Britain has warned Russia it could face new sanctions after accusing the Kremlin of attempting to hack the international body investigating the Salisbury nerve agent attack.
Dutch authorities disclosed on Thursday how – with the help of UK intelligence – they thwarted an attempted cyber attack on the headquarters of the Organisation for the Prohibition of Chemical Weapons (OPCW) in The Hague.
The incident – just weeks after the attempted poisoning of ex-Russian spy Sergei Skripal – led to the expulsion from the Netherlands of a four-man team from Russia’s GRU military intelligence service.
In a joint statement, Theresa May and Dutch prime minister Mark Rutte condemned the “unacceptable cyber activities” of the GRU and vowed to work to uphold the “rules-based international system”.
The Russian foreign ministry dismissed the allegations as “big fantasies” and part of the West’s “spy mania”.
However in Washington, the US Department of Justice said it had indicted seven suspected GRU officers for “malicious cyber activities” against the US and its allies – including some of those named in connection with the OPCW attack.
Assistant attorney general John Demers said three of those charged had already been indicted by special prosecutor Robert Mueller’s investigation into Russian interference in the 2016 presidential election.
Details of the attempted attack on the OPCW were revealed at an extraordinary joint news conference at the Dutch Ministry of Defence with the British ambassador Peter Wilson.
He said that in the days and weeks which followed the Salisbury attack in March, a group of GRU hackers in Russia known as “Sandworm” had targeted both the Foreign Office and the Defence and Science Technology Laboratory at Porton Down which was investigating the incident.
They were also said to have sent “spear phishing” emails to the headquarters of the OPCW – which was helping the UK authorities to identify the deadly nerve agent used in the attack – in an attempt to compromise its computers.
When that failed, a GRU “close access” team was sent from Russia to the Netherlands to try to penetrate their cyber defences from close quarters.
On April 13, the Dutch security service seized a hired car containing sophisticated hacking equipment the GRU men were using near the OPCW building.
While the Russians were escorted out of the country, investigators uncovered evidence that they had been preparing to travel on to Switzerland to target the OPCW’s laboratory in Spiez.
They also found details of other operations some of the men had been involved in – including the hacking of the Malaysian investigation into the downing of flight MH17 over Ukraine and the World Anti Doping Agency (Wada) in Switzerland.
Foreign Secretary Jeremy Hunt said the disclosures were “hard evidence” of the activities of the “unacceptable” activities of the GRU which Britain has previously blamed for the Salisbury attack.
He said the Government would now be entering into discussions with allies on what new sanctions could be imposed against the Kremlin.
“The Russian government needs to know that if they flout international law in this way, there will be consequences, they will be exposed, and people will see the Russian government for what they are,” he said.
The Dutch authorities – who released CCTV images of the four men arriving at Schiphol Airport – said they had all been travelling on official Russian diplomatic passports.
They were named in them as Alekski Morenets and Evgenii Serebriakov, described as a cyber operators, and Oleg Soktnikov and Alexey Minin, who were said to have provided “humint (human intelligence) support”.
Defence minister Ank Bijleveld said: “The cyber operation targeting the OPCW is unacceptable. Our exposure of this Russian operation is intended as an unambiguous message that the Russian Federation must refrain from such actions.”
Nato secretary general Jens Stoltenberg said the alliance stood “in solidarity” with the decision by the Dutch and British governments to “call out” Russia for its actions.
“Russia must stop its reckless pattern of behaviour, including the use of force against its neighbours, attempted interference in election processes, and widespread disinformation campaigns,” he said.