Despite recent efforts by the American Medical Association (AMA), the surgeon general, and the Department of Health and Human Services (HHS), health disinformation remains common and highly effective at undermining public health efforts and capabilities. The latest tools in the arsenal of disinformation and malinformation are Disinformation-as-a-Service (DaaS), or disinformation for hire, a new species of threat actors that provide a layer of ambiguation and deniability between those sponsoring disinformation and those executing it.
Just as cyber gangs have emerged as highly powerful, complex, and elusive criminal and threat actors on the internet, DaaS actors share similar attributes, such as being based in countries beyond legal reach of their targets, the ability to act for or mimic nation-state cyber actors, and the superior ability to fake authenticity. The ability to understand and mitigate medical cyber threats and medical misinformation have become increasingly challenging. While enhanced cyber regulation is promising, efforts to rein in disinformation in the United States have died on the vine.
An essential step in combatting all forms of disinformation is understanding the nature and motivation behind the responsible threat actors. The key difference among misinformation, disinformation, and malinformation is that, usually, those who spread misinformation truly believe the information they are disseminating, whereas those spreading disinformation and malinformation know it to be untrue but are spreading it anyway with the intention of malfeasance. This key difference is why strategies to counter misinformation by appropriately employing education, fail against organized disinformation and malinformation. (These strategies do retain some efficacy once disinformation is believed and begins spreading like misinformation.)
Understanding The Links Between Cybersecurity And Disinformation
Although medical misinformation has long existed, the rise of frank medical disinformation was accelerated during the COVID-19 pandemic. For example, despite early warnings about disinformation and misinformation early in the COVID-19 pandemic, the quick spread of vaccine disinformation has prevented uptake of COVID-19 vaccines.
Traditional cyber criminals and purveyors of disinformation have been shown to capitalize on public health emergencies. For example, the hack of the United States’ HHS in 2020 was linked to a National Security Council tweet on disinformation. These “hybrid” attacks are becoming more common and are often attributed to nation-state actors. Studies have detailed sophisticated social-cyber manipulation campaigns used to generate positive and negative consumer opinions following the rollout of COVID-19 vaccines. More recently, we have seen these types of hybrid attacks being used in the Russian invasion of Ukraine where almost every physical attack has been preceded by coordinated cyber and disinformation attacks. Health care must prepare itself for these new forms of advanced persistent threats. Indeed, Food and Drug Administration (FDA) Commissioner Rob Califf has gone on the record that misinformation is now the leading cause of death in the United States.
More locally, news deserts caused by closures of local television, radio, and newspapers offer prime opportunities for misinformation and disinformation, as evidenced by the effective radicalization of political opinions in the most rural parts of the United States. DaaS actors literally have a map upon which to base their campaigns.
The hazards posed to public health by this enhanced connection among bad actors, cybersecurity, and medical disinformation therefore require that we go beyond traditional models for combatting misinformation. Organizing experts’ focus is an essential first step. But it is insufficient; action against health disinformation must happen far more quickly than the medical community has responded to cybersecurity issues.
One of the greatest shifts in information technology over the past decade has been the emergence of “as-a-service” models. These models provide alternatives to traditional computing architectures by packaging sets of coordinated capabilities into services that can be rented via subscription-based models. For example, “Infrastructure-as-a-Service” packages gather all the capabilities required to host computing apps into a comprehensive contractable service; this approach is becoming the preferred alternative to traditional computing infrastructure. The savings in time, workforce, and physical capital are so compelling that Everything-as-a-Service has become the default strategy for modern computing from software vendors to many corporations.
DaaS can operate in a similar way: Bad actors no longer have to design a disinformation campaign, develop an access strategy for the intended target populations, build the technological capabilities for simultaneous launch, and monitor progress and response and other required capabilities. Instead, all of these elements are now available for hire. The Dark Web has long been home to those buying and selling stolen data. Now, it offers services very similar to traditional branding, marketing, and public relations capabilities but instead of building something up, the campaigns intend to tear them down. For bad actors, the strength of the dark web is the anonymity that not only encourages crime but also hides these crimes from the view of many law enforcement agencies. Furthermore, payments based upon cryptocurrency add an additional layer of complexity in tracking and evidence generation. All of this is immensely complex, and most governments are playing catch up from a long way behind.
When cybercrime and disinformation intersect, together they create a threat far greater in magnitude than either could pose alone.
