Download the Full Report
Acknowledgments
We would like to express our gratitude to our advisors, Professor Stephen M. Walt and Professor Dara Kay Cohen, for their guidance and feedback on this project. We would also like to thank Eric Rosenbach, who provided valuable help throughout this project, and the Belfer Center for Science and International and Affairs for the recognition of our work with the Robert Belfer Annual Award for Best Policy Analysis Exercise, and for funding our field research in Tallinn, Estonia; Riga, Latvia; and Vilnius, Lithuania in January 2019. We would like to express our appreciation for the Belfer Center’s Defending Digital Democracy Project (D3P), whose prior work developing strategies, tools, and recommendations to protect democratic processes proved invaluable.
We would also like to thank our clients, the embassies of Estonia, Latvia, and Lithuania in Washington D.C., for their work with us on this project. Specifically, we would like to thank Kadri Peeters, Rolands Henins, and Vaidotas Urbelis – from the embassies of Estonia, Latvia, and Lithuania in Washington, D.C. respectively – for their invaluable guidance and support. We would also like to thank Kersti Luha, Anda Zule, and Zivile Vaicekauskaite for their support on the ground in Tallinn, Riga, and Vilnius.
Executive Summary
Recent years have seen a cascade of revelations regarding Russian attempts to interfere with or disrupt elections in the West. While the Russian government’s influence campaign in the 2016 US presidential election is the most well-known, it was by no means an isolated incident. Western governments are waking up the threat that Russian cyber and information operations pose to the integrity of their elections and the stability of their domestic politics. However, the question of how to counter these efforts remains unanswered.
The goal of this report is to offer an answer to two questions:
- How do we understand the Russian threat to election integrity?
- What can governments do to counter such efforts or mitigate their impact?
Our specific focus is on Russian election interference efforts in Estonia, Latvia, and Lithuania, which have a long history dealing with and responding to Russian political interference. By studying the mechanisms through which Russia seeks to undermine domestic political processes in the Baltic states, we can better understand the threat that Russia poses. And by analyzing the policies that the Baltic governments have implemented over the last three decades, we can better assess the effectiveness of countermeasures and determine how Estonia, Latvia, Lithuania, and their Western allies should counter election interference in the future.
The current Western discourse emphasizes two vectors of malign Russian interference in elections. The first is the cyber vector, through which Russia uses cyber capabilities to compromise sensitive election systems (and other government networks) with the goal of affecting the election outcome. The second is the information vector, through which Russia injects disinformation, propaganda, and leaked or stolen documents into the domestic political discourse in order to inflame divisions within a society, undermine its politics and institutions, and affect the election outcome.
Russian strategy emphasizes the information vector over the cyber vector. Russia primarily interferes in the democratic processes of the Baltic states using information means, with cyber playing a secondary, enabling role. The Kremlin considers disinformation and information operations to be the most effective means of affecting political outcomes in other countries. Russia seizes on existing domestic political, social, or ethnic divisions and instrumentalizes them to change how voters think – and through that how they vote.
We have termed this strategy “cognitive warfare” – altering through information means how a target population thinks, and through that, how they act. Russia has employed a cognitive warfare strategy in the Baltic states for years. Russian has pushed, through traditional and social media, narratives designed to divide ethnic Russians and Russian-speakers from the rest of the society, undermine domestic political stability, and break the Baltic commitment to the EU and NATO. Russia’s cognitive warfare efforts have not always met with success or improved the electoral results of pro-Russian political forces; however, the strategy has been consistent since the Baltic states regained their independence in the early 1990s.
At present, the threat that cognitive warfare operations pose to election integrity is greater than the threat posed by Russian cyber capabilities. We assess a low level of risk to the scenario in which Russia successfully, undetectably compromises election systems and alters an election outcome in the Baltic states. That is not to say the governments of the Baltic states do not – or should not – emphasize cybersecurity countermeasures. On the contrary, all three Baltic governments have rightly developed robust cybersecurity protections for their election systems and implemented monitoring or post-election auditing procedures to protect against foreign compromise.
In our view, the most significant cyber risk to election integrity derives from inadequate cybersecurity protections put into place by other politically-relevant actors, particularly political campaigns, political parties, and media. Russian hackers regularly target these organizations, stealing sensitive, private information that the Kremlin later integrates into interference and influence campaigns in the Baltic states. Rather than posing a direct threat to election systems, Russian cyber actors more often work to enable later information operations.
What should governments do? We assess that the approaches taken by the Estonian, Latvian, and Lithuanian governments to counteract and mitigate the impact of Russian interference efforts are sound and should continue. Responding to a cognitive warfare strategy is not merely a technical problem – it is a society-wide information challenge, requiring more than simply debunking fake news or removing fake accounts on Facebook or Twitter. We recommend that these governments build upon their efforts in several areas:
- Expand investments in election cybersecurity;
- Provide additional resources to working groups on election security and disinformation;
- Exercise and stress-test election-related contingency plans;
- Deepen sharing of intelligence, best practices, and lessons learned with allies;
- Invest in the monitoring of disinformation and explore regulatory approaches;
- Expand integration policies targeting Russian minority populations; and
- Craft and promote compelling, unifying national narratives.
We believe that adopting this set of recommendations will enhance the effectiveness of the Baltic governments in responding to Russian interference in the short-term and promote greater societal resilience to cognitive warfare campaigns over the long-term.
Other Western governments can learn from the experience of the Baltic states as well. If the experiences of Estonia, Latvia, and Lithuania are a guide – and we believe that they are – it is Russia’s cognitive warfare strategy and information operations, not cyber threats, that pose the greater threat to election integrity on both sides of the Atlantic. The Kremlin’s goal is to undermine Western elections by interfering with the minds of voters, not our digital voting systems. Simply improving the security of those systems will not be sufficient to meet this threat. Russia weaponizes our domestic political, social, and cultural divisions, turning them against us and using them to undermine the integrity of our electoral processes.
Western governments should also be clear-eyed in recognizing that mitigating the impact of Russian political interference campaigns is a long-term problem. This is the work of decades, not years. Russian interference is not a problem that can be easily solved; instead, Western governments will have to manage it for years to come. Just as cognitive warfare relies on our domestic vulnerabilities to function, so too will the Russian threat to election integrity not be fully mitigated as long as those vulnerabilities persist.
