Information Operations (United States)

U.S. Military personnel assigned to the 4th Psychological Operations Group, 193rd Special Operations Wing, Pennsylvania Air National Guard (ANG) broadcast television and radio programming

EC-130J Commando Solo

• Electronic warfare (EW) refers to any action involving the use of the electromagnetic spectrum or directed energy to control the spectrum, attack an enemy, or impede enemy assaults via the spectrum. The purpose of electronic warfare is to deny the opponent the advantage of, and ensure friendly unimpeded access to, the EM spectrum. EW can be applied from air, sea, land, and space by manned and unmanned systems, and can target communication, radar, or other services. EW includes three major subdivisions: Electronic Attack (EA), Electronic Protection (EP), and Electronic warfare Support (ES).
• EW as an IO Core Capability. EW contributes to the success of IO by using offensive and defensive tactics and techniques in a variety of combinations to shape, disrupt, and exploit adversarial use of the EM spectrum while protecting friendly freedom of action in that spectrum. Expanding reliance on the EM spectrum for informational purposes increases both the potential and the challenges of EW in IO. The increasing prevalence of wireless telephone and computer usage extends both the utility and threat of EW, offering opportunities to exploit an adversary's electronic vulnerabilities and a requirement to identify and protect our own from similar exploitation. As the use of the EM spectrum has become universal in military operations, so has EW become involved in all aspects of IO. All of the core, supporting, and related IO capabilities either directly use EW or indirectly benefit from EW. In order to coordinate and deconflict EW, and more broadly all military usage of the EM spectrum, an electronic warfare coordination cell (EWCC) should be established by the JFC to reside with the component commander most appropriate to the operation. In addition, all joint operations require a joint restricted frequency list (JRFL). This list specifies protected, guarded, and taboo frequencies that should not normally be disrupted without prior coordination and planning, either because of friendly use or friendly exploitation. This is maintained and promulgated by the communications system directorate of a joint staff (J-6) in coordination with J-3 and the joint commander's electronic warfare staff (or EWCC, if delegated).[1]
• Domination of the Electromagnetic Spectrum. DOD now emphasizes maximum control of the entire electromagnetic spectrum, including the capability to disrupt all current and future communication systems, sensors, and weapons systems. This may include: (1) navigation warfare, including methods for offensive space operations where global positioning satellites may be disrupted; or, (2) methods to control adversary radio systems; and, (3) methods to place false images onto radar systems, block directed energy weapons, and misdirect unmanned aerial vehicles (UAVs) or robots operated by adversaries.[2]

• CNO as an IO Core Capability. The increasing reliance of unsophisticated militaries and terrorist groups on computers and computer networks to pass information to C2 forces reinforces the importance of CNO in IO plans and activities. As the capability of computers and the range of their employment broadens, new vulnerabilities and opportunities will continue to develop. This offers both opportunities to attack and exploit an adversary's computer system weaknesses and a requirement to identify and protect our own from similar attack or exploitation.[1]
• Computer network attack (CNA). Actions are taken through the use of computer networks to disrupt, deny, degrade, or destroy information resident in computers and computer networks, or the computers and networks themselves. Also called CNA. Computer network defense (CND). Actions are taken through the use of computer networks to protect, monitor, analyze, detect and respond to unauthorized activity within the Department of Defense information systems and computer networks. Also called CND.

computer network exploitation. Enabling operations and intelligence collection capabilities conducted through the use of computer networks to gather data from target or adversary automated information systems or networks. Also called CNE.

Soldiers from the U.S. Army's 350th Tactical Psychological Operations, 10th Mountain Division, drop leaflets over a village near Hawijah in Kirkuk province, Iraq, on 6 March 2008.

