Schneier on Security

Skeptical • August 17, 2016 7:39 AM

Tit-for-Tat and Russian Mirror-Imaging

This could also be viewed as a bit of tit-for-tat, with respect to the unveiling of the FSB and GRU operations against the DNC. Following the very public arrest of several SVR deep non-official cover officers in the US, one might remember that Russia made a very public arrest of a CIA officer in Moscow, complete with photographs of that officer being “physically secured for his own safety” and being somewhat ignominiously relieved of a wig.

Such a thesis would also fit a theory that the Russian agencies involved viewed the DNC penetration as “the usual game”. Public exposure of such operations also form part of that game, from time to time, or so it seems anyway, and of course, so does the usual in-kind reprisal from the other side.

Although the FSB/GRU operations were revealed by a private US company, I would guess that Russian analysts are prone to reading such actions as directed by the US Government, as in their own country they might find it impossible to believe anyone could release such information without the permission or at the direction of the relevant authorities/powers. So, it’s plausible they viewed the public exposure of the FSB/GRU ops as deliberate on the part of the US Government; the allowed spread of samples of their tools to various US friendly cybersecurity companies as deliberate; and this is a reprisal, an effort to maintain a level engagement with the adversary and thus not lose the initiative.

Moreover, this thesis fits well with the apparent time-stamps on the material, which seem almost designed to foster debate about whether Snowden was or was not involved. Since Snowden is viewed as an embarrassment to the US Intelligence Community, such an effect would magnify the desired effects of public exposure here as reprisal.

What Is Troubling

If the foregoing is true, then this might indicate a lack of understanding by key actors within Russia of what the United States found unusually problematic: not the espionage itself, which was likely viewed as an opportunity by the Americans for counterintelligence (one might also ask whether the Russians, being well aware of that, might have used the putative intelligence gathering on the DNC as misdirection for another purpose, such as assessing US counterintelligence or attempting penetration of a different target).

Of course, it may also be to Russia’s advantage to foster an impression that they do not understand and perhaps avoid reprisals for the information operation by undertaking actions that favor a thesis that the Russians view this as business as usual. In turn this permits the Americans, in their role as the more enlightened party, to avoid instigating a cycle of escalating reprisals on the basis of what they can see to be a cultural misunderstanding.

What May Not Be Troubling

The Russians are not monolithic, and while this may be tit-for-tat by a particular Russian intelligence agency, it may not be indicative of a lack of understanding by other key actors in the Russian Government.

Where Plans By Committee Come Together

Then again, a confluence of motives might explain the action. Russian intelligence agencies may approve of the tit-for-tat nature of the exposure. Russian information operations may view this as another move in an ongoing campaign to sow doubt and confusion about US Intelligence capabilities and thereby blunt full US exploitation of a US strength. Russian diplomats and other figures may view this as buttressing the narrative that they simply viewed prior actions as normal conduct.

And there might be the hope that this could influence the mind of a deliberative, risk-averse US President, lowering his confidence level that certain options likely to be presented to him are likely to be effective, hindering his ability to predict the consequences of certain reprisal actions for the DNC leaks.

Then Again…

It’s plausible that actors other than the Russians are responsible, which is an assumption upon which all of the foregoing rests.

But nothing here alters the calculus of how the US should respond to Russian attempts to influence the US Presidential election. The only question for the United States is how their response best fits a larger strategy.

President Obama said at one point that he does not need a George Kennan. I never entirely bought the line, seeing the obvious contours of grand strategy in his foreign policy approach, but I would imagine his view on the most prudent course of action vis-a-vis Russia has modified substantially: still pragmatic, but understanding the limits imposed on Russia’s ability to cooperate in what most view as their own self interest.

Skeptical • August 18, 2016 12:00 PM

Actually… I’m going to revise.

As a threat from the Russian Government against US actions, it is far too vague. Threats have to be reasonably clear as to the consequences that will be suffered if the target fails to do – or to refrain from doing – what the threatening party demands.

But here there is neither clarity as to consequences nor clarity as to the demand. Nor can a 2013 breach of this nature – unless there’s something very special about the data – possibly be intimidating to the US.

The Russians don’t need to demonstrate that they’ve penetrated US networks previously; the US is well aware of it, and in fact named them as an adversary in cyberspace with the most depth and capability.

Nor would it make sense for Russia to merely threaten to expose US interference in a foreign election – if this leak demonstrates such knowledge (which I highly doubt), then they’ve already told the US they know, in which case the better move would be to expose it and undercut a US retaliatory action for the DNC info op.

