West says Russia hacks pervasive, target critics

Four Russian military intelligence agency officers head for a flight out of the Netherlands on Oct. 4 after they were expelled for trying to hack into the computers of the Organization for the Prohibition of Chemical Weapons. The case is among several cited Thursday in indictments by U.S., British, Australian and Dutch officials.
Four Russian military intelligence agency officers head for a flight out of the Netherlands on Oct. 4 after they were expelled for trying to hack into the computers of the Organization for the Prohibition of Chemical Weapons. The case is among several cited Thursday in indictments by U.S., British, Australian and Dutch officials.

LONDON -- The West unleashed an onslaught of new evidence and indictments Thursday accusing Russian military spies of hacking so widespread that it seemed to target anyone, anywhere who investigates Moscow's involvement in an array of criminal activities -- including doping, poisoning and the downing of a plane.

Russia defiantly denied the accusations and alleged that the Pentagon runs a clandestine U.S. biological weapons program involving toxic mosquitoes, ticks and more.

At the center of the allegations against Russia is its military intelligence agency known as the GRU.

On Thursday, U.S. authorities charged seven officers from the GRU with hacking international agencies; British and Australian authorities accused the GRU of a devastating 2017 cyberattack on Ukraine, the email leaks that rocked the U.S. 2016 election and other damaging hacks; and Dutch officials alleged that GRU agents tried and failed to hack into the world's chemical weapons watchdog, the Organization for the Prohibition of Chemical Weapons.

The attempted break-in -- involving hacking equipment in the trunk of a car and a trail of physical and virtual clues -- was the most stunning operation revealed Thursday.

"Basically, the Russians got caught with their equipment, people who were doing it, and they have got to pay the piper. They are going to have to be held to account," U.S. Defense Secretary James Mattis said in Brussels, where he was meeting with NATO allies.

Mattis said the West has "a wide variety of responses" available.

Britain's ambassador to the Netherlands, Peter Wilson, said the GRU would no longer be allowed to act with impunity.

Calling Russia a "pariah state," British Defense Secretary Gavin Williamson said: "Where Russia acts in an indiscriminate and reckless way, where they have done in terms of these cyberattacks, we will be exposing them."

Deputy Foreign Minister Sergei Ryabkov of Russia said in a statement that the U.S. is taking a "dangerous path" by "deliberately inciting tensions in relations between the nuclear powers," adding that Washington's European allies should also think about it.

While the accusations expose how much damage Russia can do in foreign lands, through remote hacking and on-site infiltration -- they also expose how little Western countries can do to stop it.

Russia is already under EU and U.S. sanctions, and dozens of GRU agents and alleged Russian trolls have already been indicted by the U.S. but will likely never be handed over to face American justice.

Still, to the Western public, Thursday may have been a pivotal day, with accusations so extensive, and the chorus of condemnation so loud, that it left little doubt of Russian wrongdoing. A wealth of surveillance footage released by Western intelligence agencies was quickly and overwhelmingly confirmed by independent reporting.

UKRAINE, OTHER ATTACKS

The litany of accusations of GRU malfeasance began overnight, when British and Australian authorities accused the Russian agency of being behind the catastrophic 2017 cyberattack in Ukraine. The malicious software outbreak knocked out ATMs, gas stations, pharmacies and hospitals and, according to a secret White House assessment recently cited by Wired, caused $10 billion in damage worldwide.

The British and Australians also linked the GRU to other hacks, including the Democratic Party email leaks and online cyber-propaganda that sowed havoc before Americans voted in the 2016 presidential election.

Later Thursday, Dutch defense officials released photos and a timeline of GRU agents' botched attempt to break into the Organization for the Prohibition of Chemical Weapons using Wi-Fi hacking equipment hidden in a car parked outside a nearby Marriott Hotel. The chemical-weapons watchdog was investigating a nerve agent attack on a former GRU spy, Sergei Skripal, and his daughter in Salisbury, England, that Britain has blamed on the Russian government.

British police believe two GRU agents, using the aliases Alexander Petrov and Ruslan Boshirov, sprayed the weapons-grade nerve poison novichok on a door handle at Skripal's home on March 4.

The attack left Skripal and his daughter, Yulia, critically ill. Salisbury resident Dawn Sturgess, 44, who was later exposed to the same nerve agent carried into the U.K. in a counterfeit perfume bottle, died in July.

Moscow vehemently denies involvement.

Photographs released by the Dutch Ministry of Defense showed a trunk loaded with a computer, battery, a bulky white transformer and a hidden antenna; officials said the equipment was operational when Dutch counterintelligence interrupted the operation.

Dutch authorities found a taxi receipt in the pocket of one of the agents that showed he had hired a cab to take him from a street next to GRU headquarters to Moscow's Sheremetyevo Airport. A laptop found with the team appeared to tie them to other alleged GRU hacks.

The men were expelled instead of arrested because they were traveling on diplomatic passports.

"This attempt to access the secure systems of an international organization working to rid the world of chemical weapons demonstrates the GRU's disregard for the global values and rules that keep us all safe," U.K. Prime Minister Theresa May and Mark Rutte, her Dutch counterpart, said in a joint statement. U.S. officials backed up the allegations.

The Dutch also accused the GRU of trying to hack investigators examining the 2014 downing of a Malaysian Airlines jetliner over eastern Ukraine that killed all 298 people on board. A Dutch-led team says it has strong evidence that the missile that took the plane down came from a Russia-based military unit. Russia has denied the accusation.

Later Thursday, the U.S. Justice Department charged seven GRU officers -- including the four caught in The Hague -- in an international hacking rampage that targeted more than 250 athletes, a Pennsylvania-based nuclear energy company, a Swiss chemical laboratory and the Organization for the Prohibition of Chemical Weapons.

