Inside Cyber Warfare Part 18

The FEP was founded by Gleb Olegovich Pavlovsky, born in Odessa on March 5, 1951. Pavlovsky self-identifies as a "political technologist," which makes perfect sense in today's connected world. He's what Western technologists consider an early adopter, creating programs for the Russian Internet (RUNET) in its earliest days of existence, starting with the Russkiy Zhurnal and later the Internet-based ezines Gazeta.ru, Lenta.ru, and Inosmi.ru.

Pavlovsky's leadership of FEP has been peppered with frequent Russian press articles that accuse him of dirty deeds supporting government power. For example, on December 4, 1997, an Obschchaya Gazeta article accused Pavlovsky of planting information detrimental to Boris Berezovskiy. The article reviewed Pavlovsky's career path, pointing out his shift from Yeltsin opponent to Yeltsin supporter and his subsequent economic prosperity. On December 10, 1997, Moskovskiy Komsolets stated that Pavlovsky provided political a.n.a.lysis to government figures at the direction of Anatoliy Chubays, then head of the presidential administration.

A January 18, 1999, Ekspert article by Pavlovsky is quite prescient and suggests excellent connections. In the article, Pavlovsky states that Russian society demands a right-wing conservative government. As Pavlovsky says, "After a decade of unregulated, essentially uncontrolled changes in the country, a shift towards a strong authoritative state is preordained." By August, Vladimir Putin was prime minister and by December he was acting president. Numerous Russian press articles from 1999 detail Pavlovsky's rise as a trusted political operative who moved from supporting Yeltsin to Putin. Indeed, on December 24, 1999, SeG.o.dyna credited Pavlovsky with inspiring Putin's new Center for Strategic Studies, which was tasked to work out plans for Russia's future development.

Pavlovsky's FEP was also an early force on the Russian Internet. FEP's original website, FEP.ru, is no longer active, but archived information shows the website active from 1998 through 2007. The site touts FEP's expertise in Internet operations, providing examples of sites FEP developed supporting Russian political figures and their campaigns. However, contemporaneous press articles accuse Pavlovsky of disseminating disinformation via the same routes.

A few years later, the Kremlin favored the publishing houses of Konstantin Rykov's Newmedia Stars, as well as Dni.ru, Vzglyad.ru, and the video portal Rossiya.ru. Rykov was rewarded with a seat at the State Duma.

Today the new favorites include Pravda.ru, Yoki.ru, Elektorat.info, and Politonlayn.ru, all published by Vadim Gorshenin, who is friendly with former United Russia PR chief Konstantin Kostin, deputy chief of the presidential staff's Domestic Policy Administration since 2008.

In 2008, the Kremlin's focus was more honed to monitoring rather than propaganda, and these efforts were primarily run from Gleb Paylovsky's FEP and Vadim Goreshenin's Pravda.ru.

Konstantin Kostin described the effort: We are called upon to provide monitoring in social milieus and social networks-real ones rather than Internet ones-of what is topical to these milieus and present the results in a public field.

Two years ago, Maksim Zharov, one of the authors of Chronicles of Information Warfare, used to work for Nikita Ivanov, then deputy chief of the Administration for Interregional and Cultural Ties With Foreign Countries of the President's Staff and supervisor of the pro-Kremlin youth movements (i.e., the Nashi). Zharov earlier published (through Yevropa) an instruction manual for bloggers who want to "fight the enemies of Russia" in the blogosphere.

Chronicles of Information Warfare

In spite of these shifts of interest on the part of the ruling party, Pavlovsky continues to be an influential voice in Russian politics as well as a human rights advocate. His organization created the Yevropa publishing house, the publisher of Chronicles of Information Warfare (English translation of the Russian name) by Maksim Sharov and Tomofey Shevyakov.

The book covers guidance provided by First Deputy Chief of Staff to the President of Russia and former GRU Intelligence Officer Vladislav Surkov. Surkov was also instrumental in creating official youth organizations such as Nashi that have played an important part in implementing Kremlin policy through a variety of methods, including hacking opponents' computers.

Shortly after the Georgia conflict, Surkov held a closed-door conference with Russian spin doctors explaining how to use information as a weapon to fight Russia's enemies (such as the government of Georgia). Those remarks have been captured by authors Sharov and Shevyakov as content for their book. The following is a quote from the introduction: Net wars have always been an internal peculiarity of the Internet-and were of no interest to anyone in real life. The five-day war showed that the Net is a front just like the traditional media, and a front that is much faster to respond and much larger in scale. August 2008 was the starting point of the virtual reality of conflicts and the moment of recognition of the need to wage war in the information field too.

a.n.a.lysis

Although the FEP is not a part of the Armed Forces of the Russian Federation, it is part of the official voice of the Kremlin and a key player in orchestrating a response to anti-Kremlin speech or actions against both internal and external opponents. Since cyber warfare is frequently categorized as information warfare, the FEP is an important, albeit little-known, organization to watch.

