Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Hacking for Ukraine, supply chain risk and cyber moonshots
Guests:
Trey Herr, Emma Schroeder
Published:
Updated:
Duration:
49 min
Episode summary
There’s a flood of cybersecurity news as a result of the Ukraine War as well as Washington’s recent efforts compelling organizations to report cyberattacks to federal officials. In this episode, Trey Herr and Emma Schroeder of the Atlantic Council’s Cyber Statecraft Initiative break it all down. They explore the consequences of an escalating digital battlefield in Europe, whether a hack could bring NATO into the war and strategies for creating more consensus within the tangled and complicated realm of cyber policy. Why you should listen:
Understand what’s at stake as cyber warriors do battle on both sides of the the Ukraine War.
Learn about some potential consequences of a destructive hack in Europe and whether that could even draw NATO into the war.
Hear what Washington is doing to obtain better insights and actionable intelligence that could improve cybersecurity defenses.
Incident data matters more than mandates Trey calls the reporting requirement overdue, and sees CISA as a reasonable home for it. He argues that the real value lies in how the data is used, since analysts mostly hear about high-consequence failures.
Supply chain attacks keep paying off Trey calls software supply chain security the gift that keeps on giving to attackers. The team's focus for the year is open source and firmware, and their Broken Trust project tracks two decades of supply chain attacks and disclosures.
Cyber spillover hit far beyond Ukraine The attack on satellite operator ViaSat, apparently aimed at Ukrainian broadband, caused outages across Europe. It left about 5,000 wind turbines in Germany unreachable for a time.
Cyber is less useful once bombs fall Both guests say the shortage of destructive attacks is not surprising. Cyber's strength is slow, covert shaping and sabotage, and tanks are more efficient for destructive effects during an invasion.
Volunteer hacking carries real risks Untargeted attacks by volunteers can tip off Russian defenders to more valuable Western intelligence operations, be misattributed to a government, or harm Russian civilians instead of the state.
Topics covered
Thought Leadership
U.S. Public Sector
Notable quotes
We do a lot of work on the story and not anywhere near as much on the storytelling.
Software supply chain security. It is the gift that keeps on giving to every attacker around the world.
There isn't really a state of peace and war in the cyber domain.
…finding some humility alongside that obligation to understand how you can actually best influence the situation rather than just trying to find the most iconic thing…
Questions this episode answers
Is the new cyber incident reporting requirement for critical infrastructure a good idea?
Trey says it is overdue and that CISA has matured into a good home for the data. He was disappointed by the FBI's last-minute push to take over the role. Read this section
Why have there been so few destructive cyberattacks in the Ukraine war?
Emma says tanks are more efficient than malware for destructive effects, and sophisticated operations take time to build. Russia may also fear spillover into a NATO member, and most proxy groups only have DDoS-level capability. Read this section
Could a cyberattack trigger NATO Article 5?
NATO has said a cyberattack could be grounds for invoking Article 5. Trey thinks it would likely have to be destructive and unrecoverable, such as wiping out a member state's banking system, and Emma says the wider campaign context would matter more than any single incident. Read this section
What are the risks of volunteer hackers attacking Russia?
Trey lists three: exposing more sophisticated intelligence operations, attacks being misread as a Western government move and escalating the crisis, and harming Russian civilians rather than the state. Read this section
How can people in security best help Ukraine?
Emma says even small donations to trustworthy organizations help, as long as you check who you are funding or amplifying. Trey points to groups like Doctors Without Borders and UNICEF rather than defacing Russian websites. Read this section
About the guests
Trey Herr
Trey Herr works on cyber policy at the Atlantic Council's Cyber Statecraft Initiative, part of the Scowcroft Center for Strategy and Security. At the time of recording, he described the initiative's work as bringing people with hands-on technical, military, and engineering experience into conversations about strategy and statecraft. He discussed the team's focus on software supply chain security, open source, and firmware.
Emma Schroeder
Emma Schroeder works on cybersecurity issues at the Atlantic Council's Cyber Statecraft Initiative, part of the Scowcroft Center for Strategy and Security. At the time of recording, she led the Cyber Moonshot short-story project, which uses science fiction to make cyber policy ideas more approachable. She also discussed the team's Broken Trust project on software supply chain attacks.
And I'm Jeremiah Roe. Today, we're gonna hear from Trey Herr and Emma Schroeder from the Atlantic Council, a Washington DC think tank that focuses on finding solutions to some of our biggest economic, political, and security issues.
Trey and Emma both focus on cybersecurity issues in their role at the Atlantic Council's Cyber Statecraft Initiative. They work under the Scowcroft Center for Strategy and Security.
