Estonian intelligence: Russia underestimated Ukraine's cyber resilience

Russia’s expectation that it would occupy Kyiv and overthrow the Ukrainian government during the first few weeks of the invasion last February may have caused the Kremlin initially to forgo cyberattacks against critical infrastructure, according to the Estonian Foreign Intelligence Service.

And when the cyberattacks did come, Ukraine's resistance was surprising to Russia, according to the annual report published Wednesday by the Välisluureamet.

“Russia underestimated the resilience of Ukraine’s cyberspace and the help it receives from Western countries and cybersecurity companies,” the report said. Estonia, a former Soviet state that shares a border with Russia, closely watches its neighbor’s military and cyber activity.

Although Russian cyber units have a long record of launching attacks on Ukrainian infrastructure, the Välisluureamet suggested that these may not initially have been organized so that Russia could “maintain the support of the local population.”

Following the initial retreat from Kyiv, this no longer appears to be a Russian objective. Kinetic and cyber attacks against Ukraine’s power grid have escalated during the winter. Andriy Yermak, the head of the Ukrainian presidential office, said at the beginning of December that the physical destruction of Ukraine’s energy infrastructure was an attempt to freeze the country into submission or death.

Read more: Life during wartime: Ukraine ‘has to be ready for new more powerful and complex’ cyberattacks

In its report, the Estonian agency warned that these cyberattacks “like the actions of [Russia’s] armed forces,” now are intended to wear down Ukraine and undermine the morale of Ukrainian society.

“Therefore, a cyberattack need not actually disrupt an information system, as with each attack, investigators have to spend human and time resources to check whether and how extensively the information system has been attacked, how to improve defence, etc,” the Välisluureamet said.

The report echoes comments made last year by Lindy Cameron, the chief executive of the U.K.’s National Cyber Security Centre — a part of Britain’s signals and cyber intelligence agency GCHQ. 

Russian initial cyberattacks weren’t intended to be apocalyptic, Cameron said, but to reduce the Ukrainian government’s ability to communicate with its population, to interrupt the financial system and spread panic, and to distract Ukraine’s cybersecurity resources from their other priorities.

Cameron said: “For me, in many ways the most important lesson to take from the invasion is not around the Russian attacks — which have been very significant and, in many cases, very sophisticated. It is around Russia’s lack of success.

“Try as they might, Russian cyber attacks simply have not had the intended impact … If the Ukrainian cyber defense teaches us a wider lesson – for military theory and beyond – it is that in cybersecurity, the defender has significant agency. In many ways you can choose how vulnerable you can be to attacks.”

The Välisluureamet’s report stated: “Despite denial-of-service attacks on the websites of state institutions to disrupt the flow of information, among other things, the Ukrainian government has found alternative ways of communication, for example, using social media.” The report also cited the satellite internet service Starlink as having “an important role” in civilian and military communications.

Russia’s influence operations also have not had the intended effects, the Estonian agency said.

“Ukrainian society remains united and trusts its government despite threats posted on social media and data leaks,” the report said. But the agency warned that while Russia’s activities in cyberspace have not yielded the results which it had hoped for, “we must remain vigilant.”

The agency’s director general, Kaupo Rosin, wrote in his forward to the report: “For now, there is still enough fuel to keep the war machine going — Russia will not run out of cannon fodder, Soviet-era armaments or propaganda-induced imperialism any time soon. However, a quality leap in Russia’s war-fighting capability is very unlikely. Putin is playing for time, believing that Ukraine and the West will wear out before Russia. Putin thinks he can ‘bomb’ Ukraine to the negotiating table.”