A Conversation with Martha Turnbull of the European Centre of Excellence for Countering Hybrid Threats
In this IWI Emerging Technology conversation, Jeff Szuchman and Aidan Harte speak with Martha Turnbull of the European Centre of Excellence for Countering Hybrid Threats about how governments and societies are responding to information manipulation and other hybrid threats. They discuss why terminology matters, how China and Russia are using AI in influence operations, the difficulty of measuring the impact of information campaigns, attribution and deterrence, and how hostile actors learn from and cooperate with one another. The conversation also looks ahead to AI-enabled micro-targeting, the growing use of non-state proxies, and the long-term effects of foreign interference on trust in democratic institutions.
Note: This transcript has been edited for readability while preserving the meaning and substance of the conversation.
Transcript
Jeff Szuchman: Hello, and welcome to the Irregular Warfare Initiative’s Emerging Technology Series. My name is Jeff Szuchman. I’m the co-director of IWI’s Emerging Technology Program.
Aidan Harte: I’m Aidan Harte, advisor at the IWI Emerging Technology Program. Today, we’re joined by Martha Turnbull, director of the Community of Interest on Hybrid Influence at the European Centre of Excellence for Countering Hybrid Threats in Helsinki.
Jeff: Hybrid CoE is an international expert organization that brings together 35 participating states and works closely with the European Union and NATO to understand and counter hybrid threats, from information manipulation and election interference to proxies, sabotage and other forms of coercion below the threshold of conventional conflict.
Aidan: Martha’s portfolio includes disinformation, AI, election interference, and proxies. She came to the role after 15 years in the UK government, working on national security issues including hybrid threats and counterterrorism.
Martha, welcome. Thank you so much for joining us today.
Martha Turnbull: Thank you for having me.
Jeff: So, Martha, we’re excited for this conversation. There’s a lot to cover, but let’s start with you and your story: how you came to this world of hybrid influence, and then also about Hybrid CoE and how that began. What was it that Hybrid CoE thought were issues that weren’t being addressed by governments and multilaterals?
Martha: Sure. So, from my perspective, I’ve spent over 15 years now working in the UK government. Initially, the first 12 or so years of my career were focused on counterterrorism. But I think, as anybody who works in the national security community can tell you, the direction of travel seemed to be very firmly towards hybrid threats or state threats.
And so there was a pivot in my career about three or four years ago, where I started looking at this problem increasingly, first from the lens of how counterterrorism and our responses to countering terrorism can help us deal with these emerging hybrid threats.
But then, more recently, as you say, I’ve moved to the Hybrid CoE in Helsinki, where I’m now one of the directors of a team of analysts working on a variety of different topics.
So really, for me, it’s been a fantastic continuation of my career. I’ve been an analyst for the majority of my career, so looking at deep dives into terrorist organizations and how they operate, but now thinking about hybrid threats, which are very different to that but, in my view, quite connected. And some of the responses are connected as well.
So it’s been helpful to have two different thematics throughout my career.
Aidan: Great. You know, one of the joys of being a part of IWI is getting to levy questions, I guess, that we would often get asked to answer.
So I wanted to sort of introduce this as well with a question about terminology—a definitional question—not just because there seem to be so many terms for similar ideas, but because the choices about which terms to use shape both organizational power dynamics and, certainly as we’ve seen in the U.S., can really influence funding.
Cognitive warfare is a common term in the irregular warfare community, but other terms are sometimes used to mean similar or the same thing, including foreign information manipulation and interference, active measures, mis- and disinformation, and others. I’ve often preferred, for example, the use of the term “malign narratives” over “disinformation” to avoid rejecting underlying grievances.
And so I’m really curious how you and Hybrid CoE think about the choices you make about terminology, and why do you think they matter?
Martha: Yeah, so I think terminology is really important. I think it can often be quite a thorny question because terminology is never neutral. And I think, particularly in this space, we can see how different terms emphasize different aspects of the problem.
