Yurii Shchyhol doesn’t have a lot of time to spare.
The head of the Derzhspetszviazok, Ukraine’s version of the US Cybersecurity and Infrastructure Security Agency, can be forgiven for working speedily. His country is under attack—and with it, the world order. “This is the first time ever in history that we’ve had such a full-fledged cyberwar happening right now in Ukraine,” says Shchyhol, who’s tasked with keeping Ukraine’s cyber territory safe in the same way president Volodymyr Zelensky oversees the country’s physical armed forces.
Ukraine’s Cyberwar Chief Sounds Like He’s Winning
Yurii Shchyhol gives WIRED a rare interview about running the country’s Derzhspetszviazok and the state of the online conflict with Russia.
www.wired.co.uk
We also identified that around 90 websites were not accessible as a result of that attack,” says Shchyhol. “The goal of the Russian hackers was to sow panic among the Ukrainian population, and to demonstrate to the outside world that Ukraine is a weak state that couldn’t handle the attacks,” he says. This is why the Derzhspetszviazok rushed to relaunch the sites affected. “The longest it took us for one site was close to one week,” he says. “No data was lost, and the outcome of this attack was more psychological warfare.”
When Russian soldiers began intruding into Ukraine’s physical territory, the attacks in cyberspace stepped up. For a full month, Russia targeted communications nodes, media, logistics, and railways, says Shchyhol. “At that time, there were lots of civilians—noncombatant Ukrainians fleeing to safer places,” he adds. “That’s why the goal of those attacks was to disrupt the work of communications lines, and railways in particular.”
We’re now in the third stage of Russia’s cyberwar against Ukraine, says Shchyhol—one that’s ongoing and perpetrated “mostly against civilian infrastructure: utilities and companies that render services to civilians, since they failed to destroy in the second phase our communication lines and our ability to keep people abreast of what’s going on.” Russia’s digital war playbook is similar to its physical warfare strategy, says the cybersecurity chief. “Our attitude remains the same,” he says. “We treat them as criminals trying to destroy our country, invading it on the land but also trying to disrupt and destroy our lifestyle in cyberspace. And our job is to help defend our country.”
One thing that helped Ukraine learn Russia’s cyber MO was creating a database of attributed Russian attacks that were specified to particular hacker groups. Shchyhol says the Derzhspetszviazok learned that most groups were sponsored by either Russia’s intelligence service—the FSB, Russia’s post-Soviet successor to the KGB—or the Russian army. Shchyhol refutes the term “hacktivist” when used in relation to Russia. “A hacktivist is a person who does it from the generosity of his heart, free of charge,” he says. “These guys are sponsored by the state and receive a mandate to perpetrate crimes.” Knowing who was behind the attacks helped, Shchyhol says. “By virtue of realizing who is attacking us, it allowed us to be better and more successfully get prepared to repel those attacks,” he says.
Ukraine’s cybersecurity lead admits that at least one Ukrainian database has been wiped as a result of Russia’s reported widespread use of wiper malware: the government’s motor insurance policy bureau, responsible for issuing coverage for Ukrainian drivers. “For two weeks, this bureau wasn’t able to issue the insurance policies to their clients,” says Shchyhol. But the bureau—like many in Ukraine—was warned about the risks and had a backup that enabled it to return to normal operations relatively quickly.
Ukraine’s defenses have also been bolstered by covering fire in the cyberwarfare field by pro-Ukraine hacktivists—here, he’s more willing to use the term. “I’m talking not only about the Ukrainian IT Army,” a Telegram group set up at the start of the invasion that had at its peak more than 300,000 subscribers, “but other hacktivists worldwide that joined the effort at the beginning of the invasion.” Shchyhol says that those hacktivists have provided much-needed help—even if there’s little proof that the hacktivist army made any meaningful impact. Indeed, one recent academic analysis compared their work to breaking into a disused shopping center in a small city and spray-painting “Putin sux” on the walls.
“Being a military person, I believe anything that weakens our enemy is good for us,” he says. But Shchyhol is keen to make it clear that’s his personal opinion—wanting to avoid any suggestion of collusion or organization by the Ukrainian state. “They are a self-organized community, operating by setting their own goals,” he says. “There is no coordination of their activities coming from the government of Ukraine, and no sponsoring of their activities. We, as the government of Ukraine, are not giving them any direct order to target, for instance, infrastructure.” Even if they were to do so, Shchyhol says, Russia and its infrastructure would be lawful targets because of “all the crimes they perpetrated here.”
Hyvä haastattelu, sillä se selventää paljon sitä cybersodankäynnin tauhkaa mikä on ollut paljon pelkkää teoriaa tähän mennessä. Vaikka hän avautuu niin paljon on asioita mistä hän ei sano mitään, vaan toistaa jo tunnettuja asioita ja "virallista linjaa." Toivon enemmän, mutta ymmärrän että hän ei voi kertoa kaikista asioista.