Do Cyber Spies Dream of Electric Shadows?

Alice sits at a bar with Bob, a travel consultant she has been seeing socially since she met him a few weeks ago in the lobby of the building where she works as a network administrator. Her company develops IT systems for the military. Bob isn’t actually a consultant but a foreign intelligence officer who has been influencing Alice to sell state secrets. He is facing away from the closed-circuit TV camera above the counter, but he’s oblivious to the fact that his movements have been tracked via facial recognition ever since he arrived in the country. Bob’s true identity was revealed in a ransacked personnel database and the microphone on his smartphone was hacked through a zero-day vulnerability to record Alice breaking the law.

Cyberspace is changing spycraft, and national security agencies are being urged to adopt machine learning and open-source data to bolster their analytical capabilities. Human intelligence and networks of informants, however, will remain necessary for acquiring some secrets, assisting cyber operations by placing USB drives in air-gapped computers, for example, and providing insights into the thinking of decision-makers in target countries. To establish trust between officers and their informants, interpersonal and face-to-face meetings may be unavoidable while virtual reality and other digital technologies mature.

In countries like Russia and China, some experts have argued that traditional HUMINT tradecraft has become obsolete due to the use of facial recognition, biometric scanning and internet-connected devices that leave ‘digital dust’ for counterintelligence officers to detect. This has followed a New York Times report claiming a top-secret CIA cable revealed that dozens of informants working for the US had been compromised or killed in these increasingly difficult operating environments.

However, technological advances haven’t been fully utilised yet and present an opportunity for HUMINT collection agencies like the CIA, MI6 and the Australian Secret Intelligence Service to work with the NSA, GCHQ and Australian Signals Directorate to develop new HUMINT tradecraft. For example, new covert communication techniques could take advantage of anonymising technologies that are already challenging counterintelligence in open democracies.

Last month, an undercover FBI operation resulted in the arrest of Jonathan Toebbe, a US Navy engineer, for attempting to sell classified nuclear submarine technology to a foreign government. Toebbe employed a range of tools to protect his identity and encrypt his communications. ProtonMail, an end-to-end encryption mail service, was used over the Tor Network via publicly available wi-fi to hide his affiliated IP addresses. He also asked to be paid in Monero, a cryptocurrency that is harder to trace than Bitcoin but not impossible.

This case shows that anonymising technology can be used to avoid interception, but poor tradecraft might still result in detection. Even if Toebbe had been less trusting of his purported foreign handlers, these tools would have only delayed his eventual discovery. He would have had difficulty using and laundering the cryptocurrency, stolen information can be eventually traced back to the few users who had access to the original documents, and specific surveillance of Toebbe’s devices may have revealed suspicious activity.

The key takeaway is that knowledge of human behaviour combined with technical expertise is still essential to understanding the limitations of technologies and how they can be applied in HUMINT tradecraft. As described by former MI6 head Alex Younger, fourth-generation espionage will require ‘fusing … traditional human skills with accelerated innovation’.

In general, intelligence agencies could creatively use technology and consider tools and media that are not necessarily technical or were designed for other purposes.

For example, the China Institutes of Contemporary International Relations, a think tank affiliated with China’s top intelligence agency, the Ministry of State Security, published a report on the national security implications of the so-called metaverse (元宇宙). It recognised that this new model is likely to be the next generation of the internet and will become an integral part of a country’s political discourse and social culture. Without stating it explicitly, the report suggests that Chinese intelligence officers may be already thinking about how virtual and augmented realities could be used for recruitment or influence activities. Chinese intelligence services have previously exploited social media platforms like LinkedIn for similar espionage purposes and used traditional avenues like political organisations to carry out influence campaigns under plausibly deniable fronts.

Other technologies such as generative adversarial networks, or GANs, a class of artificial intelligence models that are designed to avoid detection by other AI models, could be used to mask covert activity among normal activities. They are already used in deep fakes and, combined with language models, like GPT-3, could be trained to automate the process of creating misleading digital personal data, spoof mobile metadata for operatives or create fake informant or employee entries as honeypots to taint personal databases that might be hacked.

For HUMINT collection agencies in the West, emerging technologies are an opportunity to support operations in increasingly difficult environments. To develop new tradecraft, HUMINT agencies could team up with technical agencies and recruit new talent for the next generation of cyber-enabled spies.

Albert Zhang is a researcher at ASPI’s International Cyber Policy Centre.

This article appeared originally at The Strategist (ASPI).