2016: The Year the Veils Over State Offensive Cyber Operations Were Lifted (By François Delerue, CEIS)

The development of information and communication technologies and the creation of the Internet in particular represent a formidable progress for humanity. This technological evolution is bringing about new prospects in terms of education and circulation of knowledge, communication, and human and economic development. However, certain players have quickly identified the potential of the Internet and information technology networks in pursuing and undertaking malicious and belligerent activities.

Thus it is common knowledge that many states build digital arsenals. The official objective is to develop the capabilities required to defend their information technology networks. Yet, most of the time, a second and less honourable objective is hidden behind this security imperative: the development of offensive capabilities to carry out operations against individuals and groups, but also other states. For around a decade, these clandestine confrontations have even given rise to a veritable information technology war in which many states accuse one another or are accused of directly or indirectly carrying out large-scale cyber operations. This was the case, for example, of the DDoS attacks against Estonia, Lithuania and Georgia and even of the Stuxnet virus. Discovered in 2010, the Stuxnet virus, which targeted the Iranian nuclear programme and led to the destruction of several centrifuges at the Natanz facility, is believed having been designed by the United States National Security Agency (NSA) in collaboration with the Israel Defense Forces. Another milestone was the Snowden revelations, in 2013, which brought to light certain digital surveillance capabilities that the American government probably would have preferred to keep secret.

The year 2016 marked a historic watershed in this regard: the secret digital activities of two of the main military and digital powers in the world were brought out publically. These revelations were unprecedented: they not only involved the usual allegations of state responsibility for one operation or another, but also actually lifted a corner of the veil over the organisation and operation of the digital capabilities of some states.

On the one hand, in the middle of summer 2016, hackers calling themselves the Shadow Brokers chose to announce that they had stolen several cyberweapons belonging to the Equation Group and publish evidence of the link between the Equation Group and the NSA.[1] With these revelations, the pieces of a bigger puzzle, notably involving the Edward Snowden revelations, came together. They enabled the company Kaspersky to retrace the digital activities of the Equation Group and bring them to light. On the other hand, the hacking and online publication by WikiLeaks of documents from the United States Democratic Party marked the beginning of a series of events that eventually brought the cyber activities of the Federal Security Service of the Russian Federation (FSB) and the Main Intelligence Agency (GRU), two Russian intelligence services, out into the open.

These two events warrant two comments. First, it is interesting to note that these revelations and the spotlighting of the activities of the two groups occurred in a very short period of time. Thus the two major military and digital powers that are the United States and Russia, which for several years have advocated adopting measures to curtail aggressive digital behaviour, were caught red-handed at the same time. This situation may ultimately lead to a diplomatic and international draw for these two nations. The second comment concerns the instigators of these revelations. On the one hand, there was the Russian company Kaspersky, which did most of the work of analysing the tools of the Equation Group and revealed the extent of American activities. On the other hand, American cybersecurity companies, particularly Crowdstrike, lifted the veil over the activities of the Russian intelligence services. The key role played by Kaspersky and Crowdstrike in these revelations also shows the importance of the private sector. This role shall be revisited later.

Some 27 years after the fall of the Berlin Wall, the fall of the USSR and the end of the Cold War, the revelations on the cyber activities conducted on behalf of the United States and Russia through various groups bore an uncanny resemblance to the secret activities conducted by the two blocs through proxy groups. What is to be learned from these revelations? What are their consequences on an international level?

The Equation Group: the digital toolbox of the NSA

On 13 August 2016, hackers calling themselves the Shadow Brokers announced on their Twitter accounts that they had posted on Pastebin a great deal of data belonging to the Equation Group, a group of individuals supposedly working on behalf of the NSA.[2] These revelations were accompanied by the auction of certain files stolen from the Equation Group. Two sets of two documents in two different PGP-encrypted files were available on the Pastebin account of the Shadow Brokers. A first file named <eqgrp-free-file.tar.xz.gpg> whose encryption key was disclosed on the Pastebin page itself served to prove the authenticity of the files offered by the Shadow Brokers. The second file <eqgrp_auction_file.tar.xz.asc> was freely available for download, but only the highest bidder in the auction would be sent the decryption key.

The Equation Group from which the cyberweapons auctioned by the Shadow Brokers were stolen had already gained some notoriety in the past. The Russian cybersecurity company Kaspersky had actually already attributed certain cyber operations to this group, naming the Equation Group due to its penchant for using strong encryption protocols. The methods used by the group include a specific method for implementing the RC5 and RC6 encryption algorithms[3] that is more efficient on certain hardware than the usual method and thus boosts stealth. A nearly identical implementation was found in the tools revealed by the Shadow Brokers. This attested to the authenticity of the tools posted.

The Kaspersky revelations on the Equation Group date back to February 2015 and the publication of the document Equation Group: Questions and Answers.[4] The Kaspersky teams examined 500 cyber operations conducted by the Equation Group in 42 different states. They stated that there could have been as many as several tens of thousands of infections given the self-destruct protocol used, which made them difficult to search for and identify.

This analysis brought to light the different malware families used by the Equation Group. Kaspersky also identified a link between different types of malware from the Equation Group and other known types of malware, including Stuxnet. It showed, among other things, strong links between its tools and Stuxnet (methods and exploits used) and indicated that in all likelihood the Equation Group and the developers of Stuxnet were the same or at least worked in close collaboration.

After the discovery of the leak, the NSA would have activated its own sensors to detect the use of these tools by third parties, particularly Chinese and Russian agencies. Moreover, The Intercept took the opportunity to publish never-before-released documents supplied by Edward Snowden describing one of the tools and explaining to operators how to trace its use with the help of a 16-character string,[5] thus illustrating the use of sensors. This initiative would have allowed the NSA to identify the foreign services that had obtained the stolen tools one way or another, but it seems that this was not the case.

The revelations of the Shadow Brokers and the auction of the tools in August 2016 were part of the work of Kaspersky and did not constitute hitherto unpublished revelations since they essentially reproduced those already made in 2015. While not never-before-released, they nonetheless incited Kaspersky to gradually put together the pieces of the puzzle. This led to the discovery of the American digital arsenal.

Today, neither the American government nor the NSA[6] has acknowledged its link to the Equation Group. However, the different revelations and analyses have left little room for doubt. Thus it is very likely that the people hiding behind the Equation Group are working on behalf of the NSA.[7] While these links now appear indisputable, future revelations and analyses will have to identify their legal and organisational reality and, more broadly, the nature of the Equation Group. Does it consist of isolated hackers or an organised group working indirectly for the NSA, or even a division of the NSA? What degree of control do the NSA and the American government exert over its activities? As long as these questions go unanswered, it will remain impossible to legally attribute the behaviour of the Equation Group to the United States and render it liable, or even adopt countermeasures under international law in response.

Another question to be posed concerning the revelations of the Shadow Brokers on the actions of the NSA and the Equation Group: who is hiding behind the Shadow Brokers group? In a series of tweets published just after the August 2016 revelations, Edward Snowden suggested that Russia was involved in these revelations.[8] Reuters put forward a similar analysis.[9] Some wanted to see the hand of the Russian Federation behind these revelations intended to undermine the American image and spotlight its aggressive behaviour in the digital world. Some went so far as to suggest that these revelations were linked to the hackings of the Democratic Party and concurrent revelations, which had occurred a month before.[10]

Fancy Bear and Cozy Bear: the digital armed divisions of the Russian intelligence services

On 22 July 2016, 19,252 emails and 8,034 attachments stolen from the Democratic National Committee (DNC), the governing body of the United States Democratic Party, were published on the WikiLeaks website.[11] This document leak occurred during the 2016 presidential election primaries. Thus it disrupted the internal voting process and led certain party executives to resign. The Democratic Party was already aware of the hacking and the fact that some documents had been stolen a few months before they were published on WikiLeaks. It then turned to the American cybersecurity company Crowdstrike to investigate this hacking.[12] In June 2016, Crowdstrike published its conclusions: the hacking was the work of two different groups called Cozy Bear and Fancy Bear (these groups shall be revisited later), which acted separately yet simultaneously in the information technology networks of the Democratic Party.[13] Moreover, these two groups did not limit themselves to the hacking of the Democratic Party, since they also targeted the Republican Party (though to a lesser extent) and other institutions and think tanks, always in the context of the American elections.[14]