So you’re right. In the work that I’m doing at the Hybrid Influence team at the Hybrid CoE, we work with participating states that call it disinformation. We work with other states who prefer to use the terminology FIMI—foreign information manipulation and interference. But we also have separate programs of work that look at cognitive warfare as a separate subset.
But we’re also constantly coming up against misinformation as well, increasingly fake news, which is kind of associated in this space. But also what we’ve seen recently is a trend towards using the term DIMI, which is domestic information manipulation and interference.
So you have all of these terminologies which are kind of just constantly floating around in this space. And which one is the best one, I think, often depends on the country or the organization and the context, and what works best for them.
But I think some of the key differences are important to recognize here, because when we talk about disinformation, we’re talking about false or misleading information. When we talk about FIMI, we’re focusing on the behavior of the actor behind the activity rather than the truthfulness necessarily of the individual pieces of content.
So this is about information manipulation and interference by a foreign actor, and so it’s quite specific in that way.
And then, obviously, at the Hybrid CoE, we look beyond this topic as well. We look at hybrid threats, which is obviously a much broader topic that includes information operations, but also includes that link across to cyber activity and other threats like economic coercion, sabotage, proxies, political interference. All of that kind of sits within that hybrid threats terminology.
So I think the conversation on this seems to be evolving. Certainly in the European Union context, countries within the European Union seem to be favoring FIMI because it allows countries to focus on the foreign element of that.
At the Hybrid CoE, we prefer to use disinformation because we’re more specifically talking about false and misleading information, so that helps us. But we also find that that enables us to have a conversation about foreign actors and domestic actors, including the ways in which they work together.
Whereas when you use FIMI, you’re talking specifically about the foreign actors. So that’s important.
And I think the other thing to mention in this space is that, when we are doing our analysis on disinformation, the work that kind of constantly comes up again is that the actors that we’re analyzing here are exploiting real grievances, often genuine societal debates or existing divisions within society.
And so it’s not always a question of, “Is the statement true or false?” but it’s about how it’s being manipulated. So it’s quite important to remember that as well when we’re thinking about this.
But I think the terminology is important because it can shape the policy responses. So, for example, if we just saw a problem as being misinformation, we might just focus on fact-checking because we’re talking about false information.
If we are just thinking about foreign interference, we’d be perhaps immediately looking at attribution, networks, financing, proxies, strategic intent—all of those things. And so that’s why the terminology can be really important, because it can shape the policy response that you have.
Aidan: I think that’s a fantastic response and very, very true. I think that nuance there is incredibly important because the terms that we use oftentimes inherently dismiss the legitimacy of a grievance or our ability to understand how to respond to it. So I really appreciate those distinctions. Thanks.
Jeff: Have you seen instances where there is disagreement about terminology kind of leading to real differences around policy responses that make it more difficult to cooperate?
Martha: So I think the only thing that we have seen in this space is that, in some states, their legislation makes it difficult for them to focus on foreign and domestic actors at the same time.
So they might be mandated to only do foreign actors, or they’re mandated to only do domestic actors. And so the piece that can sometimes be missing in that case is the way in which the two are often connected, and increasingly connected.
So I’d say that really is the problem. It’s less about terminology, but it’s more about, I guess, legislative structures and cooperation between departments and what is allowed and not allowed in certain circumstances within countries. That is the thing that stands out to me in that space.
Jeff: Okay, let’s talk about AI and how this has kind of transformed the toolkit for hybrid activities.
Hybrid CoE has a recent paper looking at how China and Russia are each employing AI in different ways to bolster their toolkits. It makes the case that Russia has not quite the advanced capabilities that China has, but is still using AI to bolster misinformation, sowing chaos and confusion, and manipulating publics.
So how do you see the way Russia and China are each integrating AI differently? And especially as the technology is advancing so rapidly, how do you see this changing?
Martha: So this is a topic that we have looked at in quite some depth in response to some questions that we had from some of our participating states. And the paper that you mentioned is one where we seek to compare and contrast Russia and China’s use of artificial intelligence to see if we can draw any conclusions from this.
