• August 2, 2022

Attribution of information influence operations is broken – this is how to fix it, suggests a new publication by NATO StratCom COE and Hybrid CoE

Digital platforms are vulnerable to manipulation: Since 2018, the big three platforms – Google/YouTube, Facebook, and Twitter – have announced over 350 takedowns of coordinated efforts at manipulation. Such takedowns usually involve attribution, a statement of blame towards the actors behind the information influence operation (IIO).

However, attribution of information influence operations is dysfunctional, claim James Pamment and Victoria Smith, the authors of a new study published by the NATO Strategic Communications Centre of Excellence and the European Centre of Excellence for Countering Hybrid Threats.

According to the study, a typical platform takedown makes a statement of attribution but rarely shares the evidence that led to that conclusion. Hence, the study aims to improve the ability of practitioners to collect and analyse evidence in support of the attribution process.

To this end, the authors offer an attribution framework consisting of the types of evidence available through different kinds of data.

Attribution can be based on four types of evidence:

  • Technical evidence (the observable traces that an adversary leaves behind at the level of digital signals)
  • Behavioural evidence (knowledge of the tools, techniques and procedures (TTPs) by which adversaries carry out their work) 
  • Contextual evidence (an assessment of the content and the socio-political context of the IIO and the motivations of the adversary) 
  • A legal & ethical assessment (as to whether assigning blame is proportionate, and whether it sets into motion considerations relating to e.g. political or commercial fallout, treaties or litigation)

The evidence may be derived from three kinds of data:

  • Open source (open-source information and intelligence, OSINT)
  • Proprietary source (based on privileged backend data sources such as those available to digital platforms, private intelligence and cyber security companies)
  • Classified source (based on secret information primarily held by governments and the military)

The study aims to improve understanding between actors about the benefits and weaknesses of the different types of information available to different actors, and to use this understanding to improve information-sharing within the IIO community (journalists, researchers, NGOs, companies, intergovernmental organizations, and governments).

According to the authors, the clearest areas of collaboration seem to be around behavioural, contextual, and legal-ethical assessments.

“If the holders of classified and proprietary technical and behavioural evidence want to present their attributions as the most apolitical and objective assessments possible, they need open-source researchers to get better at what they do. This is only possible with a firm commitment to information-sharing, transparency, and honesty,” the authors write.

You can download and read the study entitled Attributing Information Influence Operations: Identifying those Responsible for Malicious Behaviour Online on NATO StratCom COE’s website.

The work on attribution at Hybrid CoE is led and coordinated by the Community of Interest on Hybrid Influence. You can read more about its work on our website.

  • June 29, 2022

National exercise with a focus on hybrid threats piloted in Austria

Hybrid CoE has developed an exercise to foster nationwide awareness of hybrid threats; to demonstrate the need for nationwide cooperation in countering them; and to look at existing structures and processes within the framework of the national Crisis Management Systems and interministerial working groups.

This national decision-making tabletop exercise (TTX) with a focus on hybrid threats was piloted on 14 June in Austria, the country which originally proposed that the Centre could develop this type of exercise. The exercise was designed from the outset with the intention of also making it available to other Participating States in order to develop a whole-of-government/-society approach based on existing national crisis management systems for countering hybrid threats/attacks.

The TTX consisted of two parts. Phase one was targeted at working-level practitioners, whereas the nationwide political decision-making process with the involvement of strategic-level participants from all ministries was at the core of phase two. Injects ranged from terrorist and cyber attacks, challenges regarding critical infrastructure, disinformation related to the health sector, the use of proxies, and instrumentalized migration. These challenges taught the ministries the importance of cross-government communication when faced with hybrid attacks. The results of the national exercise will only be relayed to the respective governments.

“Hybrid CoE is grateful for the opportunity to test this national exercise with the Austrian government.  We hope to further refine this product so that Hybrid CoE can make this programme a permanent part of the training catalogue,” said Shiho Rybski, Hybrid CoE’s Training and Exercises Director.

