Wednesday, May 31, 2017

U.S. Options to Develop a Cyberspace Influence Capability


divergentoptions.org


image from

Sina Kashefipour is the founder and producer of the national security podcast The Loopcast.  He  currently works as an analyst.  The opinions expressed in this paper do not represent the position of his employer.  Divergent Options’ content does not contain information of an official nature nor does the content represent the official position of any government, any organization, or any group.

National Security Situation:  The battle for control and influence over the information space.
Date Originally Written:  May 18, 2017.
Date Originally Published:  May 29, 2017.
Author and / or Article Point of View:  The author believes that there is no meat space or cyberspace, there is only the information space.  The author also believes that while the tools, data, and knowledge are available, there is no United States organization designed primarily to address the issue of information warfare.
Background:  Information warfare is being used by state and non-state adversaries. Information warfare, broadly defined, makes use of information technology to gain an advantage over an adversary.  Information is the weapon, the target, and the medium through which this type of conflict takes place[1][2][3].  Information warfare includes tactics such as misinformation, disinformation, propaganda, psychological operations and computer network operations [3][4][5].
Significance:  Information warfare is a force multiplier.  Control and mastery of information determines success in politics and enables the driving of the political narrative with the benefit of not having to engage in overt warfare.  Information warfare has taken a new edge as the information space and the political are highly interlinked and can, in some instances, be considered as one[6][7][8].
Option #1:  The revival of the United States Information Agency (USIA) or the creation of a government agency with similar function and outlook. The USIA’s original purpose can be summed as:
  • “To explain and advocate U.S. policies in terms that are credible and meaningful in foreign cultures”
  • “To provide information about the official policies of the United States, and about the people, values, and institutions which influence those policies”
  • “To bring the benefits of international engagement to American citizens and institutions by helping them build strong long-term relationships with their counterparts overseas”
  • “To advise the President and U.S. government policy-makers on the ways in which foreign attitudes will have a direct bearing on the effectiveness of U.S. policies.[9]”
USIA’s original purpose was largely designated by the Cold War.  The aforementioned four points are a good starting point, but any revival of the USIA would involve the resulting organization as one devoted to modern information warfare.  A modern USIA would not just focus on what a government agency can do but also build ties with other governments and across the private sector including with companies like Google, Facebook, and Twitter as they are platforms that have been used recently to propagate information warfare campaigns [10][11].  Private sector companies are also essential to understanding and limiting these types of campaigns [10][12][13][14].  Furthermore, building ties and partnering with other countries facing similar issues to engage in information warfare would be part of the mission [15][16][17].
Risk:  There are two fundamental risks to reconstituting a USIA: where does a USIA agency fit within the national security bureaucracy and how does modern information warfare pair with the legal bounds of the first amendment?
Defining the USIA within the national security apparatus would be difficult[18].  The purpose of the USIA would be easy to state, but difficult to bureaucratically define.  Is this an organization to include public diplomacy and how does that pair/compete with the Department of State’s public diplomacy mission?  Furthermore, if this is an organization to include information warfare how does that impact Department of Defense capabilities such as the National Security Agency or United States Cyber Command?  Where does the Broadcasting Board of Governors fit in?  Lastly, modern execution of successful information warfare relies on a whole of government approach or the ability to advance strategy in an interdisciplinary fashion, which is difficult given the complexity of the bureaucracy.
The second risk is how does an agency engage in information warfare in regards to the first amendment?  Consider for a moment that if war or conflict that sees information as the weapon, the target, and the medium, what role can the government legally play?  Can a government wage information warfare without, say, engaging in outright censorship or control of information mediums like Facebook and Twitter?  The legal framework surrounding these issues are ill-defined at present [19][20].
Gain:  Having a fully funded cabinet level organization devoted to information warfare complete with the ability to network across government agencies, other governments and the private sector able to both wage and defend the United States against information warfare.
Option #2:  Smaller and specific interagency working groups similar to the Active Measures Working Group of the late eighties.  The original Active Measures Working Group was an interagency collaboration devoted to countering Soviet disinformation, which consequently became the “U.S Government’s body of expertise on disinformation [21].”
The proposed working group would focus on a singular issue and in contrast to Option #1, a working group would have a tightly focused mission, limited staff, and only focus on a singular problem.
Risk:  Political will is in competition with success, meaning if the proposed working group does not show immediate success, more than likely it will be disbanded.  The group has the potential of being disbanded once the issue appears “solved.”
Gain:  A small and focused group has the potential to punch far above its weight.  As Schoen and Lamb point out “the group exposed Soviet disinformation at little cost to the United States but negated much of the effort mounted by the large Soviet bureaucracy that produced the multibillion dollar Soviet disinformation effort[22].”
Option #3:  The United States Government creates a dox and dump Wikileaks/Shadow Brokers style group[23][24].  If all else fails then engaging in attacks against adversary’s secrets and making them public could be an option.  Unlike the previous two options, this option does not necessarily represent a truthful approach, rather just truthiness[25].  In practice this means leaking/dumping data that reinforces and emphasizes a deleterious narrative concerning an adversary.  Thus, making their secrets very public, and putting the adversary in a compromising position.
Risk:  Burning data publicly might compromise sources and methods which would ultimately impede/stop investigations and prosecutions.  For instance, if an adversary has a deep and wide corruption problem is it more effective to dox and dump accounts and shell companies or engage in a multi-year investigatory process?  Dox and dump would have an immediate effect but an investigation and prosecution would likely have a longer effect.
Gain:  An organization and/or network is only as stable as its secrets are secure, and being able to challenge that security effectively is again.
Recommendation:  None

