29 September 2020

The Real Hacking Threat

By Elisabeth Braw

“Ahead of the 2020 U.S. elections,” National Counterintelligence and Security Center Director William Evanina declared in an Aug. 7 statement, “foreign states will continue to use covert and overt influence measures in their attempts to sway U.S. voters’ preferences and perspectives.” Such activities may be less dramatic than an armed attack, but they’re even more sinister. And although there are ways to counter them, the United States is running out of time to get it right.

In the run-up to the November vote, the United States’ rivals, Evanina explained in his remarks, will try to “shift U.S. policies, increase discord in the United States, and undermine the American people’s confidence” in their democracy. In his agency’s assessment, while China works to discredit U.S. President Donald Trump, Russia is aiming to undermine Democratic presidential nominee Joe Biden.

But “it’s not about that election or the other, that candidate or the other,” Marko Mihkelson, a member of parliament for Estonia’s liberal Reform Party, said in August. Mihkelson is no stranger to foreign meddling in elections. Ever since Estonia gained independence from the crumbling Soviet Union in 1991, Russia has needled it with disinformation campaigns and cyberattacks. Most of the time, Mihkelson argued, interference isn’t really meant to sway the vote toward one side or the other. In an interview with PBS, Alex Stamos, Facebook’s chief security officer during the 2016 U.S. presidential election, concurred. In a discussion about Russia’s Internet Research Agency (IRA), which posted misleading content to social media ahead of that year’s vote, he noted that “90 percent of their content had nothing to do with any candidate. It was really about driving division in American society.” It became painfully obvious that the gambit had worked when Americans found themselves disagreeing about whether Trump’s victory was legitimate.

The IRA is at it again ahead of this year’s poll. It has created fake Facebook and Twitter accounts and has set up a website intended for a left-leaning U.S. audience that subtly sows doubts about Biden’s record. According to the U.S. Department of Homeland Security’s Office of Intelligence and Analysis, Russia is also trying to discredit voting by mail. And U.S. National Security Advisor Robert O’Brien alleged in August that “China, like Russia, like Iran—they’ve engaged in cyberattacks and phishing and that sort of thing with respect to our election infrastructure.” In September, Microsoft added a warning of its own, reporting that a Russian hacker group had struck over 200 organizations involved in the election campaign, that a Chinese group had gone after key personalities in Biden’s campaign, and that Iranian hackers targeted people in Trump’s campaign. Microsoft said most of the attacks were stopped by its software.

But whether the United States’ rivals actually do hack the country’s election infrastructure this year is almost beside the point. What matters is people’s belief that interference campaigns are working. A February poll by the Economist and YouGov showed that a majority of Americans don’t think their country can defend itself against foreign election interference. Whatever the outcome in November, then, there’s reason to believe that supporters of the losing side may believe that foreign powers sabotaged the vote and will insist on the result’s invalidity. In that sense, it doesn’t matter whether China, Russia, or any other country in fact manages to sway the ballot. What matters is whether voters believe they did.

It doesn’t matter whether China, Russia, or any other country in fact manages to sway the ballot. What matters is whether voters believe they did.

And that is the kind of influence operation the United States needs to fight. To do so, Washington should launch influence operations of its own, geared toward convincing American voters that the 2020 election will reflect the will of the people. Although important, a quiet upgrade of U.S. election software alone won’t sway the public; communications to hostile governments and their helpers that they will suffer consequences if they attempt to mess with voters might.

To be sure, as a liberal democracy, the United States has to recognize that it is particularly vulnerable to sundry forms of meddling. Freedom of expression provides would-be interferers with a smorgasbord of often divisive homemade opinions to disseminate. What’s more, since liberal democracy’s very foundation is the majority’s conviction that their voices count, eroding that trust constitutes the biggest bang for a rival’s buck.

That is why resilience is paramount: informed citizens who check the provenance of social media content before reading or sharing it, social media companies that filter out content generated by undeclared state-linked entities, and trusted election infrastructure that can better withstand cyberattacks.