Source: Babaroga / shutterstock.com
  • June 9, 2022

From private corporations to religious institutions – Hybrid CoE’s taxonomy of non-state hybrid threat actors

Russia has been making vigorous efforts to infiltrate Western political movements and civil society networks, for example through wealthy individuals and foundations affiliated with the Russian Orthodox Church. Similarly, China has worked hard to implement the United Front approach, through which the Chinese Communist Party seeks to induce diaspora organizations, foreign business, academic associations, political parties and individual influencers to carry out its will across the globe, while maintaining nominal deniability.

Both the Russian and Chinese efforts are examples of how states use non-state actors (NSAs) in their hybrid threat activities. Non-state actors range from individuals to private corporations, religious institutions, humanitarian organizations, armed groups and de facto regimes in actual control of territory and populations. Non-state actors play a crucial role in the hybrid threat landscape. However, there is no agreed definition of the concept itself.

Hybrid CoE’s new research has produced a taxonomy of NSAs, providing practitioners and decision-makers with a tool to detect potential hybrid threats posed by non-state actors.

The taxonomy is built around the operational capacities that NSAs may possess, and the types of relationship they may have with a state sponsor:Hybrid threat activities through non-state actor clients depicted according to the relationship between the state and non-state actor (auxiliary, surrogate, affiliate or proxy) and the categories of power that the non-state actor may use against the target society (cyber, privatized, people, terrorist, real economic, financial, diplomatic, civil, scientific and technological, or media power).

Hybrid threat activities through non-state actor clients

According to the new research, the role played by NSAs in the context of hybrid threats is likely to continue to gain importance, as the variety of NSAs suited to such a role is likely to increase.

“It is vital to listen to practitioners so that the toolbox for detecting and countering NSAs engaged in hybrid threat activities is as effective as possible,” said Janne Jokinen, Deputy Director of the Community of Interest on Hybrid Influence and one of the authors of the new study. “A key element in this discussion should be the collaboration between public authorities and private actors, including civil society organizations, private enterprise, and the population at large.”

  • May 27, 2022

Real-world simulations teach how to defend against disinformation: Hybrid CoE organized the Helsinki Countering Disinformation Wargame

Policymakers, journalists, media influencers, and experts from the European Centre of Excellence for Countering Hybrid Threats gathered in Helsinki 23-27 May for the Helsinki Countering Disinformation Wargame (CDWG). This was a series of events that seek to build the capacities of Hybrid CoE’s 31 Participating States and their populations to counter disinformation through the development and implementation of two wargame simulations and a boardgame. The events will lead to the further development of tools and techniques to help counter disinformation, and will include strategic communications strategies.

“By simulating real-world scenarios we raise awareness of disinformation and offer participants the opportunity to practise the best approaches to recognizing, responding to, and defending against disinformation,” said Ms Shiho Rybski, Director of Training & Exercises at Hybrid CoE.

The Helsinki Countering Disinformation Wargame consisted of three parts: First, a one-day conference titled Demystifying disinformation was organized on Monday 23 May in a physical and virtual format. Second, on Tuesday and Wednesday, national teams from Hybrid CoE’s Participating States practised their skills in countering disinformation in a two-day virtual wargame connecting the capital cities with the Helsinki-based control cell. Day one focused on Russian disinformation, day two on Chinese disinformation.

Finally, on Friday 27 May, two half-day boardgame events were organized, where university students were able to play a physical boardgame – entitled Malign – developed in cooperation with the Georgetown University Wargaming Society and Hybrid CoE. The card-driven educational boardgame is designed to help players better understand, detect, and deter disinformation.

The CDWG project is funded by the U.S. Global Engagement Center. The project endeavours to develop and implement a physical boardgame on disinformation for university students and Hybrid CoE’s Participating States. The project also seeks to design and implement a virtual wargame on disinformation to be made available to Hybrid CoE’s Participating States, tailored to their needs and hybrid threat landscapes.  

