Russia Charged With OPCW Hacking Attempt

November 2018
By Alicia Sanders-Zakre

The European Union established a new mechanism for chemical weapons sanctions, days after several countries blamed Russian intelligence operatives for attempting to hack computers at the Organisation for the Prohibition of Chemical Weapons (OPCW).

The sanctions framework approved by EU foreign ministers last month reflects an effort by the Europeans to bolster international norms against chemical weapons use at a time when the legal prohibition established by the 1993 Chemical Weapons Convention (CWC) has been violated by Russia and Syria, both states-parties to the accord.

Russian efforts to compromise independent investigations into its own chemical weapons use and that of Syria will be a key issue when CWC states-parties gather for the treaty’s fourth review conference in November. Russia has denounced an agreement to strengthen the OPCW’s ability to investigate and attribute blame for chemical weapons use, and Western governments say Moscow has sought to interfere with the work of the OPCW.

The Dutch Defense Ministry announced on Oct. 4 that, in April, it had disrupted an attempted Russian cyberattack on the chemical weapons watchdog agency. Dutch authorities stated that four agents from Russia’s GRU military intelligence agency were spotted in a car filled with electronic equipment “installed for the purpose of infiltrating the OPCW’s network” parked adjacent to OPCW headquarters in The Hague. The Russian agents were detained and then expelled.

“Our exposure of this Russian operation is intended as an unambiguous message that the Russian Federation must refrain from such actions,” said Dutch Defense Minister Ank Bijleveld on Oct. 10.

At the time of the attempted breach, the OPCW was investigating a chemical weapons attack against former Russian spy Sergei Skripal and his daughter in Salisbury, United Kingdom, which the United Kingdom and other countries have accused Moscow of carrying out with use of the Russian nerve agent Novichok. (See ACT, April 2018.)

The UK seconded Dutch allegations of Russian efforts to hack into the OPCW and published additional accusations of attempted GRU cyberattacks to disrupt investigations of chemical weapons use.

The UK National Security Centre in an Oct. 4 statement identified a number of pseudonyms that GRU personnel used in cyberattacks around the world. Additional attempted Russian attacks included a so-called spear-phishing attack in March aimed at compromising UK Foreign and Commonwealth Offices and a similar May effort in which GRU agents impersonated Swiss federal authorities to target OPCW officials. Spear phishing refers to using deceptive emails that seem to be from a known or trusted sender in order to gain access to a computer or network.

“The GRU’s actions are reckless and indiscriminate,” UK Foreign Secretary Jeremy Hunt said Oct. 4. “This pattern of behavior demonstrates their desire to operate without regard to international law or established norms and to do so with a feeling of impunity and without consequences.”

Russia rejected the allegations, continuing a pattern of denial of chemical weapons use or possession.

“We are watching with regret how the U.S. authorities continue to poison the atmosphere of Russian-American relations by bringing ever new groundless accusations against Russia, which certain other NATO countries would hurry to repeat at the command from Washington,” Russian Deputy Foreign Minister Sergey Ryabkov wrote on Oct. 4. “Russia is used to these U.S. methods but the purposeful fomenting of tensions in relations between nuclear powers and internationally is a dangerous path.”

The Europeans and the United States hastened to punish Russia for its alleged cybercrimes and chemical weapons use. On Oct. 4, a federal grand jury in Pennsylvania charged seven GRU agents with planning cyberattacks against various entities including the OPCW and the Spiez Swiss Chemical Laboratory, an OPCW-affiliated laboratory, which was analyzing Novichok agent, as well as U.S. and international anti-doping agencies and sports federations.

On Oct. 15, a meeting of EU foreign ministers in Luxembourg adopted a new regime of restrictive measures against those who use or develop chemical weapons or those who assist to do so, regardless of nationality. The sanctions include a travel ban to the EU and an asset freeze, according to an Oct. 15 press release.

No individuals have been sanctioned under the new mechanism, although the two GRU individuals identified by the UK as responsible for the UK poisonings in Salisbury and nearby Amesbury will likely be considered.

Members of the OPCW Executive Council, who met shortly after the announcement about the attempted Russian hack into the chemical weapons watchdog, and all CWC states-parties, who are scheduled to meet at the Nov. 21–30 CWC review conference, face pressure to find measures to counter the erosion of the norm against chemical weapons use and attempted Russian meddling into international investigations.

At the Oct. 9–12 OPCW Executive Council meeting, Canada, the Netherlands, and the United States proposed adding Novichok to the list of chemicals specifically prohibited by name by the CWC.

Several states also expressed support for OPCW Director-General Fernando Arias to create a new OPCW attribution mechanism approved at the June special session of CWC states-parties, which would investigate and assign blame for chemical weapons attacks. (See ACT, July/August 2018.)

Russia, in a statement by the foreign ministry, denounced the decision to provide the OPCW with the attribution authority, calling it the result of “political manipulations, direct bribery of a number of delegations, and blatant blackmail.” The June 28 statement said the action was outside the limited authority established by the CWC and “jeopardizes the integrity of the CWC.”

The previous attribution mechanism for chemical weapons attacks in Syria, the OPCW-UN Joint Investigative Mechanism, was forced to shut down after Russia vetoed its continued operation at the UN Security Council. (See ACT, December 2017.) Subsequent attempts at the UN Security Council to restart attribution investigations were also blocked by Russia.

“The upcoming review conference provides an opportunity to reflect on the last five years of the work of this organization and set direction for the next five years,” Peter Wilson, UK ambassador to the Netherlands, said at the OPCW Executive Council meeting. “We must face up to the reality that our hard-won gains against the scourge of chemical weapons are being challenged like never before. We must stand together against chemical weapons use, and we must ensure that the OPCW and our new director-general have the tools they need to face the next five years.”