During the Cold War, Sweden perfected a “total defense” model that saw large parts of the population involved in defending their country against Soviet aggression. Tasks included providing vehicles to the armed forces and training in crisis management. The same can be done in defense against election interference. A citizen who merely hears about meddling will feel despondent, while a citizen who is offered concrete guidance on how to curb it is likely to feel empowered. Americans could follow the lead of enterprising Lithuanians and form citizen groups to ferret out suspicious online content. These groups call themselves “elves”—the opposite of trolls. And who wouldn’t want to be an elf for their country?

After resilience comes counteraction, and that means retaliating against meddlers. The United States is not going to respond militarily, which is part of why interfering in U.S. elections is appealing to begin with. Should the United States tinker in Russian elections to punish Vladimir Putin? He says it already does. “The United States, everywhere, all over the world, is actively interfering in electoral campaigns in other countries,” the Russian president told then-NBC News host Megyn Kelly in 2017. He has a point. In 1948, the United States was so concerned about a potential Communist election victory in Italy that it energetically intervened on behalf of the Christian Democrats, who won. The United States has tried to steer the outcome of assorted Latin American elections as well as Serbia’s 2000 presidential poll. But such hypocrisy makes things worse.

Instead, a more productive retaliatory effort would bank on surprise. If a country interferes, the United States should punish it in a time and (nonmilitary) manner of its own choosing: a public relations version of asymmetric warfare. Call it second-strike communications. Washington could, for example, retaliate against Russian or Chinese intrusions by releasing information about those countries’ leaders, including which of them have children at U.S. universities or how many bank accounts they have in the United States.

To date, Western governments have mostly punished such leaders by freezing their assets, but humiliation may be more effective. Sure, nobody likes losing access to their money, but reputation matters more than treasure. And apart from leaders like Putin and Xi Jinping, most officials in countries hostile to the West are not household names; in fact, they’re hardly known abroad at all. Gaining sudden notoriety as a hypocrite who tries to harm the West while owning property there is a sobering prospect.

Humiliation may be more effective than freezing assets. Nobody likes losing access to their money, but reputation matters more than treasure.

The Godfather could also provide inspiration. In director Francis Ford Coppola’s masterpiece, Jack Woltz, a Hollywood executive who had refused to give Don Vito Corleone’s godson a movie role, wakes up to find the severed head of his beloved horse next to him in bed. Woltz gets the message and gives Don Corleone’s godson the role. Prior to the 2018 U.S. midterm elections, U.S. Cyber Command used such a strategy, obviously without referring to it as such. Cyber Command soldiers reportedly left hints for Russian would-be meddlers that American operatives had identified them and were tracking their activities. It seemed to work: The 2018 elections proceeded without significant Russian interference.

The Godfather strategy works because it targets individuals rather than governments. An American threat of revenge against the government of Russia or China would not frighten Moscow or Beijing because they know that the United States wouldn’t risk serious escalation. But individual hackers may be keen to avoid being banned from visiting New York or maintaining U.S. bank accounts.

This summer, the European Union used such punishment for the first time, imposing travel bans on four Russian intelligence officers and two Chinese hackers. Since then, there have been no serious attacks on the union that could be linked to the Chinese or Russian government. At the same time, the U.S. government’s indictment of four Chinese military officers over the 2017 Equifax hack hasn’t ended Chinese cyberattacks on the country nor, as polling indicates, has it convinced the public that the problem is under control. That’s reason for governments to be louder about the punishments they mete out. Western officials should repeatedly mention any travel bans, bank account freezes, and criminal charges their governments impose. That way, citizens grasp that their government is capable of defense and that, by extension, so are they.

The State Department, for its part, is trying to up the ante by offering rewards of up to $10 million each for those who report would-be cyberattackers targeting U.S. election infrastructure. The initiative is part of the government’s Rewards for Justice program—a program that had until now offered bounties for notorious terrorists. The scheme may sound dubious, but with the election around the corner, even a Hail Mary pass is worth a try. Even one election meddler turned in by a colleague or acquaintance would be an important victory for the United States, not least in the all-important realm of public perception.

Just as ordinary Swedes did their part for national defense during the Cold War by lending their cars and tractors to the armed forces, Americans themselves must play more active civic roles. In turn, they will realize that the sanctity of their elections truly is in their hands, whether the president uses his office to communicate to the public that the vote is unassailable—or not.

No comments: