On 28 October 2020, the municipality turned the tide and agreed to NATO-allied nuclear submarines being allowed to dock in Tromsø. Barely three weeks later, port manager Jørn-Even Hanssen received a phone call. – We were contacted by the National Security Authority during the day on 17 November 2020. They could tell us that we were under a major attack. At the time it was referred to as by foreign intelligence. news learns that it must have been the Russian intelligence service that tried to break into the computer systems in the harbor via an e-mail account. The harbor master himself thinks it was a coincidence that the computer attack came just weeks after it became clear that they were to receive allied submarines. But he does not think it was a coincidence that Tromsø harbor was attacked. Port Director at the Port of Tromsø, Jørn-Even Hanssen. Photo: Erlend Koppergård/news – Interest in the harbor has increased significantly. There are several reasons why the port of Tromsø possesses critically important infrastructure, which may be of interest to Russian intelligence to know something about. Tromsø is a major port in the north, with considerable capacity in terms of quay facilities and storage. It is also one of three designated standby ports in Norway. In addition, last year more than 200 Russian fishing vessels called here. – We are Norway’s largest fishing harbor and are important for Russian fishing boats. Tromsø harbor is one of the most Russian-trafficked in Europe, after other countries have closed the Russian vessels out. Photo: Harald Albrigtsen At the same time, the harbor is also widely used by Norwegian and allied military vessels. – We can see that interest in our port has increased significantly over the past two years, especially when the war in Ukraine broke out. There is a large influx of military vessels to Tromsø, says the port director. – Is the port of Tromsø vulnerable? – If our ports were closed, it would affect approximately 10,000 annual calls for goods, fish, transport and defence. I think Tromsø, the region and not least Svalbard would notice it very quickly. The regular submarine calls in Tromsø are not advertised anywhere. – A main goal for Russia will be to prevent Norway from receiving reinforcements if the situation escalates. Ports and infrastructure around ports are obvious targets and a vulnerability that, in this sense, may be worth noting, explains Åse Gilje Østensen at the Norwegian Naval Academy to news. Photo: Erlend Koppergård / news A few will know that a submarine is coming. On average, the plan was that they could welcome six to eight submarines a year. It has proven to hold true, says harbor manager Jørn-Even Hanssen. Only a short time before each submarine arrives, the port of Tromsø is notified. Only a few people will know that allied guests are coming. – If we had announced for a long time in advance that a reactor-powered submarine was coming, it would have been leaving the cards too wide open for the intelligence of foreign countries. So we will take that up in the Chamber with the Armed Forces. You can still have a look at Grøtsund, where the submarines dock. In the Nordic documentary series “The Shadow War”, news, together with the Nordic broadcasters, has revealed how Russian ships such as fishing vessels, cargo ships and yachts carry out intelligence activities in the Nordics, also against allied submarines. news’s mapping of ship traffic shows 50 Russian ships that keep appearing in places where they can spy or gather information, including about critical infrastructure. – We are certainly of foreign intelligence interest. The harbor master believes that the submarine calls have put an extra spotlight on the harbor in Tromsø. – It has to do with the fact that we are the largest port in Northern Norway. As the crow flies, it is not far from Tromsø to the Northern Fleet with its main seat at Kola. – Do you know what those who attacked the computer systems were looking for? – What we believe is that our preparedness systems, vulnerability analyzes with technical descriptions of quay facilities are information they will be interested in. Access to that information makes it easier for them to put us out of business. – Submarine landing? – Yes, definitely. You can be sure that the calls are accompanied by intelligence. Like when the boats come and go, how big they are, how many men and women are on board and get on or off. Or the supplies, says the harbor master. – The intelligence services are experts at taking small pieces and putting them together to create an overall understanding of the situation. The director of the National Security Agency (NSM) says threat actors need information about ports and critical infrastructure. She believes this knowledge has gained increased value. Director Sofie Nystrøm (NSM) explains how information from the National Intelligence Service and the Police’s security service indicates that Russian intelligence takes greater risks to obtain information. Photo: Erlend Koppergård/news – Can be used for operations