Characterizing a NATO Cyber Victimology: A Futurist Anticipated Shame Cyber Attacker Model

A summer Google Mandiant report on North Atlantic Treaty Organization (NATO) cyber threats emphasized that nation states and cybercriminal gangs are becoming better and bolder, highlighting the increased instrumental use of social engineering techniques and common tools to victimize NATO personnel and target NATO network infrastructure.

 

Cyber Victimology

Some of those cyber threats include attempts at infrastructure disruption or destruction if gaining unauthorized access to NATO personnel accounts and NATO infrastructure.

This article looks closer at who might be targeted in NATO communities and why, suggesting there may be a unique NATO cyber victimology.

This may be one of the first attempts at characterizing a cyber victimology distinct to former and current NATO military and civilian personnel, considering how NATO military cultures could drive someone’s vulnerability to social engineering compliance approaches and threats.

The threat of social engineering online to NATO personnel has been featured previously, notably following a past NATO military exercise where a NATO ‘red team’ socially engineered NATO personnel, online using open-source information and social media platforms to influence some targeted NATO personnel to make different decisions during the military exercise.

That exercise was likely influenced by more historical case examples in the United States, where several dozen inmates in South Carolina prisons ran sextortion schemes, often using only contraband cellphones to victimize people they convinced to send nude photos of themselves.  The inmates would then masquerade as the fathers of the ‘underage’ girls demanding payment or they threatened to report them to law enforcement and military authorities for soliciting a minor.

Many of these inmates were in jail related to prior armed burglary and assault convictions.  These inmates were not skilled cyber attackers.

Hundreds of American military personnel were victimized for hundreds of thousands of dollars.  Several military personnel took their own lives because of these sextortion attempts; however, the long-term mental health and behavioral health costs were likely to far exceed the value of the money obtained by the criminals.

This article not only attempts to shape a working characterization of a unique NATO cyber victimology, but to characterize some of the cascading mental health and behavioral health effects military personnel have experienced and could experience when faced with the threatened consequences of this kind of anticipated shame attack.

This futurist attack in a cyber threat context is arguably not limited to nation state attackers or cybercriminal enterprises, as this approach has already been demonstrated by basic online users.

How sextortion isolates victims

Sextortion can take many forms, but generally involves the use of compromising personal nude images to coerce victims to share more images or send money, for example.

Education and social justice researcher Cassandra Cross noted that in many cases of sextortion, the offender may not possess any images of the victim, but the victim believes they do. Offenders use shame to intimidate their victims and discourage them from reporting this crime.  This is also a way to isolate a victim.

The forms of psychological distress for victims of sextortion are dynamic.  The fear of what a sextortion offender might do and how they could hurt a victim includes the emotional and financial and reputational damage that could follow some disclosure of real or suggested nudes.  This fear sometimes influences victims to attempt to take their own lives or take their own lives.  Longer-term effects could include more chronic demonstrations of anxiety, depression, maladaptive behavior (such as substance abuse), and post-traumatic stress. Another, less discussed long-term effective is narrative rupture in the form of moral and existential wounding.

Cyber Attacker Model

 

The bidirectional relationship between the internet and loneliness often primes the victim to become vulnerable to manipulation and sextortion.  Andrew P. Smith and Hasah Alheneidi define loneliness as a state of being that arises when our need for social contact and relationships is not met. While loneliness can be population- and individually-specific, it is understood that the military community—particularly new soldiers or transitioning soldiers without adequate support systems—is at significant risk of experiencing substantial loneliness.

The devastation of the experience of being sextorted may also be heightened for segments of the public, such as younger males in the military who may be the least likely to report sextortion. This can be particularly challenging because increased stressors and biological changes can lead a young person to have their first experience with declining mental and behavioral health.

Younger males are increasingly considered to be the most common sextortion victim, but older males including older males serving in the military or recently separated from the military can be just as vulnerable considering their established social and cultural relationships from the military.  The risk can be magnified for this range of males in the military and recently separated from the military, because their behaviors and habits in those military environments and cultures can often become maladaptive behaviors and habits outside of the military, including resistance to behavioral health treatment and increased risk-taking behaviors.

A working characterization of NATO military cyber victimology

Several of the American military victims of the South Carolina inmate sextortion campaigns had one or more deployments overseas in combat.  Clinical psychologist B. Christopher Freuh found that that military personnel involved in special operations tend to carry significant allostatic or chronic stress “loads” and experience higher rates of physical and psychological injury, but arguably, any military personnel who deployed to and experience a combat zone would likely have a higher stress and trauma range than someone who did not.

