HomeRemarks and Releases – Brussels Media Hub...Online Press Briefing with Principal Deputy Assistant Secretary for the Bureau of Cyberspace and Digital Policy Jennifer Bachus

# 									Online Press Briefing with Principal Deputy Assistant Secretary for the Bureau of Cyberspace and Digital Policy Jennifer Bachus							

Special Briefing

Brussels Hub

May 10, 2024

						Download AUDIO FILE						(m4a)						[23 MB]

https://www.state.gov/wp-content/uploads/2024/05/05102024_Briefing_Bachus.m4a

**MODERATOR:**  Okay, and good afternoon from the State Department’s Brussels Media Hub.  I would like to welcome everyone joining us for today’s virtual press briefing.  Today, we are very honored to be joined by Principal Deputy Assistant Secretary for the Bureau of Cyberspace and Digital Policy Jennifer Bachus.

Finally, a reminder that today’s briefing is on the record.  And with that, let’s get started.  Thank you so much for joining us today, and I’ll turn it over to you, Principal Deputy Assistant Secretary Bachus, for your opening remarks. 

**MS BACHUS:**  Thank you very much.  It’s a real pleasure to be on this call with you all as, if you’ve read my bio, you know I have spent significant time in Europe, so it’s an area I know and appreciate quite well.  I’m also very excited to be able to do this call this week because I hope you all have seen that we released the U.S. International Cyberspace and Digital Policy Strategy this week.  The Secretary of State spoke at RSA and sort of announced this.  

To sort of spend a couple of minutes on this before I get into the main purpose of the call today, the strategy is recognizing the growing role that technology and technology policy is playing across foreign policy issues, and it focused on building what we’re calling broad digital solidarity to work with international partners to advance a digital future that is rights-respecting for tech safety and security online and leverages technology to address some of the most profound global challenges.  

Essentially, digital solidarity is a willingness to work together on shared goals, to stand together, to help partners build capacity, and to provide mutual support.  It recognizes that all who seek to use digital technologies in a rights-respecting manner are made more secure, resilient, self-determining, and prosperous when we work together to shape the international environment and innovate at the technological edge. 

So, we have three guiding principles that are laid out by this strategy and four action areas.  I will not spend more time on that unless you all want to, but just to say that this concept of digital solidarity aligns very closely with what we’re here to talk about today, which is the attack that Germany came to us to – that the United States joined Germany in attributing malicious cyber activity. 

Just a little bit of background:  Due to our longstanding close relationship with Germany that’s been built up over a decade of close cooperation, Germany came to us after it detected malicious cyber activity carried out by the Russian group APT28 that was targeting a German political party.  It came to us; it asked us to join in attributing this activity; it gave us information that we were able to verify; and we were very pleased to be able to support this attribution both bilaterally and through NATO.  And as I’m sure you saw in our statement, we came together with the EU and NATO Allies condemning the activity and supporting efforts to counter disruptive cyber activities and hold malicious cyber actors accountable.  

I know there are some questions to this extent, but maybe I’ll just start out by saying that APT28, which has a lot of other known acronyms – Fancy Bear, Strontium, Forest Blizzard – is part of the Russian Federation’s General Staff Main Intelligence Directorate, GRU, and is a well-known malicious cyber entity with a very long history of engaging in destabilizing and disruptive behavior.  

I think it’s also important to recognize the United States has previously indicted and sanctioned actors associated with APT28 for their involvement in a wide range of malign cyber activities such as the sustained hack-and-leak operations that targeted the World Anti-Doping Agency and cyber activities aimed at interfering in the 2016 U.S. presidential elections.  Of course, these are just a few of the many malign, disruptive, and destabilizing activities associated with APT28.  And we’d just note that this pattern of behavior blatantly disregards the framework of responsible safe behavior in cyberspace, which was affirmed by all UN member states.

I will stop there.  I know some of those – some of my opening statement hopefully answers some of the questions you all have, but happy to go into more detail. 

**MODERATOR:**  Okay, thanks very much.  We will now turn to the question-and-answer portion of today’s briefing.  Okay, so the first question goes to Lisa O’Carroll at The Guardian, Europe/UK.  “Have you any knowledge of APT attacks on other countries other than Germany and Czechia in the EU?  How concerned are you about attacks on infrastructure and transport such as jamming air traffic control?”  

