A coalition of countries has provided Ukraine with more than €1.3bn of telecommunications, information technology and other high-tech equipment since Russia began the deadliest conflict in Europe since the Second World War.
Although €1.3bn may be small compared with Ukraine’s military budget, the equipment – provided with the support of Western governments and companies – has been critical to allow Ukraine’s government and institutions to continue functioning under Russian attack.
Heli Tiirmaa-Klaar, chair of the IT Coalition Steering Group, told Computer Weekly that with peace talks floundering in Moscow, the group is prepared for a long game, and is ready to support Ukraine’s technology infrastructure for the next five or, if necessary, 10 years.
Russia’s attempts to use “well crafted” cyber attacks to destabilise Ukraine just before troops crossed the border were largely unsuccessful, she told Computer Weekly.
Speaking ahead of a talk at the SANS CyberThreat Summit in London, Tiirmaa-Klaar said that Russian attacks included a widely reported attempt to deploy wiper software to destroy data on Ukraine’s critical computer systems.
Ukraine had the support networks in place to patch the zero-day vulnerabilities used in the attack in a matter of hours.
An attack by Russia on Ukraine’s train network the day before Russian troops crossed the boarder also failed, said Tiirmaa-Klaar. “By the time the invasion happened, and you needed to evacuate, the trains were running again,” she said. The defence was good enough and resilient enough, and that is why we could not see major cyber disruptions during the invasion.
“The Ukrainians were quite successful, especially in the early days of the conflict, keeping the lights on, keeping the phones working, the trains running and other critical services running despite major cyber attacks,” said Tiirmaa-Klaar.
Ukraine was able to prepare in advance by moving government data to cloud systems run by the major hyperscalers. It meant that even if data was destroyed during the war, there were backups available.
Russia behind ‘hybrid attacks’
Since Russia launched its military action, cyber attacks are no longer a Russian priority in Ukraine. Tiirmaa-Klaar added: “The Russian rationale would be, ‘Why do we need to cyber bomb if we can actually bomb?’
“Their main goal is political, and the main means for them is still the military – troops on the ground and tanks rolling over the border,” she said. “They don’t see hybrid warfare and cyber as key capabilities once they have decided to invade.”
Moscow is widely believed to be behind drones and balloon incursions that have disrupted airports in Europe, and the sabotage of undersea communications cables.
“I think this is the old tactic of creating disruptions, testing the response and trying to influence public opinion … to show that [Russia] can bring the war closer to you if you continue to support Ukraine,” said Tiirmaa-Klaar.
Information wars
Tiirmaa-Klaar said the media has also played a part in amplifying Russia’s disruption tactics, by over-publicising the disruption caused by suspected Russian drones in some Western countries.
“The way the journalists responded was a dream for Russian operatives because they just spread chaos,” she said.
The tactic is called “reflexive control” – setting up the conditions so that an enemy responds the way Russia intended. “You create the decision-making ground,” explained Tiirmaa-Klaar. “You can anticipate their next steps because you know how your actions are going to influence them.”
Fighting hybrid warfare poses a tougher challenge than fighting cyber attacks, she added. It will need government agencies, the military and civilians to collaborate in new ways.
Tiirmaa-Klaar pointed to Finland’s response to a Russian ship suspected of cutting critical cable links between Estonia and Finland last year as an example of the type of response needed.
Finland boarded the ship and arrested the crew, and it sent an important political message, she said: “You mess with us, and we mess with you. If we respond properly, if we get our act together, then we diminish the probability that we will be influenced by these hybrid operations.”
The IT Coalition Steering Group Tiirmaa-Klaar chairs was established during the first few weeks of Russia’s second invasion against Ukraine, in February 2022.
A US initiative led to the Ramstein Coalition, which today brings together 56 countries – including European Union and Nato members – to provide military support to Ukraine.
Some 10 subgroups provide support in areas ranging from maritime equipment, to artillery, drones and de-mining. Tiirmaa-Klaar chairs the IT coalition, a group of 18 countries which provides Ukraine with hardware, software, tactical communications cyber defences and IT hardware.
Military procurement is notoriously slow, so the IT coalition focuses on dual-use devices, such as laptops, tactical radio communications equipment and satellite communications technology.
Ukraine has “a very long list” of equipment that it needs, which is constantly updated. Every time there is a battle, essential equipment including radios and computer equipment is lost and will need replacing.
There are also logistical challenges ensuring that equipment reaches the front line, which might be more than 2,000km away.
Old phone masts could help Ukraine
A priority is to source decommissioned mobile phone masts that could be used to provide Ukraine with military communications. The group is also supplying equipment for the Ukrainian military to build datacentres and private clouds.
Tiirmaa-Klaar is far from optimistic that the current peace talks brokered by the US will bring a quick end to the conflict. “Putin has no interest, as far as I can see, in ending the war,” she said.
The IT coalition is prepared, with a three-year plan, a five-year plan, and – if necessary – a 10-year plan.
“We will go on even after peace is signed, because if peace is signed, we do not know how long it will hold,” said Tiirmaa-Klaar. “And the Ukrainian armed forces still need to build up capabilities, even in peace time, because they need to have credible deterrence.”
