Search

Begin New Search Topic Security Publishing Institution Carnegie Endowment for International Peace Publication Year within 25 Years Publication Year within 1 Year

1. No Water’s Edge: Russia’s Information War and Regime Security

Author:
Gavin Wilde and Justin Sherman
Publication Date:
01-2023
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
To the extent that any unified theory of Russian information warfare actually exists, its core tenet might well be that regime security has historically been indivisible from information warfare in Russian strategic thought. Rather than an aggressive or expansionist expression of Moscow’s foreign policy, the Kremlin’s so-called information war should primarily be viewed through a domestic and regime security prism—it’s as much a counterinsurgency as an expeditionary strategy, less an escalation than a projection. Analysts and decisionmakers should therefore avoid reflexively casting the United States and the West as Russia’s primary antagonists in its information war, as doing so risks reinforcing these insecurities and exaggerating Moscow’s degree of power in the information ecosystem.
Topic:
Security, Foreign Policy, Information Warfare, and Russia-Ukraine War
Political Geography:
Russia, Eurasia, and United States of America

2. Phase-based Tactical Analysis of Online Operations

Author:
Ben Nimmo and Eric Hutchins
Publication Date:
03-2023
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
The online threatscape in 2023 is characterized by an unprecedented variety of actors, types of operation, and threat response teams. Threat actors range from intelligence agencies and troll farms to child-abuse networks. Abuses range from hacking to scams, election interference to harassment. Responders include platform trust-and-safety teams, government agencies, open-source researchers, and others. As yet, these responding entities lack a shared model to analyze, describe, compare, and disrupt the tactics of malicious online operations. Yet the nature of online activity—assuming the targets are human—is such that there are significant commonalities between these abuse types: widely different actors may follow the same chain of steps. By conducting a phase-based analysis of different violations, it is possible to isolate the links in the chain within a unified model, where breaking any single link can disrupt at least part of the operation, and breaking many links—“completing the kill chain”—can disrupt it comprehensively. Using this model will allow investigators to analyze individual operations and identify the earliest moments at which they can be detected and disrupted. It will also enable them to compare multiple operations across a far wider range of threats than has been possible so far, to identify common patterns and weaknesses in the operation. Finally, it will allow different investigative teams across industry, civil society, and government to share and compare their insights into operations and threat actors according to a common taxonomy, giving each a better understanding of each threat and a better chance of detecting and disrupting it.
Topic:
Security, Internet, and Non-Traditional Threats
Political Geography:
Global Focus