Case Study

Overview

On February 24th, 2022, the day of Russia’s invasion into Ukraine, a cyberattack disrupted broadband satellite internet access. This attack disabled modems that communicate with Viasat Inc's KA-SAT satellite network, which supplies internet access to tens of thousands of people in Ukraine and Europe. Researchers from SentinelLabs believe that the attack was the result of a new strain of wiper malware called “AcidRain” that was designed to remotely erase vulnerable modems and routers. [1] [2] Viasat agreed with this assessment, and in a later statement said they believed the purpose of the attack was to interrupt service rather than to access data or systems. The United State's assessed “...that Russia launched cyber attacks in late February against commercial satellite communications networks to disrupt Ukrainian command and control during the invasion, and those actions had spillover impacts into other European countries.” [3]

Impact

As the attack impacted telecommunications systems, it did not just have the potential to threaten government or military objects, but rather it also impacted the civilian population and civilian objects both in Ukraine and beyond when they experienced a loss of internet access and possible disruptions to systems in the energy sector. Some reported that their internet access was offline for more than two weeks. The attack on Viasat also impacted a major German energy company who lost remote monitoring access to over 5,800 wind turbines, and in France nearly 9,000 subscribers of a satellite internet service provider experienced an internet outage. In addition, around a third of 40,000 subscribers of another satellite internet service provider in Europe (Germany, France, Hungary, Greece, Italy, Poland) were affected. Overall, this attack impacted several thousand customers located in Ukraine and tens of thousands of other fixed broadband customers across Europe.

Attribution

A first technical attribution was conducted and publicly disclosed by SentinelLabs at the end of March 2022, as they found that AcidRain presented developmental similarities with a 2018 VPNFilter campaign previously attributed to the Russian government. [4]

Months later, on May 10, the EU and the Five Eyes governments consisting of the United States, United Kingdom, Australia, New Zealand, and Canada, released public statements attributing AcidRain to the Russian military intelligence (GRU) and linking it to multiple families of destructive wiper malware, including WhisperGate, targeted on the Ukrainian government and private sector networks. Further specific national statements aligning with this attribution were made by the ministries of foreign affairs of Estonia, Denmark, Ireland, the Netherlands, Norway, Austria, Germany, Czechia, Italy, Finland, Romania, Poland, and France. This consistent response by many governments is an important step in the practice of political attribution of cyberattacks and greatly contributes to the development of states’ practice in this sense.

In addition, many of the statements presented references and allegations to Russia’s violations of the normative framework for responsible state behavior in cyberspace, as established through the consensus reports of the UN Group of Governmental Experts (UNGGE) and reaffirmed by the previous Open Ended Working Group (OEWG). According to these semi-collective attributions, both the targeting of critical infrastructures and the spillover effects on civilians not being directly involved in the conflict are undermining the rules-based international order. Thus, the public statements that followed the Viasat cyberattack contribute to a certain extent to improve the understanding of states’ view on how international law and the UN normative framework applies to cyberspace.

Applicable Governance Documents

When an attack like this occurs, it is natural to quickly think about justice. What can be done to hold the perpetrator to account? What kind of remedy or reparation can victims fight for? Below is a table that summarizes the domestic, regional, and international laws that have either already been applied or could be applied to this case. It must be noted that the application of some of these legal tools, in particular international law, depends on who the perpetrator is. In this case, the attack has been attributed to a nation state actor, and could therefore trigger action under international law.

In addition to the legal tools available, there are other relevant agreements and obligations that should be taken into consideration. These documents, such as UN agreements, cyber strategies and multistakeholder efforts, help provide a better sense of the context in which this attack occurred. Independent evaluation of these documents in relation to this case can also help to understand what tools exist, and what needs to be strengthened to better protect citizens in Ukraine. Please note that this is a summary.