An exception to this might be in an instance where the exposure would harm Russia as well – suppose the US interfered in Turkey’s elections, and Russia exposed this. Erdogan’s position would be strengthened, his ties with the US weakened, but it’s unclear that Russia would benefit from a domestically empowered Erdogan that feels more vulnerable. Indeed that might be a substantially dangerous situation for Russian interests, as Erdogan might act with less restraint in Syria, and the US might be less able to persuade him otherwise – while still being obliged to defend Turkey as part of NATO.

So the threat would be… “we haven’t exposed this because it’s in our interests not to, but if you hurt us badly enough, we will; and as a proof of will, we’re sacrificing some useful intelligence to demonstrate this knowledge.” But – this seems far-fetched, to say the least.

Perhaps we’re attributing too much unity and rationality to the Russian Government, though. It’s known that the Russian Government employs skilled technicians of loose affiliation with the Government to conduct certain cyberespionage and cyberoffensive operations. Those same skilled technicians may, perhaps, also work on the side for less political causes.

In other words, the command structure may be sufficiently decentralized for a person or group to – for reasons having little to do with the considered interests of the Russian Government – leak such data for reasons of their own. Pride, perhaps, after the debacle of the DNC penetration? Learning that you were owned a year ago, having your goods passed around Western cybersecurity companies, and potentially exposing an important client (the Russian Government, and related entities) to serious blowback, can’t be considered a very good day. In fact, that kind of thing seems like it could entail humiliation and fear, depending on the position of the individual/group (if an official unit, less so – if unofficial or quasi-official, more so).

The size of the pie in Russia is shrinking – unexpected arrests and removals are happening – this may not be a good time to be seen as vulnerable.

So… a bid to regain credibility and patch up one’s reputation with current and potential customers? “Sure, we lost the DNC operation – not our best work. But here’s something from a few years ago that we can show without compromising anything current of our own that shows some real skill…”

Maybe.

But there’s another possibility. This would make sense as a threat if you wanted to demonstrate that a known breach in 2013 included much more than has been published, and that if X happens, then more will be published.

So in this alternative, an organization like Wikileaks – or a supporter – is concerned about possible US retribution for its witting cooperation with Russian interference in the US election process. How to forestall retaliation? Deterrence by denial? Unlikely to be feasible. Deterrence by punishment? How much did Snowden really walk away with? How much does he owe – or thinks he owes – Wikileaks for his current refuge?

Snowden is someone who thought the US would pay Hong Kong gangsters to kill him. Would it be difficult for someone trusted, someone close to him, from Wikileaks to persuade him of a dire threat to that organization? And if so – would he be willing to provide a piece of a puzzle to enable some of the extra leverage he squirreled away to be unearthed, unlocked, and used for protection?

If that’s the case, one would assume a message was communicated to the US Government via alternative means regarding the meaning of this leak. Perhaps that meaning is to be found in a tweet; perhaps it was delivered more directly by a trusted intermediary.

Then again… perhaps Snowden simply trusted the wrong person – also associated with Wikileaks, also with a paranoid approach to the US Government (perhaps narcissistic, and with delusions of grandeur as well) – with some of his insurance policy, and that person unlocked a bit of it for the same reason. Indeed, perhaps such a person is currently in need herself, or himself, of additional friends and leverage in the world. What a way to gain that. A hero again, and with buried gold somewhere besides.

In both cases – whether Snowden or a trusted person who betrayed that trust – one would expect Snowden to downplay the potential harm to the US from this particular leak.

I’m increasingly inclined towards one of the above two (or three I suppose) possibilities. I wouldn’t rule out it being a sanctioned action by the Russian Government, but it’s a very peculiar one if so.

In any event – all complete speculation on my part. Perhaps someone simply cracked a third party with this stuff in storage – allegedly individuals involved with a NSA operation in Greece practiced sloppy tradecraft. Perhaps this was part of the take, and perhaps the take was in turn taken by another third party, who desired to stir the pot for purposes of their own.

But I cannot see any possibility under which this leak was a wise decision by the leaker. Even as a kind of cracker advertisement it doesn’t make much sense. Who wants to hire the guy who just waved a red flag in front of the Five-Eyed creature that glimpses the streams of light coursing between the continents 50 fathoms deep with as much difficulty as one might have finding that email lost somewhere in one’s inbox.

Then again, there’s a lot I don’t see. But speculation can be a fun game.