Warner calls for new cyber doctrine

In a Dec. 7 speech, Sen. Mark Warner (D-Va.) called for a new U.S. cyber doctrine designed to combat modern threats from hackers and disinformation campaigns.

Government, tech companies, social media platforms and other stakeholders must collaborate on a "whole of society effort" to counter malicious campaigns from China, Russia and other countries, which have developed military strategies around shaping information in the digital space.

"Despite a flurry of strategy documents from the White House and DOD, the federal government is still not sufficiently organized or resourced to tackle this hybrid threat," said Warner.

Warner criticized President Donald Trump to task for not using his office to mobilize a broader response, and for eliminating important government positions, like the White House and State Department cyber coordinator posts.

Warner said the U.S. must be at the forefront of shaping international norms that govern nation state behavior in cyberspace and set the table for acceptable use of offensive operations.

"You almost need an international agreement on norms before you can start using offensive capabilities," said Warner.

Warner called for a comprehensive and coordinated strategy to counter foreign-directed misinformation operations, particularly on social media. He called out Facebook, Twitter, Reddit, Google-owned YouTube and Tumblr as companies who "aren't doing nearly enough to prevent their platforms from becoming petri dishes for disinformation and propaganda."

Warner said these companies must improve the way they detect and minimize propaganda on their platforms, alert users when they're interacting with bots and improve transparency around data collection procedures and warned that regulation could be in the offing.

"At some point if they don't work with us, Congress will have to act on its own," said Warner. "One thing is clear: the Wild Wild West days of social media are coming to an end."

Renee DiResta, a disinformation researcher, refers to this status quo in a November 2018 research paper as one of "continuous partial conflict" between nations that falls somewhere between a cold war and a hot one.

DiResta argues that only social media platforms are positioned to regulate the problem in the short term, and only if they recognize their own responsibility.

"Platforms cannot continue to operate as if all users are basically the same; they have to develop constant awareness of how various combatant types will abuse the new features that they roll out, and build detection of combatant tactics into the technology they're creating to police the problem," DiResta wrote.

Many U.S. government agencies are legally and politically constrained from policing disinformation without running afoul of Constitution limits, since it is often difficult to tease out from many campaigns where foreign influence ends and domestic free speech begins.

Robert Taylor, former Principal Deputy General Counsel and Acting General Counsel for the Department of Defense under the Obama administration, told FCW that the Trump administration's cyber strategy lacked a meaningful component around combatting misinformation that outlines responsibility for the private sector while balancing relevant constitutional concerns around free speech and free enterprise.

However, he disagreed with Warner's suggestion that establishing norms in cyberspace should precede the use of offensive cyber tools, arguing that a willingness to conduct such operations is an essential component of current deterrence strategies.

"Offensive cyber capabilities and the ability to act outside our own networks to disable offensive capabilities directed at our networks, and the willingness to deploy such capabilities when necessary, are critical to a meaningful deterrence," said Taylor.