Novaya Gazeta [ENG] is considered to be the most liberal opposition newspaper in Russia. It is known for its famous investigations and independent coverage of major Russian news. After several of its journalists had been killed, the newspaper attracted attention far beyond Russia's borders. It continues to receive various threats regularly. Sergey Sokolov, deputy executive editor of Novaya Gazeta, one of the newspaper's founders and head of its investigations department, shared with GV his perspectives on information security at an opposition newspaper, online democracy initiatives in Russia, and the latest news about the ongoing investigations into the journalists’ murders. What kind of Internet attacks does Novaya Gazeta have to deal with? The most unpleasant incident that Novaya Gazeta experienced was a powerful DDoS attack that took place in February 2010. Our website had to stop working for a week and a half. It started at 9 AM and, at first, we had a few hundred requests per second. We managed to solve this problem in 24 hours, and the website was restored. However, one hour later, our website crashed again, since we started to get more than one million requests per second. It made clear for us that we were not just an accidental target, but that it was an attack well prepared in advance. As we discovered, at the beginning the attacker used a relatively small [botnet, a network of robots or virus-infected computers]. When we neutralized the first attack, the attacker used another botnet, which was much bigger. As we know now, the source of the big botnet was in South Korea. Our official request to the police to investigate the attack had no results. Police officials asked us if we knew who the attacker was. When we said that we didn’t, they responded that in this case they had nothing to do with it. Only some time later, when a few other media organizations that experienced DDoS attacks, including Vedomosti, Kommersant and Moskovskiy Komsomolets newspapers, submitted a letter with a request to investigate these attacks to the president during his meeting with executive editors, the Federal Security Service (FSB) launched an investigation. As far as I know, it continues still and the investigators are trying to find something. Do you know who was behind these attacks? As far as I know, using a powerful botnet is pretty expensive. I don’t think that these were the people from businesses companies, since we had no stories at that time that could threaten commercial interests. So we can make a conclusion that this was a political action, due to the general position of our newspaper and due to the fact that this attack was one in a series of DDoS attacks against the Russian liberal media. Since some Kremlin-backed youth organizations, already known for their involvement in this kind of attacks, e.g. [the DDoS attack against Estonia], we assume that our intruders were from the same place. Since we were not the first target, I think that there is some general plan as to how to use the budget that the youth organization receives for these purposes, within the general plan of struggle against the so-called “orange threat” [a threat of a so-called Orange Revolution]. What was the impact of this attack on the newspaper, and how did you manage the situation during the attack? Obviously, it caused us some problems, not only in regard to content publishing but also to other resources. We used LiveJournal to publish our main articles. Our media partners also helped us by publishing some of our content and also by linking to our blog. Generally, the attack had no impact on the number of visitors, since we have a very stable readership. Plus, our newspaper is not a commercial organization, and we don’t have much advertising, so the financial loss wasn't significant. Moreover, it did not hurt out image. Quite the opposite, the attack probably raised our rating among our audience. But it was an unpleasant situation that cost us lots of nerves, time and effort. What are the other Internet and electronic threats that your newspaper experienced? The first incident took place in 1999. Someone deleted the whole newspaper issue via remote access and, consequently, we couldn’t print the newspaper on time. About a year ago, our website was contaminated by a virus and everyone who visited our website automatically got infected. This type of provocation is much more painful for us and our audience than a DDoS attack, and we certainly will do anything to avoid it in the future. Our major problem is spyware that compromises our editorial process. I can’t be sure it is taking place, but we had a few situations when the subjects of our investigations received information about upcoming articles and called us in this regard.