Below is a partial transcript from The Cipher Brief’s Gray Zone Group. The briefing has been lightly edited for length and clarity. For more background on recent Gray Zone attacks, the Cipher Brief has a good rundown.
The Cipher Brief: How are you thinking about the increase in activities and what concerns does that lead to?
Dr. Vickers: The UK and Germany have both noted the expansion of Russian activity, and it’s also become more lethal. During the Cold War, Russian intelligence services focused principally on intelligence. The KGB utilized active measures, mostly propaganda, sometimes some wet affairs (operations that involve assassination or murder). Russia’s GRU does a lot of that now; sabotage and assassinations and other things that are being noticed across Europe, as well as deploying new cyber tools. And disinformation launched by China in Taiwan has really intensified substantially.
Pitts: When you look at the increase in activity by adversaries, it tells us that they think this is an effective strategic effort and that it is working. That’s bad for us. It means all the things that we’re doing to highlight and deter it aren’t working, at least not to the extent that they should. I think we should also look at the expanding breadth of these activities. How often is it that we talk about undersea cables being cut by accident by ships? We should expect an increase in breadth as well.
Sanner: I don’t think we have a policy of deterrence. There’s very little written, in fact, in a comprehensive way in academic literature on this. There’s a lot of deterrence theory, but it’s all about nuclear deterrence. We’ve never really had a great comprehensive look at this. There’s no “gray zone solarium” that’s coming up with these ideas to answer questions of, “What should we do?” Everybody’s still addressing this in one-off ways. A cyberattack is a cyberattack, but it’s not. We have yet to define these things and to then build out a toolkit of deterrence.
Branch: There’s way too much ambiguity right now on what this is and what these challenges present to all of us. And I’ll note that it’s not just a government challenge. It’s not just a government security issue. Western-based multinational corporations, other institutions that we have throughout the globe are being challenged by pressures on their economic and market positions. Fisheries, fossil fuels, precious metals all these areas and the access to that trust and faith and confidence in relationships with partners overseas, are all being challenged. And the front lines of those engagements are not just occupied by nation states, but our businesses and our corporations are also there, fighting every day to ensure that they have access to the market space. I believe there’s an intersection of shared interest between what they’re experiencing and what we as a nation are looking at in our security considerations in the gray zone. We need attention on this to reduce ambiguity and to be able to focus and plan against these threats.
The Cipher Brief: What can we do about it? It’s commonly believed that the U.S. is not currently structured to be effective at fighting in gray zone areas.
Branch: I believe that because of all our shared interests and shared security challenges, the only way to compete and to push back on some of these pressures is through networks of like-minded folks. We need to utilize the power to convene in order to drive a common orientation and understanding so that people and organizations and governments can start to drive actions to compete and contest these pressures. That doesn’t mean that everyone has to agree on everything. That doesn’t mean that everything has to be coordinated or aligned, but we do need to be operating in a common orientation, because there are shared interests. We haven’t discussed what those common interests are and how we will align actions to secure our respective interests.
Pitts: We often think this is an attack on the U.S. government, and of course gray zone attacks are. But a few years ago, the statistic was that 85% of critical infrastructure inside the United States belonged to the private sector or was managed by the private sector. If you look at global logistics, you look at global shipping, you look at the airline industry, you look at global banking, you look at global energy, you look at all the things we rely on as a nation for global security and global influence — it’s in the hands of the private sector. Quite often when we are talking about attacks in the gray zone, the private sector feels them the most, they experienced them the earliest and sometimes more critically. I think the government and private sector shared interest is inseparable. Quite often, the private sector will see potential gray zone attacks before we will because of how they’re postured. I think there’s an element of transparency there that we should be working toward to a much greater extent.
Sanner: We have cyber collaboration with the private sector that’s quite deep and very mature. But that’s not really the case everywhere. You have small businesses affected by these things as well. I think that there needs to be a strategic and regular conversation for example, between the National Security Council and the U.S. Chamber of Commerce to find a vector to a much greater swath of the private sector, than just kind of the same old actors that come in and talk about cyber. Because it is just so much more than that.
And we have examples. NATO’s new Baltic Security Initiative has a component of engaging with the private sector in terms of threats to undersea cables and shipping and addressing Russia’s shadow fleet. There’s a private sector part of that that’s built in. How do we expand that? NATO’s great, because we have our key Pacific partners who are partner nations with offices in Brussels and we need to actually start doing something, because I think Americans believe, including administrations, that this is really an ‘over there problem’ as in, “Oh, we have problems with our critical infrastructure.” And then we have the lightning rod of disinformation they don’t want to talk about. So, we need to get above all of that and just say, “Forget about the details of which vectors we’re doing here. We have to go after these nation state whole-of-government things in a whole-of-government plus whole-of-society way ourselves.”
Dr. Vickers: Policymakers really have an important role here. Particularly, not to stretch the pun too far, to illuminate what’s gray a little bit. Why is it a series of orchestrated actions with strategic intent? Why aren’t they just one-offs? That’s the role and there just hasn’t been much of that lately.
Branch: We ought to use and leverage the power to convene and to drive these conversations — they’re not going to naturally happen. They have to be engineered, and they have to be driven and inspired. And sessions like this one and others that we’ll participate in ought to drive that conversation, because it’s not going to happen on its own.
