Intelligence Community Assessment: Foreign Threats to the 2020 US Federal Elections. Suggestions for any cyber czar. Cyber Pearl Harbor as metaphor.

At a glance.

• A look at the US Intelligence Community's report on foreign attempts to influence the 2020 US Federal elections.
• Suggestions on proper responsibilities for a cyber czar.
• Cyber metaphors and cyber policy.

Intelligence report on foreign influence operations targeting 2020 election. 

The Office of the Director of National Intelligence (ODNI) released a declassified version of the National Intelligence Council’s assessment of Foreign Threats to the 2020 US Federal Elections. The Washington Post has an account of the findings, and Johns Hopkins Professor of Strategic Studies Thomas Rid tweeted some main takeaways: 

• The report assesses “intentions and efforts,” not impact. 
• Russian threat actors were “more disciplined” this election cycle.   
• The main campaign centered on alleged “corrupt ties” between the Biden family and Ukraine. 
• Russian operatives funneled stories to US outlets and influential people, “hired a US firm,” and contributed to a documentary that made it to US airwaves. 
• Kremlin proxies “amplified” unflattering narratives about the Bidens. 
• There was a GRU phishing attempt at Burisma subsidiaries.

The assessment also found that Iran undertook an aggressive influence campaign against the Trump Administration using “at least several thousand” social profiles and more than one-thousand posts targeting the pandemic response and “civil unrest,” likely at the behest of the country’s Supreme Leader.

As the Washington Examiner notes, the assessment mentions additional, smaller influence operations conducted by Cuba, Venezuela, Hezbollah, and China against President Trump. The majority view was that China considered joining the fun but ultimately stayed out of the fray, but a minority opinion maintained that “at least some” actions were taken. The report’s submission was held up by internal disagreements over this point. 

The ODNI’s Analytic Ombudsman claimed anti-President Trump sentiment led analysts to minimize evidence of Chinese interference, while management engaged in “strong efforts to suppress” dissenting voices. (The Ombudsman’s report also identified perceptions of pro-President Trump pressures at play in intelligence products.) His analysis determined that key definitions were “applied inconsistently” across Chinese and Russian findings. (The Ombudsman’s remit is to find problems. Internal IC dissenting views are highlighted in the report itself.)

About the impact of the various efforts, Rid concludes, “Important to be cautious here. None of this influence activity was strategically significant or effective. Russian activity in 2020 was less impressive than in 2016. And a hard look at the data shows that—highly likely—not even 2016 moved the needle.” 

Citing a complementary review from the Departments of Justice and Homeland Security, another Washington Post article affirms that voting infrastructure was secure. The piece recommends ramping up cybersecurity investments, locking arms across the political aisle against foreign influence, and implementing “auditable” ballots to defend the next election. 

What a US national cyber director needs.

A Fortune editorial says Washington’s new national cyber director will need support from the President, similar to former President Bush’s wholehearted backing of the first Director of Homeland Security, in addition to assistance from the private sector. One way this industry assistance could manifest would be “a more rigorous set of security standards that, for example, would require the use of physical tokens to insert code and detailed logging at every stage of the build, development, and distribution process.”

Metaphors and cyber policy.

We're pleased to share an op-ed from Jan Kallberg, of the US Army Cyber Institute at West Point. He'd like to introduce a note of skeptical caution about the historical metaphors that often inform thinking about cybersecurity policy and strategy. In his essay, he takes up one of them: concern about a "cyber Pearl Harbor." He thinks it's time to retire the metaphor. It's not that a damaging cyberattack couldn't achieve operational surprise, as the 1941 attack on Pearl Harbor did. (Consider, for example, the possibility of exploiting SolarWinds for more than espionage by using it to stage attacks that could have a kinetic effect on critical infrastructure.) Rather, it's that it's important to understand that the adversary has its own challenges to overcome, and any credible adversary will have its own strategic aims as well. And it's also worth remembering that the adversaries have their problems, too.

So it might be worth taking our metaphors seriously. They can be instructive. "Cyber 911" is used almost interchangeably with "cyber Pearl Harbor." Both suggest a bolt from the blue, but the reality of the original, literal events they allude to was more complex. Other metaphors worth thinking through include "cyber is a team sport," and "we need a moonshot for cybersecurity." They all have some point, and they also all warrant some critical scrutiny, lest they prompt naive picture-thinking about cyber policy and strategy.