At the push of a button, a soldier holding a laptop sends sparks across a circuit board, causing an electricity generator to flash bright red as a beeping sound grows louder. This is the representation of a country’s electrical infrastructure under cyberattack.
Although the circuit board depicts a fictional island, with streets labeled “Blockchain Street” and “Macintosh Street”, an actual cyberattack may not be as visible as this one. Yet the effects on infrastructure can be just as devastating, causing homes to lose electricity or water.
The scenario is only a simulation, but it serves as a training ground for the soldiers who are at NATO’s Cyber Range in the Estonian capital, Tallinn.
At the CR14 NATO Cyber Range, around 145 on-scene commanders from no less than 30 countries – most of them NATO countries but some not – are put through their paces on how they would prevent a cyber attack.
Inside the three-story building that houses it, the first floor is where food and refreshments are provided and some of the innovations are showcased. The second floor is used for training and where phones are not permitted. And the third floor is where the real action takes place, but it’s off-limits to reporters.
Ukraine and Article 5
NATO’s week-long cyber operation, which took place last week, is an annual affair. This year saw the most participants, which is not surprising given the war in Ukraine.
“What we’ve seen in Ukraine is really incessant cyberattacks since February, since just before the war started,” said David Cattler, assistant secretary general for intelligence and security at NATO.
“Additional cyber operations are underway…Some of these operations have been linked to Russian military intelligence, the GRU, and are clearly designed to cause psychological effects and drain cyber defense resources, which again underlines the role that the cyber in a crisis. and plays out in this war,” he said.
NATO takes cyberattacks so seriously that its Secretary General, Jens Stoltenberg, said this year that cyberattacks on a NATO member could trigger Article 5, which means they are considered an attack on all NATO members and that the alliance could react.
truth in fiction
Back at the Cyber Range, the made-up storylines that participants must solve involve the fictional island of “Icebergen”, home to the nations of supposed NATO member “Anduaria” and “Harbardus”, an enemy.
“This [the situation in Ukraine] brings more seriousness to how it actually happens. It’s not so fictional anymore. And that’s the difference this thing makes,” Bernd Hansen, head of the cyberspace branch at NATO’s Allied Command Transformation, told Euronews Next.
Although the scenarios are kept top secret by the participants and NATO, they say it can include infrastructure attacks, network intrusions and potential insider threats.
But the focus is on how each participating country shares information and can help the other in the event of an attack, rather than compete with each other.
This is called Operation Locked Shields, a live exercise in which they would react and help other countries.
“I believe it emphasizes collaboration and nothing else, because if you start competing you tend to be in a situation where you don’t share as much because you want to be in a good situation in shields locked and you could get points by sharing them,” said Tobias Malm, a cyber defense specialist with the Swedish Armed Forces.
“Of course, there will always be a competitive side in that all technicians want to solve technical problems on their own and be the first to solve them. So in that sense it’s a competitive ingredient in exercise,” he told Euronews Next.
Although not currently a NATO member, Sweden may soon be after NATO members quickly welcomed its bid to join the alliance alongside neighboring Finland following the invasion of Ukraine by Russia.
But this is not the first time that Sweden has taken part in NATO training programmes.
“We have been in this exercise for I think 10 or 12 years. So it’s nothing new,” Malm said.
“But for us working together on cyber defense is good, we are learning a lot and I think we can bring something new to NATO in terms of how we work and also in terms of way we work”.
Although Sweden and Finland have been here before, this has been an important year for the countries.
“This year we have improved capabilities and information exchange,” said Markus Riihonen, commander of defense in the Finnish Defense Forces.
“I felt really, really proud to be treated so warmly. And that’s partly because there are people I walk around here with and they kind of treat me like an ally,” he told Euronews Next.
“I am delighted to have two countries of very high level in terms of cybersecurity [Finland and Sweden]which is very beneficial to them [NATO]. That’s what they [NATO] let me know that they look forward to membership and integration in the future”.
With the many cybersecurity start-ups in Finland and Sweden, NATO has every reason to be excited about countries joining.
“We are very excited to be able to welcome Finland and Sweden into our innovation ecosystem to maintain our technological lead. I mean, they are now their world-class partners or guests, and there will also be very close working allies,” said David van Weel, NATO Under-Secretary General for Emerging Security Challenges.
“They are two very capable countries, especially when it comes to innovation. They have a history of strong engagement with their private sectors. They have thriving innovation ecosystems,” he said.
Van Weel said working with the private sector and academia will prove crucial for cyber defense, as evidenced by how companies like Starlink and Microsoft have helped Ukraine.
“NATO is committed to maintaining its technological edge and exercises like the Cyber Coalition help us test and put these new technologies into practice,” he said.
“The threat from cyberspace is real and growing and we need to invest more in strengthening our cyber defenses, more expertise, more strengthening cooperation, also with the private sector.”
In NATO’s Cyber Range building, innovation is in the spotlight in the form of the world’s first 5G scooters zipping through the long hallways. Although it’s only there for inspiration, it shows how transports running on 5G could be attacked.
Similarly, there is also a battleship simulator, which could be subject to a cyberattack if the digital map used by the ship is hacked and countries or islands disappear.
But the biggest test for participating countries is infrastructure, such as street lighting, water supply and heating, which comes under cyberattack.
This, in the real world, is a serious threat, which Ukraine has faced since October after Russia began attacking its energy infrastructure, leaving around 30% of power plants across the country destroyed and many without heat or light in winter.
Georgia, also a neighbor of Russia, is also worried about cyberattacks. The post-Soviet country, which is not a member of NATO, was attacked by Russia 13 years ago in a five-day war.
Much of Georgia’s infrastructure is also Soviet in its design and installation.
“For the Ministry of Defense, cybersecurity is one of the main priorities because we are facing many challenges,” said Nika Gogindze of the Georgian Ministry of Defense on cybersecurity.
He said that the NATO Cyber Security Week allowed him to improve Georgia’s cyber cooperation with other countries.
“Our goal was to improve coordination with our allies and their nature and reduce the time needed to find new ways to communicate with them during the crisis of cyberattacks.
“So the goal has been achieved and I’m very happy about that.”
As the weekend draws to a close, so does of course any cybernetic trace of the operations that took place. All e-mail connections are erased from the building and a new week begins for new cyber training operations.