**MS BACHUS:**  So we recognize or we understand that there were attacks in Czechia, Lithuania, Poland, Slovakia, and Sweden that have all been targeted by this malicious cyber actor.  On the question of our concern on critical infrastructure, I will say, broadly speaking, we have seen increasing efforts both by state-sponsored actors such as APT28 as well as non-state actors such as ransomware actors targeting critical infrastructure, and therefore we continue to encourage all critical infrastructure owners to continue to upgrade their basic cybersecurity.

I don’t have any specific information on the question of jamming and traffic control.  

**MODERATOR:** Okay.  Thanks very much.  Let’s move on to one of the next questions.  So, we have Jakub Lucky from Czech Radio.  And the question is: “What kind of cooperation has there been with Czechia?”  

**MS BACHUS:**So great question.  I served in the Czech Republic for three years, so I can tell you from personal experience have a very close and deep relationship with the Czech Republic on all things cyber related.  We actually held our first cyber dialogue with the Czech Republic – I believe it was last month – which was held on the margins of the 5G Cybersecurity Conference.  So for a long time we, of course, exchanged information, supported the Czech agencies in their own investigations, and just broadly had deep cooperation both at the sort of law enforcement level as well as the diplomatic level.  And so we will – we have and we will continue to have such a strong relationship, recognizing that the Czech Republic itself has very strong cyber actors.  

**MODERATOR:**Great.  Thanks very much.  Let’s go on to our next question, and it is from Karol Darmoros from Polish Radio in Poland.  And the question is: “Recent North Atlantic Council’s statement concerning malicious activities points directly to Germany and Czechia.  Does the U.S. see specific threats to Poland in this area?  Could you elaborate on this?  Is Belarus, with its relatively strong IT sector, a possible Russian proxy?”

**MS BACHUS:**  We do not have specific information about this threat actor and doing similar to what it did in Germany and Czechia.  But, of course, I think we all need to recognize that there are malicious, persistent cyber actors out there who will continue to seek opportunities to carry out destabilizing cyber intrusions.  And therefore, as I said earlier, it is critically important that every country continues to improve its cyber hygiene, that it continues to undertake the sort of needed basics that are being done.

Again, we’ve had very strong, longstanding cooperation with Poland.  My boss, Ambassador Fick, was in Poland a few months ago.  I had a series of engagements with the Polish Government.  We know the Polish Government is taking this very seriously, and we would encourage them to continue to do so.  

In terms of the relationship between Belarus and Russia, I personally don’t have any further comment on that.  We see that there are malicious cyber actors that are spread in many countries around the world, and, again, this is why it’s so critically important that every country does the sort of cyber 101 that’s necessary to strengthen its own systems.  

**MODERATOR:** Okay.  Great.  Thanks very much.  Let’s go to the next question.  So, we have Momchil Indjov from Club Z Media in Bulgaria: “Do you have any information about any cyber attack of the APT28 against Bulgaria?  And if so, could you provide any details?”

**MS BACHUS:**  So, again, I – we do not have specific – in this particular situation we do not have specific information on Bulgaria; but, again, I think that the – that it is a very pernicious actor which is likely to seek any accesses it can, regardless of which country it is.  So, I have no specific information when it comes to Bulgaria, but that doesn’t mean that the APT28 is not active in Bulgaria.  

**MODERATOR:**  Thanks very much.  Okay.  We do have quite a few questions here, so let me go on to another one here.  And we have Llazar Semini, Associated Press out of Albania.  And the question is: “Earlier this week Kosovo suffered a cyber attack from what they said was a Russian hacker.  Are you aware of that incident?  Any specifics?  And is Kosovo considered a target for Russia?”  

**MS BACHUS:**  I am not personally able to attribute the attack in Kosovo to APT28.  Again, we have seen the actor actively engaged in activities throughout Europe, and so it is possible that APT28 has been active in Kosovo.  We have similarly spent significant time and energy trying to support Kosovo in strengthening its cybersecurity, and we will continue to do so.  