[For more information, please contact:
Shiho Rybski, Director, Training & Exercises, shiho.rybski@hybridcoe.fi]

  • May 3, 2022

Civil society engagement at the core of the ‘Resilient Civilians’ exercise

On 25–26 April, Hybrid CoE hosted the main exercise for the ‘Resilient Civilians’ project, funded by the NATO Science for Peace and Security Programme and led by UiT the Arctic University of Norway.

With keynote addresses by NATO Deputy Assistant Secretary General for Emerging Security Challenges Mr James Appathurai, EEAS Security and Defence Policy Director Ms Joanneke Balfoort, and Finnish Security Committee Secretary-General Petri Toivonen, the event drew some 70 participants to Helsinki from Hybrid CoE’s Participating States, including the private sector, academia and civil society. 

The aim of the exercise was to hold scenario-based discussions in order to enhance preparedness for crises caused or instrumentalized by hybrid threat activities. “Civil society engagement in the face of a crisis caused by hybrid threat activity is of paramount importance,” stated Hanna Smith, Research Director at the Centre. “Civilian agency must be integrated into crisis response because civilians are the first witnesses, targets, and responders in many hybrid threat-related crises.” 

The exercise findings will feed into the Resilient Civilians project results and constitute a major deliverable for the project. 

  • April 25, 2022

Maritime hybrid threats under the loupe at Hybrid CoE

Russia’s attack on Ukraine and other recent international developments have accentuated the importance of studying the maritime domain to detect vulnerabilities to potential future hybrid threat operations.

Hybrid CoE’s flagship publication from 2019, the Handbook on Maritime Hybrid Threats, is currently being updated with at least five new scenarios. To gain feedback on the process from all Participating States, the Centre held a workshop on 22 April for relevant representatives and experts to map out potential new maritime threats to be included in the updated Handbook, which is due to be published by the end of the year.

The current edition of the Handbook presents ten hybrid threat scenarios with the potential to be realized in any part of the world, involving complex legal considerations in the context of the United Nations Convention on the Law of the Sea (UNCLOS).

“Unfortunately, it’s likely that we’ll see some of the scenarios realized in the near future. For instance, our Scenario 4 describing harassment of sea lines of communication by means of military exercises has become very relevant in the current international context,” stated Jukka Savolainen, Director of the Community of Interest on Vulnerabilities and Resilience. 

“It’s very important for our Participating States, the EU and NATO to be ready to respond in such situations. The first step in establishing preparedness is to understand the legal frameworks concerned in each possible situation. The issues are complex and they require in-depth expertise in international law. Rapidly emerging situations require quick decision-making, firstly by maritime operators and soon after at the political level as well. If the legal aspects are not known, the decisions risk unintentional escalation. Legal argumentation of this nature, if started from scratch, may take days or weeks.”

“Legal preparedness is not the only aspect to be strengthened. We are there to help in organizing operational and political-level decision-making exercises as well,” Jukka Savolainen emphasized.

Source: Gil Corzo / shutterstock.com
  • April 21, 2022

New Trend Report on China: Regime survival is President Xi’s first priority

Regime survival is now the predominant trend in China’s power politics, writes Dr habil May-Britt U. Stumbaum from the Bundeswehr Universität Münich in the latest Hybrid CoE Trend Report on China.

According to Dr Stumbaum, Chinese President Xi Jinping is running a campaign to achieve utmost control within China, and over China issues worldwide. “Regime survival makes all other intertwined trends subordinate to this one overarching strategy,” Dr Stumbaum writes.

Covid-19 has worked as a catalyst for Xi’s goal, as the pandemic has offered up ample opportunities for disinformation campaigns and initiatives to discredit the competence of Western liberal democracies. However, Covid-19 has also increased pressure on the Chinese Communist Party (CCP) to deliver economic well-being and safety to Chinese citizens. The CCP needs to legitimize its grip on power more than ever.

At the same time, Xi is waging a historical campaign to remake Chinese society and render it fit for the global competition ahead. Central to this aim is ensuring that the people are absorbing the “right socialist values,” Dr Stumbaum writes. This spills over to China’s foreign policy and manifests itself as the second trend that Dr Stumbaum identifies: a “whole-of-society approach” in hybrid threat operations.

