Four new paradigms to understand power and security in cyberspace
The frequency and volume of attacks are continually increasing in cyberspace. A total of more than 200 events that could be considered as cyberattacks by one state against another have been identified. Criminal actions are also multiplying on the Internet. The number of harassments committed via an online communication service doubled in France between 2016 and 2018.
A description of the benefits of cyberspace is useful in understanding this increase in attacks and in better addressing digital power.
The spread of messages and data is first and foremost immediate and global in cyberspace. Any two computers can exchange information instantly provided that their communication protocols are compatible. Physical geography no longer counts. The scale effects are disproportionate with what was practiced beforehand.
If an attack is possible, it can spread extensively and quickly. Military theaters of action acquire a global dimension. Although the physical operations are contained in the war zones during conflicts, sympathizers living in areas far removed from combat, or even in an enemy country, can also play a role. Conventional concepts of boundaries and sovereignty are being challenged.
Offensive means of action are favored. Access to the network is easy and requires modest investment. The cost/result ratio is particularly low and may encourage hackers to act. Failure will have little effect. The attacker also has the initiative. A computer system is similar to a fortress. It is fixed. It can be observed, its defenses can be tested, its faults detected and exploited. It is difficult for the defender to imagine all the possibilities for penetrating their network and to protect themselves against them. One of the hacker’s favorite modes of action is to identify a weakness, known as “zero day”, corresponding to a security fault in the software or the operating system that the designers are not aware of. Imagination is the hacker’s greatest strength.
The attacker also acts covertly. It is very difficult to immediately detect an attack and then to trace the intricacies of the network to identify the perpetrators. The initial priority is rather to understand the nature of the attack to limit its effects. The attribution phase only comes afterwards. And it is very unlikely to find a “smoking gun” identifying the origin of the attack withcertainty. Various criteria have to be gathered and interpreted. States can cover their tracks by entrusting the performance of some sensitive tasks to private actors. In any event, this stealth boosts the incentive for hackers to act, since they know they will have relative immunity.
Finally, common rules of engagement or a code of good practice shared by all do not exist in cyberspace. Actors’ behavior can be very different and unpredictable because of a lack of regulation. Uncertainty and mistrust reign because actors ignore their rivals’ capabilities and the limits they set themselves.
Therefore, digital power is also an asymmetrical power, reducing the power gap and capacity to act between the different actors.
Private business entrepreneurs were the first to understand how to best possibly coordinate all these resources. They envisioned a new form of organization, overthrowing value chains and the dominance of established companies.
Start-ups are breaking free from the Taylorist model and promoting “scalability”. Since they can theoretically reach all Internet users at very low financial cost, they are developing new products that they can continue to “manufacture” in the event of a growth shock, if demand rapidly explodes.
Small teams with a great deal of autonomy have been established. Initially, for example, Wikipedia was grouped around eightpeople. Facebook had 450 employees in 2007 (as opposed to 35,000 in 2018). Clients are responsible for voluntarily and freely supplying the components required for a start-up’s development.
An original idea is exploited by imagining a simple prototype. For example, the objective is to manufacture a luxury car, but only the engine is fitted on a chassis and four wheels. The rest is designed by the clients. Their preferences and wishes are known and applied through direct interaction with them. It is enough to offer them what suits them best. Entrepreneurs are taking advantage of the network’s collective intelligence while individualizing the service. Supply and demand meet directly without intermediaries. Financial losses are sometimes high at the outset, but are largely offset by future profits. Growth is ensured by means of marketing technologies and addictive psychological skills. Faithfulness is rewarded by benefits and exclusive discounts.
Digital platforms obviously do not manufacture cars, but they do provide services. They aggregate them to make them even more attractive and to dominate the market. You are no longer selling a vehicle, but a life experience. You are no longer selling a hotel room, but a trip. Software is replacing intermediaries and transaction services. The digital platforms are responsible for finding the most attractive offers for potential tourists, saving themtime and money. They combine offers from hotel groups with those of transport companies.
Besides controlling the value chain, these platforms are tempted to control digital infrastructure to manage data flows more closely. Controlling interfaces, like mobile telephones, is essential for clients to exclusively access the platforms’ applications. Amazon started by selling books. The US firm then digitalized the content thatwas only readable on the Kindle. It now manufactures the chips thatpower these e-readers.
Clients are becoming captives of an ecosystem thatis unevenly shared. The platforms are becoming indispensable by developing a world where the more or less artificial needs of its inhabitants are satisfied. In return, they collect an invisible tithe, made up of the data their clients will asymmetrically provide about their behavior and preferences. It is the source of the platforms’ wealth that will make them grow. Advertising (Facebook and Twitter) is individualized. Of course, mapping services inform users of their locations, but they also provide them with several nearby addresses that are likely to trigger an irrepressible desire to consume.
This tithe makes customers even more indebted since they become even more dependent on the services provided by the platform.
However, this data no longer belongs to them. It is in the hands of the large companies, which turn it into instruments of power. Data is not the new oil in business, but its new soil. All the connected individuals are the new serfs of the digital era. They are tenant farmers who are cultivating, maintaining and developing the digital soil that does not belong to them and that they can suddenly be denied access to, if their masters so decide.
The purpose of these platforms is to create a closed, hyperconcentrated system where they can eliminate any competition. They can then order the data according to their own logic,and influence many areas, such as work, privacy and taxation. For example, Facebook wants to issue its own money with Libra. They embody a modern version of the large colonial companies that took on commercial and then state and military roles, like the East India Company between the 17th and 19th century, that had India in its clutches.
