The more we learn about Russia’s interference in the 2016 election, the clearer it becomes that this was, if not quite an act of war, then certainly an act utilizing techniques of warfare—specifically, the branch of combat known as “information warfare.” The operation raises questions about whether social media should be subject to stricter regulation, especially whether the anonymity of Twitter might be hurting democracy more than helping it.
Much is already known about the hijacking of the Clinton campaign’s email and its select distribution through WikiLeaks. Scott Shane’s front-page story in Friday’s New York Times reveals the extensive effort to amplify these leaks (as well as a good deal of made-up information) through social media. The Russians, the Times reports, created hundreds or thousands of fake Facebook and Twitter accounts “to spread anti-Clinton messages and promote the hacked material they had leaked.”*
Essentially, what the articles calls “the vanguard of a cyberarmy”—“a legion of Russian-controlled impostors” and bots—turned the most popular social media sites into “engines of deception and propaganda.”
In June 2016, Russia’s military intelligence agency, the GRU, created a site called DCLeaks.com, which posted the first samples of the campaign files stolen by Russian hackers. Very soon after, swarms of messages hit the internet—from usurped or phony names on Facebook, and from anonymous or automated accounts on Twitter—urging people to take a look at the site.
The goal was to flood social media—and, from there, broader media—with material that damaged Hillary Clinton’s image and thus helped Donald Trump win the election. The U.S. intelligence community made this observation in a report late last year, concluding with “high confidence” that the operation was ordered by Russian President Vladimir Putin. The report also noted that the Russians hacked Trump’s campaign as well but—tellingly—did not release any of those materials.
This is the essence of “information warfare,” defined in a 1997 U.S. Air Force pamphlet as “any action to deny, exploit, corrupt, or destroy the enemy’s information and its functions,” with the aim of “degrading his will or capability to fight.” This might involve severing communications between the commanders and their troops in the field. Or it might involve hacking those communications and deleting, distorting, or inventing messages, misleading a commander’s judgment or sowing doubts in his mind about whether the orders, intelligence, and other reports that he’s seeing are true.
In a political operation, information warfare could involve throwing a candidate’s campaign into disarray, twisting the media coverage of that candidate, or instilling distrust in the minds of voters—distrust of a certain candidate or of the entire political system. The U.S. intelligence report on Russian hacking concluded that the point of Russia’s info war campaign against Clinton was to weaken her as a candidate—and, if she won the election anyway, to weaken her legitimacy as president, thus dampening support for her policies and weakening U.S. power in the world.
Over the years, the U.S. military has tried to block enemy info warfare campaigns in several ways: isolating crucial systems from the public internet as much as possible; equipping computers with intrusion-detection systems; creating agencies that monitor suspicious traffic, trace its path, identify its source, and take action if necessary. Bad guys still get inside the network anyway, but not as often as before, and their movements are spotted more quickly.
Can similar steps be taken to ward off info war operations against election campaigns—against, to put it another way, American democracy?
The operations uncovered in the Times story—swamping social media with phony Facebook and Twitter accounts that spread propaganda—are particularly hard to stop because they exploit the internet’s central trait: its openness. This has been the net’s strength and also its weakness. Openness allows the free exchange of ideas and expression of dissent but also leaves the system, and everyone in it, prey to criminals, terrorists, and, in this case, foreign spies and propagandists: all of them shrouded in anonymity.
It may be time to impose some regulations on this system. Yes, there are dangers down that road, a slippery slope to the kind of political censorship that authoritarian regimes now impose on many sites and users. But those who maliciously exploit the net’s laissez-faire nature are now threatening the democracy that undergirds those broader freedoms.
There are ways to clamp down the exploiters without snuffing those freedoms.
The first step, as was the case with the military in its attempts to ward off intruders, is to start acting like this is a problem. This means, above all, exercising cyberhygiene. The Clinton campaign was hacked when one of its senior advisers fell for a pretty simple phishing expedition. Political campaigns should also install intrusion-detection systems and hire good security firms that can do real-time digital forensics—tracking malware, tracing it to its source, and expelling it from the network. CrowdStrike did that for the Clinton campaign and the Democratic National Committee; FireEye nabbed the fake Facebook accounts for the New York Times. But they did their work long after the fact—too late to affect the outcome of the battle. These security firms are costly, what they do is very much in the public interest, and so should be publicly funded.
But things have already got out of hand if you need to bring in the likes of CrowdStrike and FireEye to solve your problem. The basic problem is with the system, and it may be time to change the system. For starters, it may be time for Twitter to prohibit anonymous and automated accounts.
I say it may be time because I understand the drawbacks. Anonymity allows dissidents and whistleblowers to have a say, but there are other forums for such activists to get out their message (they existed long before the internet was invented). The execs of Twitter and Facebook say they have stepped up efforts to remove fraudulent accounts—a clear statement that they don’t endorse such things. And yet, owing to their policies and procedures, fraudulent accounts are to some degree inevitable. Maybe they should change their policies and procedures in a way that makes fraud harder to commit and easier to spot. One idea floating around is to require bots to have a human ID and to prohibit, say, an officer or hacker in Russia from pretending to be a housewife in Ohio.
This is an urgent matter. The United States coined the term information warfare, and our intelligence agencies have practiced it in various ways, but Moscow sees this domain of warfare as central to its post–Cold War competition with the United States. In February 2016, just four months before the GRU set up DCLeaks.com, a senior Kremlin adviser named Andrey Krutskikh gave a speech at an info warfare conference. In a Washington Post column two days before Trump’s inauguration, David Ignatius quoted the notes from Krutskikh’s speech, which was given to an entirely Russian audience:
You think we are living in 2016. No, we are living in 1948. And do you know why? Because in 1949, the Soviet Union had its first atomic bomb test. And if until that moment, the Soviet Union was trying to reach agreement with [President Harry] Truman to ban nuclear weapons, and the Americans were not taking us seriously, in 1949 everything changed and they started talking to us on an equal footing. I’m warning you: We are at the verge of having “something” in the information arena, which will allow us to talk to the Americans as equals.
It may be no coincidence, comrades, that four months after Krutskikh’s speech, the GRU created the DCLeaks.com website. In any case, the 2016 election was the first time the Russians tried to sway an American presidential election with the full range of information warfare techniques. It won’t be the last time. The next time, we should come to the contest prepared.
Read more in Slate about Russia’s 2016 election meddling.
*Correction, Sept. 8, 2017: This article originally misstated that the Times reported that Russia created hundreds of thousands of fake Facebook and Twitter accounts. It was hundreds or thousands of accounts. (Return.)