**MODERATOR:**  Great.  Thanks very much.  Okay.  So, we have another question here, and this question comes from Stella Venohr from DPA in Germany.  And the question is: “To what extent is cyberspace considered national territory?  So is there a scenario in which a Russian cyberattack could fall under Article 5 of NATO?””  

**MS BACHUS:**  First of all, I would say that we believe that there is a critical importance to the open, interoperable, secure, and reliable internet, which means that information will continue to flow across borders.  The question of whether a cyber attack falls into Article 5 is one that’s been discussed for many years.  I think that ultimately it would depend upon the level of the activity.  There is those that create destabilizing downstream impacts onto, for example, critical infrastructure; there are those that are hack-and-leak operations.  So there is not a one-size-fits-all answer to the question.  It really would depend on what is the actual ultimate activity, what is the outcome of the attack, and what is the impact on civilian or other infrastructure.

So again, I know people want answers on when does it reach into Article 5.  I will say this is an ongoing conversation that we have throughout the Alliance.  We do recognize that there is the possibility that significant malicious, cumulative cyber activities might in some circumstances be considered an armed attack that would lead to the invocation of Article 5, but this would be on a case-by-case basis and, again, it would require a real analysis.

**MODERATOR:**  Thanks very much.  And let’s move on to the next question.  We have Alexej Hock from CORRECTIV in Germany.  And the question is: “Could you please provide a few details about how APT28 is disguising its own infrastructure, and how attribution works then?”

**MS BACHUS:**  So, there are a variety of ways that actors such as APT28 disguise their activities.  And essentially, they – in this particular case, APT28 was using the exploitation of a particular cybersecurity vulnerability, which I can name if anyone actually cares.  It’s CBE-2023-23397.  Essentially, what it was, was there was a network of hundreds of small office and home office routers, and these were being used to carry out the attack.

So, there was work that was done with the U.S. Department of Justice in Germany to help remediate this network and to block the GRU from regaining access to the remediated devices.  We will continue to take action against APT28 to protect itself [sic]  – to protect ourselves, our citizens, and foreign partners, and we will continue to do so.

I don’t know if I missed the last part of that question.  I apologize if I did.

**MODERATOR:**  No, I think you did get the whole question, so thanks very much.  I’m going to move to one of the next questions that we have here.  And so we have Maggie Miller from Politico, and the question is this:  “Various European countries are seeing attacks from Russia in recent weeks.  Can you talk about the trend in attacks by Russia against Europe?  And how are you expecting Russian cyber attacks to evolve against Europe this year?”

**MS BACHUS:**  Thank you, Maggie, always good to have questions from you.  I think that, yes, we are seeing an increase in the frequency and type of activity coming out of Russia.  This, I think, aligns with its full-scale invasion and illegal war in Ukraine, and I think we can expect that this will continue to happen.

And I think that the reality is, is that Russia does try to calibrate what it’s doing to avoid escalatory impacts, but nonetheless is carrying out destabilizing intrusions into cyber networks around Europe and into the United States, as well.  And so I think this is a trend that we expect will continue.  I think it aligns similarly with what has become a really frightening increase in the amount of ransomware attacks, as well.

And again, it just goes to show the importance of addressing known vulnerabilities of the private sector and the public sector, catching these vulnerabilities, working together to find them, to remediate them, and then also just to do the basics when it comes to cyber hygiene.  I think the only way to address this is to continue to up our preventative game.

**MODERATOR:**  Okay, thanks very much for that answer.  We’re going to go now to an actual live question from Lisa O’Carroll from The Guardian Europe/UK.

**QUESTION:**  Thank you for the second chance.  It’s actually a follow-up, really, to that previous question.  What is your nightmare scenario?  There’s an election coming up here in four weeks’ time, and we all know and can see the disinformation is proliferating, and the cyber attacks and ransomware.  Our own company is being – has been a victim of ransomware 18 months ago.  It’s a pretty severe attack.  What is the nightmare scenario that you have in Europe at the moment that you’ve game-planned for?

**MS BACHUS:**  It’s a really good question.  I think I’m always worried about giving a nightmare scenario because, if you give a nightmare scenario, does that then give ideas to our adversaries on what to do?

