U.K. Foreign Secretary David Cameron recently declared, "Ukraine’s security is our security.” As the front line between Russia and Ukraine becomes ever more static, Russia will continue to seek out ways to disrupt Ukraine’s flow of military aid and harm its partners.
As one of the leading contributors of military aid to Ukraine, the U.K. now ranks as the third most frequently targeted country for cyber attacks, trailing only behind the U.S. and Ukraine. Given the leading role that the U.K. is playing in supporting Ukraine, it should be prepared to address its digital vulnerabilities.
The U.K. has been at the forefront of the push to help arm Ukraine, having been the first country to provide lethal aid and the first to send Western tanks and other advanced weaponry when Germany and the U.S. refused to lead. The U.K. is also the only nation to provide long-range cruise missiles, known as Storm Shadows, that can travel over 240 kilometers (150 miles) to help strike deep behind enemy lines.
The Kremlin threatened to destroy the U.K. for giving Ukraine long-range Storm Shadow missiles. Since receiving the air-launched missiles, Ukrainian forces have wreaked havoc on Russian targets in occupied Crimea, far out of range of other missile systems, such as the American-supplied HIMARS.
As House Republicans in the U.S. have played domestic politics with foreign aid during a crucial time for Ukraine, the U.K. has stepped into this leadership void to deliver its largest aid package to date. In January, the U.K. finalized an unprecedented security agreement with Ukraine, offering a military aid package worth 2.5 billion pounds ($3.2 billion), showcasing its ironclad support for Ukraine.
Tim Mak
While Russia has shown either a reluctance or inability to follow through on its threat to “destroy” the U.K. for giving Ukraine long-range missiles, it can continue increasing its cyber attacks in retaliation. Russian cyber aggression will focus on degrading Ukraine’s ability to fight by targeting nations that provide it with military and financial backing.
The reality is that, like many countries in the West, the U.K.’s critical infrastructure is very vulnerable to a devastating Russian cyber attack.
A report published in December 2023 from a U.K. parliamentary committee underscored the vulnerability of the U.K. government to a “catastrophic ransomware attack” capable of grinding the nation to a halt. If such an attack were to happen, it could potentially expose the government’s insufficient efforts in protecting against ransomware and preparing for the aftermath of a major cyber attack.
U.K. Secretary of State in the Cabinet Office Oliver Dowden also warned in April 2023 that Russian hackers aim to destroy the country’s infrastructure or, at a minimum, cause extensive disruption.
In July 2023, Russian hackers conducted attacks against U.K. airports, likely with the hope that, if it brought down airline operations, a prolonged outage would cause widespread panic across the country. A report in The Guardian from December 2023 helped uncover how the U.K.’s most hazardous nuclear site has already been hacked by groups linked to Russia and China.
At the end of October 2023, the British Library was hit by a ransomware attack from a group called Rhysida, thought to be from Russia. The attack shut down the library’s catalog and computer systems. Repairs might take a year and use up about 40% of the library’s savings. Rhysida published over 570 GB of data – around 90% of the stolen user data – to the dark web. Rhysida also attacked King Edward VII Hospital in London, attempting to steal the medical records of the British Royal Family.
The Kyiv Independent
While Ukraine has borne the brunt of the most devastating cyber attacks in recent years, the recent Kyivstar attack was revealing of what other Western nations, like the U.K., could face. The most severe attack on Ukraine's critical infrastructure happened in December 2023, when Russia disabled Kyivstar, the largest mobile network operator in Ukraine, severely damaging the telecom company's IT infrastructure. Kyivstar’s CEO even called the attack the “largest cyberattack on telecom infrastructure in the world.”
Illia Vitiuk, who leads the cybersecurity division of the Security Service of Ukraine (SBU), stated that hackers had been targeting Kyivstar since at least May 2023. He emphasized that this attack stands as a stark warning to Western countries, pointing out that no one is untouchable, as Kyivstar was one of the most fortified organizations in the country.
Therefore, as the U.K. continues to play a leading role in helping Ukraine, British leaders should bear in mind that doing so increases the risk of Russia lashing out with more devastating cyber attacks. Cyber attacks are an extension of Russia’s political goals and battlefield military operations – designed to weaken and destroy the enemy. To mitigate the risk of retaliatory Russian cyber attacks, the U.K. must ensure it is making the right investments in protecting its digital infrastructure as the cyber war between Russia and the West continues to escalate.
Editor’s Note: The opinions expressed in the op-ed section are those of the authors and do not purport to reflect the views of the Kyiv Independent.
