Russia has attacked Ukraine’s power grid in the past, and experts say Moscow might take similar steps as it masses troops along the border.
In the closing days of 2015, the lights went out across a swath of Ukraine as Russian hackers remotely took over an electric utility’s control center and flipped off one power station after another, while the company’s operators stared at their screens helplessly.
The next year, the same thing happened, this time around Kyiv, the capital.
Now the United States and Britain have quietly dispatched cyberwarfare experts to Ukraine in hopes of better preparing the country to confront what they think may be the next move by President Vladimir V. Putin of Russia as he again menaces the former Soviet republic: Not an invasion with the 175,000 troops he is massing on the border, but cyberattacks that take down the electric grid, the banking system, and other critical components of Ukraine’s economy and government.
Russia’s goal, according to American intelligence assessments, would be to make Ukraine’s president, Volodymyr Zelensky, look inept and defenseless — and perhaps provide an excuse for an invasion.
In one sense, the Russian cybercampaign against Ukraine never stopped, American officials say, though until recently it bubbled along at a low level. But in interviews, American officials and experts say the action has stepped up over the past month even while public attention has been focused on the troop buildup.
“It’s a widespread campaign targeting numerous Ukrainian government agencies, including internal affairs — the national police — and their electric utilities,” said Dmitri Alperovitch, a leading investigator of Russian cyberactivity and the chairman of Silverado Policy Accelerator, a new research group in Washington.
The Russian cyberactivity was discussed by roughly a dozen officials, who requested anonymity because the information was derived from classified intelligence and sensitive discussions about how to mitigate the Russian threat. Those conversations have focused on whether Putin thinks that a crippling of Ukraine’s infrastructure could be his best hope of achieving his primary goal: ousting the Ukrainian government and replacing it with a puppet leader.
The calculus, one senior intelligence official said, would be that such an attack would not require him to occupy the country — or suffer as many of the sanctions that would almost certainly follow a physical invasion.
Already Putin has been working to build support domestically and in Africa and South and Central America. Russian-led information campaigns have been focused on denigrating the Ukrainian government and accusing its leader of creating a humanitarian crisis in the country’s east, where Ukrainian government forces have been battling Russia-led separatists for years, according to U.S. and allied officials.
With the holidays approaching again, American officials say they are on high alert. But if Putin does launch a cyberattack, either as a stand-alone action or as a precursor to a physical-world attack, it will most likely come after Orthodox Christmas, at the end of the first week of January, according to people briefed on the intelligence.
Senator Angus King of Maine, a member of the Senate Intelligence Committee, said in an interview that if an invasion does take place, the first sign will be in cyberspace.
“I don’t think there’s a slightest doubt that if there is an invasion or other kind of incursion into Ukraine, it will start with cyber,” said King, an independent who caucuses with the Democrats.
King has long argued that the United States and its allies need to think more deeply about how to deter cyberattacks. The United States, King said, should issue a declaratory policy about what the consequences for such attacks will be.
Representative Mike Gallagher, Republican of Wisconsin who along with King leads the Cyberspace Solarium Commission, said the United States should try to prevent a cyberattack on Ukraine by making it clear it would prompt a strong response.
“We should be preparing our own cyberresponse,” Gallagher said. “We have very powerful weapons in the cyberdomain that we could use against Putin if he chooses to go further.
A cyberoperation retains allure for Moscow over a full-on military operation, because Russia can operate under a thin veil of deniability. And Putin has demonstrated over the last decade that the flimsiest of disguises is good enough.