We'll look more at the role that some hackers are playing in the conflict and how the work could have global implications for cybersecurity. We'll get into the conversation after a quick word from our sponsor.
WE'RE IN is brought to you by Synack, the premier crowdsourced platform for on demand security expertise. Synack delivers twenty four seven pen testing, intelligence, and vulnerability management from a global network of vetted and trusted researchers. Their work is enhanced by smart technologies to accelerate your critical cybersecurity mission. Synack gives businesses the best chance of finding every vulnerability that matters. Find out more at synack.com. That's synack.com.
So welcome to the show, Trey and Emma. We're we're really excited to get to speak with you today, and we've got a lot that we'd like to talk about, with what's happening in Ukraine and Russia. But first, we wanted to get started, with a brief explanation for our listeners of what Cyber Statecraft Initiative is all about.
Sure. So the Cyber Statecraft Initiative is the Atlantic Council's cyber policy program, and the Atlantic Council's a national security foreign policy think think. It's been around in DC since 1961. So what we try to do is take operational expertise, folks that have hands on keyboards, who've had actual military experience, technical experience, engineering experience, and bring them into conversations about strategy and the conduct of statecraft that involves technology. So thinking less about how states should be doing things in isolation and more how politics manifests in the real world where technology is messy and people want to do all sorts of malicious things.
Yeah. Definitely. So this this Cyber Moonshot initiative was a kind of new idea that the team came up with last year, about a year ago. And I think that it's kind of a unique format for us, but it does kind of speak to our core mission of trying to connect different communities to talk about these ideas. A lot of these concepts can seem really intimidating and daunting for people to get into. So one purpose of this project was to try to make cyber a little bit more approachable, a little bit more fun, bring more people into that conversation. To do that, we are writing a couple of short stories. It's set in the future. It's on the moon. There are cats with a couple special abilities. And it's just meant to be a fun time.
Major credit to Emma on this, I think, too, because this is one of the things that think tanks tend not to focus on as much. We do a lot of work on the story and not anywhere near as much on the storytelling. So we still fall into a lot of these tropes of, like, academics writing long papers, hoping for the best. And one of the first things that Emma had wanted to do when she came into the council was find a way to do something different and to work short form prose storytelling, and this very... What has devolved into this incredible science fiction, you know, meets the Hitchhiker's Guide to the Galaxy kind of universe where there's whimsy, but there's whimsy that's supporting really important concepts. And so I think it's something that we're we're keen to try to build out in part just because there's so many people that need to understand stuff in the space that that don't have time, don't have wherewithal, and really shouldn't be subjected to an 80 page written report, a PDF. So it's sort of on us to figure out not just what to say, but but really, hopefully, more engaging than how to say it.
So it sounds like this, that particular initiative is geared towards bringing sort of like, I don't want say like regular people, but maybe not like people that are deep, deep in the industry professionals, bringing them up to speed and giving them education. What other types of... I guess I'm curious, who else do you interface with? Who else are you bringing into the conversation?
So a lot of it, and I think I'm going reference this, is we're trying to bridge the community between folks who work on technology, who build it, who design it, who commit code, with folks that regulate it, that talk about the political implications of it. And so for a long time, that's been sort of the divide between congress and technology developers. In the world that we look at today, it's between law enforcement and folks that are sort of in civil society doing open source research on cybercrime. It's between the military community and the technical community that would like to be in the military, but maybe, you know, has has some strong fixation on certain substances or isn't really keen on doing a bunch of push ups. And so for for the way that we work, it's really trying to blend the user base and the developer base that we see with the policy community. And and they look different, and they say different things, and they mean different things when they say the same words. And so a lot of this is trying to find mechanisms to translate, but also to present and allow people to live in that context and that culture so that it's a little bit less of an us other thing.
People, I think, are more likely to to engage with something. It's easier to connect with things when it's it's given to them in a format that they can understand. And a lot of the time, we have a lot of dense reporting out there, which is obviously really great. And then there's a lot of... You're on social media and you're like, oh, I wanna know what happened today. And you go and you're like, wall of things just hitting you. And it can be really hard to kind of walk through that and figure out what can I trust, what happened, how can I understand it on a human level, as well as just verifying what I'm seeing? And I think that we do try to pull some of that narrative thread into a lot of our work, even if it's largely not fiction.
Having something to say and making sure that message is carried through very strongly is something that just can really help connect a lot of different communities. And I think especially when we're seeing tragedies unfolding, having having ways to tell that story in a more human and approachable way is always gonna be a good thing.
