We’ve not been investing in IT and now China is threatening those systems,” he said. “We will now do the things that we should have done ten or 20 years ago. The narrative has shifted.”

Moving the onus of cyber security from response to prevention is key, added Lepassaar. In fact, Ukraine’s thorough preparations are what has helped the country stay online despite multiple setbacks and has even enabled them to host “press conferences in besieged cities”, he said. “There has been a good deal of resilience from the Ukrainian state around maintaining connectivity. [This shows] the value of building partnerships early on and making sure you build distributed systems that are difficult to take down and attack.”

Select and enter your email address Your weekly guide to the best writing on ideas, politics, books and culture every Saturday - from the New Statesman. Sign up directly at The New Statesman's quick and essential guide to the news and politics of the day. Sign up directly at Stay up to date with NS events, subscription offers & updates. Weekly analysis of the shift to a new economy from the New Statesman's Spotlight on Policy team.
  • Administration / Office
  • Arts and Culture
  • Board Member
  • Business / Corporate Services
  • Client / Customer Services
  • Communications
  • Construction, Works, Engineering
  • Education, Curriculum and Teaching
  • Environment, Conservation and NRM
  • Facility / Grounds Management and Maintenance
  • Finance Management
  • Health - Medical and Nursing Management
  • HR, Training and Organisational Development
  • Information and Communications Technology
  • Information Services, Statistics, Records, Archives
  • Infrastructure Management - Transport, Utilities
  • Legal Officers and Practitioners
  • Librarians and Library Management
  • Management
  • Marketing
  • OH&S, Risk Management
  • Operations Management
  • Planning, Policy, Strategy
  • Printing, Design, Publishing, Web
  • Projects, Programs and Advisors
  • Property, Assets and Fleet Management
  • Public Relations and Media
  • Purchasing and Procurement
  • Quality Management
  • Science and Technical Research and Development
  • Security and Law Enforcement
  • Service Delivery
  • Sport and Recreation
  • Travel, Accommodation, Tourism
  • Wellbeing, Community / Social Services
Visit our privacy Policy for more information about our services, how New Statesman Media Group may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications.

Topics in this article :