Psychological operations are upgrading to the 21st cyber century and impacts politics, economies and societies.

by Julien Chesaux, Cyber Security Consultant, Kudelski Security

Cyber but not New

Fake news, disinformation, influence, propaganda, sponsored demonstration, and national interference are increasing but these threats are nothing new. What is new, however, is how functionalities of  Web 2.0 – user-generated content,  usability and interoperability  – have  enabled a whole new generation of innovative approaches and possibilities for attackers.

These can be grouped in what is called, in the U.S. military language, psychological operations (PSYOP). PSYOP are planned operations, which aim  to influence  specific  audiences  through the diffusion of information, real or not. Thanks to cyber space, cyber PSYOP are taking a new dimension and  are nowadays used by states that want to protect and promote their  own interests.

The Russian Government, for example, masters this strategy through the concept of hybrid warfare. Through different involvements, it creates opportunities that can be then leveraged. Therefore, it uses cyber PSYOP as a cyber-strategy integrated in its political,  economic  and social warfare.

Old Methods Are the Best

To protect and spread their ideas and interests, states  use propaganda since time immemorial. At the beginning of the 20th Century it became institutionalized; governments systematically produced propaganda to target citizens to influence their opinion or in support of their efforts to undermine their enemy. WWI and WWII saw the advent of mass media as radio, television and video were added to print media1. After that, propaganda and  opinion  influence  continued  in many occasions, whether during wars or political duels. The aim was and still is to control information, especially through  the Internet, which combines the communication means of traditional print, audio and visual media.

In Russia, the government’s foreign policy uses old communist methods  from  the Soviet era  such as propaganda,  disinformation,  subversion,  manipulation,  destabilization  and  deception (the Russian military doctrine of Maskirovska) but updated for the 21st century Internet age.

1 E.g. posters, leaflets, books, movies, animations, newspapers and even comics books and cartoons [with 1940 comic book “How Superman Would End the War” by taking Adolf Hitler and Joseph Stalin to the League of Nations

http://www.archive.org/stream/HowSupermanWouldEndTheWar/look#page/n3/mode/2up

Blur the Lines Between Peace and War

Over the last years, the Kremlin became Washington’s foremost foe in cyberspace by having no reluctance to use aggressive tactics in a stealthy way, thanks to the anonymity offered by the Internet. Since 2007, many campaigns were detected and analyzed. The  majority  of  them targeted governments, international organizations  and critical infrastructure (such as energy, electricity, transportation,  and telecommunication sectors). Most of these operations  are Advanced Persistent Threats  (APT), which means that they target a specific entity with persistency and effectiveness. Recently, 13 Russian citizens and 3 Russian companies where charged for trolling  on social media and  supporting  demonstrations against  2016 U.S. Presidential election candidate Hillary Clinton2.

The combination of traditional military methods with information manipulation to achieve political and strategic goals refers to hybrid warfare. The Russian Chief of General Staff General Gerasimov advised it in 2013 by integrating asymmetrical actions combining Special Forc es – such as the “little green men” (i.e. masked and unmarked soldiers during the 2014 Crimea annexation) with information manipulation to establish a perpetual sensation of tension and unpredictability.

Russia’s Successes

This approach produced three operational  field  successes3. With the 2008 Georgian war,  Russia used for the first time cyber PSYOP and cyber attacks towards Georgia’s state, media  and critical infrastructure. The invasion resulted in the de facto independence of Abkhazia and South Ossetia. This was a clear action to stop the eastward spreading of the UE and NATO  and to prove that the Russian army can effectively wage combined military operations abroad.

In Syria, the Russian intervention seized the opportunity to demonstrate that it  is  back  at  the core of the international playing  field.  The media coverage on the Mashriq  region was  exploited by nourishing it with propaganda, disinformation and fake news on social media.

Finally, the 2014 Crimea annexation employed a mixed strategy; as leverage  internationally towards Europe and the U.S., and domestically to fill the glass of patriotism. Clearly,  it was beyond belief that Russia would abandon its Sevastopol military harbor, its unique access to the Black and the Mediterranean seas, which have highly strategic values. Regarding these latest successes, this new  doctrine might be used in “frozen conflicts” such as in the Balkans, Transnistria, Nagorno-Karabakh, the Caucasus, or Central Asia4.

2 APUZZO Matt & LAFRANIERE Sharon. “13 Russians Indicted as Mueller Reveals Effort to Aid Trump Campaign”, NY Times, 16 Feb, 2018

https://www.nytimes.com/2018/02/16/us/politics/russians-indicted-mueller-election-interference.html

3 DEVELLE Yuji. “Russia’s Pact with the Devil”, WonkBridge, Mar 17, 2017

https://medium.com/wonk-bridge/russias-pact-with-the-devil-a8fe72a3c076#.f73c7uwx0

4 CHAUSOVSKY Eugene. “In Europe’s Borderlands, the Winds of Change Blow in Every Direction”, Stratfor, Feb 28, 2017 https://www.stratfor.com/weekly/europes-borderlands-winds-change-blow-every-direction

Private Sector not Spared

The private  sector is no stranger to these cyber PSYOP as politics and economics are intertwined. Based on a cost/benefit ratio, hacker groups employed  by  governments  avoid  a “front cyber assault” that would request too much effort to reach their objectives. Therefore, to attack a government, the higher cost/benefit ratio is to target a  third  party  or  an  employee outside the internal network, like at home or in his/her favorite coffee place.

Consequently, a company can be the subject of an APT that will have a business impact on the performance (interruption of services), loss of clients and share value because the reputation is affected (as you suffered a data leak) and, worse, the loss of trust of its clients and the market  (the basis of our modern economies).

The objective might be pecuniary but also political. A company can be a proxy for a political message. In its latest report, Global Malware Report 20175, the Comodo Threat Research Labs established links between  the outbreak of malware activities  and geopolitical events  and  tensions. Therefore, even if you do think that your business will not be impacted by these states’ quarrels, you are miscalculating your risks.

About the Author

Julien Chesaux is a Cyber  Security Consultant at Kudelski Security, a Swiss and American cyber security company. Julien mainly works on cyber security, information security and geopolitics analysis in order to help clients to find solutions regarding their threats. He is also a mediator and writer for the Swiss Think Tank Foraus and the co- founder of the www.stralysis.com. He has worked in diplomacy and cyber security for seven years  in Switzerland, Australia and France. His main research interests are Global Security, Cyber Geopolitics, and International Affairs.