U.S. Army PSYOP Force structure

NATO leaflet in Libya

• PSYOP as an IO Core Capability. PSYOP has a central role in the achievement of IO objectives in support of the JFC. In today's information environment even PSYOP conducted at the tactical level can have strategic effects. Therefore, PSYOP has an approval process that must be understood and the necessity for timely decisions is fundamental to effective PSYOP and IO. This is particularly important in the early stages of an operation given the time it takes to develop, design, produce, distribute, disseminate, and evaluate PSYOP products and actions. All PSYOP are conducted under the authority of interagency-coordinated and OSD approved PSYOP programs. The PSYOP program approval process at the national level requires time for sufficient coordination and resolution of issues; hence, JFCs should begin PSYOP planning as early as possible to ensure the execution of PSYOP in support of operations. A JFC must have an approved PSYOP program, execution authority, and delegation of product approval authority before PSYOP execution can begin. JFCs should request PSYOP planners immediately during the initial crisis stages to ensure the JFC has plenty of lead time to obtain the proper authority to execute PSYOP. PSYOP assets may be of particular value to the JFC in pre-/post-combat operations when other means of influence are restrained or not authorized. PSYOP must be coordinated with CI, MILDEC, and OPSEC to ensure deconfliction and control, CI operations are not compromised, and that all capabilities within IO are coordinated to achieve the objectives established in planning. There must be close cooperation and coordination between PSYOP and PA staffs in order to maintain credibility with their respective audiences, which is the purpose of the IO cell. PSYOP efforts are most effective when personnel with a thorough understanding of the language and culture of the TA are included in the review of PSYOP materials and messages. As the information environment evolves, the dissemination of PSYOP products is expanding from traditional print and broadcast to more sophisticated use of the Internet, facsimile messaging, text messaging, and other emerging media. The effectiveness of PSYOP is enhanced by the synchronization and coordination of the core, supporting, and related capabilities of IO; particularly public affairs (PA), MILDEC, CNO, civil-military operations (CMO), and EW.[3]
• Psychological operations are planned operations to convey selected information and indicators to foreign audiences to influence their emotions, motives, objective reasoning, and ultimately the behavior of foreign governments, organizations, groups, and individuals.
• 4th Psychological Operations Group

Simulated OH-58C Kiowa helicopter and simulated fuel blivets during a deception operation on 10 November 1990 carried out by the XVIII Airborne Corps Deception Cell. This simulated forward arming and refueling point (FARP) at TL 139512 in the Eastern Province of Saudi Arabia was approximately 45 kilometers northwest of An Nuariya.

• MILDEC is described as being those actions executed to deliberately mislead adversary decision makers as to friendly military capabilities, intentions, and operations, thereby causing the adversary to take specific actions (or inactions) that will contribute to the accomplishment of the friendly forces' mission. MILDEC and OPSEC are complementary activities – MILDEC seeks to encourage incorrect analysis, causing the adversary to arrive at specific false deductions, while OPSEC seeks to deny real information to an adversary, and prevent correct deduction of friendly plans. To be effective, a MILDEC operation must be susceptible to adversary collection systems and "seen" as credible to the enemy commander and staff. A plausible approach to MILDEC planning is to employ a friendly course of action (COA) that can be executed by friendly forces and that adversary intelligence can verify. However, MILDEC planners must not fall into the trap of ascribing to the adversary particular attitudes, values, and reactions that "mirror image" likely friendly actions in the same situation, i.e., assuming that the adversary will respond or act in a particular manner based on how we would respond. There are always competing priorities for the resources required for deception and the resources required for the real operation. For this reason, the deception plan should be developed concurrently with the real plan, starting with the commander's and staff's initial estimate, to ensure proper resourcing of both. To encourage incorrect analysis by the adversary, it is usually more efficient and effective to provide a false purpose for real activity than to create false activity. OPSEC of the deception plan is at least as important as OPSEC of the real plan, since compromise of the deception may expose the real plan. This requirement for close hold planning while ensuring detailed coordination is the greatest challenge to MILDEC planners. On joint staffs, MILDEC planning and oversight responsibility is normally organized as a staff deception element in the operations directorate of a joint staff (J-3).[4]
• MILDEC as an IO Core Capability. MILDEC is fundamental to successful IO. It exploits the adversary's information systems, processes, and capabilities. MILDEC relies upon understanding how the adversary commander and supporting staff think and plan and how both use information management to support their efforts. This requires a high degree of coordination with all elements of friendly forces' activities in the information environment as well as with physical activities. Each of the core, supporting, and related capabilities has a part to play in the development of successful MILDEC and in maintaining its credibility over time. While PA should not be involved in the provision of false information, it must be aware of the intent and purpose of MILDEC in order not to inadvertently compromise it.[4]
• A message targeted to exploit a fissure between a key member of the adversary's leadership who has a contentious relationship with another key decision maker is an example. That message could cause internal strife resulting in the adversary foregoing an intended course of action and adopting a position more favorable to our interests.[5]
• Article title

Someone Talked

• OPSEC as an IO Core Capability. OPSEC denies the adversary the information needed to correctly assess friendly capabilities and intentions. In particular, OPSEC complements MILDEC by denying an adversary information required to both assess a real plan and to disprove a deception plan. For those IO capabilities that exploit new opportunities and vulnerabilities, such as EW and CNO, OPSEC is essential to ensure friendly capabilities are not compromised. The process of identifying essential elements of friendly information and taking measures to mask them from disclosure to adversaries is only one part of a defense-in-depth approach to securing friendly information. To be effective, other types of security must complement OPSEC. Examples of other types of security include physical security, IA programs, computer network defense (CND), and personnel programs that screen personnel and limit authorized access.[6]
• What occurs, often, is that data is either leaked, stolen, or hacked online and the enemy has access to and can decipher what that information may say. This is especially true for defensive operational security. US servicemen and servicewomen may have Facebook, multiple blogs, or upload photos, which can lead to the enemy knowing troop movements and locations. With this information, setting up ambush and wreaking havoc on US and support personnel becomes much easier. Geo-tagging features of cellular phones especially, may cause this type of breach in OPSEC.[7][8][9]

"Terrorists are adept at integrating their physical acts of violence with IO. They make audio and video recordings of the incidents for distribution over the Internet and on television. Their violence becomes theater, staged for its psychological impact, and replayed over and over again in the media as IO."[34]

• "Terrorists employ all the IO capabilities of U.S. military doctrine, including the five core capabilities of PSYOP, military deception, EW, CNO, and OPSEC, and the supporting and related capabilities. They use IO to support both offensive operations (acts of terrorism) and defensive operations (e.g., protecting their hiding places). They use IO strategically in support of broad objectives. While terrorists do not speak and write of "IO", they demonstrate an understanding of the value and methods of IO capabilities. Terrorists appear to be particularly adept at PSYOP, PA, counterpropaganda, and certain forms of OPSEC and deception, driven by their desire to simultaneously reach desired audiences and hide from their enemies. They recognize the value of various media, including the Internet, and exploit it to support their cause. Terrorists and their supporters have a CNO capability, with CNA manifesting itself as "electronic jihad" rather than as acts of terror."[35]

There are many examples of CNA and are generally done in support of other operations. Terrorists have integrated cyber attacks into their thinking, strategies, and operations as an extremely cost-effective way to harm the US and other adversaries.[36]

The same can be said for CNE, which is about penetrating computer networks before actually attacking them. Gaining access to specific networks is seen to be as part of the CNA process for terrorists (they do not distinguish between the two).[36]

As for CND, terrorists are aware of keeping data secure and websites running because they use the Internet. Hamas and Hizballaha have had to defend their websites from Israeli hackers who in the past have defaced them. The methods they use include access controls, encryption, authentication, firewalls, intrusion detection, anti-viral tools, audits, security management, and security awareness and training.[36]

• "The Taliban have in recent months waged an intensifying information war with NATO forces in the country, distributing anti-government messages on mobile phone networks and using Twitter to claim largely improbable successes as most foreign combat troops look to leave the country by 2014. A day rarely passes without a Taliban spokesman using Twitter to claim the destruction of numerous NATO armoured vehicles and the deaths of scores of Western or Afghan security forces, with NATO quickly countering in its own Twitter feeds. The Taliban also employ a sophisticated network of spokesmen to distribute messages and even have their own mobile radio broadcast service, which frequently moves location to avoid the threat of retaliatory airstrikes by NATO warplanes."[37]
  • The Taliban HAVE to rely on CNO and integrate it into their IO campaign as it is the most cost-effective method of disrupting Western forces. This is a prime example of how CNO is used in conjunction with PSYOP to achieve their objectives.

Steganography

Main article: Steganography

See also: Steganography § Alleged use by terrorists

When one considers that messages could be encrypted steganographically in email messages, particularly e-mail spam, the notion of junk e-mail takes on a whole new light. Coupled with the "chaffing and winnowing" technique, a sender could get messages out and cover their tracks all at once.

An example showing how terrorists may use forum avatars to send hidden messages. This avatar contains the message "Boss said that we should blow up the bridge at midnight." encrypted with mozaiq using "växjö" as password.

Rumors about terrorists using steganography started first in the daily newspaper USA Today on 5 February 2001 in two articles titled "Terrorist instructions hidden online" and "Terror groups hide behind Web encryption". In July the same year, an article was titled even more precisely: "Militants wire Web with links to jihad". A citation from the article: "Lately, al-Qaeda operatives have been sending hundreds of encrypted messages that have been hidden in files on digital photographs on the auction site eBay.com". Other media worldwide cited these rumors many times, especially after the terrorist attack of 9/11, without ever showing proof. The Italian newspaper Corriere della Sera reported that an Al Qaeda cell which had been captured at the Via Quaranta mosque in Milan had pornographic images on their computers, and that these images had been used to hide secret messages (although no other Italian paper ever covered the story). The USA Today articles were written by veteran foreign correspondent Jack Kelley, who in 2004 was fired after allegations emerged that he had fabricated stories and sources.

In October 2001, The New York Times published an article claiming that al-Qaeda had used steganography to encode messages into images, and then transported these via e-mail and possibly via USENET to prepare and execute the 11 September 2001 terrorist attack. The Federal Plan for Cyber Security and Information Assurance Research and Development,[38] published in April 2006 makes the following statements:

• "...immediate concerns also include the use of cyberspace for covert communications, particularly by terrorists but also by foreign intelligence services; espionage against sensitive but poorly defended data in government and industry systems; subversion by insiders, including vendors and contractors; criminal activity, primarily involving fraud and theft of financial or identity information, by hackers and organized crime groups..." (p. 9–10)
• "International interest in R&D for steganography technologies and their commercialization and application has exploded in recent years. These technologies pose a potential threat to national security. Because steganography secretly embeds additional, and nearly undetectable, information content in digital products, the potential for covert dissemination of malicious software, mobile code, or information is great." (p. 41–42)
• "The threat posed by steganography has been documented in numerous intelligence reports." (p. 42)

Moreover, an online "terrorist training manual", the "Technical Mujahid, a Training Manual for Jihadis" contained a section entitled "Covert Communications and Hiding Secrets Inside Images."[39]

By early 2002, a Cranfield University MSc thesis developed the first practical implementation of an online real-time Counter Terrorist Steganography Search Engine. This was designed to detect the most likely image steganography in transit and thereby provide UK Ministry of Defence Intelligence Staff a realistic approach to "narrowing the field", suggesting that interception capacity was never the difficulty but rather prioritising the target media.

A police search of a British, al-Qaeda member's home, uncovered what is now called "The al-Qaeda Training Manual", a techniques instruction book on deception, forgery, "blending in", hiding places, and the use of covers to blend into the terrorist area of operation (usually cities with large civilian populations).[40] The philosophy the MILDEC is for the concealment of activities rather than misleading adversaries.[41]

Terrorist PSYOP differs from American PSYOP in one two major areas. First, US PSYOP targets foreign adversaries and information is coordinated with many other agencies and screened before it is published. Second, while PSYOP by US and coalition forces is "designed to bring an end to violence and save lives, terrorist PSYOP is frequently directed toward promoting violence and threatening civilian populations with death and destruction. Suicide bombers are portrayed as martyrs rather than killers of innocent people."[42]

The Internet is the main resource to spread propaganda with al-Aqaeda and other terrorist groups. "According to Bruce Hoffman, before it was taken down, al-Qaeda's website Alneda.com emphasized three themes: 1)the West is implacably hostile to Islam, 2) the only way to address this threat and the only language the West understands is the logic of violence, and 3) jihad is the only option"[42][43]

Terrorists also like to use the Internet to recruit and persuade children to their cause. As Dorothy Denning has found, "Children are being taught to hate Jews and Westerners, and to take up arms against them [through cartoons and comic-book style web pages, bedtime stories, and computer games]".[44]

All terrorists practice a high level of OPSEC since their need to be secret is how they can be successful. Whether it is the al-Qaeda training manual, online magazines targeted for the world, or the training of youth in Jihad camps, OPSEC is one of the first priorities for terrorists.[45]

Secure communications are big as well. The 11 September hijackers, for example, accessed anonymous Hotmail and Yahoo! accounts from computers at Kinko's and at a public library.[46] Messages are also coded. Three weeks before the attacks, Mohamed Atta reportedly received a coded email message that read: "The semester begins in three more weeks. We've obtained 19 confirmations for studies in the faculty of law, the faculty of urban planning, the faculty of fine arts, and the faculty of engineering."[47] The faculties referred to the four targets (twin towers, Pentagon, and Capitol).[48]

The list of methods goes on and on and is very similar to the methods used in organized crime around the world.

• "In [stability, reconstruction, and COIN operations], the most important targets of influence are not enemy commanders, but individuals and groups, both local and international, whose cooperation is vital to the mission’s success. Granted, joint and Army IO doctrine publications do not ignore these targets – PSYOP and counterpropaganda can be designed to influence them. But it is notable that the activities most directly aimed at influencing local and international audiences – functions such as public affairs, civil affairs, CMOs, and defense support to public diplomacy – are treated only as 'related activities' in IO doctrine, if they are mentioned at all"[49]
• "There must be a fundamental change of culture in how ISAF approaches operations. StratCom should not be a separate Line of Operation, but rather an integral and fully embedded part of policy development, planning processes, and the execution of operations. Analyzing and maximizing StratCom effects must be central to the formulation of schemes of maneuver and during the execution of operations. In order to affect this paradigm shift, ISAF HQ must synchronize all stratCom stakeholders. Implicit in this change of culture is the clear recognition that modern strategic communication is about credible dialogue, not a monologue where we design our systems and resources to deliver messages to target audiences in the most effective manner. This is now a population centric campaign and no effort should be spared to ensure that the Afghan people are part of the conversation. Receiving, understanding, and amending behavior as a result of messages received from audiences can be an effective method of gaining genuine trust and credibility. This would improve the likelihood of the population accepting ISAF messages and changing their behavior as a result."[50]

• Fifth Dimension Operations
• Radicalization
• Cyberware
• Electronic warfare
• Black propaganda
• Cyberwarfare
• Communications security
• Command and control warfare
• Disinformation
• Historical revisionism
• Gatekeeper (politics)
• Industrial espionage
• Irregular Warfare
• iWar
• Network-centric warfare
• Political Warfare
• Psychological warfare
• Public affairs (military)
• Information Operations Roadmap
• Propaganda in the Mexican Drug War
• The Institute of World Politics
• Bolivarian propaganda

• U.S. Department of Defense Information Operations Related Documents
• Operations Security (JP 3-13.3)
• Military Deception (JP 3-13.4)
• Destabilizing Terrorist Networks: Disrupting and Manipulating Information Flows in the Global War on Terrorism, Yale Information Society Project Conference Paper (2005).
• Seeking Symmetry in Fourth Generation Warfare: Information Operations in the War of Ideas, Presentation (PDF slides) to the Bantle – Institute for National Security and Counterterrorism (INSCT) Symposium, Syracuse University (2006).
• K. A. Taipale, Seeking Symmetry on the Information Front: Confronting Global Jihad on the Internet, 16 National Strategy F. Rev. 14 (Summer 2007).
• White House FAQ about the WoT