As the Trump Administration starts ticking off targets for its first 100 days, the fallout from the Russian influence operation on the US presidential election is still working its way around the world. Multiple Western countries (mostly in Europe but also Australia) are grappling with how to shore up their defences against this type of cyber operation. French intelligence agencies have briefed political parties on strengthening cybersecurity standards ahead of national elections this year. The European Union is expanding the strategic communication office set up in 2015 to counter fake-news pushed from Russia. The Czech Republic is doing the same. Ahead of its federal elections in September, Germany has proposed establishing a Centre of Defense Against Misinformation. The US, along with naming and shaming Russia, has also started to set boundaries around its electoral infrastructure.
It doesn’t really matter where you fall on the political spectrum, it’s clear that Russia conducted a significant and wide-ranging information operation targeting the US election, using a variety of cyber and traditional propaganda tools. Working out what effect this operation had on the election outcome is a separate matter. This influence is probably unquantifiable and would need to be considered alongside many other factors: Hillary Clinton ran a poor campaign, didn’t connect with voters, and lacked a clear message. Trump, an effective and brilliant communicator, destroyed the blue firewall himself. That wasn’t Russia.
But we shouldn’t play down the significance of what did occur, both in terms of the what - Russia mounted an attack on the political foundations of its only nuclear-peer - and the how; the combination of old intelligence methods with modern technology.
Even if some are not convinced by the official report from the CIA, FBI and NSA, there is considerable third-party evidence and analysis that backs up the intelligence communities’ assessment in some detail.
As other Western countries begin taking measures to protect their own political processes, Australia has also started to take steps. Prime Minister Malcolm Turnbull’s announcement yesterday that Australia’s political parties would start to receive advice and briefings from government cyber security experts on how to protect themselves and their members from spear phishing attempts and other intrusion methods is a good start. While the announcement was turned into a bit of a political football, it’s also not a bad thing to air this issue publically. A public that is alert to the possibility would help to mitigate any desired effect should such an incident occur.Other initiatives are also worthy of mention, such as the offer from Tim Watts MP to teach other Labor MPs and their staff good cyber hygiene and security practices. More needs to be done and there should likely be more active Government measures.
One thing missing from the debate, however, is consideration of a key part of the US intelligence communities report. This found the hacking of the Democratic National Committee was one element of a multifaceted operation. As the report states, the influence campaign blended 'covert intelligence operations – such as cyber activity – with overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, and paid social media users or "trolls”.'
Information operations are broad and conducted through multiple channels, outlets and via a variety of sources. This makes them difficult to detect, counter and explain. More research on this aspect of the operation is being conducted by third-party cybersecurity firms and some have hinted at their preliminary findings. Once these findings are released, we will have a better understanding of the extent of the operation hinted at in the public version of the intelligence communities report.
Looking forward, governments will need to eventually address these broader aspects, as well as the cyber competency of our political parties and the security of our infrastructure. An adequate defence will be multilayered and rolling it out will be much more difficult than simply ensuring our politicians change their passwords regularly.