And I think the headline conclusion, in terms of where the two countries are similar, is that from the research that we’ve conducted, both countries—China and Russia—are using AI primarily as a force multiplier rather than a revolutionary new capability.
So it’s being kind of layered on top of their existing information operations and adding additional capabilities in terms of speeding up processes and allowing them to translate content more easily into particularly difficult languages. But it is not something that is kind of standalone as a completely new capability.
But there are differences in how the two countries are using AI and certainly their trajectory for how we think they’re likely to use AI in information operations going forward. And a lot of this comes down to money, but also it comes down to resources more generally in terms of where the most capable companies are based and how they can access those kinds of resources.
So what we’ve seen is that China has a highly developed domestic AI ecosystem and that it is able to use this AI technology for large-scale monitoring—so being able to understand our states and societies and then use that information to help them calibrate their information operations accordingly.
They can also do things like audience segmentation, content personalization, and information-environment analysis, which, again, is kind of helping them build their tools to properly target our states and societies.
And China’s approach in this space is very systematic, it’s data-driven, and it’s embedded within a broader state strategy.
If you compare that with Russia, Russia is much more opportunistic. It has fewer of those indigenous AI advantages. Some of this is down to sanctions. Some of this is down to the monetary impact of sanctions, but also the fact that Russia doesn’t have as easy access to experts on this topic in the way that China has.
But what Russia has been able to do is it can effectively exploit commercially available AI tools in order to enhance its existing tactics. So it is very much focused on disruption, confusion, and agitation.
The approach that we tend to see from Russia more broadly in information operations is known as a kind of “firehose of falsehood.” So it’s creating huge volumes of content in order to make the information environment much more confusing and very difficult to ascertain what’s true and what’s false.
And obviously AI capabilities can really help them in that, in terms of the volumes of the outputs that these systems are able to produce.
And so I think the key difference—probably the standout for me—is that we see China seeking to have influence and using AI in its information operations to increase its influence, and Russia using AI in its information operations to seek disruption.
And that’s a bit of an oversimplification, but I think there’s a kind of important distinction there between how the two countries are approaching this.
The other thing that we look at in the paper is the way in which there might potentially be some overlap between the two countries going forward. So if you have one country, China, with much more advanced AI capability, and the other country, Russia, depending on these kind of commercial solutions, is it a kind of no-brainer that one country would give to the other and then build their capability as a result of this?
I think a key thing here—and this is something that the Hybrid CoE is looking at across a multitude of different vectors at the minute—is that there is still significant distrust between those two countries and the leaderships of those two countries, which means that you don’t have that kind of immediate buy-in at a very deep strategic level. And so I think that will limit the growth here.
But I think certainly technology, in terms of China developing commercially available solutions that Russia is then also able to use—absolutely. And I think we are already seeing some examples of this.
And I think, looking forward in terms of where this is going next, AI is clearly making both of these actors more capable of personalizing the narratives that they’re using. They’re using it to automate their content production, identifying vulnerabilities in target societies.
But their political goals are still quite different. China’s information strategy is about supporting long-term geopolitical influence and legitimacy, and Russia’s is about eroding trust and creating uncertainty.
So whilst those differences are there, I think we’ll continue to see differences in approach at a kind of tactical level as well.
Aidan: Fascinating. I know we were hoping to talk later about the potential for collaboration between actors, and so hearing that there remains likely that significant distrust is really interesting.
I wanted to sort of follow up with a question about—a very difficult question about—attribution. One of the things that has been potentially alarming about the use of generative AI is that you can not only amplify and sort of easily have a message resonate across a wide array of populations, but that some of these actors are using these platforms to try to build meaningful relationships with individuals.
But I think, as with so many info ops on the sort of military side or on the civil society side, it often points to an increasing tension that Hybrid CoE’s research has also amplified, which is exactly what you said: despite the fact that AI has indeed increased the volume of info ops, that sort of democratizes that tool and allows people to increase the amount of audio, visual, and text deepfakes, that key question of attribution and impact remains a very difficult one to answer, and I think one that we all struggle with.
