Russian cyber attacks: What is the GRU?
As the UK exposes a campaign of Russian cyber attacks, the Russian military intelligence service known as the GRU is under the spotlight once again.
The UK’s National Cyber Security Centre has identified the GRU as being the organisation behind a dozen notorious cyber-hacker fronts, including Fancy Bear.
The GRU first came to national attention after the Salisbury nerve agent attack, with suspects Alexander Petrov and Ruslan Boshirov believed to be aliases used by officers in Russian intelligence service the GRU.
Theresa May told MPs the GRU was “highly disciplined”, so the Novichok attack in Salisbury was likely to have been officially sanctioned rather than a “rogue operation”.
What is the GRU?
It is Russia’s military intelligence service. Sergei Skripal, the former spy targeted in the Salisbury attack, was previously a colonel in the GRU.
Emily Ferris, from the Royal United Services Institute defence think tank, said: “The GRU is Russia’s foreign military intelligence agency, one of three of Russia’s intelligence agencies whose activities often overlap, the others are the Federal Security Services (FSB) and the Foreign Intelligence Services (SVR).
“The FSB has a broader remit, including counter-terrorism, border control and domestic surveillance, but all the agencies are in competition for resources and funding.”
Although by the end of the Soviet period the GRU declined in importance and size, she said it “appears to have become increasingly prominent since its officers led Russia’s annexation of Crimea in 2014”.
How does the GRU operate?
The Prime Minister said the GRU had “played a key part in malign Russian activity in recent years”.
The military intelligence service has been blamed or implicated in assassinations, espionage and cyber warfare around the world.
The US authorities believe the Democratic National Committee hack in the 2016 presidential election was the work of GRU agents.
As well as being active in the annexation of Crimea, reports have also linked a GRU officer to the downing of Malaysian Air flight MH17 over Ukraine.
Ms Ferris said: “The GRU is currently engaged in active signals intelligence gathering and espionage activities abroad and has been linked to several high-profile operations.”
Who could have authorised the GRU operation in Salisbury?
The Prime Minister told MPs the GRU had a “well-established chain of command” and the nerve agent attack would have been approved at a “senior level of the Russian state”.
Tory MP Bob Seely, a member of the Commons Foreign Affairs Committee and Russia expert, said Vladimir Putin himself would have given the green light.
“Under a 2006 Russian Federation law, extrajudicial assassinations by agents of the Kremlin need be approved only by the Russian head of state, without reference to others,” he said.
“Therefore, since this appears to be a GRU-planned poisoning, the order can only have come from the Russian head of state.”
Foreign Affairs Committee chairman Tom Tugendhat said: “President Putin bears responsibility for a war-like act.”
What will happen now?
The Prime Minister told MPs the organisation was “a threat to all our allies and to all our citizens” and “we will deploy the full range of tools from across our national security apparatus in order to counter the threat posed by the GRU”.
In the US, a number of GRU-linked individuals, including its chief Igor Korobov, are already subject to sanctions over the agency’s activities.
Mr Seely called for a permanent body to “investigate, understand and expose Russian political warfare”.