The Future of Democratic Threats is Digital

CYBERSEC EUROPEAN CYBERSECURITY FORUM - Kraków, Poland - Technology has transformed the geopolitical landscape and nature of conflict, said Sean Kanuck, director of Future Conflict and Cyber Security at the International Institute for Strategic Studies last week.

"Cyber operations are being used to achieve traditional, economic, political, and criminal ends," he emphasized in his keynote for the conference's State track. "The challenges to global interoperability are not limited by physical connectivity of networks."

Kanuck listed a few key strategic trends in cyber conflict: offensive operations below the level of armed conflict, private sector companies as enablers and targets, automation and higher visibility, collateral damage, and data manipulation and fabricated information campaigns.

Cyberattacks to influence democracy are stealthier; crafted to cause uncertainty. "What we actually see is nation-states intentionally operating below the threshold of armed attack that would lead to military response," he explained. "Citizens are unsure who perpetrated attacks."

The idea of compromising users' trust in the democratic system is at the foundation of many geopolitical threats, said Janis Sarts, director of the NATO Strategic Communications Centre of Excellence in Latvia. He pointed to recent attacks on voting systems as an example.

"When you think, 'What is the fundamental element of democratic society?' -- that is elections. We trust it will bring us results," he explained in a panel titled "From Cyber With Love: Digital Threats to Democracy."

"If you take away trust, either by hacking or by making people believe you did, it's enough," he continued.

Michael Chertoff, cofounder and executive chairman at the Chertoff Group and former US Secretary of Homeland Security, pointed to attacks on integrity of information and their ability to manipulate people. He pointed to attacks on media and advertising as an example.

"We haven't really appreciated what it means to lose control of information, including information about ourselves," he said. "The EU is ahead of the United States in realizing what it means to have someone else control your data."

Threats to critical infrastructure

Some threats don't target citizens' trust but critical infrastructure and the economy.

"The IoT and poorly designed devices that are easily infected present a real threat to the US economy," says Melissa Hathaway, president of Hathaway Global Strategies and former cybersecurity advisor for the George W. Bush and Barack Obama administrations, in an interview with Dark Reading.

"There needs to be an urgent focus on the few problems that affect many," she continues, citing energy, telecommunications, and finance as three sectors vulnerable to cyberattacks. "It's easy to disrupt service and get malware to destroy capabilities, and we lack resilience."

Hathaway emphasizes the importance of collaborating with allies, fixing infrastructure, and focusing on trade and diplomacy. Right now, the United States is more worried about cyber weaponry than how cyberattacks could influence its economic structure, she explains. Cybersecurity isn't always about inbound weapons, but about economic opportunity based on how actors change market forces.

We need to engage -- and right now, she says, the US is not engaging. It's critical to work with all nations in diplomatic exchanges, not only those which are like-minded. "I mean real diplomatic negotiations, understanding what the other side wants," Hathaway explains.

The Internet is core to international interactions, trade negotiations, and communications technology. It could present a real risk, and any nation could abuse it. "Anybody can be a geopolitical threat depending on how they use or misuse technologies and market forces," she says.

Fellow experts agree the issue of democratic threats is as much about public policy as it is about tech.

"Cybersecurity lies at the interface of a number of different areas -- home, abroad, civilian, and military," said Sir Julian King, European commissioner for the UK Security Union, in his opening keynote remarks. "Many different actors need to be involved when [a cyberattack] happens, and they need to work together swiftly and efficiently."

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.