Estonian Foreign Intelligence Service — Understanding Russian and Chinese Influence Operations

SweetBlue
9 min readMar 1, 2021

The Estonian Foreign Intelligence Service releases its new 2021 detailed intelligence report — International Security and Estonia 2021, about the threats they have been facing. As we all know the COVID-19 pandemic has raising struggles to all the countries around the world, but it doesn’t mean that the cyber conflicts engaged are stopped, indeed the cyber operations and influence operations are raising, with objectives to weak target countries and “declining Western influence on the global stage”. For Estonia, Russia represent the major threat to his national security but also a raising power, like China, is becoming a major problem too for the Security Services, conducting influence operations with the narrative to create a “positive image of China and to counter any kind of criticism”. But for now, we will focus on what our Estonian folks want to explain us about the Russian and Chinese influence and cyber capabilities threatening the Estonian national security and their allies, so… Bonne lecture!

The coronavirus crisis offered new opportunities for authoritarian regimes to exert influence. In a time of universal mask-wearing, some masks also fell off.

Inside the Aquarium

“The Aquarium” nickname to the Head Quarters of the GRU

When we try to understand the techniques in psychological warfare used by the GRU, we need to go back to Soviet era to see what was conducted against the Western countries and also what was successful. They called this doctrine “Informational Confrontation” and is integrated by 3 main components: Psychological Warfare, Cyber Operations and Protection against Influence Operations. But, for this dudes, in which way they conduct Psy-Ops? Well, they define as a form to influence foreign audiences with the objective to change their views and behaviors to be in line with Russia’s national interests which is ongoing in both conflict and peacetime.

According with the GRU, the main targets of this operations are: civilian population, political leadership, military personnel with their family, and a very interesting and obvious target, are the groups like ethnic minorities, religious minorities, opposition groups in which can be understood as a support in order to destabilize a enemy country, and yes… we can understand that the whole world is a Russian potential target. But as we know and can be very interesting, is that these kind of operations are conducted also in neutral and friendly countries. We never finish meeting someone, so maybe today is our friend and tomorrow they want to launch nuclear weapons to us.

The whole world is a Russian potential target

So… but the GRU is a big agency, conducting not only psy-ops, they also conduct Surveillance, HUMINT, SIGINT, Cyber Operations and so on, So how are these influence soldiers are called inside? Well, remember the magic number:

GRU Psychological Operations Unit

Unit 54777 and as well the psy-ops regional units, are in charge of many interesting tasks like: analyze and asses the military-political situation in foreign countries and also the morale and psychology of their military and civilian people. With a foreign country analyzed and assessed, then they can prepare the psychological influence material, also they participate in the armed forces deception activities like maskirovka (in Russian, military deception) and counter propaganda. All of this with active undercover agents working to establish international contacts to recruit new influence agents.

Russian embassy. Washington DC

When we mention the part of analyze and asses, these units monitor foreign media on a daily basis, with the attention on issues relevant to the GRU, current events and Russia’s role in them. This units are also specially engaged to identify influential Western publication’s articles to boost them through fake social media accounts (Trolls and Bots) and with GRU-controlled online news media, for example, the news and content will depend on the geopolitical situation and GRU priorities. The GRU conducts this operations through big social media like Twitter, Facebook, Reddit and VK (The Russian Facebook). Its important to note that all of this work is measured quantitatively, it means with more opinion pieces, news stories, comments and memes related to the likes and shares, will be much better.

The news and content will depend on the geopolitical situation and GRU priorities

We can take a case study which can be explain everything said in a real-life situation: In 2020, GRU-controlled online news media disseminating disinformation about the COVID-19 in order to undermine the Western countries in special the US, for both influence the American people to downplay the disease resulting in more infected people and also to be against their own government claiming that the coronavirus was in fact a bio weapon, and yes it sounds contradictory, but it doesn’t matter, the people doesn’t need to think about it, they only want to be part of the “truth”.

Russian Cyberspace

Now knowing the influence capabilities conducting by the GRU, we can now engage a little more in the Cyber Operations conducting by the Russian special services (FSB, SVR and GRU). Conducting at first to espionage purposes and… sometimes a destructive attack affecting the daily life of the people. For example a well known attack called spear-phishing and water-holing a classic in Russian spy agencies. As I said for the GRU, is active engaged in psychological warfare, this include also a technique well used during the Cold War with the doctrine of “active measures”, translate to the context of technology and internet, we can identify the “hack-and-leak operations” which can be divided in the first step, the intrusion (hacking) and second, the influence (propaganda), the perfect example of this is 2016 Russian interference in U.S. elections, hacking the DNC and leaking sensitive documents and emails through Wikileaks with a fake persona, Gucifer 2.0 calling for the attribution of the hack, in order to boost the Trump candidacy while demoting Clinton’s. Other dangerous threat who are very likely to be exploited by the Kremlin is the use of deep fakes, now this technology can be easily recognized as a fake video, but with new developments in AI, this will be a great threat who can undermine completely the facts and truth. Another cyber attacks used largely by the Russian government are:

DoS-Attack, can impede official information flow in government and media sites. Sowing confusing and fear while important events occur.
Website hacked, planting images, text, video or audio to disrupt the exchange of accurate
information and create fear. Targeting an ISP makes possible to attack a large number of websites.

All this kind of tactics will very likely to continue in 2021, but why? These are effective, inexpensive and without imminent escalation confront. Also, in the side of influence operations can achieve long-terms or strategic objectives in which are not always necessary to intervene in the target country, because one of the goals is that the target population push the narratives and do the job indirectly for the Russian government. Because, to disrupt a country, the main objective will be influence the target population and that same population will undermine their own government, institutions, democracy and lastly their way of life to finally waiting for the “Normalization”.

The target population also, need to push the narratives and do the job indirectly for the Russian government.

China’s vital Information Space

The coronavirus pandemic had increased the amount of biased and fake news in China becoming even more aggressive to Western societies, in line with their ideological expansion and international recognition as a superpower, China passed to be the country seen as the start of the world crisis to the “generous” and strong power who “defeat” the virus. The main narratives pushing by Chinese government through this influence operations have been improve China’s image, spread the message of the CCP , shape the discourse around it and sway the political decisions in foreign countries to China’s favour. As we mention earlier with the Russian special services, The Chinese Communist Party is likely to exploit this new technology developments in this year, seeking to intensify and amplify their message through popular Western social media which are blocked in China, what a surprise.

China’s seeks the ideological expansion and international recognition as a superpower.

A interesting thing about the techniques used, is that Chinese diplomats and media figures are actively engaged in disseminating this messages, through their official Twitter, Facebook and other social media accounts and very clever, is that they write their posts in English, enable to end in the global information space.

Zhao Lijian — Foreign Affairs spokesman

Chinese authorities had started recruiting Chinese people living abroad as well Westerners and Western information channels. Seeking to promoting praising China and justify Chinese policy. Besides the recruitment of regular people, they have promoted the creation of think tanks and media scholars publishing opinion pieces in favour of the Chinese government. The main message is nearly always the same, a call to adapt to China’s presence and the rules it has established, even if that mean abandoning the values of a democratic society. The well know Confucius Institutes are becoming a grow soft power to China’s interest around the globe and to reduce the negative publicity is likely to be rebranding as the Centre for Language Exchange and
Cooperation,
but will be only a mere formality and the institute activities will remain largely unchanged.

A call to adapt to China’s presence and the rules it has established, even if that mean abandoning the values of a democratic society.

As we mention earlier, the foreign think tanks created by the Chinese government, are linked in an informal way seeking to push the CCP narratives in the Western pluralism, but topics like the status of Hong Kong or Taiwan and the situation of Uyghurs and Tibetans are benefit with the lack of experts talking about this in favour of the CCP willing to dominate and manipulate their own version of the truth.

When we analyze the tactics used by China conducting influence operations we can assess that in a short-term development or tactically, the Chinese government follows the Russian example, although we can’t conclude that this relation is for a coordinated campaign against Western society, is more likely to be a relation with only shared objectives and interests.

Conclusion

As I related in this blog, the Russian and Chinese tactics and techniques conducted through the cyberspace were enable a new kind of warfare that seeks to weaken and undermine Western societies in order to demonstrate the excellence and superiority of Russia and China to rest of the world. Between this two countries there is for now a gap in professionalism and experience conducting this influence operations, but is likely to be shorted in a short/medium-term, while Russian efforts are to push disinformation to sow discord and confusing in line with a fallacy know as whataboutism to distract and point to the “Western hypocrisy”, China is seeking to push propaganda to glorify and recognize the excellence of the Chinese government and Chinese policy in order to abandoning democracy values. All of this will continuing through 2021 with the massive vaccinations across the world and countries going back to the “normality”, it opens a new era to new influence and cyber operations seeking to win the attention of the world in order to manipulate new target populations in China’s and Russia’s favour, forever if they can.

Xi Jinping and Vladimir Putin

--

--

SweetBlue
0 Followers

Cyber Threat Intelligence, Information Warfare, HUMINT, SIGINT and OSINT