From a communications perspective, are you all seeing any kind of shift in the way things are communicated sort of in in Washington when it comes to cybersecurity and what's currently happening over in Ukraine?
It's an interesting question. I mean, we've seen a tremendous presence by the Ukrainians, I think the government, but also folks in the civil society space just to to win the information war, the meme war alone. Yeah. That has been remarkable. And I think that is normalized in some ways, some of these kinds of communication and these media as standard official messaging channels. Maybe that's going to resonate over a longer term. I think you are seeing some people, some folks in DC exposed to that sort of imagery in a way that they haven't been before. But I don't know that I've seen it really shift the conversation yet.
I would say, and I'm curious when I misthought it, but I I think three things. One is it's overdue to have some kind of incident reporting requirement. And it's not necessarily that it has to go to government, but I think CISA is a good player for this. They've matured substantially in the role that they're playing in the space in the last eighteen to twenty four months, and it's not a bad home. But more importantly, I think number two is the paucity of data that we have about these kinds of incidents is tremendous. You know, the bias that that as analysts that we're still working through, which is to say we know a lot about certain high consequence failures, And that's what we think the domain looks like. We really don't know about good success stories. We don't often hear about the the dogs that do bark, but really not very loudly. I think that the the way this data gets used in some ways is much more important than the requirement that that data be out there alone. But the third is I just was so disappointed to see the breakdown in the interagency with FBI coming out at the last minute trying to make this public, you know, just last ditch desperate, burn the grass down in the prairie stand to get this back in their domain.
I I think that was something that really reflected poorly on the leadership over there. And it's it's a shame given how much of a role they play and how important of a stakeholder DOJ is, but especially FBI's in this space. You hope it's an aberration.
I think they aired their concerns to congress and through the interagency extensively. And I think at some point, the White House is gonna is gonna indicate what they believe is the consensus opinion. Congress is gonna make its call, that does end it the ballgame.
I think I think that's a hugely contentious topic, right, especially for commercial entities that have nothing to do with government affairs. One of the arguments is this is intellectual intellectual property or insight into my business. And and though for the greater good, if you will, it can be super beneficial.
There is a kind of perspective difference that I think is is difficult to get around in this space, which is the individual security versus collective security or individual benefit versus collective benefit. These companies, maybe in the short term, there are risks in in sharing this data or they may perceive that there are risks. But as to Trey's point, the more that we know about how these incidents unfold and the types of actors that are out there and what responses actually look like day to day, the better prepared that we can help each other be. Ensuring that through this process, it's not just a top down government requiring information one way street.
And I think this is already the way that things are trending, I think. But ensuring that if companies are giving the government information, then they are getting some sort of benefit out of that. Okay. How do we make sure this mechanism works? If they're getting information back from the government, they get that information back in a way that's actually understandable and usable for them. And making sure that we're pulling in the same direction, but not the government just yanking everybody in the same direction. If we can do everything we can to make sure that companies themselves are incentivized to work in this way, that's pulling generally in the same direction. It doesn't have to be in March step, but aligning incentives to try to produce some more collective security framework and mindset in more of the population, I think, would be helpful in these kind of conversations about reporting.
In terms of public private cooperation, I agree that you would like to see a two way street and value being passed in both directions. But it's a little bit, I guess, from my standpoint, it it reminds me of the VEP conversation where the the principal argument about the vulnerability equities process, which is the interagency process that exists for the intelligence community and for law enforcement to decide what software flaws they discover that should be turned over to industry and fixed rather than utilized for law enforcement or intelligence activities. The thesis that I bought into and I think a lot of people have bought into over time is, does it matter if private sector uses that information incredibly well, pretty well, mostly well? It's a principal question about how the government is gonna secure its citizens, whether it's through making these companies' software products more secure or using that information... Or using those software flaws to exploit and gather information in service of trying to secure people.
And so what you don't wanna see is government saying, well, we don't wanna give it to you because we don't think you're gonna do good things with it. It's like, no. The question is who's taking the lead on security? How many people are you gonna help? And if you give this thing to Google and it's gonna solve, you know, it's gonna... It closed the software flaw for hundreds of millions of users versus if you're gonna use it to target one terrorist organization. That's that's very difficult.
It is. Exactly. And that's and that's... But I think that to your point about incident reporting, the same way. Even if government doesn't make great use of this information, this is information the public should have. And this is information that should be had in aggregate for scholars and for folks in the analytic community to be able to make use of. So I think that's maybe the the third answer to the question on the incident reporting piece is, yeah, there are some companies and there are some services that exist because this is not a very well functioning market. And cybersecurity generally is not a good state of affairs. So I think we are gonna see some regulatory changes that make it much harder for certain classes of companies to operate because they've grown they've grown up around this inefficient system, and that's just the nature of the beast. That will change.