On 7 October 2016, the Department of Homeland Security and the Office of the Director of National Intelligence published a joint report affirming that they were convinced that the government of the Russian Federation was responsible for various hackings and the online publication of the documents of the Democratic Party.[15] On 10 October 2016, the White House announced that the American government was going to adopt a proprotionate response to the Russian hackings. The response of the American government took two different forms. First, it adopted new sanctions against Russia and certain individuals.[16] Moreover, on 29 December 2016, the President of the United States announced his decision to expel 35 Russian diplomats from the United States in response to the hackings and attempts at interfering with the American electoral process.[17] These diplomats left United States territory on 1 January 2017.[18] Second, it would seem that the United States used extrajudicial measures, including cyber operations against Russian interests, although to date it has not officially acknowledged them. In late October 2016, Ukrainian hackers calling themselves Cyber Hunta hacked email accounts associated with Vladislav Surkov, a close advisor to the Russian President, and published certain emails and documents online. These emails and documents featured proof of Russian involvement in the separatist movements in eastern Ukraine.[19] Some commentators see this as the American response to the hacking of the Democratic Party. For the time being, the United States has not confirmed this hypothesis.

Now that the events that led to the revelations concerning Fancy Bear and Cozy Bear have been briefly described, the identity of these two groups shall be revisited. Crowdstrike concluded that there were two groups that had already been identified in previous hackings whose targets included American institutions, universities, think tanks and NGOs. They were believed to be linked to the Russian intelligence services.[20] In a joint report, the Federal Bureau of Investigation and the Department of Homeland Security identified and analysed the modus operandi of these two groups for the different hackings that beset the 2016 American presidential election. This report supplemented the report published on 7 October 2016, in which they had officially attributed these hackings to these two groups, and by extension to the Russian Federation.[21]

Cozy Bear is linked to APT 29. The signature of this group has already been identified by different cybersecurity companies as part of several hackings. In addition to Cozy Bear, this group is also sometimes called CozyCar, the Dukes or CozyDuke. It is a group of hackers that is probably linked to the Federal Security Service of the Russian Federation (FSB [former KGB]). This group is believed to be responsible for hackings that targeted American institutions including the White House, the State Department and the Joint Chiefs of Staff.[22]

Fancy Bear is linked to APT 28, also called Pawn Storm, the Sofacy Group, Sednit or Strontium in the context of other hackings. This group is believed to be linked to the Main Intelligence Directorate of the armed forces of the Russian Federation (GRU). It is considered to be responsible for hackings that targeted the Bundestag (German parliament), TV5Monde, the White House and more recently the Organization for Security and Co-operation in Europe (OSCE).[23]

According to the report published by the Federal Bureau of Investigation and the Department of Homeland Security, these two groups use two different techniques to access their targets’ data. APT 29[24] is known for using spearphishing techniques combining phishing and social-engineering tactics. Through this technique, it spreads URL links to sites hosting malicious scripts that, once executed by the targets, compromise their computers by installing remote access tools (RATs). APT 28 is known for using sites mimicking the appearance of legitimate sites to trap users and obtain their login credentials. Once they have gained access to the target computers, these two groups use a fairly similar modus operandi to extract data and draw useful information from them.

Concerning the hacking of the Democratic Party, APT 29 would have conducted a successful phishing campaign against it starting in summer 2015 and thus would have had access to its information systems since then. APT 28 would have conducted a phishing campaign by email inviting the users targeted to enter their password on a fake website imitating the website of their email service in spring 2016, and would then have gained access to the emails and documents of the Democratic Party.[25] This example illustrates the probable lack of coordination between these two groups, or else a desire to cover their tracks and hide the reality of their cooperation.

Last question: is it possible to know (as for the Equation Group) who is hiding behind Fancy Bear and Cozy Bear? Are they FSB and GRU agents or individuals working independently, alone or within organised groups, and acting under a certain degree of control on the part of these intelligence agencies? This question remains unanswered today. However, it must be answered to allow other states, particularly the United States, to attribute the actions of these groups to the Russian Federation and render it internationally liable.

Consequences of the revelations on the Equation Group, Fancy Bear and Cozy Bear

The United States and the Russian Federation, two of the most important digital and military powers in the 21^st century, have long been believed to be responsible for a large number of offensive operations in cyberspace. However, the 2016 revelations marked a turning point.

First, they offered an unprecedented glimpse of the overall organisation and modus operandi of the cyberattack programmes of the United States and the Russian Federation. They lifted a little bit more of the veil over the extent of the cyber operations that these two countries conduct by putting together the pieces of a giant puzzle demonstrating how these states deliberately, and with complete impunity for the moment, conduct cyber operations targeting other states.

