The United States faces a growing threat of information warfare attacks and needs new strategies and organizations to counter it, national security experts told Congress this week.
John C. Inglis, former deputy director of the National Security Agency, said cyber attacks are only one form of influence, propaganda, and disinformation attacks being waged in the cyber war of ideas.
"Cyber warfare, in my view, is not a standalone entity," Inglis told a Senate subcommittee hearing Thursday. "When you're talking about information warfare, it's at that top-most stack, and it does not necessarily comprise of an exchange of tools or an exchange of literal warfare. It is, in fact, a conflict of ideas."
Inglis called for a new approach to information threats.
"We need to stop reacting well and thinking that we've therefore done good and start to drive and perhaps lead in this space and at least anticipate well or track well," he said during a hearing of the Senate Armed Services subcommittee on cyber security.
The United States must aggressively tackle the problem, Inglis said.
"We can use the techniques that have been used against us, but we should never compromise our values, and there's a distinct difference between those two," he said.
Rand Waltzman, a specialist on information warfare with the RAND Corp., told the subcommittee the U.S. government needs to review and revamp laws and polices in the information warfare realm in order to better fight influence warfare.
"Operations in the information environment are starting to play a dominant role in everything from politics to terrorism to geopolitical warfare and even business, all things that are becoming increasingly dependent on the use of techniques of mass manipulation," Waltzman said, adding that information warfare operations "occur at a speed and at an extent previously unimaginable."
Technical cyber security means, the focus of U.S. government and private sector efforts, are ill-equipped to handle influence warfare. Waltzman called for new capabilities called cognitive security.
An example was the domestic information attack launched by the Russian government in 2011 prior to the country's legislative elections. Anti-government dissidents had organized a demonstration using a Twitter hashtag. When the Russian government found out, it flooded Twitter with gibberish tweets using the hashtag at a rate of 10 tweets per second, effectively preventing the demonstrators from using the social media platform to issue instructions.
Twitter did not stop the onslaught because it did not violate the platform's terms of service.
Michael D. Lumpkin, a former State Department strategic messaging official, criticized the U.S. government's capability to counter disinformation and promote its messages as outdated and stifled.
"We are hamstrung by a myriad of reasons, to include lack of accountability and oversight, bureaucracy, resulting in insufficient levels of resourcing and an inability to absorb cutting-edge information and analytic tools, and access to highly skilled personnel," Lumpkin said.
At the same time, Lumpkin said America's enemies are increasing their capabilities and investment.
"This, while our adversaries are increasing their investment in the information environment, will not be constrained by ethics, the law, or even the truth," he said.
Clint Watts, a former FBI agent and specialist on information operations, said Russia is the leading power in the use of information operation.
"Russia does five things that sets it apart from others in terms of influence," Watts said. "One, they create content across deliberate themes, political, social, and financial messages, but they hyper-empower those with hacked materials that act as nuclear fuel for information atomic bombs."
These information bombs power political groups and other profiteers in the social media space, further amplifying their messages.
Moscow also pushes its disinformation and propaganda in unitary campaigns that appear to come from different locations at the same time, through the use of covert and overt accounts as well as social media platforms.
Russia shares content through semi-linked and covert online personas in order to create a public impression that its propaganda is more established than it is, while pushing themes over long periods of time.
The result is that Russian information warfare messages are pressed "deep into the target audience," Watts said.
Russian trolls and others engaged in information operations target political opponents, whether politicians, media personalities, or "just people that don't like Russian positions," for long periods, he said.
Watts said countering cyber influence threats is a human, not a technical, challenge.
"American obsession with social media has overlooked several types of real-world actors that help enable their operations online," he said.
They include pro-Russian "useful idiots," including unwitting Americans who don't know they are using Russian information for political gain. Others are "fellow travelers" who back Russia and provocateurs who create incidents in a bid to drive Internet traffic.
Both the Islamic State's social media campaigns and Russia's influence operations need to be countered, in addition to the use of cyber means.
"When it comes to Americans countering cyber influence operations, when all is said and done, far more is said than done," Watts said. "We talk about it a lot, but we do fewer iterations than our Russian adversaries."
Watts said that when the United States has acted in the information operations space, "it hasn't been effective, and at worse it's been counterproductive,"
"Despite spending hundreds of millions of dollars since 9/11 on U.S. influence and information operations, we've seen the expansion of al Qaeda and the Islamic State," Watts said. "We've excessively focused on bureaucracy and digital tech tools, but at the same time these social media monitoring tools have failed to counter al Qaeda. They did not detect the rise of ISIS, nor did they detect the interference of Russia in our election last year."
Better knowledge of Russian information warfare and influence operations is needed. The American government also needs better and more accurate communications.
Watts called for jettisoning the so-called whole-of-government approach to the problem and instead creating a task force to address cyber influence threats.
Current government efforts focus too much on purchasing technical tools to analyze social media, he said.
The private sector also need to restore the integrity of information on social media sites, Watts said. He noted progress by Facebook, Google, and Wikipedia, which recently launched efforts to block foreign information operations.
Facebook on Thursday published a report on information operations that called for countering influence campaigns by governments and non-state actors to distort political sentiment, "most frequently to achieve a strategic and/or geopolitical outcome."
The social media giant said Russian influence operators used Facebook pages and false personas to spread stolen emails and documents during the 2016 election.
Watts said Twitter remains a holdout in efforts to limit foreign information operations.
"Twitter's actions, if they take them on parallel with Facebook and Google and the others, can help shape the Russian influence of the French and German elections going into summer," he said.
Waltzman, the RAND Corp. analyst, called for a new strategy to "make cognitive security a reality and counter this growing threat in the information environment."
A private research center outside government should be created that is devoted to research and development of policies, technologies, and techniques for information operations.
"The center would not be operational, but rather set research and development agendas and provide education and distribution of technologies and service to any of the communities that it would serve," he said.
Second, a government office, like the Pentagon's Office of Net Assessment, should conduct a study of current laws and policies that "currently make operations in the information environment difficult to impossible" and how they can be updated to reflect the current information environment. The study also should outline a new organizational structure for information operations.
Subcommittee chairman Sen. Mike Rounds (R., S.D.) said the panel has held two classified briefings on cyber threats and efforts to counter them.
Thursday's hearing focused largely on the Russian influence operation during the 2016 election, which was part of a program that dates back to the Soviet period.
Rounds said current cyber- and disinformation-related tools "have enabled Russia to achieve operational capabilities unimaginable to its Soviet forebear."
"Ultimately, we will continue to struggle with cyber-enhanced information operation campaigns until we address the policy and strategy deficiencies that undermine our overall cyber posture," he added.
"Our adversaries aim to leverage our distaste for censorship against us to delegitimize our democracy, influence our public discourse, and ultimately undermine our national security and confidence."
Sen. Bill Nelson (D., Fla.) noted the problem is not new and that U.S. efforts to counter it are deficient.
"Our government and society remain ill-prepared to detect and counter these powerful new forms of information warfare, or to deter them through the threat of offensive versions of our own information operations," he said.
Bill Gertz is the author of iWar: War and Peace in the Information Age that highlights information warfare threats. It is available at iwarbook.com.