Cyberwar: Islamic State, Russia & China Hold The Advantage

Can democracies compete 'where powers can be fighting each other with one hand and shaking hands with the other?'

From China in Asia to Russia in Europe and the Middle East, and ISIS just about everywhere, 2015 has seen the flourishing of conflicts that exist in a gray zone, one which is not quite open war but more than regular competition, which is attuned to globalization, which liberal democracies are ill-equipped to deal with, and which may well be the way power is exercised and conflict conducted in the foreseeable future.

Described by scholars as “hybrid,” “full-spectrum,” “non-linear,” “next-generation,” or “ambiguous”—the variations in the description indicate the slipperiness of the subject—these conflicts mix psychological, media, economic, cyber, and military operations without requiring a declaration of war.

In the case of Russia’s ongoing campaign in Ukraine, for example, hyper-intense Russian propaganda has cultivated unrest inside the country by sowing enmity among segments of Ukrainian society and confusing the West with waves of disinformation, while Russian proxy forces and covert troops launch just enough military offensives to ensure that the Ukrainian government looks weak. The point is not to occupy territory—Russia could easily annex rebel-held eastern Ukraine—but to destabilize Ukraine psychologically and advance a narrative of the country as a “failed state,” thus destroying the will and support inside Ukraine and internationally for reforms that would make Kiev more independent from Moscow and might, in the longer term, create hope for democratic reform inside Russia.

China’s doctrine of the Three Warfares pushes these non-physical aspects even further, using “legal,” “psychological,” and “media” warfare to, in the words of the analyst Laura Jackson, who directed a Cambridge University and U.S. Defense Department research project on the subject, “undermine international institutions, change borders, and subvert global media, all without firing a shot. The Western, and especially American, concept of war emphasises the kinetic and the tangible—infrastructure, arms, and personnel—whereas China is asking fundamental questions: ‘What is war?’ And, in today’s world: ‘Is winning without fighting possible?’”

An immediate aim of the Three Warfares is to spread China’s dominion over the South China Sea, extending the country’s maritime borders beyond boundaries recognized by the UN Convention on the Law of the Sea in order to control massive energy reserves and strategic sea-lanes worth $5 trillion dollars; ultimately, the hope is to supplant the United States as the security guarantor in the region. The military strategy was first adopted in 2003, but many of its consequences only became apparent to the media in 2015.

First China has ramped up the construction of artificial islands in contested waters. Then it has used “Lawfare” to claim that since these islands are now its territory, it owns the surrounding seaways under maritime law. This claim is reinforced by “psychological” warfare, which involves threatening economic sanctions against states that protest China’s moves and intimidating anyone who strays into the area. Recently, a BBC reporter who flew in international airspace near a Chinese military airstrip constructed off the coast of the Philippines was bombarded by calls over the airwaves stating: “Foreign military aircraft in northwest of Meiji Reef, this is the Chinese Navy, you are threatening the security of our station.” And then there’s “media warfare”: Developments such as Japan beefing up its military, or the U.S. insisting on sailing its ships through waters the UN considers neutral, are depicted in China’s ever-expanding international news networks as examples of the aggression of China’s rivals, rather than a response to Chinese expansion.

The Chinese and Russian approaches both emphasize information war. But perhaps this year’s most spectacular propagandists are those of ISIS, with its aggressive use of social media to recruit new combatants and slick, gruesome execution videos to provoke and frighten opponents. Though ISIS has killed roughly seven times fewer people in Syria than the Assad regime, the group has used social media (some 46,000 accounts on Twitter alone) to make itself look even more menacing than it is. Every social-media user who retweets or posts ISIS material, whether in support or censure, ultimately helps strengthen ISIS’s narrative of history-making stature and millenarian significance. The Islamic State’s terrorist attacks in Paris left 130 people dead in a spate of horrific violence, but the operation was executed in a manner that made it seem as if the organization had killed orders of magnitude more.