So speaking of of malicious software and malware being utilized in unique ways, is there anything that you are particularly tracking right now from a cybersecurity perspective and vulnerabilities aspect that that is something of interest?
Software supply chain security. It is it is the it is the gift that keeps on giving to every attacker around the world. And I would say the theme the theme we're looking at for this year is open source. Yeah. And firmware. We haven't seen a lot of public information about software supply chain attacks targeting the firmware of systems, mobile phones. We have seen a few cases of, but we're really keenly interested in some of the server side attacks, especially in major cloud vendors. But the other is just open source. You know, this community has come together in the in the aftermath of Log4j and really had some great conversations about what security governance needs to look like, what sort of funding models are out there, and it's just at the early stage, and I think we're gonna see the federal government evolve in a more significant way as well. But this is an area where that is that is ripe for opportunity, unfortunately, both for the defender but also the attacker.
What do you think of when you think supply chain? Is it is it solely software based? Is it is it hardware based? Is it third party vendors that might be connected through off the shelf devices? Obviously, you mentioned firmware. So I'm just kinda... I'd kinda like to dig in on that a little bit.
Yeah. I think on our ongoing project called Broken Trust, we've kind of, I think, taken... Tried to take the idea of supply chains and, like Trey said, attack it a little bit at a time. So we have mainly focused on software supply chains as of yet and breaking down some of the vulnerabilities that we have One way that we've done that is collect our database of software supply chain disclosures and attacks over the past couple of decades. But this is definitely a complicated issue. And I think even just within software supply chain, there are a lot of different types of actors, let alone a lot of different actors.
And these different actors are gonna have different incentives. They're different sizes. They're located in different places. So trying to bring together that conversation is a complicated issue. And then, as Trey said, we're trying to focus in on not just proprietary software, so software owned and built by these companies that are selling it, but also open source, which is free and available for anybody to use, but it's also used in a lot of that proprietary software. So complicated answer to complicated question. We have a lot of moving parts in and throughout the supply chain, but you can take chunks for research on it, but those chunks are always going to have some interconnectivity with everything else.
So I want to focus our conversation more about the crisis happening in Ukraine right now and specifically the cybersecurity issues and relevance there. So specifically, I know we talked a little bit about malware and destructive cyber attacks that are happening right now. I know that that's something that's been talked about in the context of Russia attacking Ukraine. What do we know about what's happening in Ukraine related to malware, destructive cyber attacks, things like that?
Yeah. So so far, there have been a paucity of destructive cyber attacks. There was a wiper that was discovered prior to the Russians jump off on the twenty fourth that affected, it looked like about 50 targets, 50 different systems inside of Ukraine as well as a handful in Lithuania and Latvia. Although later reporting, and I believe it was Kim Zetter, had had come back and said that the Lithuania and Latvian infections were actually just collateral damage from a single contractor who had clients in all three companies... At all three countries, excuse me, who was based in Ukraine. Inside of Ukraine, there we've seen precious little offensive Russian cybersecurity activity targeted at destruction. There's been some to degrade, especially telecommunications networks. And it's not altogether surprising in part because a lot of cyber's capability is in more covert operations, more sabotage focused operations, and really to shape the environment.
And so once you pierce the threshold of bombs are falling, artillery shells are falling, that really makes cyber a little bit less useful and it takes some of its advantages off the table. Where we have seen those from really interesting cyber activity is outside of Ukraine. And in particular, there was an attack on a commercial satellite operator called ViaSat that appears to have been intended to limit, folks in Ukraine's access to broadband Internet services. And there's there's some speculation that they're a commercial provider, but they're government and military customers inside of Ukraine using the service. The effect of that degrade and disrupt attack on Viasat's infrastructure, however, was far far wider than just Ukraine, And it led to service outages for folks across Europe, including, and I think for us, really interestingly, a large commercial wind turbine operator.
So across Germany, think the number was actually 5,000 different turbines were for a period of time inaccessible and inoperable because their means of communicating back home to their operators was via this commercial satellite link and it was disrupted. Haven't seen a tremendous amount of coverage on that. There was a good write up from Rafael Satter of Reuters about a week ago. I haven't seen a tremendous amount of follow-up. But that's the kind of ancillary to the core campaign area where I think we're expecting to see cyber pop up first or at least most frequently. But turn to Emma if she's got other other pieces from that space and she's been following it.