Second, these revelations showed how these two states have today incorporated the digital domain into their military arsenal and extrajudicial measures. They illustrated, among other things, how these two states respond to cyber operations, using a combination of cyber and non-cyber responses, including sanctions and extrajudicial measures.

Third, these revelations were also a signal sent to other states concerning their digital capabilities and the extent of the operations that they carry out. The hacking of the Democratic Party and the attempts at interfering with the American elections, whose actual effects are difficult to assess, were a strong signal sent to other states with regard to the risks concerning their own upcoming elections. Thus some have already expressed their concern regarding the elections of major importance planned for 2017, particularly the French presidential election, the Iranian presidential election and the German legislative elections.[26]

Moreover, this risk particularly resonated in certain countries in Eastern Europe. The DDoS attacks against Estonia in 2007, believed to have been conducted by the Russian Federation, revived certain fears in these countries over the risks of interference on the part of Russia with their home affairs. The year 2016 probably heightened these fears for two reasons: on the one hand, the American example simultaneously serves as a reminder that such a scenario is always possible and reveals the extent of Russian capabilities; on the other hand, the new President of the United States, Donald Trump, has indicated that he would probably not automatically come to the aid of the Baltic states in the event of Russian interference.[27] The recent announcement of the hacking of the OSCE is not going to lower the tension.

Fourth, the spotlighting of the malicious, even belligerent, digital activities of these two nations demonstrated that they are very far from respecting the principles of peaceful use that they put forward at the international level. Indeed, today, the United States and the Russian Federation pride themselves on being states that drive the development of a safe cyberspace used peacefully by states. Thus they have been weakened by these revelations on an international level. Indeed, the situation is similar to the one that followed the Edward Snowden revelations. While they have never been duped, other states now have means of rendering these two states politically liable. This opens up new opportunities for them. The People’s Republic of China, often considered to be an aggressive state at the digital level, has moved into the background. A clear decrease in Chinese cyberattacks against American interests has been observed following the different discussions held by these two countries on this subject.[28] Thus China could play upon this seemingly virtuous behaviour, and the weakening of Russia and the United States, to position itself as a major player in these matters and advance its own agenda. For their part, France and the European states could also exploit the weakening of Russia and the United States to take advantage of that situation and push for their positions in the current negotiations.

Fifth, these revelations allowed certain states to render the states concerned liable in terms of credibility and politics. However, for the time being, they have not allowed them to render the states concerned legally liable, nor have they justified, among other things, sanctions and extrajudicial measures against these states. The next step, which is still very hypothetical, would be the attribution of the cyberattacks concerned backed by irrefutable evidence.

Sixth and finally, these revelations showed the central role played by non-state players acting directly or indirectly as proxies for these states. The revelations were analysed and supported by the work of teams from two private companies: the Russian company Kaspersky for the revelations concerning the NSA and the American company Crowdstrike for the revelations concerning the FSB and the GRU. Moreover, these revelations did not directly expose the activities of the intelligence agencies of these states; they exposed the activities of « groups, » which probably consist of isolated individuals as well as organised groups acting on behalf of these agencies, or even divisions of these agencies. Thus it may be observed how non-state players, isolated individuals or individuals assembled in a group are major players in these states’ strategy of influence in cyberspace. The revelations concerning the Equation Group were made by hackers calling themselves the Shadow Brokers, who are suspected of being linked to the Russian Federation, while the attackers who hacked the emails of an advisor to the Russian President are believed to be linked to the NSA. Consequently, it must be concluded that a genuine confrontation between the United States and Russia, which is simultaneously taking direct and indirect forms, and in which non-state stakeholders are playing a central role, is taking place in cyberspace.

[1] Dan Goodin, « Group claims to hack NSA-tied hackers, posts exploits as proof, » Ars Technica (15 August 2016), online: Ars Technica <http://arstechnica.com/security/2016/08/group-claims-to-hack-nsa-tied-hackers-posts-exploits-as-proof/>.

[2] Andy Greenberg, « Hackers Claim to Auction Data They Stole From NSA-Linked Spies, » WIRED (15 August 2016), online: WIRED <https://www.wired.com/2016/08/hackers-claim-auction-data-stolen-nsa-linked-spies/>; Goodin, supra note 1.

[3] Kaspersky Lab’s Global Research & Analysis Team, « The Equation giveaway » (16 August 2016), online: Securelist <https://securelist.com/blog/incidents/75812/the-equation-giveaway/>.