And so I wanted to ask you: You’ve noted in the past that hybrid threat actors have had very little success in actually influencing electoral outcomes, for example. We saw this to some degree in Moldova the last few years.
But I’m curious why you think that is, and how does Hybrid CoE think about this measurement problem, think about this attribution problem? And do you have any recommendations about how we and the broader community should be measuring the impact of these efforts?
Martha: Yes, I think questions around how to assess impact are very difficult to answer. And I think this is because impact is just so hard to measure in this space.
I think we tend to focus on questions like, “Did disinformation change the election result in X country or Y country?” But that is a really high bar for us to be able to answer.
Most of the influence operations that we see are not designed to single-handedly determine an election outcome. So they are one of many things that hybrid threat actors have in their toolkit to try and influence the outcome of elections, but they are not designed to be single-handedly the one thing that changes it.
And so I think what is often more useful in this space is to look at whether these activities, these information operations, are increasing polarization. Are they reducing trust in governments and societies, in democracy as a whole, in rule of law—all of these kind of bigger questions? Are we seeing increases in social tensions and reducing confidence in democratic institutions more generally?
These effects are kind of cumulative and harder to measure directly. But I think these are the kinds of things where, certainly over longer periods of time, we can assess: What are the changes in this, and to what extent do we think information operations might be responsible for this? And can we see who might be behind these information operations?
But I think it also gives a useful tool for states to look at the conversations that might be happening within their populations. So this is often a combination of things. So it might not even be, you know, even 20 percent down to a foreign actor trying to influence the society, but still it’s important to analyze what’s happening in order to understand what domestic things potentially need more interventions.
I think attribution is also really difficult. I think we’ve seen a concerted effort over the last 12, 18 months from a lot of Euro-Atlantic states to try and use attribution more as a tool to be able to definitively say Russia, China, whoever it might be, was responsible for that kind of activity.
But I think when you look over the last 12 months—and the European Union put out a report on this—they looked at the number of information operations, and they were able to determine that, I think it was, 65 percent of the attacks that they noticed were unattributed. So they weren’t able to attribute the vast majority of those instances.
So it’s really difficult to do. I think we can sometimes identify the actors, but linking a specific campaign to a specific behavioral outcome is methodologically really difficult.
And so another thing that I sort of mentioned at the start of this was around the fact that hostile actors are exploiting existing grievances rather than creating new ones. So they are amplifying these social dynamics rather than causing them.
And so that’s why focusing on things like trust, social cohesion, institutional confidence can often give a better understanding of what’s really going on. And that can be more meaningful indicators rather than whether somebody changed their vote during an election.
Aidan: Fascinating. Thank you.
Jeff: Yeah, I mean, this question of attribution and deniability gets at the broader set of hybrid activities. And so, for Hybrid CoE, you talk about hybrid threats in part by this ability to exploit deniability and detection.
At the same time, Europe in particular is under unprecedented levels of these types of intrusions, whether it’s sabotage or cyber or in the information space.
And so the question is: With these questions of attribution, at what point does this accumulation of individual activities add up to something more? And at what point does that demand a response that is different than the response that is already taking place?
So how do you think about that? How do the states that you work with think about that? And then what does that response ultimately look like, or what should it look like?
Martha: I think this is one of probably the most important questions that are facing the Euro-Atlantic community at the moment, because we’re very well accustomed to thinking about hybrid threats as something that sits below the threshold that would trigger conventional response.
So this is sitting below Article 5. And they purposefully exploit this ambiguity, deniability, and uncertainty over and over again because they know that they can in a lot of cases.
But the challenge that we’re seeing now is that we have an accumulation of incidents. So we have critical infrastructure sabotage. We have cyber operations, information manipulation, attempts to influence elections. We have the large-scale use of proxies and also criminal networks. We have covert influence, and we have the use of non-state actors as well. So all of that going on at the same time.
And whilst individually these attacks remain below traditional thresholds, I think you could look at them collectively and assess whether or not they form part of a strategic campaign and whether or not that changes the response that’s needed.