The FEP's hand in designing or shaping strategies is a subtle one, and its influence is often disguised or misinterpreted as "crowdsourcing," i.e., a seemingly spontaneous outburst of nationalistic cyber attacks. While there is a pile-on mentality once an Information Operation has been launched, attribution is often disguised through a technique known by stage magicians as misdirection.

"Wars of the Future Will Be Information Wars"

The National Forum of Information Security is an internationally sponsored annual event held in Moscow. "InfoForum-10," as it was known in its February 2008 incarnation, featured a speech by Russian Deputy Chief of the General Staff Aleksandr Burutin ent.i.tled "Wars of the Future Will Be Information Wars."[38]

Who is Alexandr Burutin?

According to Burutin's biography at RussiaProfile.org, his appointment as a presidential advisor had nothing to do with Russia's military industrial complex, which is the source for many advisors. Instead he descends from a military family, graduated from several military academies, and by 2003 had risen to deputy head of directorate of the Main Operational Directorate of the General Staff of the Armed Forces of the Russian Federation.

In April 2003, he was selected for his current position by then-President Vladmir Putin during one of Putin's working holidays in the Sobolinaya Mountains. Days were spent skiing, while the President's evenings were reserved for meetings with his advisors and various experts. General Burutin evidently made an impression because by the time he left the ski resort he had a new t.i.tle: Presidential Adviser for Military and Defense Matters.

The speech

General Burutin opened his speech with a discussion of how science and technology are acting as agents of change in society as a whole and in the armed forces specifically. Kinetic force is having to make room for information superiority. He describes how in a future war the emphasis will shift to attacking "state and military control systems, navigation and communication systems, and other crucial information facilities."

Burutin explains how the use of "information weapons" can be executed by a small specialized team, or even one expertly trained individual, without ever having to physically cross a state border.

The general refers to the same strategic benefit that his contemporaries in the People's Liberation Army point to: the greater the technological achievements of a particular nation, the greater the vulnerability that nation has to a cyber attack against its networked infrastructure.

Predictably, Burutin obliquely refers to "certain nations" that are actively standing up a military cyber force. He then acknowledges Russia's response: For this purpose specialized subdivisions are being created in the armed forces and special services, conceptual doc.u.ments regulating questions of preparation and conducting information operations are being developed, and appropriate training is being conducted.

Burutin goes on to discuss how Russia, as a world leader, has always been a target for lesser countries that aspire to Russia's dominant position, through the use of relatively inexpensive communication strategies promulgating anti-Russian sentiment. He then proposes some additional measures that the RF should take to protect itself: Systematic efforts to reveal threats in the information sphere and their sources, create a structural framework for the goals and tasks of ensuring information security in the field of defense and to realize these goals and tasks Active counteraction to influence the consciousness of the population with the purpose of changing national ideology Development of a domestic technological and production base in the field of information technologies Increase of information and telecommunications systems security, as well as of the systems and means of introducing information technologies in weaponry and military equipment, and troop and weapons control systems Improvement of the structure for ensuring information security in the area of defense Preparation of experts in the field of ensuring information security

a.n.a.lysis

Burutin's speech is pretty straightforward in terms of describing Russia's approach to cyber warfare, or "information warfare," which appears to be his preferred term.

Note that this speech was delivered in February 2008. He specifically called out the Northern Caucasus (i.e., Georgia) as a problem area. This adds another dimension to the cyber component of the Russia-Georgia conflict of August 2008.

"RF Military Policy in International Information Security"

There are five authors mentioned in this article from Moscow Military Thought (English), March 31, 2007 (an English translation appears in TheFreeLibrary.com): I.N. Dylevsky, S.A. Komov, S.V. Korotkov, S.N. Rodionov, and A.V. Fedorov. Unfortunately, little background information is available for some, and none appears available for others. Of the five, S. A. Komov is a Russian military theorist; Colonel Sergei Korotkov is attached to the Main Operations Department, General Staff of Armed Forces, RF; and A.V. Fedorov served in the FSB's Directorate of Counterintelligence Support to Transportation.

