NATO expert: Russians have it right — it’s information security not cyber
In international discussions about cybersecurity, there’s a long-recognized disconnect on vocabulary: The U.S. and its Western allies conceive of cybersecurity as a technical issue — the protection of software against malicious code. Russian officials talk about information security, and it’s a much broader concept of ensuring the integrity of their political and social structures by controlling the information their citizens have access to.
Now one cybersecurity expert says the Russians may have the right idea.
“The accusation always was that this [concept of information security] was just about censorship,” Kenneth Geers told CyberScoop in an interview at RSA conference.
But the broad information operations launched by Russian intelligence agencies during last year’s election campaign — in which the cyber-enabled theft of personal correspondence from democratic political operatives was amplified by carefully timed online document dumps and automated bot armies on social media — have demonstrated the importance of “information security” to Western societies, as well.
“After the 2016 election, it’s starting to look as if the Russians had the right idea,” Geers said. “We now understand that information security is an issue for us, as well.”
A senior U.S. government official confronted with Geers’ observation acknowledged that the Russians “have turned the open information society against itself.”
“It’s difficult to know how to respond” to Russia, said the official, who asked to remain anonymous because they are not authorized to speak to the media.
Geers, who is an ambassador for the NATO Cooperative Cyber Defense Centre of Excellence in Tallinn, Estonia, and senior research scientist with cybersecurity company Comodo, has been studying cyber and information warfare for the better part of a decade.
As long ago as 2009, he predicted the use of bot armies on social media.
“In the future, computer botnets may evolve from spam and Distributed Denial of Service generators to semantic creatures that can post opinions, arguments and threats on the Internet,” he wrote.
“We should have seen this coming,” he said of Russian interference in the 2016 election campaign, calling it “the greatest hack of all time.”
Instead, public attention and government concern were fixed on the possibility of cyberattacks aimed at changing vote tallies by hacking into state and local government systems or voting machinery, not on information operations aimed at hacking the voters themselves.
Many observers believe the constant drip, drip, drip of revelations from the personal email of Hilary Clinton’s campaign chairman John Podesta — posted by Wikileaks and then reported by news organizations — helped lose her the election.
“This is not just cybersecurity, it’s not even just the internet,” said Geers, noting the role of the Kremlin’s English-language RT cable television network. “It’s much bigger than that.”
RT’s American reporters were “middle America talking to middle America,” he said, with a constant stream of stories that fed the Trump campaign narrative about the fate of small towns whose economies were destroyed by rapacious Washington elites.
“They understand ‘hearts and minds’ better than we do,” Geers said of Russian intelligence.
Germany and France have national elections this year and officials from both countries have said they are concerned about possible Russian efforts to influence the outcome.
So, how should democratic societies respond?
“I don’t recommend that we over-react,” said Geers, “In my view, on the long arc, we are headed in the right direction.
Facebook and Google have both said they want to solve the “fake news” problem, he noted, though he added, “They have a conflict of interest.”
Internet companies make money based on user engagement, he noted, and research suggests that readers will engage with stories that reflect their own biases whether they are fake or not.
In the long run, he predicted, “The internet is going to fix itself.”