Yeah. I think I've seen a lot of the conversation around this idea of why haven't we seen more? Will we see more? What will it look like? And I think going through, following along a lot of what Trey said, the use so far of cyber that we've seen is not surprising. There are multiple different reasons why we see that. I think first and foremost is probably need. So the kind of effects that cyber can have, if you want those to be destructive effects in line with the direct military offensive, it's probably more efficient to use the tanks that you're gonna be rolling in. And then along with that, you have just the factors of cyber.
Its best utility is that low and slow build up. It takes time. If you're going to try to use more sophisticated cyber operations, it takes time to build those up. It takes time to find vulnerabilities, to build the malware that you're gonna use, make sure that you deploy that in an appropriate way. One caveat there is definitely the how much are the Russians afraid of a potential, again, very hypothetical sophisticated cyber operation in Ukraine spreading into an actual NATO member. Little that we've seen in terms of very sophisticated cyber operations, Maybe there has not been time. There's been a lot of talk about when Putin actually made the decision that this was going to happen as opposed to just being a buildup.
There are a lot of... As we talked about earlier, there are a lot of proxies involved in this operation. The involvement of the proxies is really fascinating. But again, most of these individuals and the groups that have coalesced don't have a lot of sophisticated capability, so they are relying mainly on DDoSing websites and that type of operation that we have seen. And then finally, just looking at what are the best tools that you can use to forward this type of operation. So that's not to say that we won't see more sophisticated cyber operations in the future, but at each step, we have to look at this and say, what's the most important fight that needs fighting?
And I think what we've seen so far is the military invasion, physical military invasion has not necessitated a sophisticated cyber support from the Russians. And what's been more important in the information space is what we've talked about, misinformation, disinformation, which does not necessitate hacking, but what it does need is, you know, really solid messaging, access to these places. So that's where we've seen a lot more activity in in kind of the cyber information environment.
I think the threat of escalation is always a concern with any war, obviously, especially when it comes to cyber operations. What are the risks in this particular conflict from an escalation perspective?
I mean, you have a nuclear armed power as one of the invading states, and there's a, by all accounts, highly centralized decision making structure with a great deal of, say, information asymmetry between what's happening on the ground and and what's being delivered back to the the central node who's actually making decisions and pulling these triggers. So that's concerning, and that has prospect for escalation written all over it. Aside from that, I think the conventional understanding is that we're NATO to become involved as a party of the conflict that that poses risk of escalation with respect to Russians seeing that as direct threat to the continued viability of their invasion. Now they're not they're not experiencing an easy time of it. I think, frankly, the Ukrainians have amazed every single analyst I've ever read, just at how effectively they've been able to to slow down the Russian advance to reverse it in some cases to impose significant consequences and costs.
But part of the flip side of that is it appears to have forced the Russians to change tactics and maybe become more desperate. So we're seeing widespread shelling and and unduided aerial munitions bombardment of major urban areas, the likes of which we have seen before in Syria and in Chechnya, just causing massive loss of life and just undirected collateral damage. And that feels like a choice, but it's also sort of active having fewer options, having having fewer resources to achieve your goals on the Russian side. As that window continues to narrow, you know, is there gonna be an effort for... Is there gonna be a choice, I guess, made to try and widen the options window by taking action against some of these other forms of support, the military that's flowing into Ukraine from folks on the border, all of whom are NATO states. And and so I I I think that the NATO as a co combatant, co belligerent aspect is really concerning as an escalation.
Yeah. The other, though, frankly, is... And and we've seen this, you know, I think less addressed in the last week or two, but these massive sanctions that are disconnecting Russia from global aviation networks, global energy network, global financial networks, they dramatically reduce the cost for Russia to come back and just impose costs on those networks just to play the spoiler and disrupt them. The kind of behavior that we've seen from from the North Koreans, where there are very few consequences to them to trying to literally rob international banks. Right. Because they're not part of the SWIFT network. They've already been sanctioned up the wazoo. I we may start to see that from the Russians as well potentially as a way of imposing costs on these other states. And that is concerning when you have a state as large and as, from a cyber standpoint, as capable, as Russia in that sort of spoiler position. So even if that doesn't cause an escalation spiral up to state on state military activity with a NATO member or nuclear release, it it absolutely causes costs for the West and for The US in trying to respond to this crisis.
One thought, and then I'll kick to Emma. It's just... It's really helpful, I think, in this context not to think about escalation on a domain specific frame. K. Right? So we may see cyber, and then that that turns into something kinetic, it goes back to cyber that ends up in information. It's just... It's very likely that these exchanges are gonna be thought of in broader terms of not to not to plug the concept, but statecraft and strategy Sure. Rather than cyber response with cyber kinetic response with kinetic. But we we kicked in as she's been thinking about that.
Yeah. I think that that question of, you know, specifically in the NATO context, what can trigger Article five is something that there's been some answers to. But again, a lot of of conversations still to be had. So the secretary general has said that cyber could trigger Article five. That's not a guarantee that it it will. And I think
Oh, yes. So article five is the agreement that if you are a NATO member, then, attack on any NATO member is attack on all NATO members. So that is the pledge that is made when a new member joins NATO. What constitutes that attack made on any NATO member? Is cyber included? That is a very slippery question because in cyber we have a lot of different definitions of what constitutes attack. And the the conflict that we see in cyber is is ongoing. There isn't really a state of peace and war in the cyber domain. We see just malicious activity back and forth all the time from espionage to degradation, intervention, all along that range.
So the deciding question of could cyber trigger Article five intervention by NATO members? Again, like Trey said, I don't think could be triggered by a cyber incident in an independent state. It would have to be part of a larger campaign. The context would matter a lot more than what that specific incident was. And I think too that that probably would have to rise to a level that it would seem it would be not in the Russians' interest to try to affect that. That conversation of could this escalate, could this draw more European countries, I think would be a conversation when it comes to cyber operations and not a trigger in that kind of sense.
I'm kind of trying to wrap my brain around, to be candid, a lot of this stuff like about NATO and these agreements and when or if or how NATO would get involved is something that I've had the privilege of not having to learn about until recently, you know, so it's all really new to me. I'm trying to understand, like, what would that potential conversation look like or like? What would it look like for for NATO to even have a have to have a conversation of like, Okay, does this cyber attack, does this cyber incident constitute something that would invoke Article five?
That was a really good question. Let me take a pass at trying to explain that as well. The way that NATO was originally constituted was intended to be a defensive alliance against a Soviet invasion of Europe. And so the notion was if the Soviets invaded part of NATO, all of NATO would come to the aid of that country. So an attack on one part of NATO was an attack on all of NATO. And it was a way to create a commitment device. Basically, hey, Soviet Union, we are visibly committing all of ourselves to come to anybody's aid if you cross the border, if you start to invade. So know that you gotta deal with everybody, not just that one country. So from a cyber perspective, that that model becomes, okay. What what what cyber things could be done that start to look like Soviet tanks rolling across the border of Germany and and running towards Berlin?
And that's an issue that's been debated and discussed ad nauseam for the last decade and a half. But the interpretation that NATO has laid down is that a cyber attack broadly construed could be the basis to invoke this if you attack one, you attack everybody model. And I think we could be is where a lot of the focus is right now. My 2¢ is most likely that could be... Would have to be a destructive attack, something where data and hardware was unrecoverable, and it was data and hardware that was somehow critical to the target state, to the host state. So as an example, if, a cyber attack were to disable, Poland's banking system, if ATMs were not just inaccessible, but they were actually fraud, if personal data... Banking data was was destroyed such that people couldn't recover their funds, a different scenario. These are the kinds of things that I think would start to lead into that discussion of this is really an armed attack.
We've kind of talked a lot about this more offensive perspective from Russia and attacking Ukraine in terms of cyber attacks, things like that. But I've also heard a lot of news about hackers, many based in The US, but also around the entire world, attacking targets in Russia as a way to kind of step in and help defend Ukraine in a way, I guess. And there's also news about Ukraine recruit recruiting an IT army to kind of help with this effort. But I wanted to dig in specifically about the legality and also the ethics of that kind of endeavor, I guess.
It's definitely a very interesting thing that has unfolded. The increasing involvement of non state actors in this conflict from a variety of different angles, from this kind of IT army to government officials in Ukraine specifically calling on different companies around the world and asking them to take certain types of action. I think that in this space, we need to have more of a conversation on what does it mean for ourselves and our allies to engage in this kind of behavior. I think it's a more simple conversation when we say, oh, Russia or China, they have patriotic hackers that attack us.
But it's not officially state sponsored or maybe it is. We don't know what can we do about that. So there is a conversation to be had along the line of, again, back to the idea of collective defense, getting people involved. But we wanna make sure that at least I think from The US perspective, more on the defensive side of things. I believe that Estonia has a cyber defense league. I might be getting the name wrong, but it is a core of volunteers. They're not officially members of the government, but volunteers that come together to help protect Estonian networks. But on the kind of other side of that, last year we saw a lot of conversation about the idea of cyber privateers and taking advantage of the incredible cyber talent that we have in The United States and kind of weaponizing that against adversaries.
I think there are a few things, cyber letters of marque. We give a couple of different groups permission to go after specific adversary groups, But that line of thinking really exposes the potential dangers of getting more people involved. Cyber is a domain where we see a lot of activity, but we don't have a solid sense of, like I said earlier, what is a red line? What's going to happen? And so giving carte blanche to different entities to take on adversaries at their own will is playing a dangerous game. But in the Ukraine specific context, they are at war.
The Ukrainians are going to use every resource at their disposal to try to beat back the Russians. And, you know, it is understandable that they came up with this idea, got the talent together. I think that that conversation is going to be a little bit distinct from how the lessons that we carry for it to The United States or other states. But in terms of Ukraine, very understandable. We'll just have to be cognizant and watch how that unfolds.
And you mentioned the dangers of getting a bunch of people involved in this kind of action. I want to talk about dangers? What happens if a ton of people from The United States, from the whole world, you know, jump in on this and something goes wrong? Like, what would that be?
In terms of dangers, two things came to mind. First is you've got a lot of folks traipsing over systems to try to find some kind of way in to do something. And the challenge is that's not very strategic. And so you don't have any of these groups plugged into the target selection, intelligence collection processes that Western agencies have. And so one one risk, I think, we've seen people call out is the possibility that one of these incidents may, in having a relatively minimal effect on a Russian system or network, actually cause the Russian network owner or defender to take a look at what has gone wrong and in so doing discover another intelligence operation, a more sophisticated penetration potentially from the Ukrainian government or from others. And so unwittingly actually compromise a useful source of intelligence for the West that may be getting funneled back to Ukraine.
That's one risk. Another is... And, you know, we talked about there's probably not a lot of prospect that these kinds of groups are gonna be conducting sustained destructive attacks. But we have seen two instances where Belarusian Belarusian activists have compromised the Belarusian national rail network both before and after the the actual kickoff of the invasion. And they were able to disable, if not actually destroy, some digital systems and switching equipment in the wrong circumstances at the wrong moment of a a more exaggerated crisis. An attack like that could appear, at least initially, or be misattributed to be The US or another major Western government. And that, I think to the point that Emma made earlier, from a signaling perspective, looks much more intentional, much more strategic, and thus potentially much more escalatory than the random act of a large diffuse group of non state participants and individuals.
And so the chance that a group gets itself in the firing line or wedged into something looking like something they're not at the wrong moment, it could be potentially costly as well. But the third thing I think that just jumps out from my side is, you know, we've seen a lot of difficulty in folks to struggle in terms of prosecuting this war against the Russian government and military versus the people of Russia. And one of the challenges is that it is just low hanging fruit to go after civilians. It's true around the world. We're unfortunately seeing that play out every day on the news with respect to Ukrainian civilian population. But for these kinds of hacker groups to start doxing random Russians to be compromising their critical infrastructure, to be targeting their bank accounts or sources of information, that really not only sends the wrong message, but is strategically unhelpful when this war is against the Russian state, not the Russian population. And so that's, I think, another harm that I... At least that I worry about is you've got a lot of folks that want to do something.
Even large companies are finding it difficult to have a strategic impact rather than just pull out of a market and sort of signal they're not gonna keep doing business. It was a really unfortunate situation. I think it was a Canadian orchestra had had been touring with a Russian... Young Russian piano prodigy, really incredibly talented, who was vocally anti war. And they kicked him off the tour, and they they they released him from his contract with the orchestra just as a way to demonstrate their sort of, you know, feelings about the conflict. And that just harms an innocent. And and in this case, harms an innocent who has active feelings in the direction that that the orchestra wants to signal. And so that's a... That's another harm from this.
What about ethics? Right? We've got citizens from The United States that are volunteering to go over and fight this particular war from from both the physical perspective, but also from a cyber perspective, sort of jumping on bandwagons to hacking parties, if you will, or joining the IT army. From an ethics standpoint, where do you even begin to approach that?
Bringing in ethics into this can be difficult as well in terms of where do we draw this conversation of individual responsibility and individual ethics versus legality and to what degree ethics informs legality. Having that conversation, I think, with what's going on will take a little bit longer. I And think there's already been a lot of conversation on this topic, the ethics of hacking in a lot of different senses. But one thing that I think kind of following along this line of how we want ethics to inform our laws and inform our global strategy is looking at the future, past this.
We have already had a lot of conversations about the involvement of different types of actors in the cyber domain. And we have already seen some ramifications of private individuals, private actors taking it upon themselves to attack entities within The United States. We have ranging from ransomware groups to companies that sell and provide offensive cyber capability as a service. And I think this has some line of thought with it of how can The United States continue to curb this growing kind of threat that we're seeing from non state actors while also seeing kind of a rise of individuals and groups that want to be active in a way that they see in line with ethics of The United States and complicating potentially if we are trying to create some more global conversations around are the norms of behavior in cyberspace, ensuring that our behavior and the behavior that we support is in line with those norms that we're trying to uphold.