There is, of course, nothing new about using information as a vital instrument of war. But in the past information tended to be a handmaiden to action. Now the informational element appears to be as important as, if not more important than, the physical dimension. Take Russia’s air strikes in Syria. The Kremlin’s official rationale for the military campaign was to combat the Islamic State. But very few of its operations have actually been aimed at ISIS, with many more directed at U.S.-supported rebels fighting Syrian President, and Russian client, Bashar al-Assad. The Kremlin clearly has more in mind than defeating ISIS militarily. Russia has entered the Syrian stage in such a way as to surprise the West and ensure it will play a starring role in any narrative going forward—whether that narrative involves keeping Assad in power or a “global fight against terror.” The Russian military might be small compared to America’s, and the Russian economy may be a mess, but Vladimir Putin has cleverly undermined America’s reputation as a “global policeman” and boosted his stature as the man who is restoring Russia as a Great Global Power.
This is not “soft power” in the classic sense of projecting a positive national image through culture and public relations, but rather a case of using strategic narrative to keep your opponent intimidated, confused, and dismayed—of exploiting ubiquitous information to appear bigger, scarier, and more indispensable than reality would suggest. Russia’s bombing raids in Syria also have the positive side effects (for Moscow) of distracting from the conflict in Ukraine and helping maintain a steady torrent of refugees to Europe, which in turn strengthens right-wing parties in countries such as France and Hungary that peddle anti-refugee fears, are supported by the Kremlin, and advocate dropping Western sanctions against Russia. What matters in the information age is not so much “military escalation dominance”—the Cold War doctrine emphasizing the ability to introduce more arms than the enemy into a conflict. Rather, it’s “narrative escalation dominance”—being able to introduce more startling storylines than your opponent.

In many ways, gray-zone conflicts are the dark flip side of globalization, where transnational media, economic integration, and the free movement of people create not a “global village,” but an environment in which we can all mess with each other in more insidious ways. Globalization also means, however, that states such as China or Russia are unlikely to declare full-on war. Why risk an open conflict they would probably lose when the aim is to preserve all the advantages of “positive” globalization—the global markets and foreign investments—while simultaneously harnessing these dynamics to subvert others.

All this leads to a situation where powers can be fighting each other with one hand and shaking hands with the other: China and the US face off in the South China Sea while strengthening economic ties; Russia and the US circle each other in Ukraine while discussing cooperation in Syria. It also leads to political promiscuity, wherein alliances are short-term and tactical, but prone to fallings-out: Turkey and Russia were best friends forever at the start of 2015, two neo-authoritarian regimes hoping for ever closer energy union; today, after the Turks shot down a Russian fighter jet over Syria, they are enemies, with each country’s leader seeking to bolster his domestic image with breast-beating. These are geopolitical relationships with all the depth of Facebook friendships, likes, and bans.

Many Chinese and Russians would argue that Western countries are likewise waging gray-zone conflicts against them. After the Chinese stock market collapsed this year, Lin Zuoming, a powerful figure within one of China’s largest state-owned enterprises, insisted the crash was “without any doubt … an economic war” led by the United States to undermine the Communist Party’s rule. Russian state media constantly blame the U.S. for cunningly coordinating everything from CNN to oil majors, Google, and NGOs to undermine Moscow.

The United States undoubtedly possesses some massive economic weapons; it can threaten, for instance, to ban Russia from the international SWIFT banking system. And Western countries have their own long traditions of covert operations. But liberal democracies in the West can also find it very difficult to act in the gray zone.

On a journalists’ tour of NATO headquarters this year, I asked senior officials how the alliance dealt with new threats. The answer was essentially that when it came to the use of money, media, or cultural warfare, NATO was only starting to work out how to respond. Tanks and nuclear missiles, and increasingly cyber attacks, they were on top of. Anything “gray” was only in development.

While it is relatively easy for authoritarian regimes to fuse the efforts of military, media, and business entities, in democracies the interests of these groups are often diametrically opposed. For example: When the U.K. government signed a deal this fall allowing China to invest in a new British nuclear reactor, the money men at the Treasury were delighted; the moral men in the media appalled by the United Kingdom selling out on human rights; and the military men worried by Chinese penetration of British energy and telecommunications infrastructure.

Of course, Western powers can unite money, media, and the military to devastating and diabolical effect when a war is declared (the lead-up to the Iraq campaigns being the most obvious recent example), but they are more at a loss when responding to not-quite-wars that are undeclared. Is Russia an enemy of the European Union or a partner with whom normal relations could be resumed? After all, Russia has never officially declared war on Ukraine, let alone the EU. For all of German Chancellor Angela Merkel’s sternness about maintaining Ukraine-related sanctions against Russia in 2015, the year ended with Germany signing an energy deal for a new pipeline between the two countries—a major coup for Moscow.

