无忧传媒

If you're a security professional fighting disinformation, the DISARM Framework can help you understand dozens of relevant tactics, techniques, and procedures (TTP)鈥攂oth threats and countermeasures. But how do you quantify and measure the various cognitive effects these actions have on people? Without quantification and measurement, it could be hard to assess which countermeasures might work best against specific threats. For now, achieving quantification and measurement remains an emerging challenge for the cognitive security community, but here are five practical principles for security teams to keep in mind:听

Avoid tripping over terminology. What is the cognitive domain? What is cognitive security? Buzzwords like "cognitive maneuver" and "stochastic terrorism鈥� don鈥檛 supply a straight answer. Here are a few key points for reference:听

• The People鈥檚 Republic of China (PRC) describes the cognitive space as the psychological realm consisting of 鈥渒nowledge, beliefs, and capabilities,鈥� and it regards the information environment as an interconnected space 鈥渂etween the cognitive and physical spaces," as our colleague Nate Beach-Westmoreland has written.听
• The Applied Research Laboratory for Intelligence and Security (ARLIS), established under sponsorship from the under secretary of defense for intelligence and security, defines cognitive security as 鈥渢he field of online and offline influence鈥攁nd protection from influence鈥攐f individuals and large populations,鈥� according to the Government Accountability Office (GAO).听听
• RAND鈥檚 Rand Waltzman has said cognitive security 鈥渇ocuses on the exploitation of cognitive biases in large public groups鈥� where 鈥渟ocial influence is an end unto itself鈥� with an emphasis on 鈥渇ormality and quantitative measurement.鈥澨�

Although the cognitive domain has been described as a 鈥渕issing domain鈥� that goes 鈥� the land, maritime, air, cybernetic, and spatial domains,鈥� the points above begin to demystify it. So, what does the cognitive domain鈥檚 landscape look like? And how do ideas鈥攁nd their physical manifestations (such as emanations)鈥攎ove across it? The next few principles can help bring this vision into focus.听

Apply two rules of thumb regarding the truth. First, the truth alone is rarely enough to influence people: Simply stating the fact of the matter is often insufficient to counter disinformation. How the message is delivered, for instance, really matters. What鈥檚 more, debunking is not always the countermeasure of choice. Second, the truth is not just a cognitive concept like knowledge and belief. Rather, it exists independent of the mind as objective reality. Sometimes the truth aligns with the goals of a cognitive security mission鈥攁nd sometimes not. Often, people find the truth to be inconvenient and hard to accept.听

When the truth hurts, debunking strategies might help. A recent study examined why attempts to correct misinformation about science succeed or fail. In their article, 鈥淎 meta-analysis of correction effects in science-relevant misinformation,鈥� the researchers noted debunking often fails, but they also highlighted opportunities for success in certain circumstances. For instance, the study found people are more receptive to corrections that turn bad news into good news as opposed to the reverse. Also, the study found detailed corrections increase the chance of success by providing a new model for understanding. What鈥檚 more, when topics are already politically polarized, the study found it鈥檚 helpful to write corrections in language that fit with the audience鈥檚 political beliefs.听听

Leverage existing metrics. Existing psychometrics for measuring what people believe and how much they care about a given issue could help security professionals choose effective countermeasures when dealing with specific disinformation threats. We suggest focusing on the quantitative measures of the strengths of beliefs and cares (SoBaC) held by individuals or groups in reaction to certain propositions (statements that are either true or false, but not both). These measures could be visualized on an X-Y axis.听

Explore the concept of visualization:听Visualizing cases would show not only the current state of SoBaC but also where they would move in response to successful efforts to counter disinformation. It's a way to envision the cognitive landscape and to map the concept of cognitive resiliency. In addition, if you find sports analogies helpful, think of how golfers assess the lay of the land on the golf course and choose their clubs based on where they want to move the ball. Security professionals countering disinformation might similarly pick from an array of tools ranging from cognitive to kinetic options when aiming to move the SoBaC to a desired state. Although the examples above involve an X-Y axis, it鈥檚 also possible to add a Z axis to create a three-dimensional version. The third might show, for instance, how hard it is to move someone from a certain position on the chart.

Now it鈥檚 time to put these practical principles into action. Adversaries are already exploring cognitive modeling with a focus on achieving mission objectives as opposed to simply promoting the truth about specific topics. We hope this introduction to quantification, measurement, and visualization will help spark further creative thinking in the cognitive security community. We also hope it will inspire more effort and funding focused on achieving mission objectives as opposed to simply stating facts. Finally, we hope this introduction helps to bridge knowledge gaps between cybersecurity professionals and experts in human and informational systems.听听