The paper

This rather lengthy treatise explores the Russian perspective of what other nations are planning in the sphere of information warfare, and what the Russian Federation should be doing in light of those activities. The authors propose the following definition for information warfare: [The] main objectives will be to disorganize (disrupt) the functioning of the key enemy military, industrial and administrative facilities and systems, as well as to bring information-psychological pressure to bear on the adversary's military-political leadership, troops and population, something to be achieved primarily through the use of state-of-the-art information technologies and a.s.sets.

They also warn readers that the United States is already fully capable of embarking on "psychological and technical information operations," and cite three doc.u.ments to support their view: DOD Directive No. 3600.1, Information Operations. October 2001 DOD Information Operations Roadmap. October 30, 2003 JP 3 - 13 Information Operations. February 13, 2006 Each of these doc.u.ments is explored in "China Military Doctrine."

To further boost the need for Russia to develop its own Information Operations (IO) capability, the authors go on to criticize the United States for not supporting UN efforts to ensure international information security: In 1998, the Russian Federation suggested to the United Nations that it was necessary to consolidate the world community's efforts in order to ensure international information security. Since then the General a.s.sembly annually pa.s.ses the resolution "Developments in the Field of Information and Telecommunications in the Context of International Security." This fact reaffirms the importance of a.s.suring international information security and the UN readiness to study and solve the problem. But progress in this matter is extremely slow on account of counterproductive att.i.tudes displayed by the United States.

For example, this was the reason why a group of government experts on international information security that operated under the auspices of the First Committee of the UN General a.s.sembly from 2004 to 2005 failed to realize the results of its work. The stumbling block was the Russian Federation's motion (supported by Brazil, Belarus, China and South Africa) on the necessity of studying the military-political component of a threat to international information security.

As is to be regretted, the U. S. is consistent in its reluctance to address the information security problem at the international level. At the 60th and 61st General a.s.sembly sessions it was the only state to vote against the said resolution. It cannot be ruled out that Washington will behave similarly towards a new group of government experts the UN is setting up in 2009.

Predictably, much of this doc.u.ment paints US policies in a negative light, even to the point of accusing it of fostering the "flower revolutions" that have taken place in the countries that used to make up the Soviet Union and are now known as the Commonwealth of Independent States (CIS): A case in point is the moral-psychological and political-economic aftermath of a string of "flower" and "color" revolutions masterminded in a number of countries contrary to the will of their peoples (the "rose revolution" in Georgia, the "orange revolution" in Ukraine, the "purple revolution" in Iraq, the "tulip revolution" in Kyrgyzstan, and the "cedar revolution" in Lebanon). For the masterminds of the "flower revolutions" there was an instant spin-off from bringing to power the desirable leaders and governments. But with the pa.s.sage of time it became clear that political crises in the countries in question and, as a consequence, their economic decline could not be surmounted.

Ironically, Russia waged its own style of information warfare on those very nations, including Chechnya (in 2002), Kyrgyzstan (in 2005 and 2009), Estonia (in 2007), Lithuania (in 2008), and Georgia (in 2008) in the form of network and government website attacks by nonstate hackers.

Creating a legend for a cyber attack

There are a few key sections that directly apply to the Kremlin keeping its distance from the activities of its nationalistic hackers during each of the aforementioned examples: In our view, isolating cyber terrorism and cyber crime from the general context of international information security is, in a sense, artificial and unsupported by any real objective necessity. This is because the effect of a "cybernetic" weapon does not depend on the motivation of a source of destructive impact, whereas it is primarily motivation that distinguishes acts of cyber terrorism, cyber crime, and military cyber attacks. The rest of their attributes may be absolutely similar. The practical part of the problem is that the target of a cyber attack, while in the process of repelling it, will not be informed about the motives guiding its source, and, accordingly, will be unable to qualify what is going on as a criminal, terrorist or military-political act. The more so that sources of cyber attacks can be easily given a legend as criminal or terrorist actions.

After establishing the tactical importance of maintaining a "legend" or cover for an act of cyber warfare to be indistinguishable from an act of cyber crime or cyber terror, the authors go on to decry efforts of the United States to secure international legislation that might infringe on a state's internal affairs in these matters: International legal acts regulating relations arising in the process of combating cyber crime and cyber terrorism must not contain norms violating such immutable principles of international law as noninterference in the internal affairs of other states, and the sovereignty of the latter.

Moreover, politically motivated cyber attacks executed on orders from governmental structures can be qualified as military crimes with all the ensuing procedures of investigation and criminal persecution of the culprits. Besides, military cyber attacks can be considered as a subject of international public law. In this case, we should speak about imposing restrictions on development and use of computers intended to bring hostile influences to bear on objects in other states' cybers.p.a.ce.

