A report that gives an account of what is widely believed to be Kremlin-sponsored hacking activities in cyberspace intended to interfere in the US presidential election was released in January 2017.
A closer analysis of the document compiled by three American agencies – the FBI, the CIA and the NSA – and some broader observations suffice to conclude that other democratic states, including Poland, are also at a considerable risk of being targeted by similar operations.
It is high time we adequately prepared ourselves for this plausible scenario.
Since time immemorial, Russia has been very successful at using the classic form of information warfare that involves collecting, defending and manipulating information to pursue its political goals.
The analysis of Russia's strategic documents, such as the Information Security Doctrine, demonstrates that the Kremlin attaches critical importance to information influence. Despite all the knowledge we have accumulated so far, the events in the US took us aback by showing how effective and powerful these types of operations can be.
However, such spectacular results could only be achieved by harnessing state-of-the-art technologies. It seems that, having learned the lessons from its previous exploits, Russia has started employing methods that are better aligned to its opponent's circumstances.
No doubt cyberspace has revolutionised the way information warfare is waged nowadays. Digital instruments are used on an unprecedented scale to gather, influence, share and disseminate information. Such acts of manipulation are likely to yield grave consequences, particularly for those countries in which unfettered access to information underpins their model of functioning and which live by the principle of transparency in public life and public trust.
This type of warfare has so far played a rather supportive role, supplementing conventional operations aimed at accomplishing a particular goal. Today, however, cyberspace has made it a strategic resource in conflict, whereby a skilful use of available tools may lead to “subduing the enemy without fighting,” as Sun Tzu, an accomplished Chinese strategist, once highlighted. This famous quote is more up to date now than it has ever been.
The incidents in the US demonstrate that by using information one can influence an opponent in such a way that he will actually start acting according to an attacker's plan. The apparent effectiveness of the Russian strategy lay in engaging incredibly efficient digital instruments in order to strike at the very foundations of a self-ruling state – democratic elections. In addition, the conveyed messages struck a perfect chord with the sentiments prevalent in the American society.
In this context, the key question to ask ourselves is: while executing their policy, will different actors increasingly shift the “centre of gravity” from conventional to digital operations? The latter ones not only pose less political risk – they are also safer and cheaper. The US presidential campaign is by no means the first occurrence of information warfare in cyberspace specifically targeting the election process. However, none of the previous attempts were as effective as this one. Earlier, some efforts to interfere in the election campaign could be observed in Ukraine. When it comes to the US, the hostile operations were successful because the attackers drew plenty of conclusions from the series of events that had taken place in cyberspace over the last few years.
Cyber scenarios
By analysing the options for conducting cyber-operations, we can distinguish three model scenarios. The first involves direct manipulation of election results and has most disastrous consequences. This goal can be achieved by breaking into voting systems and fabricating election results. However, this is very hard to do, not only due to technical limitations, but mainly because many countries still produce paper ballots as backup.
The second scenario, despite being technologically less sophisticated, has far greater chances of success. Its aim can be not so much to totally manipulate the election outcome as to undermine voters' trust in this core part of the democratic process, its course and results. All you need to do is to sow the seeds of doubt about the legitimacy of the elections.
For some portion of the society, especially the one backing a defeated candidate, this will make a good enough argument to challenge the overall election result. It will also undermine the legitimacy of the winning party. As a consequence, the state may drift towards internal chaos, with the government facing a high risk of weakening its political power and erosion of public trust. Playing the game with such an opponent is much easier – likewise influencing his behaviour and decisions he makes.
For example, societies and governments set against one another and preoccupied with internal conflicts will be far less willing to engage in active foreign policy. The problem of challenging the correctness of the election results can also undermine the country's credibility and shake its international position, rendering its policy considerably less effective. From the point of view of potential adversaries, this makes it an incredibly favourable turn of events.
The third and last scenario involves operations that affect the course of the election campaign itself, having a tangible impact on how voters vote. To this end, digital instruments can be engaged in myriad ways, including attempts to discredit one of the candidates. Ultimately, the attacking party will favour the victory of a contender who seems more “appropriate” when it comes to furthering its own interests.
The analysis of events in the US as well as the joint report released by the US agencies conclude that the Russians acted out the third scenario in an exemplary manner.
During the election campaign hackers conducted offensive cyberspace operations to attack the Democratic Party's ICT systems and hack into the most prominent Democrats' email accounts. Stolen information showing Hillary Clinton's campaign staff and advisers in an unfavourable light was then artfully disseminated using formerly tested channels such as WikiLeaks. No doubt, the perfect alignment of the narrative and message with the sentiments currently prevailing in the American society means that all the lessons from the past were fully taken on board.
The very fact of using the WikiLeaks portal, commonly viewed as a vehicle supporting the “transparency of public life”, was a skilful manoeuvre to reinforce the effects of the hackers' insidious efforts. Spread around in the spirit of protecting the values that a civil society holds dear, the public “exposure” of officials' wrongdoing had multiple consequences, also political.
In this case, the target was the American public which was supposed to create a particular mental image of Hillary Clinton based on the information disclosed. In addition, it revealed the candidate's blatant mistakes such as the use of private email to handle work-related correspondence while secretary of state. This fact tarnished Clinton's reputation, portraying her as a person unworthy of the Office: careless, untrustworthy, entangled in the dirty games played by the political establishment and too detached from the ordinary citizens and their problems.
If we assume that the underlying goal of information warfare is to spread disinformation, wreak political chaos, manipulate public opinion and play upon particular negative sentiments in order to achieve a desired socio-political effect, it becomes quite obvious that troubled Europe, and Poland, is highly likely to also be exposed to similar operations.
Polish society is currently extremely polarised. There are plenty of thorny social issues that can be exploited to push both ordinary citizens and political forces further apart or even set them against each other. This could significantly weaken the entire country. And a weak opponent is particularly prone to manipulation, which would make Poland an easy and attractive target. In fact, we can already see some signs of information warfare being waged in Polish cyberspace. Is this the beginning of an advanced information campaign intended to affect Warsaw's policy? Unfortunately, no one can rule this out.
To counter foreign disinformation operations, Poland needs to execute its policy very carefully. This will require enormous effort combined with prudent domestic policy, social awareness-raising and intense work of all our state services.
In this context, it is worth considering the establishment of a dedicated body to counter information warfare. It is one of the key takeaway points formulated during last year's European Cybersecurity Forum – CYBERSEC.
As the example of the US demonstrates, such an initiative might prove instrumental in securing our country's vital interests.
* The 3rd edition of the European Cybersecurity Forum (CYBERSEC) will be held on 9-10 October 2017 in Krakow, Poland. More information will follow soon.
* Author: Dr Joanna Świątkowska, senior research fellow at the Kosciuszko Institute and Programme Director for CYBERSEC.
* The views expressed in this blog are those of the author and do not necessarily reflect the views of SC Media or Haymarket Media.