against Norwegian targets – A port such as Tromsø harbor is important in relation to which vessels enter, which goods and military calls arrive. This is information that could be of importance to a threat actor, which they can use for further planning and operations against Norwegian targets, says Sofie Nystrøm. She confirms that they contacted Tromsø to prevent the attackers from gaining a foothold in servers or network systems in the harbour. Together they managed to stop the attack, and they did not succeed, says Nystrøm. – Is Tromsø more vulnerable because submarines come there regularly? – On a general basis, we see that where there is a military footprint, it will be more important for the threat actors to obtain information. Reception of allied forces is of great strategic importance. Chief of the Intelligence Service. Nils Andreas Stensønes believes that one of the most important changes in Russia’s maritime doctrine is the importance of the northern areas. – It was indicated as an important area until the latest doctrines came out. Now it is considered vital for Russia. Photo: Erlend Koppergård / news Nystrøm points to the computer attacks in Vadsø and Sør-Varanger as other examples, and there are more. Nystrøm describes an increased pressure on the region, after the war in Ukraine. In addition, Russian intelligence is now less concerned with whether they are exposed, she believes. – It may be that you don’t have much time for planning, but go straight to an operation on the ground or in the server domain. One has the will to be exposed, perhaps. The diplomatic aspect may not be so important anymore. The downside is so small. It costs little, both politically and economically. news has asked the Russian embassy whether Russian intelligence is behind the attack on Tromsø harbour, which ambassador Taymuraz Ramishvili denies. He writes that the Norwegian authorities constantly accuse Russia of espionage and hacker attacks, but that this has not been proven. – We have several times proposed to cooperate with the Russian National Coordination Center for Data Incidents. Nevertheless, the Norwegian authorities ignore our proposals, writes the ambassador. This is what we know about Russian military intelligence and cyber operations In autumn 2020, the Storting and a number of other Norwegian businesses were exposed to network operations. The investigation has shown that it was part of a larger national and international campaign, which has been going on since 2019 in any case. The police have found it likely that APT28 and Fancy Bear were behind it. This group belongs to Russia’s military intelligence service GRU, and their 85th Main Center for Special Services (GTsSS). Fancy Bear is known through several cases in the press. In 2018, the US authorities charged several people associated with the GRU for having been behind hacking and intelligence operations in connection with the presidential election in 2016. Fancy Bear has for many years carried out network operations against Norway, according to the Police Security Service. In December 2020, the email accounts of six UIT employees were also hacked by what are believed to be Russian actors. In April 2023, a leak known as the “Vulkan documents” tells how private Russian companies are engaged by the Russian state’s military intelligence service (GRU) to contribute advanced tools for use in cyber operations. The leak has been authenticated by several Western intelligence sources, for a journalistic collaboration between several American and European news media, such as The Guardian. The leaked documents will also show Russian intelligence’s interest in critical infrastructure, including energy, oil and gas and logistics. news has also asked the Ministry of Foreign Affairs whether they are aware that Russian intelligence services were behind a major computer attack on Tromsø harbor in 2020. We have also asked whether the government will limit Russian vessels’ access to three Norwegian ports. State Secretary Eivind Vad Petersson does not answer questions about the data attack, but writes: “To secure Norwegian interests, we are constantly considering further measures.” Hello! Over the past year, we have collaborated with colleagues in Denmark’s Radio (DR), Sweden’s Television (SVT) and Finnish Yle to survey espionage in the Nordic region. We have previously named four out of 20 Russian intelligence agents who have worked in Norway. We have also written the case about the Russian agent who was caught red-handed by PST when he met a Norwegian source in a park in Oslo. If you know of other circumstances or events that we should look into more closely, you can send us an e-mail, or you can also send us input, tips and information encrypted and secure via news’s extra secure notification reception – by clicking here. Inghild Eriksen, Håvard Gulldahl, Beth Mørch Pettersen, Tormod StrandJournalists at NRKSend us an e-mail
ttn-69
Tromsø said yes to American nuclear submarines – the harbor was attempted to be hacked by Russian intelligence – news Troms and Finnmark
