Doubt shaping up as the most sinister hack consequence
What happens when we are forced to doubt the integrity of our data? Our software? Our messages?
Doubt, it turns out, can foster all sorts of outcomes.
In a court of law, you must show proof beyond a reasonable doubt in order to gain a guilty verdict. In politics, candidates create so much doubt that fact checking is now a post-mortem debate requirement. And in pop culture, Elvis, Sasquatch, and UFOs all made careers out of doubt. (Actually, a second career for Elvis).
In hacking, doubt may be at its most sinister. It can inject chaos and false reality into any company or organization that is a target.
"What do you do when you can't believe the data," Michael Rogers, director of the National Security Agency, said earlier this year after admitting one of his top three fears going forward is that data theft will turn into data manipulation, which leaves data where it rests but with perceived, subtle or substantial changes. "What happens when that same activity [hacking] is used to manipulate data, software or products and we cannot trust the data?"
To date, the most publicized hacks have been about data theft and missing records.
But altered data is a kill shot. In 2013, an authentic looking tweet from the Associated Press's account announced explosions in the White House and Barack Obama injuries. The Dow plunged 100 points in under two minutes, but bounced back after the AP announced the Tweet was a fake and the AP had been hacked.
We need not look any further than the current U.S. election cycle to see the caustic mix of data and doubt.
Recently, the White House made accusations that Russian hackers are trying to interfere with the U.S. election by funneling stolen emails through WikiLeaks. And in the past three month, cyber security experts from both major political parties have warned of such manipulation of leaked documents.
Malcolm Nance, who was involved in U.S. intelligence for 35 years and is a best-selling author, sees data manipulation - or the appearance of manipulation - as an activity that could cripple the integrity of the 2016 presidential election.
Nance, who has previously defended Hillary Clinton, says intelligence history supports a pattern of real data leaks followed by suspect information.
"[Russian hackers] always take their best shot with real data," he said in an interview a few weeks ago on National Public Radio. "Anything that comes after that is going to be, what we call, black propaganda. That's where you have a real email or data stream... and then you'd change a word, a phrase or a sentence within them and then put them back into that stream." Nance says the owner of the original email can prove an email is doctored, but once the doctored email is in the wild the damage is done. "You would have a really, really hard time putting the genie back into the bottle, even if you had all the evidence," said Nance, who examines this scenario in his new book "The Plot to Hack America: How Putin's Cyberspies and WikiLeaks Tried to Steal the 2016 Election."
Politico cited a book excerpt earlier this month from former East German spymaster Markus Wolf on the value of a strategic lie: "Embarrassed by the publication of genuine but suppressed information, the targets were badly placed to defend themselves against the other, more damaging accusations that had been invented."
Hillary Clinton campaign chairman John Podesta, who had a cache of his emails exposed by WikiLeaks, has verified some of those messages, but not others. Is he being transparent or fighting back with his own "doubt" campaign? Donna Brazile, interim Democratic Party chairwoman, said Thursday that emails released by WikiLeaks were "doctored", but did not offer proof.
In his NPR interview, Nance said Russia won't attack voting machines, "they would attack PCs or laptops within the states themselves and make an obvious hack in voter tallies before returning the data to its original form and in the process degrading integrity of the data," and quite possibly, "give one of the opponents in this election the opportunity to say that 'this election should be nullified,' or 'this election was stolen.' That could lead to civil disturbance or even worse."
Doubt is far more divisive than knowing beyond question that data is altered and voting totals incorrect.
Politics has always been an "all's fair" battlefield, but what does this sort of cyber warfare look like in the enterprise? Would companies go so far as to attack competitors in this way? Could such a digital kill shot leave a competitor with no means to defend themselves?
As the world watches the current US political cyber drama play out, the most pressing questions concerning future cyber security strategy in the enterprise may come after Nov. 8.