The indictment said the GRU targets had publicly supported a ban on Russian athletes in international sports competitions and had condemned what they called a state-sponsored doping program by Russia.

U.S. prosecutors said the Russians also targeted a Pennsylvania-based nuclear energy company and the Organization for the Prohibition of Chemical Weapons.

The seven were identified as: Aleksei Morenets, 41; Evgenii Serebriakov, 37; Ivan Yermakov, 32; Artem Malyshev, 30; and Dmitriy Badin, 27; who were each assigned to Military Unit 26165; and Oleg Sotnikov, 46, and Alexey Minin, 46, who were also GRU officers.

The U.S. indictment says the hacking was often conducted remotely. If that wasn't successful, the hackers would conduct "on-site" or "close access" hacking operations, with trained GRU members traveling with sophisticated equipment to target their victims through Wi-Fi networks.

The World Anti-Doping Agency, the U.S. Anti-Doping Agency and the Canadian anti-doping agency were all identified by the U.S. indictment against the Russians.

The World Anti-Doping Agency said the hackers "sought to violate athletes' rights by exposing personal and private data -- often then modifying them -- and ultimately undermine the work of [the World Anti-Doping Agency] and its partners in the protection of clean sport."

Travis Tygart, the CEO of the U.S. anti-doping agency and a prominent critic of Russian athletes' drug use, says "a system that was abusing its own athletes with an institutionalized doping program has now been indicted for perpetrating cyberattacks on innocent athletes from around the world."

Russia dismissed the allegations as delusional and a "diabolical perfume blend."

"They mixed up everything in one bottle, which could be a bottle of Nina Ricci perfume: GRU, cyber spies, Kremlin hackers, and the [World Anti-Doping Agency]. This is just a diabolical perfume blend. The imagination of our U.K. colleagues is truly boundless. Who invented the whole thing? I'd like to see them. They're simply [Hans Christian] Andersens," Russian Foreign Ministry spokesman Maria Zakharova said at a press briefing Thursday.

RUSSIA ALLEGES U.S. LAB

Russia countered with accusations of its own: The Defense Ministry unveiled complex allegations that the U.S. has a clandestine biological weapons lab in the country of Georgia.

Maj. Gen. Igor Kirillov, the head of the Russian military's radiation, chemical and biological protection troops, alleged at a briefing that the lab in Georgia was part of a network of U.S. labs near the borders of Russia and China.

The allegations were based largely on materials about the U.S.-funded Richard G. Lugar Center for Public Health Research in Tbilisi, Georgia. Kirillov claimed that the documents released by former Georgian State Security Minister Igor Giorgadze showed that the facility was funded entirely by the U.S and that the Georgian ownership it has on paper was a cover.

Pentagon spokesman Eric Pahon strongly rejected Kirillov's claims, calling them "an invention of the imaginative and false Russian disinformation campaign against the West" and "obvious attempts to divert attention from Russia's bad behavior on many fronts."

"The U.S. is not developing biological weapons in the Lugar Center," Pahon said.

He said the lab, a joint human and veterinary public health facility, was owned and operated by the Georgian National Center for Disease Control and Public Health, not the United States.

The center opened in 2013 and was named for former U.S. Sen. Richard Lugar. Before he left Congress, the Indiana Republican was part of a bipartisan U.S. effort to help secure the Soviet arsenal of nuclear and other weapons of mass destruction after the 1991 breakup of the Soviet Union.

Russia's Kirillov said the documents published by Giorgadze signaled more sinister activities were happening under the cover of civilian research.

He noted that Giorgadze's materials cited the deaths of 73 volunteers who took part in tests of a new drug at the lab in 2015-16. The claim couldn't be independently confirmed.

Kirillov alleged that the deaths showed the Lugar Center used the volunteers as guinea pigs in tests of a new deadly toxin.

"The near simultaneous deaths of a large number of volunteers give reason to believe that the Lugar Center was researching a highly toxic and highly lethal chemical or biological agent," he said.

The Russian general also claimed that the spread of viral diseases in southern Russia could have been linked to the activities of the Lugar Center. He pointed to the spread of the African swine fever from Georgia since 2007 that caused losses for the Russian farm sector.

Ticks carrying the Crimean-Congo hemorrhagic fever, a deadly viral disease, also spread across several regions of southern Russia in an unusual pattern, another sign of the U.S. lab's alleged involvement, Kirillov said without specifying a time period.

"It's highly likely that the U.S. is building up its military biological potential under the cover of studying protective means and conducting other peaceful research, flouting international agreements," he said.

Among the documents released by Giorgadze was a U.S. patent for a drone intended to disseminate infected insects, he said. Other patents covered projectiles for delivering chemical and biological agents.

"Such research doesn't conform to Washington's international obligations regarding the ban on biological and toxin weapons," Kirillov said. "A legitimate question is why such documents are being stored in the Lugar Center for Public Health Research. We hope to receive a precise answer from Georgia and the United States."

Information for this article was contributed by Gregory Katz, Michael Balsamo, Raf Casert, Raphael Satter, Nataliya Vasilyeva, Vladimir Isachenkov, Lorne Cook, Eric Tucker, Robert Burns and Angela Charlton of The Associated Press; by Michael Birnbaum, William Booth, Anton Troianovski and Amie Ferris-Rotman of The Washington Post; and by Kitty Donaldson, Joost Akkermans, Henry Meyer and Richard Bravo of Bloomberg News.

photo

AP/Dutch Defense Ministry

This image shows one of many phones used by four Russians after one of them tried to destroy it when they were caught April 13 in The Hague, Netherlands.

RELATED ARTICLE

https://www.arkansa…">Russian hackers said to have new targets

A Section on 10/05/2018

Upcoming Events