The message from the Kyiv International Cyber Resilience Forum this week is “everyone get ready and stay ready,” particularly when it comes to securing critical supply chains. The word that was used in abundance was “trust.”
Folks from the cyber resilience community in Europe and beyond gathered for the two-day forum in Kyiv this week to hash out the future of cyber resilience, discuss supply chain trust and make agreements to support new projects joining the fight for secure cyber spaces.
Among the many guests that graced the stage was a surprise appearance from Moxie Marlinspike (aka Matthew Rosenfeld), the American cryptographer and entrepreneur who developed the Signal Protocol and co-founded the Signal messenger.
“It’s possible to build privacy into technology that is also user-friendly, those two things are not incompatible,” Marilinspike told the audience. “In a lot of ways, security benefits from simplicity. Complex systems are usually very brittle, and brittle systems are usually exploitable, and so a lot of times, it’s possible to develop products that are both simple, easy to use and secure.”
He was talking to Oksana Ferchuk, Ukraine’s Deputy Minister of Defence of Ukraine for Digital Development, Digital Transformation, and Digitalisation, who has big plans for how to ramp up Ukraine’s military tech engagement. She responded. “Companies are putting a lot of legislation commitments that they will not breach your personal data, but if it happens, people can lose credibility or money,” she said. “In our case, in defence, people lose lives.”
Later in the conversation, Marlinspike was asked what he thought about rival messenger app Telegram.
He emphasised that Telegram is not an encrypted messaging app and people in Ukraine may be using it at their peril.
“In the context of Ukraine, Telegram is maintained by a team of Russian developers who are still alive and walking around, which seems suspicious,” he said. “It indicates to me that Russia probably has access to every message that everyone has ever sent or received.” These are issues for Russia, too, apparently. Regulators in the country are reportedly restricting usage of the app in Russia over extremist content and the fact that Russia’s adversaries can read private messages that soldiers and others are sending over the app.
Indeed, some of that spying ability has been used to effect by adversaries. Lancelot Systems’ computer vision guidance for drones has been trained on 10 million combat videos scraped from Russian Telegram channels, the company said this week.
“Putin made a fundamental mistake by not securing his Telegram channels better,” said Merlin Hipp, CEO and founder of Lancelot Systems. “We have saved [the data] on European servers and he will never ever get it back.”
People and trust in short supply
Forum attendee Maks Franko, Representative of the separate Cyberforce Centre of the Armed Forces of Ukraine, told Resilience Media that the most critical issue facing the Ukrainian cyber warfare fight was lack of people.
They are fighting a war against an enemy “that has more people, more money and a history of cyber specialists,” he said. Also with Ukraine’s private sector offering more money, benefits and other protections, it’s hard to lure specialists to join the forces, he added.
He also told Resilience Media that the country needs to prioritise in cyber resilience better than it does now.
“When we receive help [from] abroad, including medical equipment for saving lives or generators, these are things you can see and you can touch them,” he said. “People give money to things they can see. Cybersecurity is unseen, but it is very important to receive software solutions to protect the country. It protects critical stuff. That is very hard to explain to people, if they can’t physically see it.”
Franko added that exchanging information remains very important. Having a huge knowledge base of Russian attacks can prove useful to other partners, but there is still an issue with exchange that needs to be solved: trust.
“We see sometimes that our European partners don’t trust us enough,” he said. “They think we have [Russian spies on the] inside. We also have not trusted some of our partners because we don’t know well enough what they can provide us with. But if we do not trust anybody we will not get anywhere, so we must learn to trust,” he told us.
New fund launch
Meanwhile, cybersecurity relations between Ukraine and The Netherlands were strengthened during the forum with the launch of a new fund, the Netherlands Ukraine Cybersecurity Fund, which intends to distribute €2.5 million across ten projects, providing €250,000 to each. “We aim to really boost innovation within the cybersecurity sector of Ukraine and the Netherlands, with both sides bringing unique value,” Jurriën Norder, Head of NCC-NL, told Resilience Media. “In the end it will create new products and services and ventures to the market.”
The fund is a joint project of the Ministry of Foreign Affairs of the Netherlands and the Tallinn Mechanism, in partnership with the National Coordination Center for Cybersecurity of Ukraine. It will be officially announced next week.
AI update
If there was a theme beyond trust, it was (no surprise here) artificial intelligence. AI systems featured prominently throughout both days, especially AI agents and the perennial debate around how much one can depend on them in critical situations.
Commanders now must “deliberately designate which decisions require human judgement and which decisions leverage automation for velocity,” said Lieutenant colonel (ret.) Christopher Ghorbani of Raincloud. “Automated recommendations [must never be allowed to] compress reflection time below the threshold needed to assess consequences.”
Others saw agentic systems as a tool that could augment human decision making when humans are under stress.
“When human beings are under extreme duress and pressure, as they are in Ukraine, they cannot operate at the optimal level of their cognitive abilities,” said Cracken head of business development Jesse Nuese. “AI agents can fill in as digital staff officers.”
Unit Range organised a human vs AI Cyber Defense contest during the event to show off the capabilities of the latter. The human teams consisted of representatives of private cybersecurity companies, university students, and Ukrainian government cybersecurity specialists.
The AI emerged victorious on the first day of the conference; but on day two, team DYTOX (the human team) won.
“When AI took first place on day one, it was demotivating for our participants to understand that AI can be better than people” said Anastasia Loban, product manager at Unit Range, “but my advice is that people need to accept AI, we will be stronger.”
