Hugo Zunzarren: “In hybrid warfare, the battlefield is people’s minds”

Attacking companies that are critical to a country undermines confidence in politics and the economy and creates more insecurity. This is all part of a hybrid war environment, not just against companies or against states, but as part of a whole.

Hugo Zunzarren is the director of economic intelligence operations for several companies, specialising in project management and cyber counter-interference operations. Zunzarren worked for fifteen years in naval intelligence for the French Navy and the Directorate of Military Intelligence. He is the author of several books, including ‘Ciberinteligencia en la geopolítica y geoeconomía actual. Principales amenazas para la Unión Europea’ (Cyberintelligence in today’s geopolitics and geoeconomics. Main threats to the European Union), published this year.

Álvaro Peñas: Cybersecurity has gone from being the domain of states to being increasingly present in many sectors.

Hugo Zunzarren: Yes, cybersecurity has evolved a lot and should be seen as an aspect of security as a whole. In other words, an intrusion into a company’s systems may be accompanied by an attack on its reputation to create discontent or to exploit other factors; this is known as a hybrid asymmetric attack. It seems that these attacks have only just been discovered, but all the attacks I have seen since I have been in the intelligence business, and that is 27 years now, have been asymmetric hybrids. It’s silly to think that it’s not all linked and interconnected, and the perpetrators are getting better and better at it. Criminal gangs may have little economic power, but they make up for it with flexibility and knowledge, and they look for any loophole they can get into. That is why cybersecurity cannot be a watertight box, where one hand does not know what the other is doing.

Another increasingly used term is ‘hybrid warfare’. How do attacks on companies fit into a hybrid war?

An attack on a company is not an end in itself, but part of an overall hybrid attack on states. Attacking companies that are critical to a country undermines confidence in politics and the economy and creates more insecurity. There is a direct correlation between discontent and a sense of insecurity and an increase in crime. The fact that businesses are known to be targeted also undermines the welfare state, the reputation of law enforcement, the prospects for progress, and so on. This is all part of a hybrid war environment, not just against companies or against states, but as part of a whole.

It is also a cognitive war in which attacks are conducted to influence public opinion through simple messages that are sown in such a way that they are adapted and accepted without much analysis by those who read and share them. From there, their perceptions are changed, and when their perceptions change, their attitudes change. This manipulation, which is becoming more and more common, can be seen in the media and on social networks; it is an underground war of one culture against another, of one will against another, in which the battlefield is not economic or military, but in people’s minds.

Is there an effective defence against this kind of confrontation, for example against bot farms spreading disinformation?   

We have verification, fact-checking, but this tool only serves to determine whether a piece of information is true or false, it does not determine the will behind it, the reasons why it was done and how it was done. Discovering the ‘how’ is the best way to find the origin, because we can discover signatures and procedures, protocols of cognitive warfare and large-scale manipulation that can tell us who is behind it. If we come across a deep fake promoted by a bot farm, we can deny its narrative, but we don’t know what impact it’s had or what else it’s part of. It is never a one-off, but a concerted effort that is part of something much bigger.

The idea is always the important thing in manipulation, because bots are only a means to spread it and sometimes a means so obvious that it is sometimes used as a bait. What is dangerous is targeted information based on profiling, on a large scale, with Artificial Intelligence to profile and predict behaviour of large social groups or influencers, and with targeted analysis of impact statistics.

Bots can be easy to detect, but what about Artificial Intelligence, how can we discover manipulations made with AI?

We have a bit of a problem here, and that is that it is a competition where the bad guys have two skates and we only have one. In the legal field there are eight laws for the use of AI, but those who misuse this technology do not respect these and other laws. What is the best way to counteract AI? Human intelligence is superior and with the right training, teams can be formed that are trained to detect attempts at manipulation by AI.

Another hotly debated issue is the use of electronic voting and the possibility of electoral fraud. Several countries that have opted for e-voting have decided to back out, is this the right decision?

E-voting should not be insecure if it is carried out by competent people and if the population is aware of how to use e-voting or any other use of their personal data, for example not connecting to free and unsecured wifi. The problem is that whenever there is e-voting, the possibility of fraud can be suggested and the result of the election can be questioned. Technically, it is not more insecure, and I believe that the necessary technology is available, such as blockchain, to avoid manipulation, but it is true that it can be misused, opening the door to complaints of fraud and tarnishing the whole process.

Is Spain well prepared in terms of cyber security?

In terms of protection, Spain is one of the leading countries in cybersecurity because it has great professionals and a good approach. I am half French, but when I had to bring a cybersecurity philosophy to African countries, the Spanish philosophy was much more successful than the French one. In terms of attacks, we are ahead of many countries, but our defensive capacity is very high.     

As for Africa, you know it very well. How has Russia been able to expand its influence in so many French-speaking African countries?

France is a serious country in terms of what it needs. At the moment it is a leading country in nuclear energy, and its nuclear resources have been under control for a long time. Of course, France does not want to lose influence, but the main critical and strategic aspects are covered. There were sections of the French government that were unhappy about sending so much aid to African countries without getting anything in return, and frankly I wouldn’t be surprised if Wagner’s appearance in Africa helped them to let go.

Politically, isn’t this a mistake in the medium to long term?

Politically it may be, but in terms of resources France has covered its back. Russia, for its part, is seeking what the French once sought: resources and influence. To this end, it offers Wagner to local governments, which gain stability from Wagner’s ruthless methods against their enemies, such as jihadists. An example of this influence is that in Africa there is enormous disinterest in the war in Ukraine, and indeed most people there do not even associate Wagner with the war.