Thread by @olgs7

In week 8 of “Lies & Disinformation” @Georgetown, we focused on how state-sponsored espionage operations, hacks and leaks can play a role in influence operations. How does the dissemination of leaked material and forgeries fit into the IO playbook?

https://twitter.com/olgs7/status/1271500145868365832?s=20

@Georgetown To start, students read “Tainted Leaks: Disinformation and Phishing With a Russian Nexus” frm @citizenlab @jsrailton @CyberClues @cmatthewbrooks, Peter Tanchak, Ron Diebert citizenlab.ca/2017/05/tainte… for a case study into stolen and manipulated documents & how they can be used in IO

@Georgetown @citizenlab @jsrailton @CyberClues @cmatthewbrooks For a refresher on the 2016 Russian hack & leak operation, students read “The Perfect Weapon: How Russian Cyberpower Invaded the US” @SangerNYT @ScottShaneNYT @EricLiptonNYT nytimes.com/2016/12/13/us/…. Perhaps next semester, I’ll assign documentary now @HBO hbo.com/documentaries/…

@Georgetown @citizenlab @jsrailton @CyberClues @cmatthewbrooks @SangerNYT @ScottShaneNYT @EricLiptonNYT @HBO For a primary source document, students read the 2018 @TheJusticeDept indictment of 12 Russian nationals for "federal crimes that were intended to interfere with the 2016 U.S. presidential election.” You can’t complete a class on IO w/o reading this: justice.gov/file/1080281/d…

@Georgetown @citizenlab @jsrailton @CyberClues @cmatthewbrooks @SangerNYT @ScottShaneNYT @EricLiptonNYT @HBO @TheJusticeDept In class, we broke down hack-and-leak ops into a kill chain, from phishing and data collection, optional post-hoc fabrication, audience building, dissemination, and amplification. We also talked about whether indictments are an effective deterrent /punishment for a hack-and-leak

@Georgetown @citizenlab @jsrailton @CyberClues @cmatthewbrooks @SangerNYT @ScottShaneNYT @EricLiptonNYT @HBO @TheJusticeDept We also spent a bit of time in class and in our readings focused not only on US 2016, but also on the 2017 MacronLeaks campaign. For an overview of that, students read this great analysis of that operation from @jeangene_vilmer @AtlanticCouncil atlanticcouncil.org/in-depth-resea…

@Georgetown @citizenlab @jsrailton @CyberClues @cmatthewbrooks @SangerNYT @ScottShaneNYT @EricLiptonNYT @HBO @TheJusticeDept @jeangene_vilmer @AtlanticCouncil In class, we discussed how much the media blackout, official media advisories in France, the lessons learned from US 2016, and what Macron campaign “cyber geek” Mahjoubi called “cyber-blurring” played a role in slowing down/ muting the MacronLeaks hack-and-leak operation in 2017

@Georgetown @citizenlab @jsrailton @CyberClues @cmatthewbrooks @SangerNYT @ScottShaneNYT @EricLiptonNYT @HBO @TheJusticeDept @jeangene_vilmer @AtlanticCouncil Another interesting study on this subject students read was “Hacking the discourse: Leaked emails, transparency, and disinformation" @bsorensen96 @Stanford which delves into importance of the response of journalists, politicians, voters to leaked material pacscenter.stanford.edu/publication/ha…

@Georgetown @citizenlab @jsrailton @CyberClues @cmatthewbrooks @SangerNYT @ScottShaneNYT @EricLiptonNYT @HBO @TheJusticeDept @jeangene_vilmer @AtlanticCouncil @bsorensen96 @Stanford In that piece, @bsorensen96 wisely writes that “readers are not accustomed to scrutinizing the contents of a leak for themselves, and may instinctively assume due diligence on the part of whoever is presenting the information,” speaking to the importance of context creation

@Georgetown @citizenlab @jsrailton @CyberClues @cmatthewbrooks @SangerNYT @ScottShaneNYT @EricLiptonNYT @HBO @TheJusticeDept @jeangene_vilmer @AtlanticCouncil @bsorensen96 @Stanford In class we discussed some interesting questions like whether platforms should treat hack and leaks differently from whistleblower leaks and how that might work in practice. And what kind of role government should play in providing cybersecurity assistance to political campaigns

@Georgetown @citizenlab @jsrailton @CyberClues @cmatthewbrooks @SangerNYT @ScottShaneNYT @EricLiptonNYT @HBO @TheJusticeDept @jeangene_vilmer @AtlanticCouncil @bsorensen96 @Stanford Another fun thing that we did in class was an exercise led by one of the students @RiddellSam, now an IO Analyst @FireEye, looking at Op Secondary Infektion, trying to determine what made some of the forgeries and posts look suspicious & the techniques one might use to see that