The decision to claim credit for a cyberattack on a government or institution depends on both the goals of the attack and the characteristics of the attacker, according to a study co-authored by a UConn political scientist that is one of the first to look into the voluntary claiming of cybersecurity operations.<\/p>\n
The type of attacker \u2013 whether a state or a non-state actor such as a terrorist group \u2013 determines whether credit is claimed for a cyberattack and how it is communicated, according to the study, \u201cRethinking Secrecy in Cyberspace: The Politics of Voluntary Attribution,\u201d forthcoming in the Journal of Global Security Studies<\/em>. Co-authors of the study are Evan Perkoski, assistant professor of political science at UConn, and Michael Poznansky, assistant professor of political science at the University of Pittsburgh\u2019s Graduate School of Public Affairs.<\/p>\n Among the findings of the study:<\/p>\n \u2022 Both states and non-state actors face similar decisions in the lifecycle of a cyberattack, yet the characteristics of each can cause their strategies to diverge, \u201cparticularly with the optics of credit claiming.\u201d Perkoski says that in developing the study, a distinction was drawn between cybercrime and cyberblackmail because \u201cthey are inherently different forms of cyber operations with different goals in mind.\u201d<\/p>\n He notes that typically the goal of cybercrime is personal or financial gain, which does not follow the same logic as states operating against other states in cyberspace. In the case of cyberblackmail, the attacker wants the victim to know something was stolen, such as when North Korea hacked into the servers at Sony following the release of \u201cThe Interview,\u201d a film about assassinating its leader, Kim Jong-un.<\/p>\n \u201cThey hacked into Sony servers, stole certain information, and said we want you to do X or we\u2019ll release this information,\u201d Perkoski says. \u201cIt was a form of pretty basic blackmail. It\u2019s not operating on the same kind of pattern of state-on-state or non-state-on-state intervention in cyberspace. In that case, you only want to communicate with the person you\u2019ve hacked and let them know you have this material. It\u2019s a different dynamic than a state trying to coerce an opponent to give up their nuclear arms program.\u201d<\/p>\n The researchers began their collaboration studying cybersecurity several years ago while they were both fellows at the Belfer Center for Science and International Affairs at Harvard\u2019s Kennedy School of Government. Perkoski is a specialist in political violence and terrorism, while Poznansky studies clandestine and covert interventions.<\/p>\n Perkoski says the alleged Russian meddling in the 2016 U.S. Presidential election fits into the study\u2019s findings. Russian operatives reportedly hacked into the Democratic National Committee computers to obtain emails from the Hillary Clinton campaign, and then used social media trolls to sway public opinion toward Donald J. Trump\u2019s campaign.<\/p>\n \u201cRussia wouldn\u2019t get as many benefits from claiming their operation,\u201d he says. \u201cThey\u2019re not looking to get attention for their message or cause. They\u2019re really looking to influence the way events might unfold. Because it\u2019s unclear, it makes it hard for the U.S. to take a hard stance against them. You can always play devil\u2019s advocate and say maybe it wasn\u2019t Russia, as President Trump has said. Maybe it was some guy in his basement hacking on his own. In that case, it makes sense that Russia doesn\u2019t want to claim credit, to limit possible escalatory dynamics.\u201d<\/p>\n One of the challenges in confirming clandestine state-sponsored activities is that it may only be possible from classified documents. Perkoski says scholars are still learning important details about historic events with the release of classified documents decades after the events occurred, such as the recent release of documents concerning the controversial 1961 U.S. invasion of Cuba at the Bay of Pigs.<\/p>\n \u201cWhen we think about what\u2019s happening with the U.S. and Russia, Iran, and North Korea and their cyber operations, it may be another 30 or 40 years until we know what\u2019s really going on,\u201d he says.<\/p>\n Perkoski says the study helps to clarify the fact that not all cyber operations are inherently anonymous, and that actors may claim credit for them, which then opens the door to using cyber tools as almost traditional instruments of state power. At the same time, there is no firm understanding of how non-state actor groups operate in cyberspace.<\/p>\n \u201cWe know a lot about how terrorists and insurgent groups come together, and what sustains them, but we don\u2019t have a theory of any of this stuff for a hacking organization and whether they follow the same paradigms or not,\u201d Perkoski says. \u201cHow do you defeat a militant organization or a hacking collective like Anonymous when they\u2019re all spread out around the world, they operate in states that don\u2019t have extradition treaties with the United States, and they might even operate in some states that give them de facto immunity? We know, for instance, that some Russian hackers don\u2019t get support from the government, but they allow them to operate freely because they\u2019re operating in Russia\u2019s own interest. That raises a lot of questions about understanding these groups.\u201d<\/p>\n At the same time, Perkoski says, as advances in cybersecurity improve the ability of government and law enforcement agencies to track hackers, terror groups and militant organizations are moving away from technology.<\/p>\n \u201cThere was a period when government agencies were quite effective at using these tools to their advantage and gaining information. Now I think you\u2019re seeing militant groups respond to that and go more low-tech, to avoid some of those weaknesses,\u201d he says. \u201cLook at how the U.S. found Osama bin Laden in Pakistan. It wasn\u2019t through hacking or satellite imagery. It was by tracking a courier going to his house and meeting with other guys who would go back to Afghanistan. It was very much traditional signals intelligence that the CIA has been using for 50 to 60 years.\u201d<\/p>\n Listen to Perkoski discussing his study with the UConn 360 podcast:<\/em><\/p>\n
\n\u2022 While most research treats cyber operations as distinct from more traditional elements of state power, states \u201cmay be able to leverage their cyber assets to achieve many of the same goals most frequently pursued with conventional forces.\u201d
\n\u2022 The decision to privately or publicly acknowledge sponsorship of an attack may provide \u201ccrucial information about both their motives and identity.\u201d<\/p>\n