Web Storm Rising

We are exposed. In September 2020, FBI Director Christopher Wray testified to Congress: “If you are an American adult, it is more likely than not that China has stolen your personal data.”¹ The scale of the theft—and number of affected Americans—is staggering: 22.1 million from the 2015 U.S. Office of Personnel Management (OPM) hack; 78 million from the 2014 hack of the insurance provider Anthem; and 147 million from the 2017 hack of Equifax, which alone included “nearly half of the American population and most American adults.”²

However, these thefts are only part of the concern. Americans consciously share extensive personal information online, and unwittingly generate volumes more that is collected from their digital wake. In aggregate, this data is making service members increasingly vulnerable. Adversaries will weaponize legally available technology originally developed for the online advertising industry and employ it against the United States, with national security implications.

User Data

While traditional print, radio, and television focused on managed one-way mass communication, internet-enabled communications (e.g., social media, blogs, and websites) enable content generation quickly and at scale, creating a “many-to-many” democratized distribution model. Users are not only consumers, but also producers of content shared through posts, tweets, and uploaded photos and video, much of which is personal. User account registrations may contain name, age, gender, marital status, political affiliation, sexual preference, and even education.

Users now play an important role in mediating content as they interact with it. This includes the ability to “like,” “share,” or “retweet,” feeding metrics about that content’s interest value. A prime example is the popular website Reddit. Reddit users post news and self-generated content into topical communities; other users can comment and vote it up or down, which increases or decreases its ranking and visibility.³ This interaction previously helped propagate Russian disinformation among voters during U.S. elections, and it will likely increase in the wake of real-world effects achieved by Reddit users manipulating financial markets in the GameStop saga.⁴

All this generation, accessing, and interaction leaves a digital trail, with data created and captured (for the most part legally) unbeknownst to the person navigating the web. This includes unique identifying information (e.g., IP and MAC addresses), peripheral information (e.g., location, device model, operating system, and browser), and raw behavioral data (web history, time spent on each site, and even hand mouse movements to determine where a cursor hovers and for how long).⁵ While collectively this yields a massive amount of data, the data alone is of limited value without tools to process, make sense from, and employ it. Guided by a business model based on maximizing advertising revenue through user engagement (screentime), technology companies have created powerful tools to monetize user data.

Microtargeting

The continuously generated user data yields specific user profiles.⁶ Web tracking software and cookies enable the collection of extensive information, which in aggregate sheds light on the behavior, routines, interests, preferences, and beliefs of the user.⁷ This information then enters a vast “digital advertising ecosystem,” where it is sold, merged with other personal information, and continually aggregated and resold by data brokers.⁸ Additional tracking algorithms make connections to infer unique users even as they transition across devices and platforms.

This process has enabled “microtargeting,” a highly refined “audience segmentation” tool for advertisers to precisely filter data-derived user profiles to deliver tailored content to specific audiences. Microtargeting enables the eerie personal specificity and relevance of digital advertising and gained wider prominence during the 2016 U.S. election. After modifying an existing Facebook app that asked users to answer personality-related questions, Cambridge Analytica deceptively collected identifying information and “likes” of the app’s users and their friends; this fed an algorithm that assigned personality scores to the users and their friends, matched those to voter records, and ultimately profiled voters for targeted political content delivered as advertisements.⁹ While the concept of using “psychographic profiles” to tailor messages for individual personalities and interests is not necessarily new, this episode brought it to public attention.¹⁰

The technology associated with microtargeting has advanced to “sniper-targeting,” with content tailored for extremely small predetermined groups.¹¹ For example, Facebook—with more than 1.5 billion users—allows advertisers to create custom audiences as small as 20 people.¹² Regardless of content, the recipients do not know the messages are tailored specially for them based on their predicted likelihood to believe and react to it.

