Андрей Солдатов - The Red Web - The Struggle Between Russia's Digital Dictators and the New Online Revolutionaries

In December 1999 Sherstyuk moved out of FAPSI to the Russian Security Council, an advisory group to the president on security. Once there, he supervised a department for information security, which included the Internet, and brought his ideas with him. The Security Council normally is made up of top officials, including the president, and meets periodically, but it also has an influential staff, which Sherstyuk joined. In 2000 his team composed the “Doctrine of the Information Security of the Russian Federation,” which included an unusually broad list of threats, ranging from “compromising of keys and cryptographic protection of information” to “devaluation of spiritual values,” “reduction of spiritual, moral and creative potential of the Russian population,” as well as “manipulation of information (disinformation, concealment or misrepresentation).” Quite ominously, it identified one source of the threats as “the desire of some countries to dominate and infringe the interests of Russia in the global information space.” [3] Doctrine of the Information Security of the Russian Federation, Russian Security Council, www.scrf.gov.ru/documents/6/5.html . Putin approved the doctrine on December 9, 2000.

In 2003 FAPSI was disbanded, but not the ideas of the suspicious generals. Sherstyuk remained at the Security Council, and some of his views were reinforced when a like-minded top official from the FSB, Nikolai Klimashin, was moved to the Security Council. Sherstyuk founded and headed the Information Security Institute at Moscow State University, which he built into a major think tank to define Russian foreign policy on information security. Meanwhile, Krutskikh rose to become deputy chief of the Department for Security and Disarmament Issues at the ministry.

For years at international meetings Krutskikh had been driving home that Russia wanted to govern its own space on the Internet. Whereas others, including the United States, saw the Internet as a wide-open expanse of freedom for the whole world, Krutskikh insisted that Russia should be able to control what was said online within its borders. He expressed fear that, without such control, hostile forces might use the Internet to harm Russia and its people. “If through the Internet we would be forced to forget our mighty great Russian language, and speak only using curse words, we should not agree with that,” he told us, echoing Putin’s deep suspicions about the Internet and who was behind it. Krutskikh repeatedly proposed some kind of international agreement or treaty that would give Russia the control it sought over the Internet. Influenced by his own career in arms-control negotiations, he was convinced that such an agreement must be between Russia and the United States. He wasn’t anti-American, but he grew emotionally attached to the idea that the two former Cold War superpowers could somehow make a pact that would give Russia control over its digital space. The United States, however, never warmed to the idea—the US government never attempted to control content on the Internet, and many of the first Internet pioneers in America were very open about the Internet as a symbol of how information should roam free—but what Krutskikh wanted most was to be taken seriously and to have his views treated with respect, as they were during the Cold War.

But he didn’t get much respect. At a bilateral meeting in March 2009 in Vienna, Krutskikh delivered a long monologue arguing that Russia and the United States—and perhaps other nations—should collaborate to regulate the Internet as nations and governments. He expressed fear that the Internet was building beyond their control, that there could be an arms race in cyber space, and it was time for governments to take charge.

Russian generals felt they were losing the global cyber arms race and wanted to put some limits on the United States’ offensive capabilities. But Krutskikh’s speech fell on deaf ears. An American diplomat cabled back an account of the meeting, saying, “There was little change, if any, between U.S. and Russian long-held views” on the subject. Krutskikh desperately wanted some sort of joint statement with the United States, but the US administration was reluctant to sign anything. [4] The diplomat who reported this was US chargé d’affaires Hugh Neighbour, reporting March 16, about a meeting in Vienna. “U.S.-RF Cybersecurity Bilateral on Margins of Osce Cyber Workshop,” March 25, 2009, WikiLeaks, https://wikileaks.org/plusd/cables/09USOSCE66_a.html .

But he didn’t give up. In 2010 Kaspersky Lab investigated Stuxnet, the US-Israeli worm that wrecked nearly a thousand Iranian centrifuges. [5] In 2010 Kaspersky Lab discovered Stuxnet, the US-Israeli worm that wrecked nearly a thousand Iranian centrifuges. Two years later it exposed Flame, which attacked computers running the Microsoft Windows operating system; the program is being used for targeted cyber espionage in the Middle Eastern countries. Based on Kaspersky Lab’s investigation, experts and journalists found additional evidence that the United States was behind the development of Stuxnet and Flame. For details, see Kaspersky Lab, “Stuxnet Worm: Insight from Kaspersky Lab,” Virus News , September 27, 2010, www.kaspersky.com/about/news/virus/2010/Stuxnet_Worm_Insight_from_Kaspersky_Lab . Andrey Krutskikh referred to Stuxnet at the meeting in Garmisch, 2012; see Adrian Croft, “Russia Says Many States Arming for Cyber Warfare,” Reuters, April 25, 2012, www.reuters.com/article/2012/04/25/germany-cyber-idUSL6E8FP40M20120425 , and Krutskikh remarks at London Cyber conference on November 11, 2011, the conference Kaspersky also attended: www.rusemb.org.uk/article/112 . Krutskikh seized on the incident—with its destructive malware, designed in part by the United States—as a justification for a ban on cyber weapons. [6] In January 2011 Krutskikh welcomed Andrey Yarnikh, head of Government Relations at Kaspersky Lab, into the Russian delegation at the intergovernmental group on cyber crime of the UN Office on Drugs and Crime. Open-ended intergovernmental expert group on cybercrime, UNODC, January 21, 2011, www.unodc.org/documents/treaties/organized_crime/EGM_cybercrime_2011/UNODC_CCPCJ_EG4_2011_INF_2_Rev1.pdf . In 2011 Kaspersky, who was highly regarded in Russia as an Internet entrepreneur, added his voice to the idea of a ban on cyber weapons, and in November he wrote on his blog, “Considering the fact that peace and world stability strongly relies on the internet, an international organization needs to be created in order to control cyber-weapons. A kind of International Atomic Energy Agency but dedicated to the cyberspace.” [7] Eugene Kaspersky blog, “Call for Action: Internet Should Become a Military-Free Zone,” November 25, 2011, http://eugene.kaspersky.com/2011/11/25/internet-military-free-zone .

In the Bavarian Alps a small mountain resort town, Garmisch-Partenkirchen, is famous for its spectacular views and NATO’s Marshall Center for Security Studies, which is based there. Nearby is a pretty hotel, Atlas, with a traditional Bavarian three-story lodge that is a twenty-minute walk from the Marshall Center. Founded in the early sixteenth century as a tavern, the hotel proudly lists among its previous guests Duke Ludwig from Bavaria, the Prince of Wales, and the King of Jordan. Every April, for almost a week, the hotel hangs a Russian flag from its balcony, hung personally by Sherstyuk, who, since 2007, has been bringing to the lodge a group of Russian and American generals and high-placed officials to talk quietly about information security and cyber conflict. The first two days are always reserved for general discussions, mostly on cyber security and what kind of research is required. Russians gathered in one part of the hotel, and non-Russians gathered in another, partly because many Russians didn’t speak English, and most Americans didn’t speak Russian. The third day was devoted to individual meetings. The real business was conducted in closed rooms with only a few participants. Klimashin was among the guests, as well as Krutskikh, who never tired of making speeches and arguing for agreement on “terms and definitions” in cyberspace and for greater UN involvement in Internet governance. He favored the United Nations because it was filled with governments, not companies, and many of them were sympathetic to Russia’s desire to control the Internet within their borders. [8] The account is based on authors’ interviews with Russian and American participants of the conference who preferred not to be named.