I think the debate is then shifting away from whether this activity is hybrid and towards asking what these kind of cumulative strategic effect is trying to achieve.
And so I think we are increasingly looking at what is the pattern here, rather than what is the individual event, and how do we respond to an individual event versus seeing this as part of a pattern.
And I think we have seen some really good examples over the past 12 months of how states have come together in response to particular incidents that have happened and have either kind of collectively said, “That’s happened to you, this has happened to us, and this has happened to our neighbor. How about we respond to this as a pattern rather than individual incidents?”
And I think, particularly the work that we have done at the Hybrid CoE looking at deterrence and deterrence responses, one of the core parts of the model that we use here is about synchronization.
And so it’s about being able to identify those patterns across borders, and synchronizing your response to it is going to increase the ability for the actions that you take to have more of an impact.
Because if it is sanctions that are issued through the EU, that has more impact probably than an individual country. If it is a public statement that’s issued from 23 countries rather than one country, that’s also going to have more of an impact.
If we’re looking at things like asset freezes and travel bans, again, if it’s across more than one country, or if it’s across the entirety of the EU, it’s going to have more impact.
And I think we are moving into that space. I think there’s a lot of coordination that’s going on across the countries that we work with here at the Hybrid CoE, and I think that’s a great step forward.
I think the other thing that we’re seeing is increased cooperation and engagement between the EU and NATO on these matters as well. And I think that’s really important because we have two pivotal organizations in the Euro-Atlantic space responding to shared threats, and I think that is going to put us in a better position going forward.
Aidan: I think it’s a fascinating segue to the question of deterrence, because we’ve often admired the fantastic work that Hybrid CoE has done on deterrence.
It strikes me particularly—it’s impossible to read the news and not see what looks like a trend of escalatory behavior by the Kremlin. And it would seem that a key objective there, as you said, is to increase mistrust, to increase polarization, and I think also to undermine the resilience that many of these European states have built up since the full-scale invasion, with much of it, I would argue, because of Hybrid CoE’s recommendations.
You sort of mentioned sanctions, mentioned improved coordination, but I would love for you to just say a little bit more about what are the most important tools for deterrence.
And sort of just a bit of a corollary experience is, you know, I’ve always considered Moldova as having done an extraordinary job of standing up a whole-of-society approach since the full-scale invasion, and I think they’ve made tremendous strides.
But I’ve always thought that a key ingredient that contributed to the Kremlin’s inability to sort of sway Moldovan public opinion in meaningful ways is the fact that they haven’t been able to offer a viable alternative, a sort of positive future for Moldova—for Moldovans moving forward.
And so when we think about resilience, how much of what we’re calling resilience is really just an adversary failing to offer an alternative, viable option?
Martha: I think Moldova is a really great example. And at the Hybrid CoE, we are working really closely with our colleagues in Moldova to better understand the situation that they find themselves in, but also the fantastic work that they have done to push back against the significant hybrid threat that they have faced from Russia in recent years—for longer than that, in fact.
But I think in terms of our work on deterrence, obviously deterrence is split into two different categories. So you have deterrence by denial and deterrence by imposition of costs.
And I think when we think about deterrence by denial, this is about reducing the operating space for the adversary, so making it harder for them to achieve their objectives. And this can mean a whole different number of things.
Certainly, sometimes, like you say, for the Moldova example, this is where the adversary’s narrative just doesn’t work. And so that makes it a more difficult operating environment for them.
We also see examples from here in Finland where, again, the adversary’s narrative just does not work for them. And that’s why, when we saw the creation of Sputnik in the Nordic region, it was very shortly after closed down because it just wasn’t gaining the traction, because it’s a very difficult audience here for them to try and influence.
But deterrence by denial also means a kind of wider piece around resilience of communities, so making them more aware of what this threat looks like and better able to respond to it themselves.
So it’s not always about the government and their responses. It’s about hardening the population to what this threat looks like and how they should respond.
But it can also include some broader policies around digital, AI, and media literacy, around critical thinking—again, kind of hardening the population in terms of making it more difficult for the adversary to achieve what it is that they want to achieve.