And what does one do with a creature like ISIS, which is not recognized as a state but has all the appearances of one? When the UK voted on whether to bomb ISIS after the Paris terrorist attacks, one of the arguments against the action was that the British military would be conducting raids inside what was still de jure Syrian territory, when Assad’s government, unlike the Iraqi government, had never invited the U.K. to do so. The speeches in Parliament were the stuff of the 1930s—neo-Churchill’s and neo-Chamberlains invoking appeasement, fascism, and civilizational challenges. It was a discourse belonging to 20th-century wars, not to the endless subtleties and permutations of the 21st.

So how can democracies compete in this environment? Ben Nimmo, a defense analyst and former NATO press officer, suggests a new doctrine of “information defense” where governments and transnational bodies support exchanges between journalists, think-tank scholars, and academics in areas that could soon suffer a propaganda attack. That way, when Russia launches its next disinformation campaign in, say, Moldova or the Arctic Circle, there will be independent experts with networks and knowledge of the region capable of establishing what is really going on there. Laura Jackson proposes a similarly preemptive approach for the Three Warfares, encouraging the permanent stationing of cameras on military vessels in the South China Sea and the satellite streaming of Chinese island construction to better stop “unilateral, yet subtle, revisions of reality.” Mark Galeotti, a professor at New York University, advocates a “non-kinetic NATO” equipped to counter challenges such as corruption. Russian doctrine argues that corrupting another country’s elites is part of “new-generation” war. Isn’t it therefore time for the West to consider corruption a security issue?

One of the most thought-provoking proposals concerning ISIS comes from Srdja Popovic, a former student leader of the Otpor movement, which helped overthrow Slobodan Milsosevic in Yugoslavia, who is now a guru for non-violent revolutionaries around the world. The Islamic State rules over a population of some 6 million, many of whom don’t subscribe to its ideology but have been convinced that ISIS is the best available supplier of security and welfare services. In a recent article, Popovic and co-author Alia Braley give the example of Suad Nofel, a woman living in the Islamic State’s “capital” of Raqqa, Syria who spent three months protesting outside ISIS headquarters, holding up signs with slogans like, “Don’t tell me about your religion, but show it in your behavior!” and, “No for oppression, no for unjust rulers, no for atonement, and yes for thinking!” “Her story,” write Popovic and Braley, “is but one of many in which Syrian and Iraqi civilians have nonviolently confronted IS and lived to tell the tale. These underreported stories are a testament to the fact that despite its murderous image, IS is actually dependent upon maintaining goodwill and real support among Sunnis. Like any governing body, the power of IS is primarily dependent on the cooperation of those it seeks to govern.”

Instead of a military-driven strategy to, in the words of US President Barack Obama, degrade and destroy ISIS, Popovic and Braley advocate focusing on non-violent measures. ISIS “seems to feed off of [military] opposition,” they write. Western governments should first help activists inspire those living under ISIS with a more attractive vision for the region’s future than the Islamic State’s puritanical religiosity—and with a safe haven for Sunni Muslims under attack from Shiite militias and Assad’s troops. Then they should target ISIS’s potential Achilles’ heel: the provision of community services. “Many technocrats and skilled workers of all kinds have fled IS controlled areas, and those who remain may simply have had no other place to go,” Popovic and Braley point out. “IS is severely taxing and demanding exorbitant bribes from all sectors of the business and working community. … [F]armers have largely fled and the crop for next year remains dangerously unplanted. … The ranks of administrators, technocrats, workers, tribal leaders, and business people are ripe for defections and acts of noncooperation with IS.”

These ideas highlight two important elements of hybrid conflicts. The first is the power of civil society in this new form of struggle—a trend also evident in the role that the hacking collective Anonymous has played in taking down ISIS social-media accounts, in how Ukrainian activists debunk Russian disinformation, or how the blogger Eliot Higgins has provided open-source evidence for Russian military involvement in Ukraine.

“Like any governing body, the power of IS is primarily dependent on the cooperation of those it seeks to govern.”

The second is the value of an asymmetric approach to these conflicts. When ISIS releases its blood-curdling videos or slaughters innocent partygoers in Paris, it is seeking to create enmity between Muslims and the rest in the West—an outcome the Le Pens, Orbans, and Trumps in this world help realize with their anti-Muslim rhetoric. Instead, ISIS’s opponents should focus on striking the group where it’s weakest—namely at its claim of being a functional state. Likewise, when Russia wages a propaganda campaign claiming to be the champion of “conservative” values threatened by a decadent West, it is looking to suck people into a debate about a “clash of civilizations” and distract from Russia’s weak economy and illegal aggression in Ukraine. Instead of playing the Kremlin’s mind games, the West would do well to attack the Kremlin’s corruption, where the Russian government is vulnerable.

