Андрей Солдатов - The Red Web - The Struggle Between Russia's Digital Dictators and the New Online Revolutionaries

The attack on Slon.ru, the website of Natalia Sindeeva’s media empire, began at about 7:30 on Sunday morning, but it was not until 9 a.m. before the website’s programmers reacted to it. [3] Vadim Petrov (technical manager of Slon.ru), interview with authors, April 2012. At first they tried to solve the problem themselves by asking the hosting provider to cut off foreign Internet addresses trying to access the site. This fixed the problem for a short time, but then the volume of traffic increased and the attackers changed tactics, and the server went down again. The Slon.ru programmers then turned to a protective system, known as Qrator, designed to mitigate such DDOS attacks by monitoring traffic and filtering it.

The Kremlin had tried to pressure Golos and others, repeatedly, not to report election violations to the public. Once they did so, a wave of cyber attacks began, apparently intended to stop the information from spreading. The attacked sites responded by quickly migrating elsewhere. Slon.ru, Bolshoi Gorod , TV Dozhd, Echo Moskvy, and Golos all switched to Qrator’s servers, where they were shielded somewhat from the DDOS attacks. Still, the active attack phase continued into the evening of December 4, and Slon.ru alone was bombarded by 200,000 to 250,000 bots: an attacker would use a botnet, a network of zombie computers, to send a high volume of fake requests to the targeted sites with the aim of producing a server overload, which would then cause the site to crash. [4] According to a report by Highload Lab company, the owners of Qrator service, posted on the site of Habrahabr, the community of geeks in Russia, http://habrahabr.ru/company/highloadlab/blog/134124 .

On December 5 the initial wave of attacks subsided. But Echo Moskvy was still bedeviled by the hackers, who shifted to a different tactic, poised to strike again. The attackers aimed to seize the moment when the site would start to fail and possibly emerge from its protected state. About one hundred bots attempted to send difficult requests to the Echo Moskvy site, still under protection at Qrator. Under constant bombardment, Echo Moskvy and Golos distributed their news and other content on LiveJournal.com. But at the same time, LiveJournal remained under attack too, and Melkoniants, the brains behind Golos, switched to Google Docs to publish the Golos data on electoral violations.

On December 6 Ilya Klishin’s Epic Hero site was attacked, apparently for announcing the demonstration at Chistie Prudi Boulevard. On December 7 a DDOS attack then shut down our website, Agentura.ru. Our technical staff were forced to reset the site’s server every fifteen minutes, but it didn’t help: we were down for the most of the day. On December 8 an attack temporarily crippled the website of the newspaper Novaya Gazeta . The assaults on Epic Hero, Agentura.ru, and Novaya Gazeta were part of a second wave. This phase had a different objective than the first: instead of suppressing information about election fraud, the goal was to eliminate reporting about street protests.

Who was behind the take-downs? The phenomenon of crude DDOS attacks was not new; it first appeared in Russia in January 2002, when hackers paralyzed, for a day, Kavkaz.org, the website of Chechen separatist fighters. In that case the perpetrators were students in Tomsk, a medium-sized city in Siberia. Evidently the local FSB branch was fully aware of the attack, putting out a press release that defended the students’ actions as a legitimate “expression of their position as citizens, one worthy of respect.” [5] For more details, see Andrei Soldatov and Irina Borogan, The New Nobility: The Restoration of Russia’s Security State and the Enduring Legacy of the KGB , ch. 18, “Hackers” (New York: PublicAffairs, 2010). Since then Russian “hacker patriots,” as they are called in the press, have launched similar attacks aimed at the websites of independent media in Russia as well as at government agencies in Estonia, Georgia, and Lithuania. Russian government officials always deny responsibility for these attacks, but in December 2011 Konstantin Goloskokov, one of the “commissars” of the pro-Kremlin Nashi youth movement, admitted to the Financial Times that he and some of his associates had launched cyberstrikes on Estonia in 2007 after Estonia had angered the Kremlin with a decision to move a Soviet war memorial out of the center of Tallinn. [6] “Kremlin-Backed Group Behind Estonia Cyber Blitz,” Financial Times , March 11, 2009, www.ft.com/cms/s/0/57536d5a-0ddc-11de-8ea3–0000779fd2ac.html#axzz3QDihM3bC . It seems entirely plausible that DDOS attacks aimed at Putin’s adversaries were organized not by the security services directly but by hacktivists encouraged by the Kremlin.

The most prominent Russian expert on cybersecurity, Eugene Kaspersky, might have been expected to lend a hand to find out who carried out the attacks, but at the outset he didn’t seem interested. In fact, he denied that attacks on the media the day of the elections had ever occurred. On December 5 Kaspersky wrote a blog post suggesting that some of the websites could have been “victims of their popularity” and had failed to cope with tens of thousands of simultaneous requests from people who are interested in politics. He repeated the same point a day later. But then, on December 16, he disclosed that he had been given log files from New Times magazine, one of the targets. Looking at these, he finally acknowledged the fact of the massive DDOS attack but claimed, rather ambiguously, “Something tells me that neither the opposition nor the Kremlin-Lubyanka are interested in such attacks.” [7] Eugene Kaspersky personal blog, “Vibori, vibori—ddosyat-3” [Elections, Elections, Sites Are Under DDOS-3], December 16, 2011, https://eugene.kaspersky.ru/2011/12/16/vybory-vybory-3/ .

Kaspersky has never denied his KGB background, and the picture of him as a young officer in uniform is available on the Internet. He grew up in the small town of Dolgoprudny, north of Moscow, where he excelled in math and physics at school. Instead of entering the prestigious Moscow Institute of Physics and Technology, located in his hometown, he joined the High School of the KGB to study cryptology. After leaving the KGB, he built his company, Kaspersky Lab, from scratch, and has constantly cooperated with the FSB in investigating computer crimes. When thugs kidnapped his nineteen-year-old son in 2011, it was the FSB that helped release the young man in five days without harm.

The early December cyber attacks were ferocious—but ultimately proved futile. Alternative pages for posting information about the electoral violations were quickly established on social networks. When LiveJournal, the most popular blog platform in Russia, suffered an unrelenting assault, users turned to Facebook, which became a central clearinghouse for collecting information related to the protests.

As a tool for spreading news about the protests, Facebook was more popular than the local social network, VKontakte, a Russian replica of Facebook. For the protest on Bolotnaya Square on December 10, Facebook got more than thirty-five thousand people signed up, compared to some sixteen thousand who signed up on VKontakte. Facebook was simply the first network the Russian intellectual elite, experts, and journalists joined to be in contact with their friends and colleagues abroad. VKontakte, though enjoying great popularity, lacked this elite appeal.

But VKontakte did not escape the authorities’ attention. Alexey Navalny, the popular anticorruption blogger, led a user group of protesters on VKontakte, and on December 7 Edward Kot, a moderator of the group, discovered that their group seemed to be blocked, with no new posts allowed. When he complained to VKontakte, he got a reply an hour later from Pavel Durov, the somewhat mysterious founder of VKontakte. Durov, then twenty-seven, explained to Kot that Navalny’s group had reached a set limit of 1,634 posts in a single day, then added that VKontakte’s technical team was, at that moment, changing algorithms for them.