By Joseph Bunyard
Sailors are increasingly vulnerable to information operations at sea. Russia and China regularly use disinformation campaigns to degrade their adversaries’ will to fight. The proliferation of network access points and social media use underway allow for the extension of information operations to the maritime commons. At the same time, modern data collection tools make it more likely than ever that sailors will face “pinpoint propaganda” on deployment. Sea services across the West can no longer afford to overlook this eventuality.
21st Century “Pinpoint Propaganda”
“Pinpoint propaganda” combines the motives of traditional propaganda with the methods of modern cybercrime to generate a formidable psychological warfare threat. More users are posting more Personally Identifiable Information (PII) on social media every day.[1]“Demographics of Social Media Users and Adoption in the United States.” Pew Research Center: Internet, Science & Tech. Pew Research Center, June 5, 2020. … Continue reading The public nature of social media makes this Open Source Intelligence (OSINT) available globally for use in fraud and “pinpoint propaganda.”[2]Khanna, Parul, Pavol Zavarsky, and Dale Lindskog. “Experimental Analysis of Tools Used for Doxing and Proposed New Transforms to Help Organizations Protect against Doxing Attacks.” Procedia … Continue reading Cybercriminals routinely use PII to legitimize “scam” messages, which seek to steal a user’s credentials, like online banking information. This practice is known as “spear phishing.”[3]Bhadane, Aniket, and Sunil B. Mane. “Detecting Lateral Spear Phishing Attacks in Organisations.” IET Information Security 13, no. 2 (2019): 133–40. … Continue reading Like “spear phishing,” “pinpoint propaganda” uses PII to identify targets and make threats or disinformation appear more plausible. Increasingly common tools designed to “scrape” social media for information allow bad actors to collect the PII of sailors en masse.
Russia and China regularly demonstrate the ability to employ “pinpoint propaganda” at scale. Russian intelligence often sends texts containing disinformation and threats to Ukrainian soldiers and their families, using PII to target and convince their victims.[4]Brown, Daniel. “Russian-Backed Separatists Are Using Terrifying Text Messages to Shock Adversaries – and It’s Changing the Face of Warfare.” Business Insider. Business Insider, August … Continue reading Such messages purport the death of family members, the retreat of units covering the flanks of Ukrainians, or Russia’s ability to directly target a Ukrainian soldier or his family. Through “pinpoint propaganda” Russia aims to degrade a soldier’s will to fight.
China maintains an Overseas Key Individuals Database (OKDIB), which according to the Australian Financial Review, contains the PII of at least 2 million international persons of interest, including top American military officials.[5]Caroline Delbert, “A Chinese Database Is Tracking American Nuclear Scientists and Military Officers,” Popular Mechanics, October 28, 2020, … Continue reading The OKDIB is often described as a “phone book” for Chinese intelligence that combines Open Source Intelligence (OSINT) with information from hacked databases.[6]Manson, Katrina. “US Charges Eight with Alleged Plot to Harass and Kidnap Chinese Citizens.” Subscribe to read | Financial Times. Financial Times, October 28, 2020. … Continue reading The Federal Bureau of Investigation recently charged Chinese operatives with exploiting PII to track, kidnap, and forcibly repatriate Chinese dissidents living in the United States.[7]Ibid.
Access Means Exposure
The proliferation of network access points and social media use at sea makes sailors vulnerable to “pinpoint propaganda.” Social media is an integral part of daily life. In order to attract new generations of social media savvy recruits, the world’s foremost sea services—including the Japanese Maritime Self Defense Force, the Royal Canadian Navy, and the United States Navy—are racing to fit warships with quality of life Wi-Fi networks for use by off-duty sailors.[8]Mizokami, Kyle. “To Lure Recruits, Japan’s Navy Is Turning To Free WiFi.” Popular Mechanics. Popular Mechanics, January 7, 2020. … Continue reading Faced with alarming manpower shortages, Western navies are realizing that “kids won’t join the Navy” without Wi-Fi.[9]Faram, Mark D. “How the Navy Got to Be 6K Sailors Short at Sea.” Navy Times. Navy Times, March 25, 2019. … Continue reading
The renowned naval strategist Wayne Hughes famously claimed that the littorals are the focal point of naval warfare.[10]Nelson, Chris. “Fleet Tactics Returns – A Conversation with Authors Wayne Hughes and Bob Girrier.” Center for International Maritime Security, July 30, 2018. … Continue reading Securing maritime chokepoints and maintaining freedom of the seas requires sailors to operate close to shore, where next generation cellular networks will provide internet access points out of the control of a ship’s captain. “Pinpoint propaganda” in the form of texts, emails, and social media direct messages requires only a brief moment of connectivity to flash across sailors’ personal electronic devices.
A growing number of commercial services offer high-speed, low-cost internet at sea. Current maritime internet service providers require expensive transceivers that must be installed on a client’s ship.[11]“Charter Yacht Internet Service Pricing.” Viasat Maritime, December 26, 1970. https://www.maritime.viasat.com/plan-charter-yacht.html. Emerging commercial services, such as Elon Musk’s Starlink, offer transportable transceivers at a lower cost than a new iPhone.[12]McNally, Catherine. “SpaceX Starlink Satellite Internet: What We Know.” reviews.org, January 11, 2021. https://www.reviews.org/internet-service/spacex-starlink-satellite-internet-review/. Sailors may soon be able to operate private networks from the comfort of their berthings with the ease of signing up for a new cellphone plan.