Methods applied successfully in the economic field are gradually adopted in the field of conflict. Exercising digital power particularly appears to extend into the “gray area” that no longer corresponds to a state of peace, but cannot yet be considered as a state of war. The purpose is not to strike a decisive blow. The intention is rather to slowly penetrate the opponent’s digital networks to become established there permanently and to exploit them if opportunities occur or circumstances dictate it. The sum of blows struck over all these networks must ultimately weaken the enemy.
Scalability and a change of scale make it possible to redefine the conflict conditions and to reconsider some categories of international competition. To paraphrase Valery Gerasimov, the role of non-military means to achieve political and strategic goals is increasing. Sometimes, cyberactions prove more effective than armed force, blurring our societies’ relationship to violence.
The level of conflict where digital power seems most decisive is that of “political warfare.” This term dates from the beginning of the Cold War. George Kennan first defined it as the logical application of Clausewitz’s doctrine in peacetime, that is to say, the use of all means available to a nation, with the exception of war, to achieve its national goals. A more recent definition interprets it as “the intentional use of one or more components of power (diplomatic, information, military and economic) to influence the political make-up or the decision-making process within a state”.
Digital power influences this political warfare. Tactical, operational or strategic levels are abandoned in relation to conventional conflict. It is no longer a question of succeeding on the conventional battlefield, of maneuvering better than opposing armies, or of destroying means of arms production and logistic support. The purpose is to bypass all these conventional levels of war and to directly target citizens, by acting on their perception of reality and guiding their political preferences.
Domestic political debates are formatted and the legitimacy of some leaders is weakened or boosted by using procedures similar to those of commercial marketing. The same psychological bias helps to attract and retain Internet users. Never mind the exact accounts of events. For example, false stories with an exciting narrative circulate six times quicker than real facts on the Internet. Virality is exceeding truth. The feeling of belonging to a group with similar ideas, feelings or values is also a powerful driver for bringing scattered individuals together under a common theme. The impression of being right is even stronger. The fact that people do not usually like being wrong, and hate it even more when a third party shows them their mistakes, highlights the difficulty in setting the record straight.
“Monarchs” are emerging on the Internet, who know how to play on human psychology, seducing a vast audience and seizing debates for their benefit. The phenomenon of hyperconcentration at work in the growth of platforms is found here. A study of 330 million Chinese Weibo users showed that fewer than 200,000 members had more than 100,000 followers, and that only 3,000 of these were followed by more than a million individuals. Opinions are mainly formed from messages sent from only 300 accounts.
These principles have been adopted in many ways by political entrepreneurs. The Five Star Movement in Italy expanded rapidly and took power thanks to G. Casaleggio, a real Internet marketing expert. He relied on the popular and friendly image of Beppe Grillo, an Italian comedian whois critical of traditional political parties, by offering to write his blog posts. Within the space of two years, Beppe Grillo’s blog became one of the top ten blogs in the world. Internet users’ reactions were scrutinized and analyzed. The most “liked” topics were continued and developed. The aim was really to capture Internet users’ attention and retain them by giving them what they wanted. The transition to the real world and political competition was achieved by sticking to the same principle. It was still necessary to recognize, develop and maintain people’s beliefs, but also to provide a simple and consensual reason capable of explaining the cause of their frustrations. The explanation found in Italy was the failure of the elites. Although very brief, this narrative made it possible to unite various groups with very diverse, even contradictory, political opinions. Each one considered that their situation was the result of the country’s disastrous management by politicians who were incompetent.
Variations exist in this revamped form of propaganda. Moscow plays less on populism than it seeks to increase social fractures and take advantage of crises when they appear. Daesh preferred a moredecentralized approach and resorted to a redundant propaganda system in several languages, with many channels that proclaimed the advent of a regime radically breaking with Western values.
Democracies were already subject to foreign interference in influencing their citizens’ views and voting. However, their vulnerability is emphasized by the characteristics of digital power,and they are often helpless. Identifying, influencing, isolating and opposing groups of citizens distorts the functioning of a consensus-based system. Authoritatively sharing these ideas is more effective than debating them. It is now a matter of rejection rather than development. There is no need to take military action against the opponent to impose their views. The enemy can be weakened by division alone.
The current situation could even worsen with technological advances. Reactions could be analyzed through body language, such as observing faces, to discreetly detect people’ssupport or not of some ideas. Bots will be capable of automatically spreading false news specifically tailored to their targets. In short, international competition is expanding into the domestic political sphere in a revamped way thattends to blur the conventional categories of war and security. Digital power could be a factor of instability on the international stage.
Digital power is a tremendous asset for anyone who knows how to use it. It can be used for conventional activities such as subversion, espionage or sabotage,to use Thomas Rid’s classification. It can contribute to military operations tactically, operationallyandstrategically.
However, the capability of digital power to control its target, while satisfying it, by penetrating their operational processes (the brain for people and SCADA for complex systems) is probably its greatest strength. It is most effective in the area of economic services and in political warfare for defense matters. So, its deployment corresponds less to an attempt at coercion or seduction than at subjection.
Connectivity between people or connected objects and their master is guaranteed by the network. The target itself provides the conditions for its control, by asymmetrically revealing its characteristics. This information is transformed into knowledge and power provided it can be processed and enriched. The algorithmic or psychological structure of the target becomes transparent. Identifying a vulnerability in a computer system, or a behavioral or character trait in a person can cause damage. It is enough to explore it and to emphasize it so that it becomes the weak link that diminishes the organization’sgeneral balance.
Digital power could change the forms of competition between actors in the international system in the future, as it did for economic competition. Playing on violence and physical fear to undermine the will of your opponent could appear dated in some circumstances. It is less about controlling bodies than minds. Digital power is also the power to bypass violence.