Americans are particularly vulnerable to this threat. China and Russia take extensive measures to strictly control internet access and its content. Even the European Union has the General Data Protection Regulation that limits companies’ ability to collect and use personal data.¹³ The United States has less regulation (with the exception of California), and user data is largely collected, used, and sold with little user awareness.¹⁴ As such, adversaries do not need to exert much effort to develop collection capabilities or deploy teams to engage in close surveillance; they can acquire this information legally and cheaply from afar.

Operations Security

In 2018, researchers from the NATO Strategic Communications Center of Excellence conducted an experiment to determine what could be revealed about a large field exercise and its participants using only open source data, and whether that data could be used to “influence the participants’ behaviors against their given orders.”¹⁵ Before the exercise, the researchers established multiple social media accounts, message themes, and lines of persuasion.¹⁶

Once underway, researchers used general internet searches to reveal background information on the exercise from official sources, news, and social media posts. Researchers then used microtargeting approaches (including extensive employment of Facebook advertising) to identify attributes and profiles of likely exercise participants and invite them to join “honeypot” pages and user groups related to the exercise.¹⁷ On those forums, the researchers posed as soldiers and directly engaged them via group discussions to elicit information.¹⁸

The team was able to identify individual members taking part in the exercise, map out entire units based on identification of a single member using Facebook’s “Suggested Friends” feature, determine exact locations of several battalions, and gain knowledge of troop movements and key operational exercise dates.¹⁹ The researchers then applied social engineering techniques to elicit more personal information, including phone numbers and email addresses. Eventually, all participants targeted for social engineering provided requested pictures of equipment.²⁰ The researchers were able to “instill undesirable behavior” in some soldiers, including not fulfilling duties, with two soldiers lured from their posts to meet a fictitious woman from Tinder.²¹

An important point is that the researchers did not individually seek out these soldiers. Using very limited resources (about $60), the researchers used publicly available data and microtargeting tools (e.g., Facebook advertising) to induce the soldiers to come to them as self-nominating targets for exploitation.

Counterintelligence

Intelligence collectors often target people for recruitment based on money, ideology, compromise, or ego (MICE).²² Following the MICE paradigm, adversaries could leverage the growing volumes of personal data with the improving aggregation, analytic, and microtargeting tools to find service members with financial difficulties, with affiliations or loyalties to a particular cause, who are having affairs, or who are disgruntled. While the NATO experiment did not segment for these traits, it did encounter compromising material. One of the researchers remarked, “We managed to find quite a lot of data on individual people, which would include sensitive information . . . like a serviceman having a wife and also being on dating apps,” hinting that this area is ripe for exploitation.²³

When one factors in data lost through major hacking episodes, the picture becomes more concerning. For example, Office of Personnel Management data includes security background investigation files used to assess a person’s reliability and vulnerability to compromise; this is exactly what adversary intelligence is trying to assess, too.

Adversaries could also use personal information available online to coerce service members and threaten their families. In 2017, Russia reportedly targeted Estonian soldiers by hacking their phones.²⁴ A U.S. service member attending a sporting event in Latvia and another on a train in Poland were approached by strangers who revealed personal details about their families.²⁵ In eastern Ukraine, Russian forces sent frontline soldiers threatening texts, then texted their families, “Your son has been killed in action,” prompting texts and phone calls to/from the front, and then shelled the geolocated positions of the troops’ cell phones.²⁶ In 2015, the Islamic State published a hit list containing profiles of U.S. service members; while they claimed to have hacked military servers, they likely assembled this from publicly available content.²⁷ However, the most concerning prospect is the weaponization of personal information for military deception.

Military Deception

In simplified terms, military deception aims to “hide the real” and “show the fake” so an adversary decisionmaker will “see” certain activity, “think” the situation is unfolding in a particular way, and “do” a specific action in response.²⁸ “Hiding the real” may involve reducing observable signatures associated with particular activities to conceal a force’s size, composition, location, or intentions from adversary intelligence. “Showing the fake” traditionally relies on staging actions that one wants to be observed so adversaries draw incorrect conclusions.