George Slavich has shown that allostatic load should be understood as a major factor in overall human wellbeing.  This extended stress in complex and/or irregular environments has been called “operator syndrome” because these military personnel understandably struggle to regulate life at home and life in high-risk combat environments, while also experiencing significant shifts in sleep patterns, cognitions, physical activity, and nutrition. Examples might include adapting your body to stay awake for 48 hours because of the need to be aware in a combat zone every few days, but then trying to sleep normally back at home.

The mental and behavioral health of active duty or former military personnel are vulnerable, when considering this range of factors combined with other stress and trauma disorders.  Another study by Christopher Freuh, and colleagues, found that military personnel who had been actively deployed demonstrated a significant increase in the prevalence of post-traumatic stress disorder – particularly two times greater than the general American population.

Criminal justice researcher Fangzhou Wang emphasized that despite the similar phenomena of online sexual content-related scams, sextortion is distinct in that victims are “perpetually uncertain” about when and where their personal images or content might be distributed online.  Offenders create an extended model of stress and coping, which is likely to result in the degradation of overall wellbeing.

We described a degradation of cognitive processes and the development of maladaptive behaviors for affect and information processing, which means the military communities we characterized may not be functioning cognitively as healthy as perhaps they could be – ultimately, this can make them more vulnerable to cognitive warfare and social engineering and potentially even more susceptible e to being driven into maladaptive thinking and behaviors; including increased risk-taking and self-harm.

Psychologist Albert Bandura’s moral disengagement theory provides a framework for understanding the struggle for NATO military personnel, especially when victimized by sextortion. Moral disengagement, when combined with loneliness, could explain why military personnel distance themselves from the ethical standards of behavior expected of their role. In Bandura’s framework, military personnel may rationalize or blame themselves for being victims, which could make feelings of guilt and self-criticism much worse. This process can lead to excusing the behaviors of the perpetrators, which then minimizes the need to report or stop the sextortion.

NATO military cyber victimology

Some compounding factors, such as moral injury, spiritual injury, loneliness, and post-traumatic stress, could intensify those feelings.  In the experience of one of the co-authors who has worked extensively with American military personnel providing mental health therapy and support, the attitude generally of American military males in a state of negative affect or other avoidant emotions has been to avoid seeking help due to fear of social stigma and judgment from others, which is often connected to a belief that talking about mental health and behavioral health will directly and negatively impact their potential for promotion and their overall military career.

We suggest in this article that sextortion could profoundly intensify this complex victimization of NATO military personnel in a cyber threat context and ultimately serve as a low-cost high-impact method for destabilizing force readiness and effectiveness.

NATO military personnel may be more vulnerable than the general population in almost any context, even just in terms of their cognitive health.

Exploring the spectrum of negative affect as “mechanisms of persuasion”

Fear and how fear can be framed as a fear appeal is one example of the kind of negative affect that can be used as a “mechanism of persuasion” to motivate how military victims respond.

Communication researcher Melanie Tannenbaum found that effective fear appeals generally included “high amounts of fear” and guidance on how to avoid whatever is causing that fear.  Fear appeals that stressed the severity of consequence were the most effective, but there had to be communication on what that person could do or should do in response.  This framing reflects the approach used by South Carolina prisoners, who threatened military victims with consequences if they reported the underage solicitation but offered them a way to pay money to avoid those consequences.

Guilt is another example of a motivating emotion that someone can use to influence behavior.  There is an interpersonal character to guilt because the feeling of guilt is generally associated with hurting or anticipating hurting someone we are in a relationship with.

Communication researcher Daniel O’Keefe included in his review and characterization of guilt as a mechanism of persuasion the influence of anticipated guilt in shaping behavioral intentions and decisions.  While O’Keefe noted that there are limitations to anticipating what kind of framing of anticipated guilt will influence someone’s behavioral intentions or decisions, he suggested that anticipated guilt could still have the same kind of influence on someone as actual guilt feelings.  O’Keefe did emphasize that anticipated guilt and actual guilt are also distinguishable, considering that someone can anticipate feelings of guilt but still not yet experience guilt.

Thinking about risky behavior and potential consequences can heighten that anticipated feeling.  Overthinking can amplify threats and increase generalized distress when experiencing guilt.

Vulnerable to a futurist anticipated shame cyber attack model?

Health psychologists Charles Abraham and Pascal Sheeran define anticipated regret as someone feeling the anticipated feeling as a result of a choice where they will find out that result.  Behavioral intention is one of the most immediate and significant suggestions of anticipated behavior.  Anticipated regret generally appears to heighten the consistency between someone’s behavioral intention and their actual behavior.

They added that anticipated regret could even prioritize or sustain someone’s behavioral intention over time.

Abraham and Sheeran suggested that anticipated affective reactions are more important for behaviors with negative rather than positive consequences.  Anticipated regret could encourage people to take risks they would not ordinarily take.

Marketing and consumer researchers Kirsten Passyn and Mita Sujan explored what could be characterized as comorbid emotional patterns, such as fear plus guilt or fear plus regret.  Participants in a sunscreen use study they referenced were more likely to engage in applying sunscreen if secondary emotions were added to fear appeals, such as anticipated regret.  Anticipated regret in this example would be a cautionary tale or what someone might feel if they were diagnosed with skin cancer because they did not use sunscreen regularly.  Anticipating that feeling, they would likely use sunscreen, because they do not want to experience those anticipated feelings and result.  This is how anticipated regret can influence behavioral intention.

Military Cyber Victimology

This kind of decision-making in the context of anticipated regret can reveal new information on how someone weighs gains and losses in their situation.  Acute or chronic stress could also heighten the experience of and anticipation of regret.

Psychologist John Wilson reviewed the concepts of shame and guilt in the context of people who have experienced psychological trauma and the development of post-traumatic stress disorders, finding that for many people post-traumatic experiences of shame and guilt are compounded by affective processes related to depression or substance use, for example.

Wilson in the same review referred to various researchers who characterized core states of shame as almost a “preoccupation and near obsessive concern” when there is real or imagined judgment of the shame.  Experiences of extreme humiliation can lead to a sense of “soul-death” or a sense of self as “empty” or lost.  The dimensions of post-traumatic shame potentially include suicidality in fantasy or in action, which may provide some perspective on the American military personnel who took their own lives.

Wilson emphasized that shame is complex because there are multiple compositions of possible “cognitive emotional structures” resembling emotions like jealousy or envy or hatred.  These compositions should be considered within contexts of culturally defined roles and values.  Wilson explored some of the conceptual comparisons of shame and guilt, generally determining that the distinct difference may be in people feeling less impact to their sense of self when feeling guilty compared to when people feel shame which may reflect their worth.

The cognitive health factors and models of negative affect discussed in this article seem to consistently reveal the vulnerabilities likely faced by NATO military communities.

Rather than the implications of this characterization becoming confounding, we are proposing this working characterization of NATO military cyber victimology to provide greater understanding of the contexts of these models of affect and life events in these communities.

We are frankly surprised we have not seen this kind of futurist anticipated shame attack on military communities more than we have.

There is a significant risk with advancements in technology that more and more individuals will engage in relationships with fake or synthetic persons, which will be made exponentially harder with the democratization of deepfake technology and generative tools.

It is also of significant concern that increased rates of loneliness are resulting in increased vulnerability and enhanced online disinhibition. These states can be used to induce self-harm through cognitive attacks directly, or indirectly through chatbots and other ai enhanced companions.

The growing default in cybercrime markets especially to lower-skilled roles is troubling.  Cybercriminals are not getting better, there are just more of them with more to do to keep pace with growing demand for facilitating attacks.

We are starting to research both proposed military cyber victimologies, exploring in greater detail the degree of mental health vulnerability in these distinct military cultures.

Tim Pappa is a cyber deception theorist and practitioner with Walmart Global Tech’s Cyber Deception Operations team. Tim was previously a Supervisory Special Agent and certified profiler with the Federal Bureau of Investigation’s (FBI) Behavioral Analysis Unit (BAU), one of the only FBI profilers in the world specializing in online influence and cyber deception. Tim is also a Senior Behavioral Consultant for Analyst and a Strategy and Statecraft Fellow with the Center for Strategic and International Studies (CSIS). Tim is also an Adjunct with Capitol Technology University, instructing on comparative global cyber norms and influence. Tim has published in the Journal of Information Warfare and American Intelligence Journal, and presented selected papers at various international cyber deception and cyber warfare conferences.

Mike Ross

Subscribe

To be updated with all the latest news, offers and special announcements.

Popular Topics

Related Articles