Endnotes:
[1]  Virag, Saso. (2017, April 23). Information and Information Warfare Primer. Retrieved from:  http://playgod.org/information-warfare-primer/
[2]  Waltzman, Rand. (2017, April 27). The Weaponization of Information: The Need of Cognitive Security. Testimony presented before the Senate Armed Services Committee, Subcommittee on Cybersecurity on April 27, 2017.
[3]  Pomerantsev, Peter and Michael Weiss. (2014). The Menace of Unreality: How the Kremlin Weaponizes Information, Culture, and Money.
[4]  Matthews, Miriam and Paul, Christopher (2016). The Russian “Firehose of Falsehood” Propaganda Model: Why It Might Work and Options to Counter It
[5]  Giles, Keir. (2016, November). Handbook of Russian Information Warfare. Fellowship Monograph Research Division NATO Defense College.
[6]  Giles, Keir and Hagestad II, William. (2013). Divided by a Common Language: Cyber Definitions in Chinese, Russian, and English. 2013 5th International Conference on Cyber Conflict
[7]  Strategy Bridge. (2017, May 8). An Extended Discussion on an Important Question: What is Information Operations? Retrieved: https://thestrategybridge.org/the-bridge/2017/5/8/an-extended-discussion-on-an-important-question-what-is-information-operations
[8] There is an interesting conceptual and academic debate to be had between what is information warfare and what is an information operation. In reality, there is no difference given that the United States’ adversaries see no practical difference between the two.
[9] State Department. (1998). USIA Overview. Retrieved from: http://dosfan.lib.uic.edu/usia/usiahome/oldoview.htm
[10]  Nuland, William, Stamos, Alex, and Weedon, Jen. (2017, April 27). Information Operations on Facebook.
[11]  Koerner, Brendan. (2016, March). Why ISIS is Winning the Social Media War. Wired
[12]  Atlantic Council. (2017). Digital Forensic Research Lab Retrieved:  https://medium.com/dfrlab
[13]  Bellingcat. (2017).  Bellingcat: The Home of Online Investigations. Retrieved: https://www.bellingcat.com/
[14]  Bergen, Mark. (2016). Google Brings Fake News Fact-Checking to Search Results. Bloomberg News. Retrieved: https://www.bloomberg.com/news/articles/2017-04-07/google-brings-fake-news-fact-checking-to-search-results
[15]  NATO Strategic Communications Centre of Excellence. (2017). Retrieved: http://stratcomcoe.org/
[16]  National Public Radio. (2017, May 10). NATO Takes Aim at Disinformation Campaigns. Retrieved: http://www.npr.org/2017/05/10/527720078/nato-takes-aim-at-disinformation-campaigns
[17]  European Union External Action. (2017). Questions and Answers about the East Stratcom Task Force. Retrieved: https://eeas.europa.eu/headquarters/headquarters-homepage/2116/-questions-and-answers-about-the-east-
[18]  Armstrong, Matthew. (2015, November 12). No, We Do Not Need to Revive The U.S. Information Agency. War on the Rocks. Retrieved:  https://warontherocks.com/2015/11/no-we-do-not-need-to-revive-the-u-s-information-agency/ 
[19]  For example the Countering Foreign Propaganda and Disinformation Act included in the National Defense Authorization Act for fiscal year 2017 acts more with the issues of funding, organization, and some strategy rather than legal infrastructure issues.  Retrieved: https://www.congress.gov/114/crpt/hrpt840/CRPT-114hrpt840.pdf
[20]  The U.S Information and Educational Exchange Act of 1948 also known as the Smith-Mundt Act. The act effectively creates the basis for public diplomacy and the dissemination of government view point data abroad. The law also limits what the United States can disseminate at home. Retrieved: http://legisworks.org/congress/80/publaw-402.pdf
[21]  Lamb, Christopher and Schoen, Fletcher (2012, June). Deception, Disinformation, and Strategic Communications: How One Interagency Group Made a Major Difference. Retrieved: http://ndupress.ndu.edu/Portals/68/Documents/stratperspective/inss/Strategic-Perspectives-11.pdf
[22]  Lamb and Schoen, page 3
[23]  RT. (2016, October 3). Wikileaks turns 10: Biggest Secrets Exposed by Whistleblowing Project. Retrieved: https://www.rt.com/news/361483-wikileaks-anniversary-dnc-assange/
[24]  The Gruqg. (2016, August 18). Shadow Broker Breakdown. Retrieved: https://medium.com/@thegrugq/shadow-broker-breakdown-b05099eb2f4a
[25]  Truthiness is defined as “the quality of seeming to be true according to one’s intuition, opinion, or perception, without regard to logic, factual evidence, or the like.” Dictionary.com. Truthiness. Retrieved:  http://www.dictionary.com/browse/truthiness.
Truthiness in this space is not just about leaking data but also how that data is presented and organized. The goal is to take data and shape it so it feels and looks true enough to emphasize the desired narrative.

No comments: