Big data, bad actors

There is a new movement, a change in the nature of data breaches currently affecting many Americans. Not in frequency, or in identities stolen, or in money lost, but in kind and effect. Content pilfered in a typical data breach includes credit card numbers, social security numbers, and various other pieces of identity information. In the Sony, OPM, and the Ashley Madison hacks, we’ve experienced a shift in purpose. None of those breaches are driven by purely financial motivation. They signify a new foreign policy tool designed to inflict harm and represent the uncharted cyber territories.  

Data has been called the human algorithm. It is used to establish individual’s identity, patterns, associations, and connections. Data has great value for law enforcement, industry, advertising, science, and other fields, but its value to the individual is even greater – it is the most personalized and intimate outcome of one’s interaction with technology.  

{mosads}The retail and service industries use consumer data to better target ads, improve navigational services, and a host of other functions powered by large amount of data. The intelligence services use the data collected to correlate intelligence and establish better leads on individuals targeted for surveillance. For malicious actors, data represents another tool in their tool box to help them reach their strategic objectives.  

In the last year, millions of Americans have received a variety of different data breach notification letters from insurance companies, banks, and government agencies. Most are apathetic – it’s just background noise. In a 2014 study, Experian, one of the big three credit reporting agencies, discovered that consumers do nothing after a data breach; such as monitoring credit scores, phishing emails, and frequent password updates.  

That’s about to change. As of this writing, there are reports of wives confronting husbands about their Ashley Madison membership, there are neighbors looking up neighbors and there are governments and non-state actors exploring ways to exploit all of it.  

While data breaches in the retail and industry sector reveal commercial identifiers about individuals, the OPM hack provided U.S. adversaries with perfect material to understand the U.S. government’s inner workings, ways to identify its employees and assets, and a new perfect blackmailing and recruiting tool.  

The most serious implications of malicious actors seizing personal data are precisely in the national security sphere. Just recently, an ISIL- linked hacker was arrested in Malaysia and charged with providing material support to ISIL. The hacker allegedly hacked into the systems of a U.S. company and retrieved personally identifiable information (PII) on thousands of individuals. The data trove, reportedly containing information on thousands of U.S. service members and federal employees, was then passed onto the terrorist group to be used against those individuals.  

We’ve entered a new age of data breaches. Money is not the object. It’s something more. It’s about pain, torment, and pressure. It’s about foreign policy, political influence, and relationships between nations and non-state actors. It’s about inflicting emotional harm on a population in an effort to influence future outcomes. 

Data allows the rise of politically motivated extortions. It enables malicious actors to blackmail, recruit, and steal identity. Data and information about government activities can cause international embarrassment and inflict permanent harm on international relations as WikiLeaks skillfully demonstrated. It is a great tool for authoritarian regimes to enhance their domestic, anti-western messaging, or to support efforts to undermine some of the core values of the United States.  

The Sony hack is a case in point- releasing the content of emails of executives of an entertainment company wasn’t only used to embarrass and ridicule, it was intended to pressure the company to halt the release of a movie mocking the North Korean leader, thus impacting freedom of speech.  

These incidents demonstrate the unlimited possibly of how malicious actors can leverage intrusions and data breaches to undermine societal security, stability, and international relations.  

Data is not just ones and zeroes. It is information encoded with value. As such, it can be used to drive results and influence behavior. To appropriately address challenges stemming from the enormous value data can have for malicious actors, the understanding that protecting data and information is directly linked to protecting national security will have to inform policy and technical solutions of the future. Understanding the adversaries, their needs, motivations, and techniques will be important to make these decisions.

Thomas is chief of Innovation for Thomson Reuters Special Services. Jordan is associated director of the Cyber Statecraft Initiative at the Brent Scowcroft Center on International Security at the Atlantic Council.