Amateur hackers warned against joining Ukraine’s ‘IT army’

Amateur hackers are being warned off joining Ukraine's "IT army" by western officials, amid fears that activists could be breaking the law or launch attacks that spiral out control.

Ukraine's cyber-response to the Russian invasion has been bolstered by hackers organising on the Telegram messaging app under the IT Army of Ukraine banner. More than 300,000 people have signed up to the group, including members from outside Ukraine.

Western officials said they would "strongly discourage" joining the group and taking part in hacking activity against Russia."

"We wouldn't encourage criminality in any way, shape or form," said one official on Thursday. "We would strongly discourage people from looking to get involved in those kinds of activities."

Ukraine's cyber-offensive has had particular success with distributed denial of service (DDoS) attacks, in which websites are rendered unreachable by being bombarded with traffic. Russian government websites including the Kremlin and the Duma have been targeted in this way as well as Russia Today, the state-media owned news service.

Anonymous, a hacking collective, has also claimed credit for DDoS attacks.

Joining Ukrainian cyber-attacks from the US or the UK could break the law in those countries, according to experts, such as the Computer Fraud and Abuse Act in the US and the computer misuse act in the UK.

"Whilst I totally understand the sentiment behind the actions of many in this IT army, two wrongs do not make a right. Not only might it be illegal but it runs the risk of playing into Putin's hands by enabling him to talk about 'attacks from the west'," said Alan Woodward, a professor of cybersecurity at Surrey University.

He added that hacks could have unintended consequences and "it's very easy for cyber-attacks is to spill over into unintended areas"."

Western officials said the Ukrainian government has so far performed well against cyber-attacks during the war. So far Ukraine has been targeted by DDoS attacks and several "wiper" attacks, which destroy computers but have had limited impact in this instance.

They added that the UK and other western allies of Ukraine had not seen an increase in hostile Russian cyber-activity since the invasion began last month. "We are not seeing a heightened threat to the UK or generally to allies. It's fair to say that the level of cyber-activity we see is not significantly up or down," said one official.

The most significant cyber-incident involving a western target during the conflict involved the US telecoms firm Viasat. Unidentified hackers disabled tens of thousands of modems that communicate with Viasat Inc's KA-SAT satellite, which supplies internet to some customers in Europe, including in Ukraine.

"It's certainly something we're investigating quite actively," said an official.