One of the great fears in all this is that a gray-zone conflict—involving, say, US and Chinese military vessels sparring in the South China Sea, or Russia threatening to deploy its nuclear arsenal—could tumble into an open one when some party miscalculates.

More likely, however, is that the patterns on display in 2015 will become more pronounced in the coming year. According to Laura Jackson, China sees the sea, and the earth generally, as only the start of its Three Warfares campaign—a testing ground for ambitions to control portions of outer space, which Chinese military and legal thinkers see, in the words of one Chinese official, “as a natural extension of other forms of territorial control.” Russian military theory envisions the wars of the future moving from “direct clash to contactless war,” from “direct annihilation of the opponent to its inner decay,” from “war in the physical environment to a war in the human consciousness and in cyberspace.”

In June, a New York Times investigation uncovered how a series of web campaigns tried to sow panic in the United States by spreading fake Twitter messages, Wikipedia pages, and online news reports about everything from an ISIS attack in Louisiana to Ebola outbreaks and police shootings in Atlanta. This was not the work of mere pranksters, but targeted disinformation operations launched from a Kremlin-backed “troll farm” in St Petersburg. They were perhaps some of the first skirmishes in what Russian military theorists believe to be the battleground of the future: the minds of men and women, where every business deal, retweet, and Instagram post becomes a way of influencing what these theorists call “the Psychosphere.”

It’s a brave new war without beginning or end, where the borders of peace and war, serviceman and civilian have become utterly blurred—and where you and I are both a target and a weapon.

DefenseOne

 

« Turn the Tide on Cyber Security in 2016
Biggest Cybersecurity Threats In 2016 »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CYBERPOL

CYBERPOL

CYBERPOL's mission is to facilitate the widest possible mutual assistance between all cyber crime law enforcement authorities to help mitigate global cyber threats.

National Information Security & Safety Authority (NISSA) - Libya

National Information Security & Safety Authority (NISSA) - Libya

NISSA is responsible for safeguarding the integrity, availability and resilienceof ICT infrastructure, resources, services and data in Libya.

Claroty

Claroty

Claroty was conceived to secure and optimize OT networks that run the world’s most critical infrastructures.

Red Canary

Red Canary

Red Canary continuously monitors and analyzes your endpoints, users, and network activity in search of threatening behaviors, patterns, and signatures.

Tessian

Tessian

Tessian (formerly CheckRecipient) is a next-generation email security platform that helps enterprises counteract human error and significantly reduce the risk of data loss.

CyPhyCon

CyPhyCon

CyPhyCon is an annual event exploring threats and solutions to cyber attacks on cyber-physical systems such as industrial control systems, Internet of Things and Industrial Internet of Things.

Eaton

Eaton

Eaton provides comprehensive cybersecurity services for operational technology (OT) to help keep your operations and personnel safe.

ARIA Cybersecurity Solutions

ARIA Cybersecurity Solutions

The ARIA ADR Automatic Detection & Response solution was designed to find, verify, and stop all types of attacks - automatically and in real time.

Digital Pathways

Digital Pathways

Digital Pathways is an award-winning data security provider that helps businesses protect their digital assets.

Singtel Innov8

Singtel Innov8

Singtel Innov8, the venture capital arm of the Singtel Group, invests in and partners with innovative technology start-ups globally.

Balance Theory

Balance Theory

Balance Theory provides the knowledge infrastructure and collaboration center for the cybersecurity community. A networked community to build better cybersecurity outcomes.

Tsaaro Academy

Tsaaro Academy

Tsaaro Academy is a unique privacy certification training platform and here you earn a privacy certification CEH, CISM and DPO from India’s No.1 Privacy training platform.

Evo Security

Evo Security

Evo Security is an Identity and Access Management company focused exclusively on serving MSPs, MSSPs and their SMB and Mid-Market customers.

CNF Technologies

CNF Technologies

CNF Technologies is an award-winning cyber company providing technology-focused research and development to commercial, federal, and Department of Defense clients.

Security Compliance Associates (SCA)

Security Compliance Associates (SCA)

The sole focus of SCA is safeguarding critical information and complying with information security regulations.

Finlaw Associates

Finlaw Associates

Finlaw Associates is a trusted cybercrime law firm providing a wide range of taxation, legal, advisory and regulatory services to the financial, commercial and industrial communities.