Amid its standoff with Russia, Ukraine is facing a threat on two fronts: land and cyberspace.
On land, the country continues to see a buildup of Russian troops near its borders, but there has been no aggression around possible entry points like Senkivka, a border crossing that Global News visited this week.
In cyberspace, Ukraine has already fought off many attacks, President Volodymyr Zelenskyy has said, but it has also seen government websites hacked, adding further unease in east Europe.
“There’s without a doubt that if an invasion occurs, Russia will have a cyber component to it (and) at this point, it’s a matter of debate on exactly how it’s going to look,” said Alexander Rudolph, a cyber-defence expert and PhD candidate in the department of political science at Carleton University.
“We haven’t seen what’s possible yet. We’ve only seen kind of hints at this point.”
For weeks, Western nations have been trying to negotiate an agreement with Russia to ease the tensions with neighbouring Ukraine. Moscow has stationed more than 100,000 troops near Ukraine while talks continue, and has rejected Western accusations it’s planning to invade.
At the Senkivka crossing, a multi-national point between Ukraine, Russia and Belarus, Ukrainian border officer Alexandra Stupak has seen no increase in military activity or Russian aggression.
“We are hoping that we don’t face the display of aggression from our neighbours and everything will be peaceful,” Stupak told Global News through a Ukrainian translator.
But Russian aggression could also come in the form of cyberattacks, an attempted coup or sabotage, said NATO Secretary-General Jens Stoltenberg last week.
Russia has a long history in cyberspace, especially in regards to its neighbour. In 2015 and 2016, Russian hackers shut off power in portions of the country, and in 2017 deployed a virus that crippled Ukrainian banks, ministries and electricity firms before spreading elsewhere in the world.
Last month, a huge cyberattack disabled 70 Ukrainian government websites; officials found “evidence” Russia was behind the attack, but the Kremlin denied involvement, The Guardian reported. Microsoft has also found evidence of a destructive malware operation targeting multiple organizations in Ukraine.
Russia is also known for using disinformation as a tactic to sow confusion and discord. When Moscow invaded Ukraine’s Crimean Peninsula in 2014, it mounted a campaign to sway ethnic Russian residents of the territory. Moscow has long denied its involvement in cyberattacks.
While the world has seen these recent cyber events play out, the true extent of a full-scale cyberattack is not yet known, said Matthew Schmidt, an associate professor and national security expert at the University of New Haven.
Both Schmidt and Rudolph agree Ukrainian infrastructure, like its electrical system, could be vulnerable to an attack. But how damaging it could be is unclear, Schmidt said.
“We don’t know yet how badly someone could shut down an electrical system, could shut down a water system, or nuclear power plants – and the truth is we talk about those three things and we’re not very imaginative,” he told Global News.
“We think those are the things that are going to be attacked and those things are going to cause bad results out there, but we don’t really know what else you could do with these kinds of software systems.”
Ukraine’s president has claimed Russia is trying to destabilize the country, and that secret service officers and law enforcement are working daily to foil any further efforts at destabilization.
Many Western nations are offering their support to Ukraine, including Canada. Ottawa is enhancing intelligence sharing and resources to defend against cyberattacks, among other measures.
Good support from governments and the private sector is crucial for countries to be protected against cyberattacks, Schmidt said.
“These systems were not built to be secure in a digital sense … what we’ve had to do is sort of make it up over time and build digital walls around them in layers that would make it hard for malignant actors to get through each wall to get to that software for the control system.”
“The biggest weak point in any system, whether here or there, is always the human being. It’s always that you can trick somebody (and) exploit them to put the bad software in.”
Furthermore, countries need a clear declaratory policy as to what they’re going to do in cyberspace if they are attacked, said Brandon Valeriano, a cybersecurity expert and senior fellow at American think-tank Cato Institute.
“The assumption is that cyber leads to escalation; we find that cyber doesn’t even lead to retaliation,” he told Global News.
“So it’s kind of an open world in some ways, and that the opposition isn’t really clear as to what they can and cannot do.”
In 2019, Stoltenberg said a serious cyberattack against a NATO nation could trigger Article 5, where an attack against one ally is treated as an attack against all.
However, Ukraine is not a member of NATO, and Russia is pushing for the alliance to never allow the nation to join. Stoltenberg did not directly answer when asked last Friday if NATO would trigger Article 5 if a serious cyberattack occurred in Ukraine that had ramifications around world, like the 2017 hack.
“We still don’t fully understand how to grapple it (cyberattacks) at the strategic level,” Rudolph said.
“So these events become even more difficult to manage because it’s such a new space.”
Back near Ukraine’s borders, residents in the town of Horodnia told Global News they’re trying not to worry about an invasion.
“I am calm and I am thinking they should not do an invasion,” said Larysa Samoilenko through a Ukrainian translator.
“I am not believing in it and I don’t want to believe in it.”
— with files from The Associated Press and Reuters