2. Human Nature and Cyber Weaponry: Use of Denial and Deception in Cyber Counterintelligence

In 2009, the United States published the Comprehensive National Cybersecurity Initiative (CNCI). The initiative outlined US cybersecurity goals that spanned multiple agencies, including the Department of Homeland Security, the Office of Management and Budget, and the National Security Agency. The 2009 CNCI included the goal (among others) of “…enhancing US counterintelligence capabilities and increasing the security of the supply chain for key information technologies.” Specifically, the CNCI announced “Initiative #6. Develop and implement a government-wide cyber counterintelligence plan.” The Initiative stated: “Initiative #6. Develop and implement a government-wide cyber counterintelligence plan. A government-wide cyber counterintelligence plan is necessary to coordinate activities across all Federal Agencies to detect, deter, and mitigate the foreign-sponsored cyber intelligence threat to US and private sector information systems. To accomplish these goals, the plan established and expanded cyber counterintelligence education and awareness programs and workforce development to integrate counterintelligence into all cyber operations and analysis, increase employee awareness of the cyber counterintelligence threat, and increase counterintelligence collaboration across the government. The Cyber CI Plan is aligned with the National Counterintelligence Strategy of the United States of America (2007) and supports the other programmatic elements of the CNCI.”

These two threat agents have been code named by different cyber threat intelligence organizations. APT28 and APT29 are the code names used by FireEye and other organizations, and are used in this report for convenience.

For example, Duvenage et al. (2016) describe the organizational requirements for strategic, operational, and tactical/technical cyber counterintelligence operations; Victor Jaquire and Sebastiaan von Solms (2017) outline a capability maturity model for cyber counterintelligence organizations; Duvenage, Sebastian von Solms, and Manuel Corregedor (2015) describe a cyber counterintelligence process model; and Johan Sigholm and Martin Bang (2013) propose a interorganizational information exchange model for cyber counterintelligence.

It is interesting that Lowenthal’s 1992 overview of U.S. intelligence mentions counterintelligence only briefly, as a defensive FBI function, c.f., Mark M. Lowenthal (1992) U.S. Intelligence: Evolution and Anatomy, Second Edition. London: Praeger.

The term mole was applied to spies in the book Historie of the Reign of King Henry VII written in 1626 by Sir Francis Bacon; W. Thomas Smith (2003). Encyclopedia of the Central Intelligence Agency. New York: Infobase Publishing, p. 171.

This section relies on material from Frank J. Stech, Kristin E. Heckman, and Blake E. Strom (2016), “Integrating Cyber-D&D into Adversary Modeling for Active Cyber Defense,” in Sushil Jajodia, V.S. Subrahmanian, Vipin Swarup, & Cliff Wang eds. (2016), Cyber Deception: Building the Scientific Foundation. Switzerland: Springer.

See also, Neil C. Rowe & Julian Rrushi (2016) Introduction to Cyberdeception. Switzerland: Springer; and Sushil Jajodia, V.S. Subrahmanian, Vipin Swarup, Cliff Wang, eds. (2016) Cyber Deception: Building the Scientific Foundation. Switzerland: Springer.