Effects of Hacking on Russia’s Military Draft System: An Analysis

On December 11, Grigory Sverdlin, a prominent anti-war activist, revealed via Telegram that an anonymous hacking collective had successfully infiltrated the systems of Mikord, a key developer of Russia’s military draft database. This breach not only compromised sensitive information but also disrupted the operational capabilities of the digital draft system.

Sverdlin, who leads the organization Get Lost, stated that the hackers contacted his group, claiming responsibility for the attack and providing a significant cache of documents. He noted, “They had access to the system for several months and delivered a vast amount of materials from the register.” These documents have been handed over to the investigative journalism outlet iStories, which plans to release a detailed report soon. Following this, the data will be made publicly accessible.

The Unified Military Register: A brief overview

The Unified Military Register serves as Russia’s digital military draft system, consolidating personal information from various governmental databases. Operated by the Defense Ministry, this system facilitates the issuance of draft notices and enables data sharing with other agencies, including the Federal Security Service (FSB) and the Interior Ministry.

When individuals receive a draft notice—delivered either electronically or through registered mail—they are legally required to report to a military enlistment office. Once a summons is considered delivered, the individual faces travel restrictions until compliance is achieved. Furthermore, those attempting to evade the draft may encounter severe penalties, including the suspension of driving privileges and restrictions on property ownership and loan applications.

Recent cyberattack and its implications

However, Sverdlin asserts that the functionality of the Unified Military Register is now severely compromised. Following the cyberattack on Mikord, he claims that the system will remain inoperative for “at least several months.” In a conversation with Meduza, he refrained from detailing the motives behind the hackers’ collaboration with Get Lost, but he indicated that these hackers share anti-war sentiments.

According to Sverdlin, assessments from Get Lost’s IT experts suggest that the damage inflicted by the hackers is significant. “The developers of the register will require a considerable amount of time to recover both documentation and source code,” he emphasized. “They erased all traces of their work, and while there were backups, those too have been destroyed, prolonging the recovery timeline.”

Consequences for draftees and draft evaders

Sverdlin has provided insights regarding the current state of the digital draft system, stating that it has been non-operational since December 10. While the hackers have reportedly restored some basic functionalities of the database, many critical features remain disabled. “The system is currently functioning on a rudimentary level,” he stated, noting that automatic restrictions on travel, bank loans, and driver’s licenses are not operational. Nevertheless, he cautioned that these limitations can still be applied manually to draftees.

The timing of the cyberattack is particularly significant, occurring amidst the implementation of the Unified Military Register, a project initiated following a law passed in April. By that time, the database housed over 30 million records, each containing around 100 data points. When asked about the potential for another mobilization wave, Sverdlin remained vague, indicating that the necessary functionalities would not be available in the immediate future.

Increased demand for assistance

Since the introduction of the digital draft system in July, Get Lost has experienced a dramatic rise in requests for assistance, exceeding 100 daily. “This surge is primarily linked to the heightened anxiety surrounding the draft notices,” Sverdlin explained. Many individuals began receiving notifications that their personal details had been integrated into the register, leading to the subsequent delivery of electronic summonses.

While Sverdlin did not disclose the timeline for the publication of iStories’ investigative findings, he assured that the extensive data acquired from Mikord would eventually become public. This trove will include pertinent details about the individuals and companies involved in the development of the Unified Military Register. “We are aware of all the key players profiting from this endeavor and will ensure that this information is accessible for public scrutiny,” he concluded, inviting others to explore the intricate details surrounding this situation.