I think, of course, we’re both concerned about influence, operations which we see coming out of Russia, and particularly in this massive election year, both in the UK but also in the United States, in Europe, and elsewhere.  It’s a huge election year for us.  So, I think you have the question of malign influence, and then you have the question, of course, of destabilizing cyber intrusions.  I think we will continue to be concerned, as you noted, both about state-sponsored but as well about ransomware actors carrying out such attacks.

And I think that we’ve seen – I mean, in the United States we’ve already seen some really terrible ransomware activity.  The attack against the U.S. health care industry, which essentially brought down the ability of people to make appointments, to receive prescriptions, et cetera, I think these are already some pretty bad scenarios that are impacting our everyday life.  I think we could see that on a large scale, again, not necessarily from state actors, but also potentially from non-state actors.  And I think that it’s critically important that we recognize that these vulnerabilities can be used by both, and that’s why it’s so critically important to address them.

So, I guess I would not have a specific nightmare scenario I would want to highlight, but to just say that there’s already a lot of very bad scenarios out there that we need to continue to guard against.

**MODERATOR:**  Okay.  And it looks like we have two more questions, and we have just about enough time to answer two more questions, so that fits well.  So let me get to the first of the final two questions.  And this comes from Novika Mikhailovic from an outlet in the Western Balkans, and the question is:  “How resilient to cyber attacks from Russia are the Western Balkan countries?”

**MS BACHUS:**  I would say the Western Balkan countries have done a lot of work to increase their cyber hygiene, but I think that there is more work to be done – not just in relation to the attack that happened this week in Kosovo, but also to the massive cyber intrusion that occurred in Albania, I guess almost two years ago.  I know Montenegro has also had cyber intrusions that have been quite destabilizing.  I think that there is continued basic work that needs to happen throughout the Western Balkans.  

I can tell you the United States and Europe have come together to try to continue to improve the ability of the Western Balkans to protect its own infrastructure; we will continue to do so.  It’s an area that we have devoted significant resources to and that we will continue to do so, again, in close cooperation with the EU and European member states.

**MODERATOR:**  Okay.  And if – if we can, we’ll go to the final question for today’s briefing.  And it’s a question – so a second question from Alexej Hock from CORRECTIV in Germany.  And the question is:  “Are the activities of APT28 hack-and-leak activities?  And do you have any signs that correspondence from the hacked mail inboxes of the SPD in Germany is being used already?”

**MS BACHUS:**  I think that I would defer on that question to Germany.  We – we – our role in this really was to support and to reaffirm Germany’s information.  So, I would recommend you engage with the German Government on that question.

**MODERATOR:**  All right.  And unfortunately, that’s all the time we have for today.  Thank you for your questions, and thank you, Principal Deputy Assistant Secretary Bachus, for joining us.  But before we close the call, I’d like to see if our speaker has any final remarks or wrap-up thoughts for the group.

**MS BACHUS:**  Thank you very much.  We came here today to talk about what’s really malicious cyber activity.  But I just hope you all walk away recognizing the critical importance that – of the collaboration between the United States and Europe both to address when these types of incidents occur, but also to try to prepare for them, try to prevent them, and essentially to come together around a shared vision of the internet and how we can work together.  I think that this collaboration between the United States and Europe ultimately makes both sides stronger and allows us to continue to stand up for the framework of responsible state behavior in cyberspace, which is a critically important element of our shared commitment to a stable cyberspace.  

So, thank you very much for joining us, and thank you very much for your interest in what’s a critically important topic.  

**MODERATOR:**  Great, thank you.  So shortly we’ll send the audio recording of this briefing to all the participating journalists, and we will provide a transcript as soon as it’s available.  We’d love to hear any feedback at TheBrusselsHub@state.gov.  Again, that’s one word, TheBrusselsHub@state.gov.  

So, thanks again for everyone’s participation, and we hope you can join us for another press briefing soon.  This ends today’s press briefing.

# # #

Tags

AlbaniaBrussels Media HubBulgariaCyber SecurityCzech RepublicGermanyPoland

Back to Top