Comment by DyslexicAtheist | Hacker News Reader

Comment by DyslexicAtheist | Hacker News Reader

DyslexicAtheist

I posted this because of the cyber/Tech angle in some tweets:

> Ukraine’s vice PM & minister for digital transformation says an “IT army” formed & now it’s recruiting IT specialists from other countries. ‘We translated tasks in English. Task # 1: use any vectors of cyber and DDoS attacks on sites and systems of Russian govt, biz, banks.’ -- https://twitter.com/ChristopherJM/status/1497813622793379842

> Zelensky announced the formation of a new unit - the International Legion of Territorial Defense of Ukraine. It will be made up of foreigners who want to take part in repelling Russian aggression. -- https://twitter.com/ragipsoylu/status/1497826690822594562

While I can't picture myself taking up (cyber) arms against a foreign nation, aren't EU / US law quite explicit about the legality of meddling as a civilian? Or does it mean registering with the UA office will make it legal?. There are plenty on the fringes in the West who don't have a job or are totally disillusioned by their prospects for a good future.

The idea that attacking Russian assets (banks, companies) from your home in say UK, France or US and with impunity could be tempting. I think calling for a "foreign cyber army" may set a dangerous precedent to vigilante hacktivism and lead to escalation. It could also get messy if not coordinated with ongoing activities. No idea how the law works in this case? Even if I would lot of the cyber is uncharted territory.

I do hope it works out for them and they can recruit some top cyber brass this way.

Not directly related to the call for an international IT army, but one thing I can’t wrap my head around with Ukraine’s call for hackers is how can they coordinate anything? Presumably Russian state aligned hackers are out there, pretending to be white hats available to help, “oh yea, let us help setup your firewall.”

What’s the game plan? To clarify, not saying it’s a bad idea, just that I don’t understand how it is supposed to work

One thing about inviting the whole world to help is that they massively outnumber the target (and make no mistake, the whole world is responding). The west has enough hacking and DDOS capability to take out all of the Russian targets. At this scale, and with this much redundancy, coordination becomes unnecessary - it's more of a contest about who does most damage.

As for the those who travel it would be very different and perhaps more clear cut. For the cyber, what they could do is provide a rough guide about where to focus their energy on, how to pick targets, some opsec lessons, some legal disclaimers.

I doubt they will give them a detailed list of targets and say hit Sberbank & Rosneft please, but more of a guide to fighters to assess their own capabilities and risks. Then based on that self-assessment which targets to self-identify and select, and also where to report to on a regular basis. I doubt it would be a collaborative environment where people who've never met share communication with other operatives. But it might become one if the war drags on (it probably does and in any case there is strong incentive to keep building on this afterwards)

This is just speculation. In reality they might all be thrown into a couple of telegram channels and hope for the best. In fact maybe this could also be a great idea, because if you compartmentalize 1000 people with potential 20 Russian-friendly lurkers into 5-person chat channels you might get some sabotage but the benefits of team-work might outweigh the sabotage. Also your chances of people staying on because they're part of a team is bigger.

These kinds of laws are applied selectively in terms of attention, populism, etc..

My bet, is that if nobody is really aware that you're messing with the Russian Postal Service during 'this time' there isn't really going to be a concern.

The UK Government, I believe, just this morning indicated that they would support people who wanted to go and fight.

People have fought with the Kurds from various countries, though their actions were on foreign soil.

My hunch is that this is political. If you're doing it for ISIS, and authorities become aware, you're somehow going to be in trouble. They will find a law that you are breaking.

If you are fighting against Russian in a moment of crisis, and not completely publicly flaunting some very obvious law, then maybe the authorities won't care.

In the US however, it's tricky, because if someone, somewhere doesn't like what you're up to, they can put the DA on someone and find a way to book them for '100 years in jail' (i.e. Aaron Swartz).