[4] Kaspersky Lab’s Global Research & Analysis Team, Equation Group: Questions and Answers (Version 1.5), Kaspersky, 2015, online: <https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf>.

[5] Sam Biddle, « The NSA Leak Is Real, Snowden Documents Confirm, » The Intercept (19 August 2016), online: The Intercept <https://theintercept.com/2016/08/19/the-nsa-was-hacked-snowden-documents-confirm/>.

[6] Following the publication of the Kaspersky report in February 2015, the NSA sent a statement to several media outlets indicating: « We are aware of the recently released report. We are not going to comment publicly on any allegations that the report raises, or discuss any details. On January 17, 2014, the President gave a detailed address about our signals intelligence activities, and he also issued Presidential Policy Directive 28 (PPD-28). As we have affirmed publicly many times, we continue to abide by the commitments made in the President’s speech and PPD-28. The U.S. Government calls on our intelligence agencies to protect the United States, its citizens, and its allies from a wide array of serious threats — including terrorist plots from al-Qaeda, ISIL, and others; the proliferation of weapons of mass destruction; foreign aggression against ourselves and our allies; and international criminal organizations. » See in particular: Dan Goodin, « How ‘omnipotent’ hackers tied to NSA hid for 14 years — and were found at last, » Ars Technica (16 February 2015), online: Ars Technica <http://arstechnica.com/security/2015/02/how-omnipotent-hackers-tied-to-the-nsa-hid-for-14-years-and-were-found-at-last/>.

[7] Thomas Fox-Brewster, « Equation = NSA? Researchers Uncloak Huge ‘American Cyber Arsenal,’ » Forbes (16 February 2015), online: Forbes <http://www.forbes.com/sites/thomasbrewster/2015/02/16/nsa-equation-cyber-tool-treasure-chest/>; Joseph Menn, « Russian researchers expose breakthrough U.S. spying program, » Reuters (16 February 2015), online: Reuters <http://www.reuters.com/article/us-usa-cyberspying-idUSKBN0LK1QV20150216>; Biddle, supra note 5.

[8] https://twitter.com/Snowden/status/765513662597623808

[9] James Bamford, « Commentary: Evidence points to another Snowden at the NSA, » Reuters (24 August 2016), online: Reuters <http://www.reuters.com/article/us-intelligence-nsa-commentary-idUSKCN10X01P>.

[10] Russell Brandom, « The Shadow Brokers hack is starting to look like Russia vs. NSA, » The Verge (17 August 2016), online: The Verge <http://www.theverge.com/2016/8/17/12519804/shadow-brokers-russia-nsa-hack-equation-group>.

[11] Karen Tumulty and Tom Hamburger, « WikiLeaks releases thousands of documents about Clinton and internal deliberations, » Washington Post (22 July 2016), online: Washington Post <https://www.washingtonpost.com/news/post-politics/wp/2016/07/22/on-eve-of-democratic-convention-wikileaks-releases-thousands-of-documents-about-clinton-the-campaign-and-internal-deliberations/>.

[12] Ellen Nakashima, « Russian government hackers penetrated DNC, stole opposition research on Trump, » Washington Post (14 June 2016), online: Washington Post <https://www.washingtonpost.com/world/national-security/russian-government-hackers-penetrated-dnc-stole-opposition-research-on-trump/2016/06/14/cf006cb4-316e-11e6-8ff7-7b6c1998b7a0_story.html?utm_term=.0e3db4fef921>.

[13] Dmitri Alperovitch, « Bears in the Midst: Intrusion into the Democratic National Committee  » (15 June 2016), online: Crowdstrike <https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/>.

[14] United States, Department of Homeland Security (DHS) and Federal Bureau of Investigation (FBI), GRIZZLY STEPPE — Russian Malicious Cyber Activity, Joint Analysis Report, DHS and FBI, 2016, online: <https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf>.

[15] United States, DHS and FBI, « Joint Statement from the Department of Homeland Security and Office of the Director of National Intelligence on Election Security » (7 October 2016), online: <https://www.dhs.gov/news/2016/10/07/joint-statement-department-homeland-security-and-office-director-national>; Ellen Nakashima, « U.S. government officially accuses Russia of hacking campaign to interfere with elections, » Washington Post (7 October 2016), online: Washington Post <https://www.washingtonpost.com/world/national-security/us-government-officially-accuses-russia-of-hacking-campaign-to-influence-elections/2016/10/07/4e0b9654-8cbf-11e6-875e-2c1bfe943b66_story.html?utm_term=.83a87b1a2451>.

