Georgia Cyber Attacks By Russian Gov't? Not So Fast

Let's try to understand what is really happening online between Georgia and Russia, and what it means.

In recent days, news and government websites in Georgia have suffered DDoS attacks. While these attacks seem to indirectly affect the backbone of the Georgian Internet, it is still there.

News reports popped up everywhere, along with supposedly informed technical analysis, claiming anything from the Georgian Internet routes being hijacked to Russia launching a cyber offensive, but with little proof.

Let's try to understand what is really happening over there, and what it means.


1.) There are botnet attacks against Georgian websites.

2.) These attacks affect the Georgian Internet infrastructure indirectly, due to the mass of traffic sent, but the Internet is still very much there.

3.) Some Georgian websites have been defaced with political statements.

4.) Unrelated, a media war is being fought.

Up to the Estonian war, such attacks would be called "hacker enthusiast attacks" or "cyber terrorism" (of the weak sort). Nowadays any attack of a political nature seems to get the "information warfare" tag. When 300 Lithuanian websites were defaced last month, "cyber war" was the buzzword, even though it ended up being an internal Lithuanian matter.

Running security for the Israeli government Internet operation and later founding the Israeli government CERT, I found that such attacks were routine. Seeing the panicked reaction this type of attack has generated seems quaint from my perspective.

Not all fighting is warfare. While Georgia is obviously under DDoS attacks that are political in nature, it doesn't so far seem different from any other online aftermath by fans. Political tensions are always followed with online attacks by sympathizers.

DDoS attacks harm the Internet itself rather than just this or that website, which often requires some of us in the vetted Internet security operations community to get involved in mitigating the attacks, if they don't just drop on their own. Our purpose is not to get involved in any local situation, but rather to preserve our common global critical infrastructure - the Internet.

Could this somehow be indirectly related to Russian military action? Yes, but there is no evidence to indicate it is the case as of yet. If anything, the opposite seems likely at this point in time.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Show Comments