Telegram channel: https://t.me/itarmyofukraine2022

please don't use telegram especially now that Russia is at war with the West it's terrible opsec. It's cryptographc snake-oil and the Tech is literally controlled by Russians. There is also a reason all the IS fighters organizing themselves there got pwned ;)

Agreed to cryptographic snake oil, but in regard to Russian-controlled would encourage to read on the biography of https://en.m.wikipedia.org/wiki/Pavel_Durov and him opposing Putin and how Telegram has tried to just outrun any state control.

In that sense, I believe Telegram is much more independent than fully undermined FB/Whatsapp... but for what does it matter? Any public group will have leakers And can potentially be undermined by any big enough actor... either you are in a small fully trusted and encrypted circle, or you are in a big and always public group with potentially enemy actors?

I have nothing against Pavel Durov, but in a situation where it's likely that they can't make Pavel what they want, they absolutely will lean on his family. I'm not throwing a dice no matter what I think of him personally. Everyone cracks so unless he doesn't have a single person in RU (or even abroad) that he cares about I'm skeptic.

Telegram is used because it's popular and everyone else uses it I get that. In case this is crucial somehow and this reason prevents me from using Signal, Wire, etc I'd still use WhatsApp/FB over TG in time like this. I'd rather chose the platform from a place that has a history of being an adversary of (in this case) RU.

> either you are in a small fully trusted and encrypted circle

Good advise to never say anything even with a fully trusted circle, because it's not only who gets your phone but who gets your recipients phone. Also peoples allegiances change. Today's friends will 100% flip on you tomorrow.

Maybe this old linked piece of excellent advise is relevant? ...: https://news.ycombinator.com/item?id=8950875

The Ukrainian govt is officially using it.

Spreading FUD in this time does no one any good.

just because X is using it doesn't mean it's good opsec. But hey, I'm not the boss of you!

Telegram is not end to end encrypted and requires you to use a phone number for ID. The only worse IM app I can think of is iMessage.

Commenters don't seem to understand, but it is the actual telegram channel created by Ukrainian forces to coordinate actions.

Ukraine foreign minister, invited minutes ago on BBC, all interested to contact the Ukrainian embassy in their respective Country.

>While I can't picture myself taking up (cyber) arms against a foreign nation, aren't EU / US law quite explicit about the legality of meddling as a civilian?

To actually take a shot at your question, for the US at least in general it appears to be perfectly legal purely as a matter of current US law for a private citizen to go and fight for another country, so long as it's not against the US. I could have sworn this had come up fairly recently in the midst of all the middle east battles and indeed Foreign Policy had a whole article devoted to it in 2011: "Is It Legal for Americans to Fight in Another Country’s Army?" [0]. Caveats don't seem to apply here, obviously the UA is not an American "designated terrorist organization", Russia is not an ally (to put it mildly), etc. So just in terms of "could an American go volunteer for this?" answer seems to be yes.

Of course in practice it's a lot more complicated. Being legal to go fight in another army has nothing to do with actually getting there, what you can bring, and coverage for your actions. Unless you have a direct private US<>Ukraine flight or boat, have to check on transit laws for all the countries one is going through. Laws about transport of weapons or equipment (ITAR) still apply, though things you bring purely for your own use may be allowed but it's not clear at a glance. Bringing extras would definitely require licensing. Regulations for commercial air/sea travel, customs and so on still apply. If an officially sanctioned uniformed part of the UA volunteers should be protected by the GC and POW treaties and so on same as any other soldier, but of course Russia's adherence to that isn't a given, and they won't actually have the US military backing them directly like a US soldier would. Any crimes committed could be prosecuted, and there are requirements for GC coverage (like being in uniform, chain of command) that over enthusiastic volunteers might ignore at their peril. Russia could well be expected to flat out invent supposed crimes they "saw" volunteers committing and that wouldn't be trivial to avoid if captured. And much more.

It's a heroic cause and if somebody or some group was serious about navigating all that and accepting the risk even beyond that to their lives I'd honor them for it, and if all went well and they made it home there doesn't appear to be any legal risk back here so there is that. But it'd be an even more serious business than going to fight as part of the regular US forces.

----

0: https://foreignpolicy.com/2011/09/02/is-it-legal-for-america...

Reply on news.ycombinator.com