How Serbia’s Cyber-War Outreach Taught Legions of Serbian Schoolchildren the Art of Hacking

Through the hot summer of 1998, electricity hung in the air. It felt as if the power of the electrical zeroes and ones pulsing through schools, homes, intelligence, militaries, and universities was generating the dry storm clouds that swept in over the mountains for evening.

America was in flower. Its map was bursting with new wires and exchanges, the internet bringing the country to itself like the railroads and the auto routes had for the past hundred years and more. This was Al Gore’s information superhighway all right. If it existed, there were websites for it, partly because there had never been anything like this and partly because interest rates were falling and low interest rates were going to make money free, and borrowing to invest would never be so gloriously untethered from risk.

Through the summer, Go.com, Boo.com, Pets.com, and Flooz.com blew the bricks-and-mortar companies from TV ad slots, took over the Super Bowl, stormed the news, torched the stock market. It was the new mall. The new space. The new battlefield. The new dating. The new leading business sector. Every day, a new something else. That summer, the Naval Institute’s Proceedings published a paper called “Network-Centric Warfare: Its Origin and Future” that sounded a chilling warning. “Here at the end of the millennium we are driven to a new era in warfare. Society has changed. The underlying economics and technologies have changed. American business has changed. We should be surprised and shocked if America’s military did not.”

In fact, the internet’s biggest single investor was the US government. For the past three years, it had funded an initiative called Google. The initiative was the first really big test of a project that the US intelligence community had founded in 1995, as part of a US government–Silicon Valley partnership that they hoped would secure American interests online into the new century. It was borne of the realization that the internet, if it grew at the rate they predicted, would itself become a form of voluntary mass surveillance.

Funded jointly by the CIA and NSA, computer scientists at CalTech, MIT, Carnegie Mellon, Harvard, and Stanford formed the Massive Digital Data Systems (MDDS) project. It predicted that like flocks of birds or colonies of ants, like-minded groups of humans would coalesce on the internet around certain nodes. Among the communities that would coalesce around certain click patterns, you could spot anything. People who were interested in a certain idea, or product, or political position. People who weren’t, but matched those people’s other online behaviors so might be worth targeting. Demographics. Communities of interest. Political and religious persuasions. Potential sex criminals. Terrorists. Potential terrorists.

The first two DARPA/National Science Foundation grants under the initiative funded research by Larry Page and Sergey Brin, a pair of Stanford graduate students who were making rapid advances in the science of interpreting that data at scale. Google launched to the public in September 1998. But to become the world’s eyes and ears—to be of help in a crowdsourced cyber war—it would have to achieve the massive coverage in the East that would make its patterns mean something. That would take time.

Time was in short supply.

Kosovo, the wild borderland between Serbia to the north and Albania to the south, was a simmering cauldron. A rural, hilly land populated mostly by ethnic Albanians, it has long been considered by Serbia to be Serb territory. Typically for the area—and in common with the Bosnian wars—the issue is clouded by enclaves of populations within populations, and by history as much as diplomacy, myth as much as fact. Through the mid-1990s, the Albanian-sponsored Kosovo Liberation Army (KLA) had been carrying out acts of sabotage and attacks against Serbian authorities and installations in Kosovo.

By February 1998, the Serbian response had escalated beyond mere enforcement. A series of summary executions and civilian massacres in early 1998 tipped the scales toward full-blown conflict, with Secretary of State Madeleine Albright warning Serb president Slobodan Milošević that on the current trajectory, the crisis was no longer “an internal affair.” Where ultranationalist paramilitaries from Serbia and Croatia had shelled, burned, tortured, raped, and massacred their way through Sarajevo, Srebrenica, and the rest of Bosnia through the 1990s, now Kosovo was in Serbian nationalists’ sights. Slowly, but with terrible, slipping inevitability, it began tipping toward war.

As the world turned its attention toward the possibility of another full-blown Balkan conflict in which Milošević was the antagonist, waves of hackers began breaching Albanian-language websites in what seemed increasingly like focused, if not organized, fashion. During “visits,” the Serbian coat of arms would be placed on the home page together with suitable messages. They wrote in both Serbian and English languages. One read: “Welcome to the website of the world’s biggest liars and murderers.” Another one: “Albanian brothers, this coat of arms will stay on your flag as long as it exists.” Their next target was the Kosovo Information Centre site, on the basis that it was “enemy propaganda” angled against Serbian interests.

