Foreign secretary condemns ‘cynical and reckless’ bid to disrupt Games, before they were postponed
Russian military intelligence services were planning a cyber-attack on the Japanese-hosted Olympics and Paralympics in Tokyo this summer in an attempt to disrupt the world’s premier sporting event, the UK National Cyber Security Centre has revealed, disclosing a joint operation with the US intelligence agencies.
The Russian cyber-reconnaissance work covered the Games organisers, logistics services and sponsors and was under way before the Olympics was postponed due to coronavirus.
Many previous ascribed Russian cyber-attacks have been against the state institutions of Moscow’s political opponents, but some cyber-activity has been directed at the agencies conducting inquiries into Russian sports doping.
The evidence is the first indication that Russia was prepared to go as far as to disrupt the summer Games, from which all Russian competitors had been excluded because of persistent state-sponsored doping offences.
The Tokyo Games’ organising committee said there was “no significant impact observed” from possible cyber-attacks on its operations.
“Tokyo 2020 sees cyber security as an important aspect of hosting the Games, and the Tokyo 2020 organising committee has been taking a range of measures and making thorough preparations,” it said in an emailed statement to the Guardian.
“Although we are not able to disclose details of the countermeasures due to the nature of the topic, we will continue to work closely with the relevant organisations and authorities to ensure that they are thoroughly implemented.”
Japan’s chief government spokesman, Katsunobu Kato, said the country would do everything possible to ensure that the postponed Games would be free of cyber-attacks.
“We would not be able to overlook an ill-intentioned cyber-attack that could undermine the foundation of democracy,” Kato said, adding that Japanese authorities were collecting information and would continue to share it with other countries.
The Kyodo news agency said a senior Japanese government official had indicated that Tokyo would consider lodging a protest with Moscow if cyber-attacks were confirmed to have been carried out by Russia.
In Pyeongchang, according to the UK, the GRU’s cyber-unit attempted to disguise itself as North Korean and Chinese hackers when it targeted the opening ceremony of the 2018 winter Games, crashing the website so spectators could not print out tickets and crashing the wifi in the stadium.
The key targets also included broadcasters, a ski resort, Olympic officials, service providers and sponsors of the games in 2018, meaning the objects of the attacks were not just in Korea.
The GRU also deployed data-deletion malware against the winter Games IT systems and targeted devices across South Korea using VPNFilter malware.
The UK assumes that the reconnaissance work for the summer Olympics – including spearphishing to gather key account details, setting up fake websites and researching individual account security – was designed to mount the same form of disruption, making the Games a logistical nightmare for business, spectators and athletes.
The foreign secretary, Dominic Raab, said: “The GRU’s actions against the Olympic and Paralympic Games are cynical and reckless. We condemn them in the strongest possible terms.
“The UK will continue to work with our allies to call out and counter future malicious cyber-attacks.”
On Monday, the US indicted six Russian military intelligence officers for their alleged role in hacking attacks on the 2018 winter Olympics, and on targets of the “NotPetya” malware, including a Pennsylvania hospital, which is also alleged to be work of the GRU’s unit 74455, known by cybersecurity researchers, as the “Sandworm team”.
The US assistant attorney general John Demers said the “Olympic Destroyer” attack, in revenge for a doping investigation of the Russian Olympic team, “combined the emotional maturity of a petulant child with the resources of a nation state”.
“As this case shows, no country has weaponised its cyber-capabilities as maliciously and irresponsibly as Russia, wantonly causing unprecedented collateral damage to pursue small tactical advantages and fits of spite,” Demers said, adding the damages on three US targets amounted to more than $1bn (£770m).
The US justice department estimates the total worldwide damage caused by the NotPetya worm at more than $10bn, with more than 300 victims worldwide, making it the costliest hacking attack ever. The US indictments also cover alleged GRU attacks on Ukraine, Georgia, the South Korean Olympics, the French elections and the investigation into the 2018 Russian novichok nerve agent attack in the UK.
The six indicted GRU officers were charged with roles in producing components of the NotPetya, Olympic Destroyer and other malware, as well as involvement in spearphishing attacks on Olympic, French and Georgian officials.
The US indictment provided intricate details of the alleged hacking operations, including spearphishing attacks on Olympic athletes, with links to malware disguised as updates about accommodation. British defence officials and experts from the Organisation for Prohibition of Chemical Weapons were targeted with emails designed to look as if they were sent by UK and German journalists.
One of the accused GRU officers, Anatoliy Sergeyevich Kovalev, is also alleged to have targeted car dealers and real estate agents for personal profit.
Demers did not comment on the UK allegations that the GRU 74455 team was targeting next summer’s Olympics.
The UK accusations are part of an attempt to disrupt Russia’s cybersecurity threat through maximum exposure and deter any disruption of a rescheduled summer Games next year. British sources said the extent and persistence of the cyber-activity against sporting bodies was likely to have been cleared at the highest echelons of the Russian state.
Russia was banned in December 2019 from all world sporting events by the World-wide Anti-Doping Agency (Wada), including the summer Olympics, after Russia’s own anti-doping agency was found guilty of manipulating laboratory data handed over to investigators in January 2019.
At the time of the four-year Wada ban, Russia claimed it was a victim of hysteria.
The 2018 attack on the winter Olympics predates the ban, and underlines how Russia has been for many years trying to intimidate and penetrate those agencies seeking to investigate Russian doping, even now going to the length of disrupting the summer Olympics themselves.
The revelations potentially come at a difficult time for Donald Trump as the issue of Russian interference in US politics has reared its head again in the presidential election campaign. Trump’s personal lawyer Rudy Giuliani and the New York Post have been accused of unwittingly letting themselves be used by Russia to spread disinformation about the Democratic candidate, Joe Biden, and his son Hunter.
The UK claims the cyber-attacks are part of a pattern by the Russian state to electronically target countries ranging from Ukraine, the US and Georgia to the UK, including the Foreign Office.
British officials pointed out that Russia at the UN general assembly had signed up to an Olympic truce, including a commitment not to disrupt, or in any way undermine, the safety of the Games.