“The CCP’s siege mentality is part of its creation myth. Hence, understanding the role of ideology and the perceptions of the CCP is becoming essential in analyzing how domestic developments, structures, and paradigms spill over into China’s foreign policy approaches,” Dr Stumbaum notes.

According to the author, an ever-intensifying level of hybrid operations by China is to be expected. Other trends identified in the report are as follows:

  • China’s economic statecraft, which derives from sanctions and incentives for conditioned development projects, as well as altering international norms and standards.
  • China-Russia cooperation and coordination, with China drawing on lessons from Russian hybrid threat operations.
  • A rise in awareness, resilience and resistance in affected states, particularly in Europe, North America and the Indo-Pacific.

You can download and read the new Hybrid CoE Trend Report on China here.

This Trend Report forms part of Hybrid CoE’s work on analyzing China and Russia as hybrid threat actors. The work will continue in 2022 with a Trend Report on Russia, as well as a study comparing the two.

Read more on our work on China:

Hybrid CoE Trend Report 5: Trends in China’s Power Politics

Hybrid CoE Research Report 1: China as a hybrid influencer: Non-state actors as state proxies (by Jukka Aukia)

Hybrid CoE Paper 9: Towards a more China-centred global economy? Implications for Chinese power in the age of hybrid threats (by John Seaman)

  • April 12, 2022

Invitation to Jyväskylä Summer School course: ‘The Landscape of Hybrid Threats: Culture and the Changing Nature of War’, 8 –12 August 2022

The University of Jyväskylä (JYU) in cooperation with Hybrid CoE will organize a course on ‘The Landscape of Hybrid Threats: Culture and the Changing Nature of War’ as part of the 31st Jyväskylä Summer School. The course will enhance students’ understanding of how culture expresses the “memory” of the people. Broadly speaking, the course explores how vulnerabilities in the cultural domain can be exploited, as well as how this domain could also contribute to resilience in the sense that culture and diversity can have a protective and immunizing effect against hybrid threats/warfare.


Subjects to be covered: 
– Culture as an indicator of hybrid crisis / hybrid threat / warfare impact (the Kassandra Project) (Brace for Impact) (HYFUTEC)
– Strategic culture: authoritarian strategic culture versus democratic states’ strategic culture versus state-specific strategic culture (R&D)
– “Culture eats strategy for breakfast” – how culture impacts policies and (military) strategies (S&D)
– Culture in the age of information and AI (HYFUTEC) / Cyber “culture” (e.g. disinformation)

Lecturers on the course will include Col (ret) Dr Martti J. Kari (JYU), Dr Hanna Smith and Colonel Sönke Marahrens from Hybrid CoE, as well as a number of guest lecturers.

The course is aimed at master’s students, PhD students, civil servants, as well as military and law enforcement officers with a basic knowledge of hybrid threats. More information about the course can be found HERE. The application period for the Summer School is 1 March – 30 April. Applications can be submitted HERE. 

For further information, please email jss@jyu.fi

Illustration of the tensions between Ukraine Russia and the European Union
Source: Shutterstock
  • March 18, 2022

Hybrid CoE continues to work to support European security and Ukraine

While Ukraine is not a Participating State of the Centre, Hybrid CoE has had practical cooperation with the country since the Centre was established in 2017, and contacts have been further strengthened since the start of the war. The Centre has supported Ukrainian exercises and conducts analysis on the situation in the country.

The Centre’s current work concerning Russian aggression and its implications builds on Hybrid CoE’s longstanding research and analysis about Russian hybrid threat operations and strategies, disinformation narratives, as well as its strategic culture. This work will continue as outlined in the Centre’s work plan for 2022. Two recent publications related to Russia’s attack on Ukraine are ‘Russia’s military buildup along Ukraine’s border: What to expect?’ by Margarete Klein and ‘The Kremlin’s messaging on Ukraine: Authorities and “media” hand in hand’  by Jakub Kalenský. 

