Although hacktivists are not officially affiliated with a specific government — they can be populated with what Pescatore called "annoyed citizens" — that doesn't mean there's no connection between those who launched the first wave of cyber attacks in Estonia, Georgia and apparently the Ukraine and Russia recently, and a government.
"Every intelligence agency from time immemorial has tried to influence rebel groups," said Pescatore. "Nation states have seeded hacktivist groups with technology and know-how just like they have backed rebels with money and guns."
Hacktivists also give governments plausible deniability, Stiennon noted. "They provide cover," he said. "All of us will be reporting these things."
Meanwhile, Russia will be able to launch more sophisticated cyber attacks to isolate the Ukraine. Pescatore compared hacktivist attacks to a "softening up" phase in open battle, when airpower degrades an opponent's ability to communicate with its forces, and bombs those forces directly.
Russian military doctrine, like that of any modern nation state, is to prepare the ground for battle by disrupting an adversary's communications, including Internet-based civilian communications so that opposition leaders cannot effectively inform the citizenry.
If a shooting war erupted, either because of a larger Russian incursion into eastern Ukraine under the pretext of protecting ethnic Russians and pro-Russian Ukrainians, or because of open battle in the Crimea between Ukrainian and Russian units, the cyberwar will heat up correspondingly, said the experts.
Pescatore expects that Russia would try to stifle social media, both domestically and in the Ukraine, to sow confusion and make it difficult — if not impossible — for citizens to figure out what was really happening. "This is a standard government response," said Pescatore, of authoritarian regimes, citing examples from Iran and Egypt to Syria and Georgia.
Stiennon envisioned targeted attacks against Ukrainian telecom and power grids using malware, routing diversions and DDoS attacks, along with high-powered cyber assaults against Ukrainian radar and anti-aircraft targeting systems, if the crisis escalates to military blows.
"If Russia invades eastern Ukraine, it will have to go all out, because defeat would be unacceptable," said Stiennon. "They have demonstrated their ability to take out radar and targeting systems."
Those facilities and systems are left-overs from the days when the Ukraine was part of the Soviet Union, and so familiar to the Russians (as well as to countries, like the U.S., who long opposed the U.S.S.R).
"Cyber attacks against Ukraine's defensive missile guidance and targeting radar systems should not come as a surprise," Stiennon said. "Russia has to be worried about Ukrainian hackers, but they'd be willing to accept that during an incursion."
According to Renesys, a U.S. Internet monitoring and intelligence firm, it would be very difficult for anyone, including Russia, to completely isolate Ukraine from the global Internet. "Our model predicts that the chances of a successful single-event Internet shutdown are extremely low," said Renesys in a Feb. 26 blog post, referring to Ukraine.
Sign up for Computerworld eNewsletters.