But you also have deterrence, which is the imposition of costs. So making it clear to the adversary that if you do this, this will be the cost to you.
And there’s a whole bunch of different things that can be done in that space around legislation, but also around diplomatic signaling and using back channels and all these sorts of things to make it clear to the adversary that there are consequences of what it is that they are doing.
And I think, from the work that we have been doing here with our participating states, we have seen a big uptick in the level of interest in our deterrence workstrand recently, which is great to see, and we’re really happy to have that conversation with them.
And the model that we use in our training courses on deterrence, trying to kind of help participating states and organizations to build their capability, is situated around something that we call the “Four S Model.”
The first one here is situation. So it’s really important to understand the threat environment that you’re facing. So having that deep understanding of what this actually looks like, what the adversary is trying to achieve, can help you build your capabilities.
The second one is self. And this might sound a bit bizarre, but sometimes we find that having this assessment of your own position—what are your red lines? What are your capabilities? What are your legislative opportunities to go after the adversary?—sometimes that needs to be done again, to be re-looked at, to understand exactly what those capabilities are.
And then you move on to solutions, which is thinking about what is it that you’re able to do in this space? How do you influence the cost-benefit calculation of your adversary?
And then the final one is synchronization, which is where this kind of cooperation point comes into it, because the work that we have seen is that deterrence is more effective when it’s synchronized or coordinated with other partners. And so looking for opportunities to do that is something that we encourage our participating states to do.
I think there has been a lot of conversation, particularly over the last 12 months on resilience in particular. And I think this is where the balance needs to be perhaps recalibrated in some cases.
So one of the important findings that we’ve had from some of the exercises that we’ve been running in this space is that sometimes democracies can become overly focused on absorbing the pressure. So the resilience side: just absorb it, harden the population, make it more difficult, rather than imposing costs.
And so hostile actors might conclude that they can continue operating below the threshold with little consequence.
Resilience is clearly an essential part of this response. But if resilience becomes synonymous with endurance alone, then adversaries might interpret that restraint as permissiveness.
And so we need to kind of make sure that we have that balance right between the two sides of deterrence.
Aidan: And that’s a distinction that both Jeff and I have found fascinating. I think it’s a really interesting and unique insight.
When you’re thinking about resilience and, again, thinking about a long-term objective of undermining resilience, and acknowledging that it can be difficult to maintain that degree of resilience over a long period of time, are there specific—going back to the question of impact and measurement—are there specific metrics that you specifically would point to as indicators of either degrees of lagging resilience, for example, or indications that resilience has flatlined? Are there specific metrics that you would point to?
Martha: So I think it would depend on the vector that we’re specifically trying to measure resilience in relation to.
But, for example, resilience in the information space—it would probably be good to look at media, digital, AI literacy, and some of those measurements, which would at least be able to tell you a snapshot of how capable the population were to engage in some of these debates, but also to identify myths and disinformation, and particularly AI-generated content as well.
That would be one way that you could get at least a baseline of how the population would be likely to engage with this kind of content.
But beyond that, I think it becomes much more difficult. But there are some studies that have looked at, for example, the extent to which Russian-linked narratives are growing or shrinking in populations.
So narratives towards the war in Ukraine and continued economic and other support to Ukraine—how those narratives and support for those narratives have changed over time.
And again, it’s not being able to then say your efforts on resilience or the efforts of the adversary have necessarily been the one thing that has changed this. But I think it does give an indication of how the population feels that then allows the state to look deeper into what might be the factors behind this and how can we do something about it.
Aidan: Fascinating. Yeah, I have found social contagion theory as being a useful construct to think about this as well, because it similarly takes a very holistic approach to trying to understand behavioral change.
I wanted to sort of ask a question about lessons and coordination. And you had mentioned prior that significant or preexisting distrust between the Kremlin and China, for example, inhibits outright coordination. But I sort of wanted to ask you a question about what you’re seeing in terms of lessons that different actors have sort of drawn from one another.
