Episode 61
EPISODE SUMMARY
Subscribe or listen now: 
Joseph Carson:
Hello everyone. Welcome back to another episode of the 401 Access Denied podcast. I'm really excited to be here. I'm your host for the episode, Joseph Carson, and I'm joined again with Chloe, my new co-host of the show. So Chloe, do you want to give us an introduction who you are and also who the guest will be?
Chloé Messdaghi:
Yeah. Hi everyone. My name is Chloe Messdaghi and I'm the Chief Impact Officer over at Cybrary and today we have Chris Kubecka. Chris, why don't you tell the world a little bit about yourself?
Chris Kubecka:
Well, I wear a couple of different hats. I run my own incident management company for nation-state attacks only with government reference. Also, I am currently the distinguished chair of the Middle East Institute's Cybersecurity and Emerging Technology program, as well as being an ethical hacker.
Joseph Carson:
Fantastic. One of the things I think me and Chloe's been watching this year, which has been fascinating, just watching your journey and experience. I think we were kind of chatting on social media quite often as we were going through that. It was quite shocking and the episodes this year and the events starting from January right through to even now has been shocking the world. What's been happening in Ukraine has just been devastating, has been sometimes even hard to watch and difficult to watch and the reality of what's happening. I think the audience would really like to see your journey, what's been happening.
Can you start, what were you doing in Ukraine to begin with and give us a bit of a background of how you got there because I know we've done a lot of work before. I'm just curious how your travel started there.
Chris Kubecka:
Definitely. I was asked if I would stage in the capitol city in case there were any nuclear cyber attacks. Part of my background is dealing with nuclear cyber incidents. So I've done six kind of big ones in the past and I thought, "Well, haven't been to Ukraine before. Sure thing."
I ended up taking the very last Air France flight into the capitol city and got there on the 20th and it was very interesting because no one really knew what was going to happen. There had been troop buildups along some of the borders, and there was a lot of fake news going around. A lot of propaganda, misinformation, disinformation, malinformation, as well as is what Western media telling us going to actually happen or is this just a lot of fluff because unfortunately the way that you get news stories clicks and reads is to make them as sensationalized as possible. That happens everywhere.
The next day, around the time that I got notice that Air France was cutting off all flights during a very late lunch/dinner, I also was notified that there were attacks against the water infrastructure in Luhansk that they were starting to attribute to cyber attacks and it affected all of the water infrastructure at once, which nobody believed it was just a breakdown of the mechanics, the facilities. Also, around that time, ATM machines, again in the capitol city, stopped working.
By Tuesday, the next day, there were problems with currency exchange and also there started to get disruptions with the Diia app, which is the ID app that Ukraine has, where it has your ID, your tax information, your car registration, your vaccination status, and your business information as well, if you own a business.
By Wednesday, things were starting to heat up. I just happened to be in the hotel, the Intercontinental in Kyiv where all the journalists we're at. So there were a lot of conversations going around. Some of the major media decided to leave, which is understandable.
Then there were plans put into motion. We had received through one particular media outlet intelligence from the Pentagon themselves saying that they thought an attack would occur at 4:00 AM on Thursday morning, the 24th. Since I was not the immediate recipient, the journalist who got it asked me to speak with the staff because he wasn't permitted to and tell them, because they had been asking me when they should leave. I told them they should get their stuff and start going.
We also started setting up evacuation plans. I had a couple of routes out. One was with a particular security team of a media outlet. He got me ready with where we were going to meet, when we were going to go, a flack vest as well to get everything prepared. Then on the other side, a Ukrainian that I'd met, because I had gone around Kyiv a little bit, kind of waiting for a phone call, something bad was going to happen to the nuclear infrastructure. He had already arranged a bus and he had asked me that evening at about 10:00 PM, "Should I get my family out?" I said, "Yes, absolutely." So he started moving his wife and children south of the capitol city, but said he would be back early in the morning to pick us up if I didn't want to go with the news media.
It seemed like a tense time, but I had been on a call that evening with a bunch of like-minded people, national security with a focus on cyber, which lasted until about 3:00 AM Thursday morning. I loved the call and love the people, hate the time zone difference. It's every Wednesday. I'd also sent out, well, quoted a Tweet when one journalist said there's a rumor that the attack is going to start at 4:00 AM. I said, "Yes, that's the rumor. We're all expecting it," basically.
So I tried to go to sleep. I was watching a UN special session and I thought, "All right, I'll make sure," I had my bag packed. I'd already cleared out all the non-perishables from the mini bar just in case, because you don't know.
Joseph Carson:
You never know when the next time you get a shop or money is when this was going on.
Chris Kubecka:
Correct. Correct. I was wearing my clothes and I was like, "All right, I'm going to get some sleep." I think I Tweeted, "I'm finally going to go to sleep." About five minutes later, boom. I immediately got contacted by the security team going through shelling.
