At the touch of a button, a soldier holding a laptop sends sparks flying across a circuit board, causing a power generator to flash bright red as a beep gets louder. This is the representation of the electrical infrastructure of a country that suffers a cyber attack.
While the circuit map depicts an imaginary island, with streets named “Blockchain Street” and “Macintosh Street,” a real-life cyber attack might not be as visible. However, the effects on infrastructure can be just as devastating, causing homes to lose electricity or water.
The scenario is just a simulation, but it serves as a training ground for soldiers who are at the NATO Cyber Range in Estonia’s capital Tallinn.
At the CR14 NATO Cyber Range, around 145 field commanders from as many as 30 countries – most of them NATO countries but some not – are challenged on how to prevent a cyber-attack.
Inside the three-story building that houses it, food and drinks are provided on the first floor and some of the novelties are presented. The second floor is used for training and where phones are not allowed. And the third floor is where the real action takes place, but it’s off-limits for reporters.
Ukraine and Article 5
NATO’s week-long cyber operation, which took place last week, is an annual affair. This year saw the highest number of attendees, which is no surprise the war in Ukraine.
“What we’ve seen in Ukraine is really non-stop cyberattacks since February, just before the war started,” said David Cattler, deputy secretary general for intelligence and security at NATO.
“More cyber operations are underway… Some of these operations have been linked to Russian military intelligence, the GRU, and are clearly designed to cause psychological effects and deplete cyber defense resources, which highlights once again the role that cyber plays in a crisis and is played out in this war,” he said.
NATO takes cyberattacks so seriously that its secretary general, Jens Stoltenberg, said this year that cyberattacks against a NATO member could trigger Article 5, meaning it is considered an attack on all NATO members and the alliance could react.
The truth in fiction
Back at the Cyber Range, the made-up storylines that the participants must solve involve the fictional island of ‘Icebergen’, home to the nations of alleged NATO member ‘Antuaria’ and ‘Harbardus’, an enemy.
“It [the situation in Ukraine] brings more seriousness in terms of how this actually happens. It’s no longer fictitious. And that’s the difference this thing makes,” Bernd Hansen, branch head of Cyberspace at NATO’s Allied Command Transformation, told Euronews Next.
While the plots are kept very secret by the participants and NATO, they say they can include infrastructure attacks, network intrusions and potential insider threats.
But the focus is on how each participating country shares information and can help the other in the event of an attack, rather than competing with each other.
This is called the “locked shields” operation, a real life exercise where they would fight back and help other countries.
“I think it’s an emphasis on collaboration and nothing else, because if you start competing, you tend to get into a situation where you don’t share much because you want to be in a good situation with shields locked down and you might get points for sharing,” he said. said Tobias Malm, a cyber defense expert in the Swedish Armed Forces.
“Of course, there will always be a competitive side in the sense that all technicians want to solve technical problems themselves and be the first to solve them. So in that sense, this is a competitive ingredient of the exercise,” he told Euronews Next.
While not currently a member of NATO, Sweden could soon be one after NATO members swiftly granted its request to join the alliance alongside neighboring Finland following the Russian invasion of Ukraine.
But it is not the first time that Sweden has participated in NATO training programmes.
“We’ve been in this establishment for I think 10 or 12 years. So it’s nothing new,” Malm said.
“But for us to work together on cyber defense is good, we learn a lot and I think we can bring something new to NATO regarding the way we work and also regarding the way we work.”
Although both Sweden and Finland have already been here, this year was a big one for the countries.
“We have made improvements in capabilities and information exchange this year,” said Markus Riihonen, Chief Defense Commander in the Finnish Defense Forces.
“I felt really, really proud to be treated so warmly. And partly because there are people I hang out with here who treat me like an ally,” he told Euronews Next.
“I look forward to having two world-class cyber security countries [Finland and Sweden]which is very beneficial for them [NATO]. That’s what them [NATO] they let me know that they look forward to membership and integration in the future”.
With numerous cybersecurity start-ups in Finland and Sweden, NATO has every reason to be excited about the countries joining.
“We look forward to welcoming Finland and Sweden into our innovation ecosystem to maintain our technological edge. I mean, now they are their world-class partners or guests, and there will be real close allies as well,” said David van Weel, NATO Deputy Secretary General for Emerging Security Challenges.
“These are two very capable countries, especially when it comes to innovation. They have a history of strong engagement with their private sectors. They have thriving innovation ecosystems,” she said.
Van Weel said working with the private sector and academia will prove crucial to cyber defense, as can be seen in the way companies like Starlink and Microsoft have helped Ukraine.
“NATO is committed to maintaining its technological edge and exercises such as the Cyber Coalition help us test and put these new technologies into practice,” he said.
“The threat from cyberspace is real and growing and we need to make more investments to improve our cyber defenses, more skills, more cooperation, including with the private sector.”
In the NATO Cyber Range building, innovation is on display in the form of the world’s first 5G scooters zipping along the long corridors. While it’s only there for inspiration, it shows how transports operating on 5G could be attacked.
Similarly, there is also a warship simulator, which could suffer a cyber attack if the digital map used by the ship is hacked and countries or islands disappear.
But the biggest test for the participating countries is on infrastructure, such as streetlights, water supply and heating which come under a cyberattack.
This, in the real world, is a serious threat, one that Ukraine has experienced since October after Russia began attacking its energy infrastructure, leaving about 30% of power plants across the country destroyed and many without heating or light in winter.
Georgia, which borders Russia, is also concerned about cyberattacks. The post-Soviet country, which is not a member of NATO, was attacked by Russia 13 years ago in a five-day war.
Much of Georgia’s infrastructure is also Soviet in design and installation.
“For the Ministry of Defense, cybersecurity is one of the top priorities because we are facing many challenges,” said Nika Gogindze of the Georgia Ministry of Defense on cybersecurity.
He said NATO Cyber Security Week allowed him to improve Georgia’s cyber cooperation with other countries.
“Our goal was to improve coordination with our allies and its nature and reduce the time it takes to find new ways to communicate with them during the cyberattack crisis.
“So the goal has been achieved and I’m so happy about it.”
At the end of the week, of course, also any IT trace of the operations that have taken place. All email logins are cleared from the building and a new week begins for new cyber training operations.