And just to sort of caveat that this is something, of course, we see across the spectrum, so across countries. Certainly, as we’ve seen with Iran, Lego has gotten a new lease on life. We see that memetic warfare is now seemingly ubiquitous.
And similarly, sort of broadening the aperture to stratcomms as well, President Zelensky of Ukraine, for example, has sort of very intentionally crafted a campaign that sought to sort of amplify existing intelligence indicating intelligence sharing between Russia and Iran, to try to draw a tighter connection between what’s happening in the Middle East and what’s happening in Ukraine.
And so I’m curious: How does Hybrid CoE think about distinguishing between actors sharing lessons or learning from one another and active, outright operational coordination? And what does that tell you about how to disrupt lesson-sharing and coordination moving forward?
Martha: So I think the distinction between learning from each other’s successes and failures and coordinating is really important.
And I think the distinction is also challenging sometimes because I think we don’t necessarily have all of the evidence to be able to point to specific coordination, but we can see examples of learning.
And so perhaps we’re badging things as learning when they might actually be coordination, or potentially even vice versa as well. So there’s a bit of a challenge there in terms of being able to identify exactly what’s going on.
But I think what’s important to say here is that states don’t need to have that kind of formal cooperation in order to learn from each other.
And we know that they are likely to be constantly watching what the other is doing, as well as what we’re doing in response as well.
So things like: What are our strategic communications? What are our governments doing? How effective is that? What kind of methodology are they using?
They’re watching that, as well as watching what their fellow adversaries are doing. They’re looking at successes, failures, tactics, narratives, technologies, and they’re using all of that information to then adapt their own approach accordingly.
And I think, in information operations specifically, probably imitation is more common than direct coordination just because it is easier and quicker to do. And certainly in the information space, things are developing very, very quickly. So it can often be hard to find the time to have that coordination, and they can just simply learn from watching what works elsewhere.
And I think a really interesting paper on this topic is from the Alan Turing Institute, who we worked with on our work on artificial intelligence. They have looked at China, Russia, Iran, and North Korea and looked at their use of AI in information operations, and warned against overstating cooperation across those countries in that paper. And instead, I think, showed that the evidence was for more kind of limited bilateral and transactional cooperation rather than a fully integrated alliance, which I think gets to that point earlier in the conversation around how there is still distrust between these different actors. They spy on each other, and we know from information that’s been made public that they are doing that. And therefore there isn’t that full trust between these partners. So they’re not going to fully go into this kind of cooperative relationship that we might like to think that there could be between them.
And I think, what does this mean for disrupting? I think there are two different approaches depending on whether it is coordination or whether it is learning.
So I think when we can see a clear example of operational coordination between these different threat actors, there are things that can be done around sanctions, around intelligence cooperation, financial measures, and using law enforcement.
If you can definitively say that one of these is helping the other, and what they’re doing is against the law, then there’s the kind of full force of the law that can be used against both sides, or even all sides if it’s more than two.
But I think the learning side is more difficult. So this is where we think that they are learning from each other. But there are some options here as well.
So, like, transparency—making it clear, kind of calling it out when we see it. Exposure. Maybe trying to go for some kind of rapid attribution of, you know, this country is doing this, this country is also doing it, and kind of making it clear—not that there is coordination, but that they are learning from each other.
And I think also the other thing that’s important here for this learning piece is that we need to learn ourselves around our kind of best practice for defensive lessons. And sharing that amongst us and our communities and our democracies is also really important.
So I think our democratic societies need to become faster learners in the way that we see our adversaries are very fast in learning from each other.
Aidan: Absolutely.
Jeff: So we’re coming sort of to the end of our time, and we have touched on a range of issues. And thinking about all these trends, or even ones that we haven’t talked about, which do you see looking forward—and as this moves so quickly, as you said, maybe not that far into the future—what do you think that we’re maybe, as a community, not paying close enough attention to that we should be? So that a couple years out from now, we’re not looking back to today and saying, “We should have really paid attention to that.”
And then, I guess related, what is the Hybrid CoE focused on right now, and what do you have in the works coming out?
