Emergency alerts hacking 'designed to undermine trust in government', expert says

This is apropos. Both Ukraine and Russia say their emergency alert apps were hacked overnight, sending false warnings to citizens about impending air raids, chemical and nuclear attacks. In Kyiv, many residents simply ignored the alerts, assuming the government-run app had been compromised. Offaly Jacobson has the details. These were the false warnings Ukrainians received on a popular air raid alert app Sunday night. Warnings of nuclear and chemical threats and street fighting. Ukraine's air force says the platform appeared to have been targeted by enemy interference. People in Kyiv say the incident exposed cracks in their country's digital infrastructure. Everything happened instantly. I was surprised, then I figured out what had happened. Overall, it's a problem. On one hand, you can laugh about it, but on the other hand, they gained a certain level of access and were able to hack the program. An official says the cyber attack wasn't as successful as the perpetrators perhaps had hoped. With great probability... Most likely there, the Russians, the Russian cyber aggressors, did not achieve the intended effect because they believed they wanted to trigger a wave of panic. But as we can see, they failed. But as we can see, they didn't succeed. Russia claims it was also subject to a cyber attack overnight. Officials say hackers sent fake emergency alerts through the mobile app for Russia's emergency ministry. Kremlin spokesperson Dmitry Peskov says this is nothing new. All digital resources of our agencies are under the constant threat of cyber attacks. It's unclear if the two incidents are connected. Both countries are advising residents to follow official sources for updates on any incoming threats. Well, for more, we're joined now by Dr. Melmie Garson, Associate Professor in International Security at University College London. Thanks so much, Dr. Garson, for being with us on the programme tonight. So according to Moscow, on one hand, we're hearing that hacking group HITCOR has claimed responsibility for the breach of the Ukrainian emergency alert system, but the military and the Air Force in Ukraine are blaming Russia. What actually happened here? What do we know? And are these two incidents inevitably linked? At the moment, good evening. And we know that it is a Russian or it has been attributed to Russia by Ukraine. And this evening, President Zelensky was on PBS and said as much and said that Ukraine had responded in turn. It is difficult. There's no definite attribution as to who it is. That provided the attacks and whether they are state linked or state associated hacktivist groups. But what we do know that after the initial attack on Ukraine, there was a link to a telegram channel that suddenly got 15,000 followers that started pumping out anti-Ukraine propaganda. And at the same time, after the Ukraine attack, a similar telegram channel emerged. And even though we don't know who is responsible, as you say, is there any way of knowing or? Guessing, perhaps, what's likely to have motivated this kind of incident. You know, previous hacking incidents or cyber attacks, they're put down to the work of activists or even intelligence agencies. Is that what you might speculate was happening here behind the scenes? It can be, and depending on where the source of the attack is, but cyber attacks have featured heavily within the Russian-Ukraine conflict since the very beginning of the war. Already dating back to 2015, when there's been constant sort of development of cyberattacks from Russia against Ukraine. So this is not a new phenomenon. I think what is interesting about this particular set of attacks, it's on. Almost a system that people might consider to be sacrosanct, a little bit of a red line, which is why we saw a response so quickly, which suggests this was a somewhat government-associated response. From Ukraine, although this attacking of alert apps we have seen before, it was seen very early after the Hamas invasion of Israel, where their red alert app became compromised. And bearing in mind, sort of on February 28th, 2026, at the beginning where the US strikes on Iran, there was also a situation where the prayer app was attacked. So this attacking of apps, particularly government apps, is not entirely new, but I think it's designed to really undermine faith in the government's ability to provide trust. And there is an element of undermining that level of trust and security. And the Ukrainian hack? Back in Ukraine, it doesn't seem to have caused any panic, really, in either Ukraine, nor as far as we can tell in Russia. But do these kind of false alerts, in your view, Melanie, do they kind of contribute to alert fatigue overall? Is there a risk that people stop listening to these alerts and they're not really sure at a certain point what might be a genuine alert and what might just be some fake or false disinformation? It's a huge risk. The people in Ukraine, because they've been subject to this for months and years, have a higher resilience and the wording of the alerts to some extent were very unprofessional. They're sort of the equivalent of high nuclear weapons coming your way. So they didn't appear to have that formalized government language. So they're designed to threaten and create fear. Rather than have that direct warning that the people would be used to, that the people are used to reading the alerts, they have a sense of what the wording, the timbre and the tone is, and they have slightly better critical skills than perhaps we might have outside of this conflict, for identifying this information. Nonetheless, there are seeds of doubt. And it always runs the risk that people, as you say, get alert fatigue or sort of think this is non-operational, so I'm not going to listen to it. Fortunately, there are other signals, so not entirely reliant on it, but it does undermine the credibility of these systems and the government's ability to protect their people. And we're seeing it, you