U.S. election official: ‘Whack-a-mole’ strategies less effective to combat disinfo

Disinformation continues to be a top focus for policymakers concerned with the integrity of elections, but changes in how the public utilizes social media over the past decade have made it harder for defenders — and attackers — to repeat the same playbooks, a top U.S. cybersecurity official said Tuesday.

Speaking at a Semafor cybersecurity event in Washington D.C Cait Conley, a senior adviser at the Cybersecurity and Infrastructure Security Agency, said that foreign influence operations, disinformation and artificial intelligence remain an area of concern for election officials. But traditional efforts around content moderation and takedowns of online networks are becoming more challenging and less impactful as social media use becomes more fragmented among different audiences.

“The whack-a-mole strategies that have been employed in the past when it comes to disinformation, it’s not going to be effective given today’s information environment,” Conley said. “There’s more platforms, there’s more methods of distribution, we see migrations not just of social media platforms but of chat channels.”

The comments align with what disinformation experts have told CyberScoop over the past year, namely that social media use is far more fragmented today than in past election cycles. Major platforms like Facebook and Twitter once enjoyed dominant market shares across most major demographic groups, but their usage rates have plateaued over the past decade while other services like Telegram, TikTok and Instagram have steadily risen.

In April, Clint Watts, general manager of Microsoft’s threat analysis center, said that tracking foreign influence operations online has become more difficult in recent years because some of the biggests social media sites are “no longer the place where everybody meets” but rather “where certain tribes meet.”

 “The traditional approach of shooting for the mainstream — Twitter, Facebook, YouTube — doesn’t work anymore because generationally the voters in the audience are across eight or nine different platforms,” Watts said.

The federal government has also become far less active when it comes to coordinating with social media companies. Agencies like CISA and the FBI have largely halted the kind of regular communication and coordination around disinformation that characterized previous election cycles, in part due to court challenges from groups who claim the interactions represent a violation of the First Amendment.

The Biden administration is awaiting a ruling in a case currently before the Supreme Court, Murthy vs. Missouri, that addresses the government’s authority to communicate with social media platforms around disinformation.

Conley also weighed in on recent comments from Elon Musk claiming that electronic voting machines are too insecure to run elections and that the risk of “being hacked by humans or AI, while small, is still too high.”

Conley said since 2016 the U.S. election community has done “tremendous work” to ensure the security and integrity of voting systems “because we know the threat is out there.”

“When you look at things like the electronic systems that are used — especially when it comes to the vote casting and tabulating side — there are tremendous, tremendous efforts put into place to ensure their security through air-gapping, through penetration testing, through additional physical controls and significant access controls,” Conley said.

Musk’s comments are out of step with how most cybersecurity experts have characterized the threat facing voting machines. While nearly all electronic voting machines are vulnerable to hacking, most attack vectors require an attacker to have physical access to one or more machines.

Since 2016, CISA has sought to reduce these kinds of vulnerabilities, working with states to deploy sensors that can detect malicious network traffic around election and voting systems, hardening protections around physical access to election infrastructure and mandating the use of backup paper ballots that allow for audits and recounts without the use of any technology.