Cyber Threats To Canada's Democratic Process

Explaining Cyber Threat Activity

Case Study: Swaying Public Opinion Against A Candidate

Target: Social media

Objective: Reduce popularity of a candidate

Scenario: In the lead-up to a federal election, an adversary creates a plan to tarnish the reputation of a candidate who espouses policies that are antagonistic to the adversary’s own interests. The adversary’s plan is to influence voters’ opinions by injecting disinformation into social media.

The result of this influence operation, if successful, is that the candidate loses popularity and potentially the election. The adversary can accomplish this activity by understanding how social media works, and using cyber capabilities that are easy to acquire and to use. While this process can occur in a number of different ways, this case study illustrates the basics of a social media influence operation.

  1. Planning: In this phase, the adversary surveys the existing media environment and designs a strategy for manipulating the environment to discredit the federal election candidate. The adversary identifies what types of issues are important to the candidate’s followers, and what types of stories are likely to be widely covered by the traditional media and widely shared on social media.

  2. Taking action on the Internet: In this phase, the adversary designs activities based on a comprehensive understanding of how voters’ information and opinions are formed and perpetuated in social media. For example, each social media provider uses different algorithms to promote trending content to users. The adversary understands how this works, and manipulates the system in order to introduce ideas and information that are likely to damage the reputation of the candidate.

    Three key ways the adversary manipulates the media is with troll farms, social botnets, and account hijacking. The adversary pays groups of people – troll farms – to spread disinformation and propaganda on the Internet. They post disinformation on websites that resemble reputable news websites, in the comment sections of traditional media websites and on social media.

    The adversary purchases social botnets, which are a series of social media accounts that are all controlled by one user. In this way, one person can control many accounts and inject thousands of messages into political conversations to suppress certain opinions and facts and popularize others.

    Account hijacking is a practice whereby the adversary has used cyber capabilities to gain control over the social media accounts of opinion-makers whose followers would be likely to vote for the candidate.

    By harnessing these capabilities toward a particular objective, the adversary is able to insert disinformation and propaganda in social media, amplify messages that discredit the candidate (e.g. trending content), and suppress messages that could be neutral or favourable to the candidate.

  3. Voters read and react: To voters, there is no evidence of this manipulation taking place and that their personal social media content feed is filled with disinformation and propaganda.

    Voters react to the information they receive, which affects their views of the candidate. Voters also react by sharing and/or commenting on what they see, thereby further spreading the message, helping to accomplish the goal of the adversary.

    A political adversary may also react to this news and use it to his/her benefit, further amplifying the impact of the message.

Figure 12: Case study: Cyber-enabled influence operation

Figure 12 - Description

Figure 12 is a visual representation of the information contained in the previous paragraphs.