Countering Adversary Attacks on Democracy Thought Leader Summary In 2016, Russia, in an unprecedented way, massively interfered with our elections in a way that was better organized, better coordinated and with a set of tools that caught our political system, our legal system and in many ways, our intelligence community totally off guard. - Senator Warner Mark Warner U.S. Senator from Virginia, Vice Chairman Select Committee on Intelligence Harvey Rishikof Advisory Board Chairman, American Bar Association Standing Committee on Law and National Security Thursday, November 15, 2018 5:00 pm - 6:30 pm CSIS https://www.csis.org/events/countering-adversary-attacks-democracy-its-not-just-about-elections
How did they make that interference? 1. They weaponized information that they had stolen through cyber activities Russian spy services and work outsourced to the IRA (Internet Research Agency), found ways to penetrate the Democratic and Republican political parties What they did differently, rather than to get that information and then hold it for potential compromise, they immediately weaponized that information in a way to help then-candidate Trump and hurt then-candidate Clinton They broke into the DNC and key advisors of candidate Trump and candidate Clinton - very politically well-timed release of that information to its maximum benefit to help Trump and hurt Clinton 2. Russia tested or broke into at least twenty-one state electoral systems We didn't appreciate how vulnerable we were and they were probably astounded to see how open and vulnerable these systems were The Russians left behind so much digital dust - indicates they didn't try to hide their steps with the assumption that they could use that information after 2016
How did they make that interference? 3. Russia massively manipulated our social media platforms in ways that caught the intelligence community and the platform companies off-guard Nobody considered how these great tools can bind people together and also manipulate people to turn their fears against one another 4. The effectiveness and cheapness of this effort was an 8 out of 10 If you add all the resources the Russians spent on our elections, the French elections and the British Brexit vote --> total cost was less than one F-35 airplane We spend $716 billion on defense and Russia spends $70 billion on defense Sometimes worry if we are buying the best 20th century military stuff where most of the conflict in the 21st century may very well be in the domains of cyber and misinformation / disinformation, where Russia is our peer already
Where do we go from here? Now, much work is in the special prosecutor's investigation path Enormous additional tools are available, like bringing people into the criminal justice system In 18 months, six guilty pleas and over 30 indictments issued Need to protect the integrity of the Mueller investigation and allow it to finish its work and recognize the value of protecting the Mueller investigation Recent NY Times article on Facebook - the fact of how Facebook was totally dismissive for months on end that there was any there, there, in terms of Russian manipulation - Facebook refused to acknowledge the problem and for a long time after the fact, thought that if after a time, we in Congress and others would simply go away At the moment when Facebook senior leadership testified and claimed that they saw the error of their ways and were ready to work with the committee, they hired political opposition firms to undermine the credibility of the committee members themselves - not the actions of a company who understands the threats, the challenges and the responsibility they bare to all of us
The actions that Russia took in 2016, we should not have been caught so off guard Russia leadership stated that they can only complete with the West with cyber, misinformation, and disinformation - Russia had practiced for years on their own people, Baltic neighbors, and in the Ukraine (years prior to 2016) After the 2016 incursion, ODNI Coates, at a NATO meeting, asked members how many had seen evidence of Russian interference in their politics or elections - response was unanimous When President Trump met with Putin in Helsinki, fifteen European country Parliamentarians, and the U.S. Senators, met in Washington DC to talk and learn about Russian intervention To confront this new challenge, we need strong allies, an alliance amongst the West writ large to realize this new potential threat of cyber, misinformation, and disinformation It isn't about one political party over the other but the Russians as advocates of undermining the West's faith in democratic election systems for external use and domestic use (point out failings in our systems so their system isn't so bad)
Updates since 2016 Cyber protections - U.S. national, state, and local governments are more aware, the Intelligence Community is more active in monitoring, better cyber hygiene Still have Russian interference U.S. is better but still not fully protected - now, the 2016 Russian playbook has been copied by other countries (China, Iran and potentially other adversaries) A most vulnerable spot is cyber hygiene around campaigns which are akin to a start-up - need to ensure cyber protection and cyber hygiene from the beginning U.S. lacked a cyber doctrine since 2000 - Trump administration has produced one
Updates since 2016 Election Systems - now, virtually all machines are not connected to the Internet but vulnerabilities remain: Where voter files reside - three companies control 95% of voter files and their security is unknown Machine-level - DHS has a system to monitor all machines but there is no voter-security coordinator at the White House and the White House cybersecurity position was eliminated Congress put forth $380 million to U.S. states in order to to improve security A bipartisan Secure Elections Act, that will ensure every voting machine has a paper backup and an auditing system post-election, was prevented from getting to the Rules Committee (broader bipartisan support was needed) - more work is needed
