Cyber Warfare Is Different Than We Expected

I have been working in cyber security for over 30 years. My first professional job in 1988, to build the first Network Security Monitor (NSM), came as a direct result of Cliff Stoll’s hacker (The Cuckoo’s Egg). Later that year, using my earliest tools, I watched live as Robert Morris’s Internet Worm worked its way across our computers, the earliest (accidental) large-scale cyber attack.

Over the years our community used the threats of a Cyber Pearl Harbor and later a Cyber 9/11 as both a sincere warning and an effort to drum up funding for our R&D efforts and businesses. We warned about the potential loss of life and the destruction of our critical infrastructures - the power grids, the air traffic control system, the phone system, the financial system, the military’s inability to communicate and operate during wartime, the destruction of much of the Internet itself and thus grinding our increasingly Internet dependent economy to a crawl.

The big cyber attack was going to be familiar. It was going to be about destruction.

But our imagination was limited. We were, as the saying goes, fighting the last war. Sure it would be different. The weapons would be cyber and not kinetic. But in our minds we were expecting cyber warfare to be about achieving the same effect as the kinetic weapons - destruction.

We forgot that the purpose of war is about achieving an objective, not causing destruction. It is one nation imposing its will on another nation. To paraphrase von Clausewitz in On War, “War is the continuation of politics by other means.”

We may yet see massive destruction carried out through cyberspace, but the first large-scale, nation-state warfare using cyberspace has been psychological warfare.

Below are three TED Talks that illuminate today’s large-scale psychological warfare. The first talk is about how businesses, for the purposes of creating massive profits, created the perfect weapons for mass psychological warfare. These are often referred to as “persuasion platforms”. The next two talks are about how Russia has been using these persuasion platforms (along with other techniques) in the US, Great Britain, and increasingly in other countries.

We’re building a dystopia just to make people click on ads

What we need to fear most is not what artificial intelligence will do to us on its own but how the people in power will use artificial intelligence to control us, and to manipulate us, in novel, sometimes hidden, subtle, and unexpected ways.

But it's not that the people who run, you know, Facebook or Google are maliciously and deliberately trying to make the country or the world more polarized and encourage extremism. I read the many well-intentioned statements that these people put out. But it's not the intent or the statements people in technology make that matter, it's the structures and business models they're building. And that's the core of the problem. Either Facebook is a giant con of half a trillion dollars and ads don't work on the site, it doesn't work as a persuasion architecture, or its power of influence is of great concern. It's either one or the other. It's similar for Google, too.

How (and why) Russia Hacked the US Election

Now, you'll be familiar of hacking and leaks that happened in 2016. One was the Democratic National Committee's networks, and the personal email accounts of its staff, later released on WikiLeaks. After that, various online personas, like a supposed Romanian cybercriminal who didn't speak Romanian, aggressively pushed news of these leaks to journalists. The media took the bait.

But what Russia was doing in 2016 went far beyond espionage. The DNC hack was just one of many where stolen data was posted online accompanied by a sensational narrative, then amplified in social media for lightning-speed adoption by the media.

So while hacked phone calls and emails and networks keep grabbing the headlines, the real operations are the ones that are influencing the decisions you make and the opinions you hold, all in the service of a nation-state's strategic interest. This is power in the information age.

Facebook’s role in Brexit - and the threat to democracy

But then after the article came out, this woman got in touch with me. And she was from Ebbw Vale, and she told me about all this stuff that she'd seen on Facebook. I was like, "What stuff?" And she said it was all this quite scary stuff about immigration, and especially about Turkey. So I tried to find it. But there was nothing there. Because there's no archive of ads that people had seen or what had been pushed into their news feeds. No trace of anything, gone completely dark.

And this entire referendum took place in darkness, because it took place on Facebook. And what happens on Facebook stays on Facebook, because only you see your news feed, and then it vanishes, so it's impossible to research anything. So we have no idea who saw what ads or what impact they had, or what data was used to target these people. Or even who placed the ads, or how much money was spent, or even what nationality they were.