U.S. Military Team Blunts Cyberattacks On Ukraine

Russia failed to take down Ukrainian computer systems with a massive cyberattack when it invaded this year, despite many analysts' predictions. The work of a little-known arm of the US military which hunts for adversaries online may be one reason.

Photo Insert: The US Cyber National Mission Force

The BBC was given exclusive access to the cyber-operators involved in these global missions, Gordon Corera reported for BBC.

In early December last year, a small US military team led by a young major arrived in Ukraine on a reconnaissance trip ahead of a larger deployment. But the major quickly reported that she needed to stay.

"Within a week we had the whole team there ready to go hunting," one of the team recalls. They had come to detect Russians online and their Ukrainian partners made it clear they needed to start work straight away.

"She looked at the situation and told me the team wouldn't leave," Maj. Gen. William J Hartman, who heads the US Cyber National Mission Force, told the BBC. "We almost immediately got the feedback that 'it's different in Ukraine right now'. We didn't redeploy the team, we reinforced the team."

Since 2014, Ukraine has witnessed some of the world's most significant cyber-attacks, including the first in which a power station was switched off remotely in the dead of winter.

By late last year, Western intelligence officials were watching Russian military preparations and growing increasingly concerned that a new blizzard of cyber-attacks would accompany an invasion, crippling communications, power, banking and government services, to pave the way for the seizure of power.

The US military Cyber Command wanted to discover whether Russian hackers had already infiltrated Ukrainian systems, hiding deep inside.

Within two weeks, their mission became one of its largest deployments with around 40 personnel from across US armed services. In January, they had a front-row seat as Russia began paving the way in cyberspace for a coming invasion in which Ukraine's cyber defenses would be put to an unprecedented test.

The infiltration of computer networks had for many years been primarily about espionage - stealing secrets - but recently has been increasingly militarized and linked to more destructive activities like sabotage or preparation for war.

This means a new role for the US military, whose teams are engaged in "Hunt Forward" missions, scouring the computer networks of partner countries for signs of penetration.

"They are hunters and they know the behavior of their 'prey,'" explains the operator who leads defensive work against Russia. The US military asked for some operators to remain anonymous and others to be identified only by their first names due to security concerns.

Since 2018, US military operators have been deployed to 20 countries, usually close allies, in Europe, the Middle East and the Indo-Pacific region. - although not countries like the UK, Germany or France, which have their own expertise and are less likely to need or want outside help.

WEEKLY FEATURE : MVP Group Keeps Lights On During Pandemic