Updates since 2016 Social Media - Russian-paid political advertising was not their main effort - most activity was with fake accounts who built followings - examples --> Alabama football fans or fans of gardening or fans of cooking - build the base and then slowly seed that base with propaganda Have not seen the level of cooperation needed from these three social media companies Facebook - 160 million Americans were touched by Russian propaganda Twitter - over 100 million American were touched by Russian propaganda Google - have kept quiet and failed to show for testimony - YouTube may be the best vehicle of all for Russian propaganda and for radicalizing individuals The guardrails of social media do not fall in the Democrat-Republican debate
Senator Warner used to work in the tech sector (wireless industry) Grew up with the U.S. as the tech leader in innovation and the following policy innovation In areas like 5G, quantum computing, and artificial intelligence, we are loosing that edge Privacy - what rights do we have, as social media users, to be delisted and to have some levels of privacy? General citizenry has concerns about what the government knows about the individual but less about social media companies, who know a lot more about individuals than the government Europeans have their GDPR (General Data Protection Regulation 2016)
Identity Validation - A reason the Russians were successful using social media was that they could create fake persona and people would follow that persona based upon the assumption that the individual was who they said they were as opposed to a foreign entity Right-to-Know - Individuals should have a right to know if contact is by a human or a machine - within the far-left & far-right, about 25 to 1 are foreign-based bots over actual Americans Geocoding - Joanne from northern Virginia might show up as in St. Petersburg Anonymity - Can you still maintain it? An idea is to have two Internets with one where you can be anonymous with the dark web and the other (commerce) where you must validate your identity Competition - Consider being able to move all your files from one platform to another platform - data portability and interoperability would allow new competition and allow people to opt onto platforms with greater levels of protection Transparency - Free services are not free - individuals should have the right to know what data Facebook as on them - should know what your data is worth (say $25) and have that price offered you in exchange for a level of protection
Questions and Answers Q - Will results from the mid-term elections impact your investigations? A - Have had approximately 140 witnesses - don t think much will change - continue to follow the facts and bring those facts out to the American public A - Politics is about 60% policy and 40% personal trust - trust remains - would like for the Mueller investigation to produce most of their findings prior to the change of House leadership in order to tamp down conspiracies Q - Thoughts on legislation to protect the Mueller investigation? A - There was bipartisan support for legislation out of committee - Senator McConnell stated that he didn t think it was needed so it did not go further Q - Prior to the 2018 elections, Russian-affiliated social media accounts and those pushing Russian narratives were pushing caravan stories and older stories - how do we begin to build public resilience as future elections come near? A - People say, I read it on the Internet. Part of our education system moving forward, has to have a portion on technological literacy and democracy so people become better discerners of information - the volume of information sources available is a challenge A - Sweden educates its citizenry to spot false information and foreign intervention A - Identity validation, bot vs human indicators, geolocation and similar should be looked at A - Discussion of incitement to violence in Myanmar through Facebook
A - We will look back on 2016 and realize how primitive or crude the tactics were with any kind of historical reflection - what happened in 2016 had a cyber attack and a social media attack, to the enterprise A - By 2020, when cyber and misinformation / disinformation are merged, something like an Equifax breach, followed with a telephone call with challenge-question answers, followed by deep fake technology used in a live-stream video of a politician, religious figure or similar, will make 2016 look simple - the ability to move markets and more will be possible, possibly Q - This is the perfect tool for Putin to attack the truth, to undermine the courts or the media or sources that pervade the truth A - This is not a Russian-only phenomena - Now, American politicians regularly tell lies and half-truths Q - What should we do to strengthen our resilience against these types of measures? A - We proposed an Honest Advertisement Act which said that you have to use the same rules for social media ads as you have for television or radio - did not have enough bipartisan support so we have half-measures from the platforms - self-regulation will not cover all the social media platforms
Q - FISA (Foreign Intelligence Surveillance Act) has three provisions that sunset at the end of 2019 and Russian bots are training their sights on FISA - how concerned are you on this? A - Need to have Americans become better consumers of information they receive over the Internet - our delineation of how we use surveillance A - If Boris, online, looks like Gary from McLean but is in St. Petersburg, the CIA or NSA is on the case but once Boris presses send and the information is on your screen, the CIA or NSA have to throw all their work over the transom and it now becomes the responsibility of DHS and FBI - these barriers should exist - the extent the government goes to protect private citizen information is significant - private industry and China does not do this as much - this has to be sorted through Q - Is resourcing the judiciary a federal or state obligation? A - A great reluctance exists from a state judiciary, to have any kind of federal interference A - As an analogy to election systems - there was great resistance to making election systems, critical infrastructure - not much resistance now A - A great dilemma now - Internet of Things - no minimum security standard exists now and trying to get industry to agree on a standard is extremely difficult Q - What is the responsibility of the individual? Is there a need to re-energize the need for democracy? A - We need education in a 21 st century frame - a sense of digital civics education - we need to NOT be loose with the truth as once the genie is out of the bottle, it is hard to get back in