At first, we were hoping that they were just shelling right along the border but where the capitol city is, it's actually not that far from the border. So we started getting more shelling. As it was starting to get daylight we could see there was smoke all around. We got word that the airport had been heavily damaged and possibly destroyed. By 6:00 AM, I decided to go with Mikael's bus and start getting out with them. We were trying to figure out, "Okay, how many other people need to get out?" There was one person with the bus that also had been registering Americans and basically people from the US or Canada, Australia, New Zealand. So Five Eyes. If you don't know what Five Eyes are, it's those particular countries.
I had my bag packed. I left half my stuff behind because when you're going to evacuate from a war zone, you kind of want to do it lightweight. I had my one bag and my mini bar stuff all ready to go and flack vest, ready to go. We headed down to, it was a Hilton, and when we got there, I was looking at this building like, "This is one of the tallest buildings in the capitol city. Why are we picking up people here, but okay. Cool meeting place."
There was a lot of panic on the streets. People started walking with luggage, trying to get out. You could see that the traffic was getting very bad. We had a group of Americans that were so panicked, they had brought, I don't know, eight large suitcases. Again, when you're evacuating its best not to because those suitcases take up room from people who can actually get in.
Joseph Carson:
It takes away space from people who actually need to get moving.
Chris Kubecka:
Right. So we ended up having the Sprinter van, which could fit, I think, 26 people and then a car to follow. We made the decision, because they had asked, "Well, which way should we go?" I go, "Well, we can't go north. We can't go east. The traffic is terrible to the west. Let's go south." The two Americans that had all the luggage that panicked so bad that they then were just in tears, started removing the luggage. Then I realized why.
We started seeing paratroops in the sky coming, which is not a good sign. Of course this whole time you could hear shelling. Then we got warned about a tank column on its way to the capitol city, which luckily, I believe it was a young man with a drone that warned the Ukrainian army and they were able to take out that tank column before it got to the capitol city. Thank goodness for other people.
We were almost on our way out and there was this guy that walked up to us and in English he's like, "Can you help us? We came here for business and when we contacted the people who hired us, they were like, 'new phone, who's this,'" with no evacuation plan for him. So we're like, "Well, we got this luggage off and the two Americans left with all this luggage. We have room, just get on." It was eight Romanians who were there for journalistic purposes. So they ended up getting on and we ended up, luckily, Mikael, he had been a tour operator throughout Ukraine so he knew a lot of the back roads.
We started heading through the back roads, trying to avoid the traffic. We almost got stuck in a farmer field. That was not good at all. Then finally we got through the field, had to backtrack a bit, and then got to the city where he had put his wife and two children in, which was just south of Kyiv, again, heading through the back roads, trying to avoid the highway because people don't particularly like to get bombed.
Joseph Carson:
So going the back roads, you get into the quality of the roads can be pretty bad if I remember. Then you also have not as many fuel stations as well. Did that cause any problems of quality of the roads and also probably shortage of fuel?
Chris Kubecka:
Oh absolutely. They had started restricting fuel. At that point, it was to 20 liters, which I think, is that four gallons? Something like that.
Joseph Carson:
Close to it.
Chris Kubecka:
Something like that. Here we had the two vehicles. So whenever we could, we tried to make sure that we had enough gasoline because also it was cold. We ended up having 26 people total between the two vehicles. So you need to keep the heat on. We had kids, they didn't quite understand what was going on, but the parents told them that they were going on a camping trip and adventure. Figured that was best.
We decided to use some of my friends. I contacted a buddy of mine. He goes by Dutch Osint guy and he's in the Netherlands. I go, "Hey, I don't know how much longer internet is going to stay up," because it was already getting affected, "so can you help us get a safe route to avoid bad areas by tracking my GPS on my phone?" He goes, "Yep, definitely."
So we started to do that and then the next, not big city, but bigger than a village we were actually going to turn into, to take a break because the kids were going buck wild. Right before we were going to head into that city, he goes, "Don't go to that city. Bombing is imminent." So I told the bus in front of us, because I was in the car behind, and Mikael made a very sharp right turn and started hauling ass. Again, it was a back road. So we were hitting probably about 100 or over 100 kilometers an hour. Within seconds of turning, we all heard the bombs start to be dropped. Luckily we avoided that.
We ended up going through several villages. We noticed propaganda pamphlets were dropped on the road and also we found that the Wagner Group had already had people in south and central to Kyiv and they were trying to set up checkpoints and tried to stop us. We decided to press on the gas as hard as possible to blow past them because that would've been a bad thing.
Joseph Carson:
For the audience, for Wagner Group itself, it's basically the mercenary paid military and intelligence part of Russia. So it's a very kind of common thing that they use from a privatization perspective.
Chris Kubecka:
They are not people you want to stop and chat with. Let's put it that way. We ended up catching up to the truck that was actually dropping the propaganda pamphlets, which I snapped a photo of. I should have Tweeted that out. We ended up driving probably, oh, well over 20 hours that day. So tired, in fact, that one of the last checkpoints we went through, Ukrainian checkpoints, Mikael was so tired he actually bumped into one of the barricades. Luckily there wasn't enough damage to keep us from driving. He picked a spot that was about an hour, hour and a half driving distance from Syria, Romania, where there was no real town. It was a resort not usually open that time of the year. He called.