[16] William M. Arkin, Ken Dilanian and Robert Windrem, « CIA Prepping for Possible Cyber Strike Against Russia, » NBC News (14 October 2016), online: NBC News <http://www.nbcnews.com/news/us-news/cia-prepping-possible-cyber-strike-against-russia-n666636>.

[17] Lauren Gambino, Sabrina Siddiqui and Shaun Walker, « Obama expels 35 Russian diplomats in retaliation for US election hacking, » The Guardian (30 December 2016), online: The Guardian <https://www.theguardian.com/us-news/2016/dec/29/barack-obama-sanctions-russia-election-hack>.

[18] « Expelled Russian diplomats leave United States, » Reuters (1 January 2017), online: Reuters <http://www.reuters.com/article/us-usa-russia-cyber-diplomats-idUSKBN14L17E>.

[19] Andrew Buncombe, « Russia hacked: Putin’s aide has secrets spilled by Ukrainian group, sparking suspicions of proxy cyberwar, » The Independent (28 October 2016), online: The Independent <http://www.independent.co.uk/news/world/europe/vladimir-putins-aide-gets-hacked-sparking-suspicions-of-proxy-cyberwar-ukraine-cyberhunta-a7385306.html>.

[20] Thomas Rid, « All Signs Point to Russia Being Behind the DNC Hack, » Motherboard (24 July 2016), online: Motherboard <http://motherboard.vice.com/read/all-signs-point-to-russia-being-behind-the-dnc-hack>.

[21] United States, DHS and FBI, supra note 15.

[22] Shane Harris, « Obama to Putin: Stop Hacking Me, » The Daily Beast (8 April 2015), online: The Daily Beast <http://www.thedailybeast.com/articles/2015/04/08/obama-to-putin-stop-hacking-me.html>; Evan Perez and Shimon Prokupecz, « State Dept. hack the ‘worst ever,’ » CNN (10 March 2015), online: CNN <http://www.cnn.com/2015/03/10/politics/state-department-hack-worst-ever/index.html>; « US military’s joint staff hacked as officials point the finger at Russia, » The Guardian, Technology sec. (6 August 2015), online: The Guardian <https://www.theguardian.com/technology/2015/aug/06/us-military-joint-chiefs-hacked-officials-blame-russia>.

[23] « OSCE security monitors targeted by hackers, » BBC News, Europe sec. (28 December 2016), online: BBC News <http://www.bbc.com/news/world-europe-38451064>.

[24] APT: advanced persistent threat.

[25] United States, DHS and FBI, supra note 14 on pp. 2-3.

[26] Kate Connolly, « German spy chief says Russian hackers could disrupt elections, » The Guardian, World News sec. (29 November 2016), online: The Guardian <https://www.theguardian.com/world/2016/nov/29/german-spy-chief-russian-hackers-could-disrupt-elections-bruno-kahl-cyber-attacks>; Kaveh Waddell, « Does Russia’s Election Hacking Signal a New Era in Espionage?, » The Atlantic (15 December 2016), online: The Atlantic <https://www.theatlantic.com/technology/archive/2016/12/russias-election-meddling-was-an-intelligence-coup/510743/>; Katie Mansfield, « Europe ready for CYBERWAR over fears Russia will hack Germany, France and Netherlands vote, » Express.co.uk (13 December 2016), online: Express.co.uk <http://www.express.co.uk/news/world/742875/europe-cyberwar-russia-hack-germany-france-netherlands-elections>.

[27] Michel Martin and Lucian Kim, « Baltic States Nervous Over Trump’s Attitude Toward Russia » (13 November 2016), online: NPR <http://www.npr.org/2016/11/13/501935916/baltic-states-nervous-over-trumps-attitude-toward-russia>; Radvile Kasperaviciute, « Why the people of the Baltic states are fearful of a President Trump, » The Guardian, Opinion sec. (15 November 2016), online: The Guardian <https://www.theguardian.com/commentisfree/2016/nov/15/baltic-states-fearful-president-trump-nato-latvia-estonia-lithuania-ukraine>.

[28] David E. Sanger, « Chinese Curb Cyberattacks on U.S. Interests, Report Finds, » The New York Times (20 June 2016), online: The New York Times <http://www.nytimes.com/2016/06/21/us/politics/china-us-cyber-spying.html>.