Far larger storms were brewing offline. A series of massacres apparently committed by Serbs, skirmishes with the Kosovo Liberation Army, and warlike rhetoric from Milošević were turning the mood ugly. They were whipped up by increasingly crazed regime news reports of American plans to install a New World Order with a putsch in Belgrade, or mystics reporting visions of New York on fire, or proregime historians warning that the Muslim hordes were massing again for a final assault on Christendom in Kosovo, “as foretold in Revelation,” with far-right agitation orchestrated daily, and the public mood turned ugly and fearful. As diplomatic pressure mounted for Serbia to pull back from the brink of another full-blown war and stop ethnic cleansing in Kosovo, the regime also tried to direct opposition frustration against the West that had it under sanctions.

The sanctions seemed to magnify the madness that gripped the country. Though it was now under the world’s tightest lockdown—sanctions so strict and so universal that in theory nothing came in or went out—Serbia’s rulers in government and crime, its airstrips and four‑by‑fours, streets, and speakeasies spun in a blizzard of illicit guns, cash, ecstasy, cocaine, bootleg goods, warez, and hacker code.

On one memorable evening, a gigantic chopped-cocaine swastika the size of a dinner plate became the piece de résistance at a party held by Marko Milošević, the Kendall Roy look-alike hoodlum-playboy son of President Slobodan Milošević, now an aspiring internet entrepreneur and hacker groupie himself. It was meant as a fuck-you to America, likening it to the last outside oppressors from the Wehrmacht. It was cheered as it was unveiled, like a chef’s special creation, and again as it was hoovered up by the gangland power brokers in attendance, like everything else in the land.

More than the cocaine itself, the very atmosphere in which such things were possible was a drug. For a legion of the kids, it was not PCs from parents with clear rules of creative engagement, but playground stories like the young Milošević’s party, full of dangerous glamour and the trappings of power and fear, that became the cues as to what could make you successful in this world of escalating savagery. Everybody knew even if you had no home internet or your parents were watchful, college and university tech faculties had the fastest connections and were almost completely unsupervised. Then schools began opening internet connections in class, and the wave of kids grew unstoppable.

The army began cyber-war outreach to children as young as nine. One former pupil recalls his middle school class in Belgrade being visited by a man from the Lola Ribar Institute, who told them about robots and a new kind of technological frontier that would make the horror of human-fought wars obsolete. “Robots, drones, and lines of code are going to fight the next wars for us,” the man had said. “They will not be fought on battlefields. The front line will be inside our enemy’s computer systems. Without those systems functioning, they cannot communicate. They cannot fire rockets or give orders. They cannot attack or defend.” Then, in a soft voice, the speaker asked the class who would be interested in fighting such a war, as cyber defenders. The classroom transformed into a forest of raised hands.

The hackers took on pen names and online aliases and were so confident that they now wrote and talked about their raids, hacks, breaches, and incursions increasingly openly, in print and online. They would talk to the journalists on message boards. There was no way they could be touched. Those computer mags—Racˇunari (Computers) and others—had evolved and were now like nothing else on earth, then or now. Some became bulletin boards, publishing challenges, trash talk between hackers, announcements by the hackers themselves of impending hacks, and subsequent reports on how they had done it.

Others became de facto sports pages for a sport that was illegal in the West, hardly known at all in Russia and China, but had the status of national sport here—for participants and spectators alike. It would be the late 2000s before Twitter gave the world anything like a comparable public forum, with its real-time announcements of hacks versus admins by the likes of Anonymous and Lulzsec, dumps of raided info from Wikileaks, and even terror groups like al‑Shabab and ISIL.

Once they got access to the internet, the first thing the children learned was to copy source code and amend it. In the United States and the West, the internet experience was often mediated by big businesses—AOL’s CD‑ROM walled gardens, or the context of office work or e‑commerce. But in the East, like computers themselves, it was something to interrogate, break into, remake, and weaponize. For some, learning that you could simply collect source code and mess about with it was a eureka moment. Organizations’ home pages would become hilarious, the image replaced with something else, or a rude word inserted into the main text. It was pure joy. In retrospect, they realized they were being taught how to deface websites.

Between their time on the terminals, the kids would write down ideas, just jotting them in exercise books, and take some things off the blackboard. You could learn lines of code and operations, by heart, like card tricks or jokes. Sometimes, you swapped ideas with other people, like sticker cards for football or superheroes. None of the kids concerned had any idea that they were training for cyber war; it was just fun. Yet somehow, some felt that they were doing something good and officially approved.

___________________________________

Excerpted from WE ARE ALL TARGETS: How Renegade Hackers Invented Cyber War and Unleashed an Age of Global Chaos by Matt Potter. Copyright © 2023. Available from Hachette Books, an imprint of Hachette Book Group, Inc.