Hybrid CoE stands firmly by the values of democracy, an open society, the rule of law and respect for human rights, and continues its work to strengthen its Participating States’ and the whole Euro-Atlantic area’s security. Our work is more important today than ever.

Jakub Kalenský assessing the Kremlin’s ultimate aim in its war in Ukraine. 
Margarete Klein discussing the Kremlin’s ultimate aim in its war in Ukraine.
Jakub Kalenský commenting on the content and effectiveness of Russian disinformation concerning Russia’s war in Ukraine.
Margarete Klein on what to expect from Russia concerning hybrid threats and Russia’s war in Ukraine.
Source: Shutterstock.com
  • March 16, 2022

Due to its war in Ukraine, Russia may increase its hybrid threat activities in the MENA region

Russia uses a wide spectrum of hybrid threat tools in the Middle East and North Africa, ranging from the domains of culture and diplomacy to intelligence, information and the military. Russia is most active in Libya and Syria. According to the new Hybrid CoE Research Report, Russia’s hybrid threat activities in the MENA region promote its wider strategic goal of gaining a global superpower status, and may be increased due to the war in Ukraine.

“With Russia currently being isolated by the West, an increase in military, diplomatic and information operations in Syria could again be anticipated,” says Jarno Välimäki, Analyst in the Research and Analysis function at Hybrid CoE and one of the writers of the report.

So far, Russia’s escalating hybrid threat activity in the Syrian civil war has been largely successful, as Russia has become an indispensable player in Syria and, by extension, a major player in the region in general.

“For example, Russia could begin to challenge US air access and block its convoys in Syria. We are also already witnessing Russia trying to pressure the West in the Middle East over the war in Ukraine, as Moscow is threatening to derail the Iran nuclear deal talks due to new sanctions against Russia,” Välimäki says.

Russia’s involvement in post-2011 Libya highlights four main domains of hybrid threat activity: economic, military, political, and diplomatic. Russian activity in Libya has often been opportunistic, taking advantage of dissonant policies by the West.

“Russia’s focus on becoming indispensable, rather than exerting hegemonic control over a single partner, is a cardinal feature of Moscow’s hybrid warfare strategy in Africa,” writes Samuel Ramani in his chapter on Russia’s involvement in Libya.

In this Hybrid CoE Research Report, five writers analyze Russia’s hybrid threat actions through five case studies. The analysis includes the infrastructure, economy, culture, legal, intelligence, diplomacy, political, information, and military domains. In addition to Russia’s actions in Syria and Libya, the other case studies include:

  1. China’s longstanding political and economic ties with Algeria;
  2. Iran’s actions in Lebanon to gain access to the Mediterranean; and
  3. ISIS’s activity in Iraq and Syria and its increased presence in North Africa.

You can download and read Hybrid CoE Research Report 5 in full here.

Disinformation

Attribution of information influence operations is broken – this is how to fix it, suggests a new publication by NATO StratCom COE and Hybrid CoE

Read ›
Resilience

National exercise with a focus on hybrid threats piloted in Austria

Read ›
Non-state actors

From private corporations to religious institutions – Hybrid CoE’s taxonomy of non-state hybrid threat actors

Read ›
Disinformation

Real-world simulations teach how to defend against disinformation: Hybrid CoE organized the Helsinki Countering Disinformation Wargame

Read ›
Resilience

Civil society engagement at the core of the ‘Resilient Civilians’ exercise

Read ›
Maritime

Maritime hybrid threats under the loupe at Hybrid CoE

Read ›
China

New Trend Report on China: Regime survival is President Xi’s first priority

Read ›
Hybrid warfare

Invitation to Jyväskylä Summer School course: ‘The Landscape of Hybrid Threats: Culture and the Changing Nature of War’, 8 –12 August 2022

Read ›
Illustration of the tensions between Ukraine Russia and the European Union
Hybrid warfare

Hybrid CoE continues to work to support European security and Ukraine

Read ›
MENA

Due to its war in Ukraine, Russia may increase its hybrid threat activities in the MENA region

Read ›