A person’s background and cognitive processes shape how they perceive and make sense of information.²⁹ To anticipate a decision maker’s reactions, deception planners study their target extensively.³⁰ They examine their target’s background, experiences, personality, interests, beliefs, and decision-making style to create a profile. This insight lets the planner infer the decision maker’s cognitive biases (systematic errors in information processing and analysis) and schemas (mental models based on experience in identifying and matching patterns).³¹

Collectively, these processes allow a person’s brain to take shortcuts in perception, reaching conclusions, anticipating subsequent actions, and selecting a course of action, freeing brainpower for other cognitive tasks that require deeper deliberation. The adversary deception planner presents exquisitely tailored information so the decision maker will easily assimilate it, bypassing the tendency for deep thought because it matches patterns the target recognizes.³² While painstaking, this effort is the basis for adversary doctrine.

Adversary Doctrine

The Russian concept of “reflexive control” is a scientific approach that involves setting specific background conditions and then forcing a decision point for an adversary. The background conditions appear to narrow the decision space, herding an adversary decision maker toward adopting an action that one desires them to take.³³

Reflexive control is so deeply ingrained in Russian doctrine that actions are integrated and synchronized with traditional combat task planning and execution in a concept called “double track control.”³⁴ Reflexive control begins before combat operations and directly affects force allocation decisions, and the supported/supporting relationships constantly alternate between units executing combat and those managing reflexive control.³⁵ Information packages are tailored in content and delivery method and are sent to the adversary through means and formats that one knows the adversary can receive, based on their sensors, equipment, and data processing capabilities.³⁶ Knowledge of the adversary decision maker is key to effectiveness.

The Chinese concept of “stratagem” is based on the idea that perceptions are the output of subjective processes and therefore are susceptible to manipulation. Chinese doctrine has merged stratagem with new information technology to create information warfare stratagems to “seize and maintain information supremacy.”³⁷ This involves offensive and defensive operations, such as deceiving adversary intelligence, surveillance, and reconnaissance  and communications, corrupting information processing, and interfering with command-and-control systems.³⁸ Mechanisms include “thought directing,” “intimidation through momentum-building” (psychologically targeting the adversary by presenting the appearance that China is on the verge of victory), and “contaminating” information flows to hide reality, achieve surprise, and drive adversary commanders toward bad decisions.³⁹ Like reflexive control, understanding the individual decision maker’s cognition is key to successful execution.⁴⁰

Going Forward

U.S. leaders must admit this is a national security problem. While repeated data breaches have left service members exposed, they have been treated as financial and law enforcement issues. Treating these breaches as national security matters would provide justification for increased spending on system and database cybersecurity.

Data generating and sharing behaviors must be altered to reduce adversary opportunities to manipulate or coerce. Key decision makers should stop posting biographical details on organizational websites. For this group, official information risk assessments could run in parallel with the continual assessments associated with their security clearances. While many other service members hold dismissive “I’m too junior to target” attitudes, maturing artificial intelligence and machine learning (AI/ML) capabilities will enable data aggregation, analytics, and targeting at scale, drastically decreasing the effort required to pursue lower ranking service members.

All service members need to be aware of and manage their personal aggregate digital footprints (information currently visible, posted over time, and lost through breaches) and associated vulnerabilities. Future training must highlight when advancing technology enables new threats, such as extraction of biometric signatures from high-resolution photos posted online.⁴¹ Training must go beyond protecting data because of the potential for financial and identity theft, and discuss how it also can be used to shape and manipulate perception. While service members will not stop sharing information online, minimizing the unwitting creation of new user data could reduce risk; just as service members qualify for free home-use antivirus software to increase cybersecurity, extending free “managed-attribution” and virtual private network software could limit the unconscious generation of personal data.

In the future, integration of AI/ML into decision systems might partially mitigate the threat; if assisted by algorithms, a decision maker’s cognition could be much harder to anticipate and influence. Unfortunately, this raises new concerns. Analogous to a human’s background, an algorithm’s developmental and training data could reveal insights necessary to manipulate its future behavior. The U.S. military will need to start protecting the algorithm’s “personal information,” too.