It's a good question, though. And I and I think it may be a way to close out on it is, you know, across a variety of philosophical traditions, there is often a discussion of the degree to which you own allegiance to your values. You owe some commitment to your your sort of fellow man to each other. And that notion of owing, I think that commitment is really interestingly embedded in a lot of the core ethos that we see of technology groups, of communities, of open source developers, some of the original phone phreakers, even back to the, you know, the hackers of yore in the sixties and seventies, the research communities that were putting a lot of these basic digital technologies together, there was a there was a duty to each other in trying to build these grand things. And so I think what we see here in some ways is a continuation of that tradition, the same one that Hemingway was writing about in the 40s For Whom the Bell Tolls, the experience of Americans going to fight in the Spanish Civil War against the fascist government.
There's a tradition of folks standing up and trying to take arms in defense of their values. Sometimes those values align with the state they're a part of, other times not. So from that standpoint, I think this is continuing in a long and and debated, but but pretty rich tradition. The caveat I'd only add in is, you know, where we start to see folks trying to act beyond their individual capability. It's one thing to feel an obligation or a duty to to another. It's another to try to take action even when you don't have an ability to affect that person or their situation. And so I think that's the the concern, at least, that I have is that, you know, folks that wanna contribute donate money and learn CPR or try to go and assist a massive, you know, multimillion population of refugees that have flowed into Europe and the largest internal migration in in the continent since the Second World War, there are numerous ways to help. Very few of them are directly on the battlefield, and and fewer of them, frankly, are on the cyber battlefield.
And so I think finding some some humility alongside that obligation to understand how you can actually best influence the situation rather than just trying to find the most iconic thing, I think, is also really important.
A lot of folks feel confused about what can and what we should be doing to help right now. You mentioned assessing figuring out the best way to be impactful and helpful, and it's not always some of the, I don't know, easier obvious ways. How? What do you? How do you do you have any recommendations for, you know, for us, our listeners, folks in this industry, or just in general for figuring out the best ways, the most impactful ways to help?
I think probably the the first point is that I think it can get easy to be caught up in feeling like have to do the most or, you know, feeling like you have to be keeping up with everything. And I think that's something important to remember is that a little bit still does help. Even if you're not able to actually get to Poland and get to a refugee camp, If you're able to send money to a reliable and trustworthy organization that can fund that kind of behavior, even if it's just whatever you can afford, that will still be helpful. Just And making sure on that that when you're deciding to give money or give support or even retweeting something to raise awareness, just making sure that you're doing your due diligence to understand who is it that you're amplifying, who is it that you're supporting.
Unfortunately, times sometimes do bring out the worst in people. We see people trying to profit off of this, but bad times also can bring out the best in people. So just making sure that you're a part of that, doing outreach as you can, trying to find some trusted sources to help point you in the right direction. Every little bit can help.
I really echo what Emma said. There is no lower space that cybercriminals will not stoop to take advantage of situations like this. But I think one place that folks are feeling strongly is Médecins Sans Frontières, Doctors Without Borders, has an ongoing fundraising campaign to try to ship not just medical supplies, but some tactical kind of medical equipment to folks in country. And there's a number of other charities like that that are trying to do work both to address the situation inside of Ukraine as well as some refugee populations. UNICEF is doing some really incredible work inside of Poland and Romania. So, you know, those are those are ways to contribute, directly with funds. There are also some places that are sourcing volunteers both to travel over and and try to support, but also to offer... You know, if they've got more specialized skills from a distance. So, definitely, there's a myriad of good things out there to be doing that aren't necessarily picking up a keyboard and trying to deface, the Russian MOD website again.
Does your penetration testing meet compliance requirements? Does it adhere to the most rigorous security standards on the market today? Now you can find Synack on the FedRAMP marketplace for all of your agency's security testing needs. Synack recently received moderate in process status from FedRAMP, meaning that even more US departments, agencies, and contractors can utilize Synack's global network of trusted embedded security researchers for on demand around the clock pentesting. Learn more at synack.com. That's s y n a c k dot com.
If you like today's episode, please give us a five star rating and subscribe wherever you're listening to this. It'll really help us get noticed on your favorite podcast platforms. Also, you can share this episode with your friends and make sure to check out all of the other fascinating people that we've already interviewed. We're also open to your suggestions. If you know someone that we should be talking to, drop us a line at we'[email protected]. That's we're [email protected].