Joseph Carson:
Because we're talking about it's still January, late January, so it's...
Chris Kubecka:
February.
Joseph Carson:
February. So it's kind of cold and not touristy season.
Chris Kubecka:
No, but we figured we wanted to be someplace where we wouldn't get bombed and there was nothing around and so we figured, all right, we'll sleep a few hours and then start heading towards the border. So, that's what we did. We had heard that there were long lines at the border, but we didn't know that those long lines were more like days of lines because we were so absolutely tired. Mikael, myself, and Brian were all taking shifts driving the two vehicles and then trying to get sleep.
I also found out, I hope this doesn't offend anyone, I'm kind of glad I'm not a parent. Boy, hats off to parents because I swear to goodness gracious, anytime I tried to sleep, those kids were awake.
Chloé Messdaghi:
Wow.
Chris Kubecka:
Yeah.
So we entered the very long line. Some people had been there a while, so obviously very stressed out, yelling, banging on cars. "Don't you dare jump in line in front of me," all sorts of stuff. There were limited services. Then when we could get some internet, because it was very spotty, we learned that all of the border crossings were like that. As night started to fall, we're like, "Well, it's not like we're going to be able to turn back around. We're going to all be sleeping in this bus now." Yay. I swear the kids just never slept.
Chloé Messdaghi:
They think they're going on a camping trip. They're so excited. It's like Disneyland.
Joseph Carson:
Excitement and energy is definitely, it's something an adventure for them.
Chris Kubecka:
Yeah. So we were kind of inching along little by little, trying to keep people from beating the bus up. There was a petrol station on the right hand side and we were able to get a bit of water, which was good, and some snacks. Of course, I had the mini bar snacks, so that was good.
Then I had to stay awake to keep moving forward that evening so I decided to do a ask me anything on Twitter while it was going and while I could get internet. We were close enough to the border where I could manually switch and try to keep switch to a Romanian provider and then we could get internet but the Ukrainian provider was just getting hit. I heard later from the news that the Russians were disrupting the internet service already.
Then probably about 2:00 or 3:00 AM, the wife of Mikael woke up and noticed we weren't moving at all. She's like, "All right, I'm going to try to talk to a border guard." She decided to do, I don't know, it was almost three kilometers to do the walk to talk to someone. When she came back, she's like, "There's been a cyber attack." Well, I'm like, "Oh, that's interesting." So as daylight broke, we started moving again a little bit and then Misha and I, or, Mikael, I call him Misha, Mikael decided to walk up ourselves to speak to the border guards and he did all the translation because he speaks four languages and he introduced me saying, hey, why I was in Ukraine, what's going on? They're like, "Yeah, we've had a cyber attack. A wiper virus."
They sent us through the chain all the way up to the senior officer who said, "Yeah, everything's been wiped." One of the reasons why it was so slow getting through the border was they could only let through one car at a time. They were using pencil and paper, one car at a time, when hundreds of thousands, if not a million people were trying to get out.
After the senior officer used a landline to check me out, he came back saying, "All right, you need to get out, bring your bus forward. We'll send a soldier to get through," because trust me, the crowd was not pleased that we were suddenly cutting in line.
Joseph Carson:
Yeah. When you see somebody coming from the back and you've been there for probably days, not a good feeling.
Chris Kubecka:
It's not a good feeling. So we got to the front. I was also told there was various lists that were supposedly going around. I'm not sure if it ended up being true or not, but that there were people that the Russians wanted to kill in Ukraine. I have a tendency to make fun of Putin, so perhaps it was not very safe for me to be in Ukraine at that moment.
So we were able to get out, luckily, because at first I seriously thought we might have to bribe some people as well. I always have a little bit of gold on me, something I learned from the military, to buy your freedom. So getting together any cash that we might have, whatever, with a busload of people and jewelry and trying to figure out, "All right. If we have to bribe our way out, to actually get out, this is what we're going to do." Luckily they let us all out. No bribery needed. They also let out Mikael which at the time they were not letting basically any men get out.
Joseph Carson:
Okay. This conscription that basically everyone was basically prescribed to an army that was below 65 or something. I can't remember which age.
Chris Kubecka:
There was another complication, well, several. If you had the time to grab your exemption letter, that was nice. But of course people were fleeing, but the records, the digital records of exemptions was also wiped. So basically anybody that felt like they were also in the medical field, male or female, could not get out. With that, there were some ID databases that were wiped, including some that involved children. So if you didn't have a hard copy and proof that your child was absolutely yours, they weren't going to let you out with a child that you couldn't prove was yours.
Joseph Carson:
Some documentation because when people's fleeing, it's not like you're going to go and start looking through your drawers for all of the paperwork and stuff. Time's essential. I've heard lots of stories where documentation's been left behind and trying to prove is very difficult at that point.
Chloé Messdaghi:
Don't you just hate it when a podcast episode leaves at a cliff hanger. Well, unfortunately that's what's happening here. Make sure you tune in, in the next two weeks for the continued journey of Chris Kubecka escaping from Ukraine.