In any event, the military policy in the area of international information security where it involves opposition to cyber terrorism and cyber crime should be directed at introducing international legal mechanisms that would make it possible to contain potential aggressors from uncontrolled and surrept.i.tious use of cyber weapons against the Russian Federation and its geopolitical allies.

They attempt to make a case for international regulations that would limit the ability of Western nations to support opposition parties in the breakaway republics now known as the CIS: A case in point ill.u.s.trating a foreign interference in the affairs of a sovereign state was the use of numerous English and Russian websites in support of the opposition forces in Kyrgyzstan during protests in November 2006. Published in the Internet, the opposition leaders' appeals for ma.s.s-scale anti-presidential rallies led to a surge of popular unrest in the republic.

It's interesting that they mention Kyrgyzstan and the opposition's use of the Web to express dissent. Yet these authors attempt to make the debate about free speech rather than addressing the act of cyber warfare that was used by nonstate Russian hackers to silence the opposition's Internet presence one year earlier during the Tulip Revolution (from a special report by the Open Net Initiative, February 28, 2005): On February 26th an apparent Distributed Denial Of Service Attack (DDOS) temporarily disabled all websites hosted by major Kyrgyz ISPs (Elcat and AsiaInfo). These ISPs host the websites of many Kyrgyz political parties, media outlets and NGOs. The spike in traffic a.s.sociated with the failure of Elcat's and AsiaInfo's hosting services led upstream ISPs in Russia and Europe to block access to Elcat's and AsiaInfo's IP addresses, so that web sites hosted by these ISPs are no longer accessible outside of Kyrgyzstan.

The Art of Misdirection

Misdirection is a tactic that the Russian Federation has successfully applied to its military strategy for many years, particularly during negotiations for nuclear disarmament with the United States. However, it has never been used so clearly or frequently as it has been in this century during times of cyber conflict.

In order to understand exactly how the art of misdirection is applied so adeptly to cyber events in Chechnya, Ingushetia, Kyrgyzstan, Estonia, and Georgia, it's important to know about a very successful pract.i.tioner of misdirection, a famous stage magician named Ralph Hull.

Ralph rose to celebrity in the world of stage magic as a magician's magician. In other words, his preferred audience consisted of other professionals like himself. He had long pa.s.sed the stage where fooling an audience of "civilians" provided any satisfaction. Coming up with a trick that baffled other pros, however, was his ultimate goal. He succeeded in that goal with a card trick that he named "The Tuned Deck."

Here is one possible delivery that Ralph's audience would have heard as he performed his master trick: Boys, I have a new trick to show you. It's called The Tuned Deck.

This deck of cards is magically tuned. [Hull holds the deck to his ear and riffles the cards, listening carefully to the buzz of the cards.] By their finely tuned vibrations, I can hear and feel the location of any card. Pick a card, any card...

A member of the audience would pick a card, look at it, and return it to the deck. Hull would then riffle the deck by his ear, and draw the very card the audience member selected.

No one ever figured out how he did that trick until after his death, when the details of "The Tuned Deck" were published. Hull's secret was shockingly simple. He, like his colleagues, knew multiple ways to perform this trick. Let's label them A, B, C, D, and E. When another magician guessed that Hull was using trick A, Hull would repeat the trick using B. If someone else recognized the trick as B, he would repeat it using trick C, and so on. Every time someone thought that they recognized his trick, he would immediately repeat the trick in a slightly different way, and no one expected him to revert back to a method that they had already named. Therefore, in the minds of his audience, it must be something new.

What does this have to do with Russian military strategy? Nothing. The misdirection wasn't contained in anything that Hull did on stage. The genius of Ralph Hull wasn't in what he did; it was in what he said. It was in how he named his trick-"The" Tuned Deck.

By using the word "the," he created an image of a single trick in the minds of his audience, when in reality he was performing multiple variations of one trick.

In discussing information warfare, both in speeches and in papers, Russian military officials point to a future capability that they are in the process of developing as a defense against US capabilities, which they claim are more advanced and already in place.

They define the debate by pointing to what their adversary is developing and therefore what they must develop to defend their homeland. Having defined what Information Warfare is, they will then argue for a treaty regime that limits development of those capabilities. And here is the artfully applied misdirection of the Russian government.

The Kremlin will negotiate on military capabilities that they haven't used, but will not negotiate on their civilian hacker a.s.sets that they have used. In fact, the latter is considered an internal criminal matter not open to international negotiation at all.