War on the Rocks has a generally excellent post about the unexpected ways in which the Russian cyberthreat has been manifesting.  There is no reason that other cyber actors, such as Iran and China, cannot attempt similar actions.

This isn’t the sort of “cyberwar” we were promised. When scholars and pundits talk about this set of threats, they are thinking of things like Stuxnet: sophisticated programs meant to destroy or disrupt infrastructure. From former White House officials to journalists, even to academics trying to debunk the worst of the fear mongering, the overwhelming focus is on tangible targets: the power grid, banking institutions, military installations, even voting machines. The idea of targeting one party and selectively leaking embarrassing emails just wasn’t on anyone’s radar. In hindsight, maybe it should have been….

This has exposed a frightening vulnerability in our society. The worst gossip-chasing tendencies in the media and the lackadaisical security of many legacy email systems have created a perfect storm…. While both NATO and the European have opened their own offices to counter Russian disinformation, U.S. law tightly restricts how the government can disseminate information domestically. The revelation that the government of Russia is trying to influence a U.S. election by attacking candidates and disrupting media coverage should be a big deal, but it hasn’t yet sparked much urgency in the general public. This is not mere red baiting; a hostile government attempting to manipulate a presidential election is a crisis-level event.

The right way to think about this is in terms of threats and opportunities.  If the Rocks piece has a weakness, it is its focus only on the threats.  There are opportunities to address some structural failures currently bedeviling the American system of government as well.  One of them is that America’s system of declassification doesn’t adequately address exposure of this sort.  Legally, even after the exposure of perfectly credible leaks of classified information, the only thing most officers of the government can say is, “I can neither confirm or deny the existence of those documents.”

Arcane rules forbidding viewing leaked information make it impossible for professionals to even follow the story of the leak in the press for fear of being exposed to the information.  Following the leak by the traitor Bradley Manning, for example, military officers were told not to read news stories that might contain excerpts from the classified documents — even if they had the requisite clearance and need to know to view those documents on a secure system at the same time.  Reforming these practices is a good idea anyway, and this business gives us an opportunity to make it a priority.

A second opportunity arises from the ability of these leaks to help us address the collapsing rule of law in the United States.  Though the piece suggests that these leaks normally do not reveal “corruption,” in fact they often do reveal corruption within major American institutions.  The resignation of Debbie Wasserman Schultz from the Democratic National Convention — a private party, but also an important American institution — arose from leaks of this sort.  The “Panama Papers” leaks have spawned a whole league of investigative journalists looking into what they reveal about government corruption.  At a time when the FBI and the Justice Department appear aligned to prevent prosecution of the powerful, the possibility of having those bad practices exposed is an opportunity as well as a threat.

As distasteful as it is to consider, the opportunity may be greater than the threat on this point.  Russia’s information operations outlets remain powerful only as long as they remain credible:  if they become a joke known for releasing false information, people will stop listening to what they say.  They thus have a vested interest in releasing only genuinely damaging information.  While of course journalists should investigate each leak thoroughly to make sure they are not passing on propaganda, and should avoid exposing secrets of those who are not corrupt merely for the pleasure of gossip, the fact is that many of our ordinary systems of law enforcement have broken down where entrenched powers are concerned.  It may be that we can turn this Russian tactic to our advantage in cleaning up our own political system.

That said, the threats also need to be considered.  One of them that is unaddressed is this:  insofar as our cyber-threat agencies turn toward the problem of preventing political embarrassment, they will not be spending that time and money on far more dangerous cyber threats.  The threat against the grid remains the main chance for a weaker power like Iran to literally destroy America.  Iranian efforts against our infrastructure have been focused on causing physical damage to power capacity.  The Russians, too, have already demonstrated a capacity to take down a large-scale electric grid using cyber efforts.

While it is wise to consider best practices in cyber security — such as not using a home-brew private server that is less secure even than Gmail to pass TOP SECRET information — we must not lose track of the greater threat.  Yet we are likely to do so here.  The danger to American lives posed by a destruction of the grid is extreme, but it threatens mostly the powerless.  The danger of political embarrassment points right at the governing class.  It is easy to guess which one of these issues they will focus their agencies’ attention on combating.

That ability to alter the focus of our cyber-security agencies through the threat of embarrassment to our politicians and bureaucrats may prove to be the biggest threat of all.  It is the one that could cause us to take our eye off the ball.