know, almost on a near daily basis, more cyber attacks, more hacking incidents. We saw fridges again targeted. Up to nine European countries today, these systems and these hackers, these activists or whoever is behind these cyber attacks, they're becoming increasingly sophisticated. So what do authorities need to do all about this? People might have thought, for instance, when it comes to the fridges, that maybe perhaps other supermarkets in other countries might have put better protections in place since the alert here in France a month ago. What's actually happening and what needs to happen to better protect? Absolutely. And, you know, this wave and the fridge attacks are interesting because they don't seem to come with a ransom demand. They're not the sort of usual kind of criminal cyber activity like we've seen on retail chains. It seems to be clearly sabotage that to put supply chains. At risk and absolutely countries and governments need to be looking at their cyber resilience plans, looking at where there are vulnerabilities within the technology that's supplying within this critical infrastructure and really assessing where, you know, first of all, what are the alternatives? As you've said, France should have been a flag to really... bring this sector into focus and look at where these vulnerabilities are. But increasingly, this type of sabotage of a way of expressing discontent of the way, particularly as Europe seeks a bigger role at the table within the Russia-Ukraine negotiations, is something that they have to be prepared for. And when it comes to the wartime situation in Ukraine, you say this is, You know, nothing new that these kind of attacks have been happening in Ukraine more or less since the start of the war. But do additional kind of verification mechanisms need to be put in place? Or is the priority really here for governments to just put out these alerts when when and immediately when they happen? Or do they really start need to be looking more into the accuracy? Not to say that the government was responsible for this, but when it comes to the whole system of putting these alerts out into the public. Um, it's... It's a difficult one because within, and certainly within Ukraine, and within understanding how Russia has used cyber and cyber attacks in information operations, within their whole strategy, it's a very layered strategy. And at times, it's to create that level of confusion, sometimes to add on to their kinetic attacks. So they view it very holistically. And, yes, the government will have multiple systems of people that are sadly very used to, as are in conflict zones, understanding the layering of these results, understanding the warnings. They will be accompanied by sirens and other mechanisms, and they are usually more than one of these apps. A key vulnerability was discovered. It will be closed. And Ukraine, because they have. I've been at war for the last four years. They're very adaptable in trying to reboot their systems, finding new approaches. We've seen this on the battlefield and they're very good at, sadly, at having to adapt and respond. And what kind of technological or organisational weaknesses does all of this expose when it comes to cyber attacks, when it comes to hacking, when it comes to these false alerts that are put out by government apps? It's, I think the biggest element we've, you know, the maxim in the cybersecurity community is generally, it's not if, it's when. There are huge amounts of vulnerabilities. Again, often things are being developed very quickly. And it's, you know, there's multiple entry points. These cyber criminals, cyber hacktivists, they're hugely creative, they're experts, they're trying this. The whole time, and it only needs a little bit of a vulnerability to get that entity to wreak havoc. However, what came out of Ukraine and the response from the ministers of Ukraine, as you said, was this particular alert wasn't as successful as they'd hoped. It was identified quite quickly. It was contained quite quickly. The government were able. To respond quite quickly to what's needed within these mechanisms for countries to take away is that ability to be able to identify, contain and respond very quickly and to have that messaging or alternate messaging between the government and the people so they have clarity on what's happening. Because it did seem in this particular case, you know, there were spelling mistakes, there were grammatical errors in these messages that were sent out to Ukrainians. But if that hadn't been the case and if people there weren't kind of taking this as a joke, it could have led to some potentially serious consequences for people there. So do, you know, the government's communication strategies in general need to be improved to, you know, minimize against this kind of potential confusion or potential chaos that could ensue? Absolutely. And people are well aware and they're sort of the conventional sort of maxes, don't click on links, don't follow, don't sort of try and sort of contain things so it doesn't ripple through the system. And you're right, in this case, for many people it was quite obvious it was hyperbolic. It was more of a nuisance than an actual. But at the same time, and this is where the cognitive domain comes in as part of this overall strategy, people are tired, people are exhausted. It provides another layer of just weariness and exhaustion within the mind that puts people on the back foot. But it's a constant strategy within the government of securing the communications, checking those themselves constantly. So having that. Cyber teams making sure that what is most critical is constantly secured. But again, that education process, which the people have, they clearly just to make sure that they're aware and bolstering their critical skills and sort of being heightened to these types of attacks. Because they're coming from every direction. We'll have to leave it there for now. Thank you so much for being with us. That's Dr. Melanie Garson from University College London.