Georgia blames Russia for cyberattack on Web sites, cell phones

As Russian forces fought their way into Georgia Monday, Tbilisi said they were also behind a huge cyberattack that disabled government and news Web sites for much of the weekend and may have affected cell-phone service.

Russian officials denied they were behind the assaults, which appeared to be the latest in a series of cyberattacks by organized Russian hacker gangs against countries in conflict or tension with the resurgent bear.

"Russia is trying to isolate Georgia from the world," Patrick Worms, an adviser to the Tbilisi government, told United Press International in a telephone interview.

Worms said a "huge" Distributed Denial of Service attack had taken down the government's network of Web sites and the two non-governmental sites that are the main source for news and information about the country: Interpress and CivicGeorgia.

"It is extremely difficult for us to believe that this was not orchestrated at the highest levels" of the Russian government, he said.

Over the weekend the Ministry of Foreign Affairs was posting statements and other updates on a blog site operated by Google Inc. "A cyber warfare campaign by Russia is seriously disrupting many Georgian Web sites, including that of the Ministry of Foreign Affairs," it said in a statement on the blog site.

Worms said most government sites were back online Monday, hosted on "mirror servers" outside Georgia -- including one in Atlanta -- in an effort organized by an international team of virtual volunteers.

But the Web site of the Ministry of Defense was still unreachable Monday, and during the afternoon the Georgian Parliament Web site was hacked, so that visitors saw a series of pictures of Georgian President Mikheil Saakashvili juxtaposed with images of Adolf Hitler in similar poses.

"We are dealing with the sites one by one," said Worms.

He added that the attacks, which began after fighting between the two countries erupted last week, had also affected the country's cell-phone system. "For the first two days, it was almost impossible to use mobile phones here," he said.

In an interview with CNN Sunday, Saakashvili apologized for the difficulty the network had apparently had reaching him by telephone. "Our lines get under cyberattack," he said. "That's a new technology these days of war."

CNN's publicity department did not respond to e-mail or phone requests for comment.

Mobile and land-line telecom systems often employ the Internet and other computer networks to transmit and manage telephone traffic, but experts cautioned that there could have been other causes to any difficulties users experienced in Georgia.

"In any major event, people tend to reach out" through the phone system, Eric Stern, a critical incident and cyber-war specialist at Sweden's National Defense College told UPI. "Without a lot more technical information it's hard to know exactly what happened. The system could have been overwhelmed by simple volume of traffic."

"It does not sound like hacking," Vladimer Shioshvili, an IT specialist based in Tbilisi, told UPI in an e-mail message. "(The) problem is with overload, (the) networks are not designed for so much use ... you get (the) same result in busy times -- e.g., in a stadium during a game."

Yevgeny Khorishko, a spokesman for the Russian Embassy in Washington, denied that his government had anything to do with the attacks.

"This is pure speculation and lies from the Georgian side," he told UPI. "We are not targeting the civilian infrastructure."

Computer security experts monitoring the attacks said they originated on a number of different hacker-controlled servers. "We have seen at least five," said Steven Adair of ShadowServer.org -- a volunteer computer security group.

Similar hacker gangs were behind a massive DDOS attack on Estonian government Web sites last year, an assault that coincided with a wave of protests by ethnic Russians in the country against the relocation of a statue commemorating the driving out of Nazi occupiers by the Soviet army.

"The same activists are among the attackers, the same tactics are being used," Lars Nicander, director of the Center for Asymmetric Threat Studies at Sweden's National Defense College, told UPI. "It is not a coincidence."

"We will have to get used to this from the Russians," Nicander added, calling the cyberattacks "a new instrument in the security toolbox for the exercise of non-military power."

Worms said that the effort to get the government's Web sites back online had been undertaken by "individuals from a number of countries," including the United States.

"We have many friends and we activated them," he said, adding that the government had made no formal request for assistance.

The volunteer effort had been "coordinated by individuals in a country that has had experience of this kind of attack."

He declined to name the country, but people with Estonian e-mail addresses were among those from whom UPI was directed to seek technical information by other Georgian sources.