Social Media Enables PII Collection
The proliferation of user-friendly collection tools, combined with unprecedented social media use, increases the likelihood that sailors’ PII will be collected.[13]Khanna, 459. Social media provides key insights into consumer sentiment towards products and services. As a result, commercial and open source data collection tools have flourished, spurring data privacy concerns amid torrents of targeted advertising.[14]Juels, Ari. “Targeted Advertising … and Privacy Too.” Topics in Cryptology — CT-RSA 2001 Lecture Notes in Computer Science, April 2, 2001, 408–24. … Continue reading Just as a consumer researcher can collect social media posts mentioning a given product, bad actors can identify users who post navy-related content.[15]Levin, Joy. “21+ Best Market Research Tools.” Small Business Trends, December 1, 2020. https://smallbiztrends.com/2020/06/market-research-tools.html. Free-to-use “geofencing” services even allow users to collect posts from selected locations, such as naval bases.[16]Ibid.
The same data collection tools used for consumer research are easily repurposed for “doxxing,” the process of collecting and publishing an individual’s PII.[17]Khana, 459. Social media posts containing as little information as a photo of a protest often lead to the identification of participants. Following the 2017 neo-Nazi march on Charlottesville, Virginia—and the January 6th riot at the US Capitol—amateur internet sleuths used images of participants to collect and publish their PII, leading to arrests and loss of employment.[18]Bowles, Nellie. “How ‘Doxxing’ Became a Mainstream Tool in the Culture Wars.” The New York Times. The New York Times, August 30, 2017. … Continue reading
Increased access to social media at sea will generate more OSINT that adversaries can leverage to collect the PII of sailors. Common “doxxing” techniques involve analyzing the participants and environment captured in social media images to identify individuals.[19]Bowles.A seemingly innocent “selfie” taken on a mess deck could lead to the identification of sailors whose nametapes or tagged accounts appear in the post.
The official social media accounts of sea services and journalists often expose sailors to PII exploitation. The United States Navy, for example, encourages commands to “share our Navy’s story in a rapid and transparent manner” on social media.[20]Navy Office of Information. “U.S. Navy Social Media Handbook.” U.S. Navy. Accessed November 22, … Continue readingThis often results in posts from official social media accounts that disclose the full name, location, and hometown of sailors and Marines (see below image).[21]CVN 75 Public Affairs. “@USSHARRYSTRUMAN.” HARRYSTRUMAN. Twitter, October 30, 2020. https://twitter.com/USSHARRYSTRUMAN/status/1322180456448753665. Concentrating PII on official accounts enables bad actors to automate the process of collecting sailors’ information. Once the information is collected, it can be searched on sites like White Pages to find a sailor’s phone number, email address, and place of residence.[22]Khana, 459.
The collection of PII via social media poses a unique threat to Western democracies. As illiberal actors, Russia and China are able to restrict the use of social media—and verify compliance—without regard for civil liberties. Since 2019, it is a criminal offense in Russia for an active-duty service member to share “any information about the military” online or to carry “any device capable of recording information.”[23]Vaganov, Anton. “Russian Lawmakers Just Passed Legislation Designed to Kick Soldiers off Social Media.” Meduza, February 12, 2019. … Continue readingRussian conscription prevents the Kremlin from realizing the same quality of life-based recruiting challenges seen in the West.[24]Russian Federation Defense Ministry. “Conscription Service.” Determents : Ministry of Defence of the Russian Federation. Accessed January 15, 2021. … Continue reading
“Pinpoint Propaganda” at Sea
Just as Ukrainian soldiers are subjected to Russian “pinpoint propaganda” before kinetic strikes, sailors may soon face personalized threats and disinformation prior to contentious missions, such as freedom of navigation operations in the South China Sea. A bad actor could send sailors emails, appearing to be from their financial institutions, which cite a need for an immediate response to prevent forfeiture of funds. Text messages masquerading as correspondence from hospitals, or close contacts, could call into question the safety of loved ones. Social media posts containing manufactured images of missile batteries or warships ready to intercept foreigners may test a crew’s nerve.
Like “spear phishing” ashore, “pinpoint propaganda” at sea could provide bad actors with access to sensitive systems. If a sailor were to click on a malicious link made to appear legitimate with PII, a bad actor could move laterally through the ship’s Wi-Fi network to install malware on connected devices.[25]Bhadane, 133.New research suggests that a bad actor could then jump air gaps between a sailor’s personal device and the ship’s sensitive systems.[26]Guri, Mordechi. “The Air-Gap Jumpers.” Homeland Security Research Institute. Black Hat, August 8, 2018. https://i.blackhat.com/us-18/Wed-August-8/us-18-Guri-AirGap.pdf.At a minimum, a bad actor could leverage a compromised quality of life network to identify and contact other sailors connected to it.[27]Ibid.
Faced with a resurgent China, volunteer-based navies will expand maritime internet service in an effort to address recruiting shortfalls.[28]Faram. The growing reach and falling cost of commercial internet service will likely offer sailors unsupervised connectivity options. At the same time, the rise of social media makes it easier to collect the PII of sailors en masse than ever before. Western sea services must prepare for naval warfare that includes “pinpoint propaganda.”
Ensign Bunyard is a 2020 graduate of the US Naval Academy who researches the effects of social media on the US Navy’s operational security posture at Carnegie Mellon University. Ensign Bunyard’s work can be found in the US Naval Institute’s Proceedings, the USNI Blog, the International Journal of Naval History, and Carnegie Mellon’s The Triple Helix.
The opinions and comments made in this Pen article and on this website do not represent the official position of any government, organisation or entity.
References