Unprotected Data: Review of Internet Enabled Psychological and Information Warfare

Land Forces Academy Review Vol. XXIV, No 3(95), 2019 UNPROTECTED DATA: REVIEW OF INTERNET ENABLED PSYCHOLOGICAL AND INFORMATION WARFARE Francisco GARCIA MARTINEZ Illinois Institute of Technology, School of Applied Technology, Chicago, Illinois, USA [email protected] Maurice DAWSON Illinois Institute of Technology, School of Applied Technology, Chicago, Illinois, USA [email protected] ABSTRACT Since the last elections in the United States, France, and other nations, fake news has become a tool to manipulate voters. This creation of fake news creates a problem that ripples through an entire society creating division. However, the media has not scrutinized enough on data misuse. Daily it appears that there are breaches causing millions of users to have their personal information taken, exposed, and sold on the Dark Web in exchange of encrypted currencies. Recently, news has surfaced of major social media sites allowing emails to be read without user consent. These issues bring upon concern for the misuse of data and more importantly, how can this be used for information warfare and the exploitation of targeted groups through the use of the Internet. It is essential that organizations continuously review current data policies to ensure that they do not become victims of information warfare. KEYWORDS: data misuse, information warfare, Internet security, intelligence 1. Information Warfare Information warfare is, in general In the battlefield, there is a type of terms, a way of protecting one’s information warfare known as psychological operations. infrastructure while attacking someone else’s This aspect of warfare is used to create a by using computers. In the past century, it favorable image, gaining adherents, and was commonly considered how future wars undermining opponents had already become a would take place and, more importantly, the significant weapon of 20th-century warfare. mean by they would be won (Aldrich, 1996). However, “they are neither a substitute for Consequently, information warfare has power nor a panacea” (Headquarters become a significant issue in recent decades Department of the Army, 1979, pp. 1-5) but for both governments and private companies, employed correctly they can be instrumental, who have often joined forces to strengthen making the difference between success or their economies over their adversaries. For failure in military operations. And not instance, in the United States, government exclusively military operations, but also in agencies such as the Central Intelligence numerous other fields, such as technology or Agency (CIA), Federal Bureau of marketing. Investigation (FBI) or National Security DOI: 10.2478/raft-2019-0022 © 2017. This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 3.0 License. 187 Agency (NSA) have cooperated with private Typical information warfare attacks are organizations to create infrastructure a Denial of Service attack (DoS attack), protection programs (Elbirt, 2003). The term, phishing, social engineering, or deletion, whose first recorded use was by Thomas P. manipulation or modification of data. Rona of the Boeing Corporation in 1976, is of All with the common goal of gaining a such a great importance that A. J. Elbirt favorable position over their opponents by (2003, p. 1) remarks in his paper that “the disrupting their services or stealing classified International Trade Commission estimated data. As a consequence, threatened by this the loss in the United States due to economic information warfare attacks, the United States espionage at $23.8 billion in 1987 and $40 created in 1998 the National Infrastructure billion in 1989”. Besides, a study conducted Protection Centre (NIPC). Typically, an by the University of Illinois in 1988 attacker performs three steps when concluded that 48 % of the companies conducting an attack: information gathering, surveyed admitted to being industrial attack planning, and attack execution espionage victims (Schawartau, 1997). (Elbirt, 2003). Figure no. 1: Infnformation Warfare Process The primary purpose is to retrieve as 2012). Some other personal level attacks much information as possible from the focus on unauthorizedly altering someone’s adversary while protecting ne’so private information. Thought this information infrastructure, thus ensuring misinformation could be easily removed or confidentiality, integrity, and availability. corrected, due to the extremely fast From the economic point of view, there are spreading of data across the network. Once three levels of impact in information an individual’s privacy has been invaded, warfare, being these personal, corporate, and the malicious activity has been done, and global levels. The personal level affects the resulting damage is often irreparable. a single individual or group of individuals When the conducted information electronic privacy. Attacks directed to the warfare attacks are elevated to companies personal level include, but are not limited or organizations, they are often referred to to, harassment, extortion, personal data as industrial espionage or the corporate theft or blackmailing. These kinds of level. The usual corporate level attacks attacks often consist of an individual’s involve competitor information theft, the information gathering to, later on, perform a release of their proprietary information, or specific targeted campaign of blackmail or disrupting an adversary’s activity. ransomware (O’Gorman & McDonald, Additionally, there have also been cases of 188 governments making use of Information 2. All Source Intelligence Warfare tactics to provide information to a Analyzing data could provide valuable private organization within the country information regarding an organization’s or from a competitor of a foreign country. individual’s activity with the use of Open Elbirt gives an example of this kind of Source Intelligence (OSINT) tools. OSINT activity in his paper: “Hitachi paid IBM a data is unclassified information or data that is reported $300 million in a settlement publicly available. OSINT is not to be a agreement after being caught spying on a substitute for other sources of intelligence but new generation of IBM computer equipment rather complement existing methods to and that French intelligence was proven to collect information such as Geospatial have spied on Boeing to help Airbus” Intelligence (GEOINT), Signal Intelligence (Elbirt, 2003, p. 5). (SIGINT), Human Intelligence (HUMINT), Economic espionage, or global level and Measurement Intelligence (MASINT). attacks, refer to the government’s use of This data collection method relies on Information Warfare techniques to combat information that is found publicly without the other countries or their allies in the desire of need to request access to it, and it can be used improving their economy or obtaining a to generate reports (Stalder & Hirsh, 2002). better combative position. Nonetheless, Having access to this data allows an attacker these attacks are not limited to government to develop an intelligence analysis on the activities, but they also include terrorist target. This analysis can be a culmination of groups, such as Anonymous, Al-Qa’ida, or information about the target’s movements, the famous Chinese cyber espionage group, online behaviors, technical data, and more. Axiom. However, they require a large With the Internet, several applications such as number of people involved and a significant Maltego can make the profession of an monetary investment. A key aspect of being OSINT analyst done with ease. This means successful at the global level relays on they can create transforms, perform sentiment being capable of organizing this vast analysis of words, and review other public number of people while maintaining a high databases with ease. level of privacy. Concerning data collection, databases 3. Misuse of Data can represent a great source of useful data The widespread use of newer within the information warfare. Numerous technologies and their correspondent tools access control countermeasures have been and apps leads to infinite quantities of data developed and are implemented, preventing released to the Internet. However, the most unauthorized users from accessing and critical finding in the last recent years is retrieving confidential information. that all this data has a value. All this Nevertheless, those techniques do not address the inference control problem, information which was practically where a user could perform legitimate discarded was a source of intelligence that general queries to the database as a whole traditionally took a significant work effort while restricting him from extracting to collect. Hence, enterprises have individual’s private information (Elmasri, increased their investments in software, 2008). Clifton and Marks (1996) introduce hardware, staff, education, and other some possible solutions in their paper. associated items that constitute the digital To ensure that a company cannot infer world, by 50 %, to $4 trillion (Gantz & private data from public data to, later, use it Reinsel, 2011). Grantz and Reinsel state in to gain a better position than its competitors their paper that “the amount of information in the information warfare. individuals create themselves – writing 189 documents, taking pictures, downloading uploaded a picture of him without consent. music, etc. – is far less than the amount of Although several privacy experts claim that it information being created about them in the is an

Load more