The Cyber Reality States Don’t Want to Admit

Volodymyr Styran

SubscribeSign in

The Cyber Reality States Don’t Want to Admit<br>Just me ranting about the irrational Western reaction to Russia’s actual cyber capacity builing pipeline being revealed by the Bauman University leak.

Volodymyr Styran<br>May 10, 2026

Share

On May 7, The Insider – with Le Monde, Der Spiegel, The Guardian, Delfi and VSquare – dropped a document-rich investigation into Department No. 4 at Bauman Moscow State Technical University: the “special preparation” cathedra that GRU uses, per several thousand internal documents, as an offensive-cyber and information-warfare pipeline. They headlined it “The Department of War Crimes.” It is a beautifully reported piece. That is exactly why I find myself uneasy.<br>Let me say up front: nothing below is a critique of the reporting. They tie a “civilian” department at one of Russia’s flagship technical universities to GRU unit 26165 (Fancy Bear / APT28), unit 74455 (Sandworm) and unit 29155 — the same unit The Insider had previously identifiedand which was subsequently sanctioned. They name General Viktor Netykshto — the officer who oversaw the DNC, Macron and Bundestag intrusions — as the addressee of Bauman’s staffing reports. They flag Yuri Shikolenko, under UK sanctions since July 2025, on internal correspondence. They identify two recent Bauman graduates, Alexei Kondrashov (b. 2001) and Ilya Boykov (b. 2000), now in unit 74455 — the Sandworm crew responsible for the Ukraine and Georgia blackouts and NotPetya. They place Vladislav Borovkov, named in earlier 29155 reporting, in Bauman’s doctoral program. They quote a deputy department head, Lt. Col. Kirill Stupakov, instructing students on phone tapping, parabolic mics, and the elegant detail of hiding cameras inside smoke detectors. They show curriculum modules where the coursework is, literally, “develop your own virus,” and a 31-page seminar requiring students to “create a social video using manipulation, pressure, and hidden propaganda.” They show internships at sanctioned defense firms – VOP “Granit,” the submarine bureau “Malakhit.” They show Department No. 4 hidden from the military center’s website by the expedient of skipping from “Cathedra No. 3” to “Cathedra No. 5.”<br>Thanks for reading! Subscribe for free to receive new posts and support my work.

Subscribe

I believe every word. And the framing around it does the damage worth naming out loud.<br>The “war crimes” frame is rhetorical, not legal

Start with the headline. Department of War Crimes. Some Department No. 4 graduates went on to GRU units that attacked civilian infrastructure – power grids, hospitals – in Ukraine and Georgia. Those attacks may indeed cross the threshold of international humanitarian law; some probably do. But “war crime” as a legal category requires armed conflict, intent, victim status, and effects that the cyber operations cataloged here mostly do not produce on their own. Most state-sponsored cyber activity – espionage, network exploitation, even most disruptive operations – falls below the threshold of a “use of force” under international law, let alone a war crime. The dominant Western legal-academic consensus (Tallinn Manual, Schmitt et al.) is precisely that the bar is high and most of what we call “cyberattacks” don’t clear it.<br>This is not pedantry. The Insider’s editors know it. They use the words anyway, because “Department of War Crimes” is a better headline than “Department of Below-the-Threshold State Cyber Capability.” The frame does work – it tells a Western reader that what Russia is doing here is categorically illegitimate, akin to chemical weapons, rather than what it actually is: a state methodically building offensive cyber capability the way every modern state either is or should be.<br>Two effects, neither intended

Effect one: this reporting, however adversarial in tone, functions as a great-power flex on Russia’s behalf. Look at the artifact – 1,563 reservists and 429 prospective contract officers across fourteen specialties in 2024 alone, lecturers with operational pedigrees that include the DNC and the Bundestag, curriculum that absorbs lessons from the Kursk operation in real time, a 54-slide deck on Western drones currently in Ukrainian service. The implicit message is “look at this terrifying, organized adversary.” Russia’s actual cyber performance is mixed – Sandworm is genuinely dangerous, Fancy Bear competent but unspectacular, much GRU activity loud and sloppy. A detailed leak makes the institution look more formidable than the operations it produces. Same dynamic we saw with Wagner: every long-form exposé added a coat of paint to the myth.<br>Effect two – the one that bothers me most: the “war crimes” framing creates pressure on Western democracies to not build matching capability. If GRU’s pipeline is a moral atrocity, then by symmetry NSA’s TAO, Cyber Command, GCHQ’s NCF, and the equivalent units of every NATO state are also moral...