Martha: So I think, maybe starting a bit more tactical, in the information space in particular, a lot of the conversation around the use of AI in information operations has focused on deepfakes and how they could be used and are being used and are being used.
But I think maybe the thing that we’re missing out on there is how AI can enable micro-targeting. And this is about having highly personalized influence at an enormous scale, which allows actors to tailor their messages to specific communities, identities, and vulnerabilities. And that is problematic because the messaging can then be more effective if it’s targeted in that way.
But I think the bigger, kind of long-term impact of that is about reducing the space for our own strategic communications.
So if everybody becomes more and more used to micro-targeting—so when they’re on their social media, the information that they are consuming has been targeted specifically at them in this micro-targeting way—it then reduces some of these kind of bigger narratives for us to engage with.
It reduces that kind of space because we’re so used to being funneled down and down and down into something so specific that it’s hard for us to then identify with these bigger narratives.
I think it makes it much more difficult for strategic communications from a government perspective as well. So I’d be very concerned about that, but that’s a very tactical point.
I think the other thing to mention here is the growth of non-state actors. So my team at the Hybrid CoE has a work strand that looks at non-state actors or proxies.
And the thing that concerns me here is that we have seen a massive growth in activity in this space. This has been going on for the last couple of years now, but the trajectory is going up and up and up with this.
And I think the concern for me is that we are seeing hybrid threat actors—all of them, pretty much—making use of proxies, of private firms, of criminal organizations, and loosely affiliated networks to conduct their activity.
And this makes it much harder for us to then attribute what’s going on, and their deniability increases.
And I think particularly that crossover with criminal networks—and we’ve seen Iran do this, we’ve seen Russia do this, there are other actors as well active in this space—it’s also really challenging from a response perspective because we are then needing to coordinate our kind of hybrid-threat response with our colleagues who are working on serious organized crime.
And the two kind of thematics are quite separate at the minute. And I think that is challenging from a response perspective, to try and bring the two together.
But it’s also really challenging in terms of going after the perpetrators because it’s really hard to predict when and where these kinds of activities might happen. So it’s challenging and it’s growing, and I don’t think we have necessarily got ahead of the problem.
And the final thing, I think, to mention is a longer-term one. I think we’ve seen this growth in attempts to influence our elections. And, you know, there are so many examples of this—Romania, Moldova, I could go on. There are lots.
But I think we’ve sort of moved from election to election to election and looked at, you know, where’s the next election? What’s that campaign going to look like? And let’s analyze that as and when it happens.
But perhaps what we’ve done less of is kind of standing back and looking at the impact of the erosion of trust in our democracies and our societies, and what that means for us in the long term, and how we can go about repairing that.
And some of that is connected to what’s happening within individual states and societies, and the growth of particular political parties obviously plays into some of this activity as well.
But it’s there on the periphery. What we’re really focusing on, and what we really need to do more of, is understanding how foreign actors are using ideological contestation to their advantage.
And we have a forthcoming hybrid theory paper which is going to look at that in much more detail, and particularly from a Russia perspective. But I think some of those long-term implications of that activity perhaps need a bit more attention.
Aidan: Fascinating. Well, we’ll certainly look forward to that paper. And we have run out of time here, but there’s obviously much more we could talk about. I’d be fascinated to hear this perspective on sort of micro-targeting within the Kremlin, but we’ll have to save that for another podcast.
I just wanted to thank you again, Martha, and just say, as a practitioner myself, I’ve long admired and utilized the insights that Hybrid CoE has produced. And I know that’s true for other members of certainly IWI’s audience, but the broader practitioner community.
So I just wanted to thank you again for taking the time. We really, really appreciate it.
Martha: Thank you. Thanks for having me.
Jeff: Yeah thank you so much. And for those watching, or listening, or maybe reading the transcript, please feel free to leave comments or questions. You can email us at emergingtech@irregularwarfare.org.
Please subscribe to the IWI newsletter and check out irregularwarfare.org.
Thanks so much, Martha.