Comprehensive Cybersecurity And Disinformation Strategies
In the face of these rapidly growing threats, health system leaders and policy makers must act.
First, policy makers, law enforcement, and health care should lean into existing cyber strategies to combat disinformation by using the five core cybersecurity functions (identify, protect, detect, respond, and recover) in coordination with the latest disinformation resilience tactics. Starting with “identify,” we must determine which information must be protected and build toward a single source of truth for that content.
For example, imagine if all HHS agencies and all pediatric medical societies created, curated, and operationalized a small number of highly trusted sources of content on pediatric vaccination that all pediatricians used exclusively. Messaging would be greatly improved via consistency and unity. “Detection” involves using sensors and timely sharing of threat intelligence information. For example, honey pots, sensors that mimic actual devices such as an IV pump sitting on a hospital network, have been used to measure and analyze malicious accounts and actors. A similar approach could be used for the pediatric vaccine website mentioned above.
The “response” function requires advance planning and training in incident response that ensures various stakeholders are already on the same page once an incident is detected. The “recover” function ensures normal operations and activity can resume as quickly and as safely as possible after an attack. Consider the example of a disinformation campaign employed against a Danish study assessing the protective utility of facemasks against COVID-19. Once the campaign was detected, the “response” could have included identification and mitigation of the bots that were spreading the disinformation; the “recover” campaign could take the form of strong counter messaging.
Second, one of the most effective cyber resilience strategies has been to use the toolsets and skillsets of the adversary. Ethical hackers have proven effective allies in cybersecurity, election security, medical device security, social engineering, and many other technology-based threats to society. It is important, and a bit scary, to remember that one of the largest cyber-attacks in history, the 2017 WannaCry cyberattack, was mostly avoided within the US thanks to the actions of a lone hacker literally working in his parents’ basement. Since then, health care has effectively partnered with ethical hackers via events such as a biohacking village at def con, the world’s largest hacker conference, where medical device companies work with hackers to test the security of their products. The FDA has stepped up as well and is coordinating the #WeheartHackers initiative.
Using these strategies will require coordination between parties that may not have worked together traditionally. For example, the AMA has recently detailed plans to combat the public health Infodemic, including its proposal that the organization become the single trusted source for “evidence-based information for physicians and patients.” But how would they counter sophisticated cyber and disinformation campaigns against their own sources? On the internet where we could very well see a battle between the AMA and a nation-state cyber and disinformation actor such as Killnet, the AMA would surely benefit from a partnership with ethical “white hat” hackers.
Resilience Is More Sociology Than Technology
Just as cyber and disinformation threats have come together to take on new hybrid threat models, mitigating such threats will require similarly hybridized skill sets. Exhibit 1 presents five aligned tactics that institutions can pursue to ensure readiness and resilience in the fight against disinformation and cybersecurity threats. It was created by the authors based upon current knowledge, best practices, and personal experiences.
Exhibit 1: Aligned and combined tactics to combat disinformation and cybersecurity threats
Source: Authors’ analysis.
Here’s how these tactics may be applied in health and health care, for example, by a public health agency, hospital, or research facility. It starts by elevating the chief information security officer, or organizational equivalent, to a position with unfiltered access to the organization’s top leadership; this approach should reduce the misdirection and miscommunication that too often separates executive decision making from key information security staff. Take the common model in which the most senior information security professional reports to the most senior technical professional who reports to the most senior financial professional. In these cases, complex technology risks are being filtered and passed through multiple layers that may not understand the threat data, risks, or impacts.
Second, cybersecurity training must be modernized. “Read and understand” training that advocates for strong passwords is outmoded and should be replaced by simulations such as “our hospital is under attack” (or our public health agency, online webpage, or social media identity is under attack).
Third, in many organizations, cyber security has been codified into compliance regimes. This is almost always a mistake. To be sure, HIPPA or CFR part 11 compliance are operational basics. And the Federal Information Security Management Act (FISMAcompliance has greatly improved cybersecurity resilience within the federal government. But cyber threats are evolving daily, and the tactics and strategies necessary to address those threats also change. Massive amounts of paper documentation may satisfy a FISMA audit, but it can also distract critical information security officer professionals from their core job of protecting their organizations.
For example, a National Institutes of Health-funded clinical study could require FISMA compliance, but many of the clinical sites are likely to be small, underserved clinics that do not have access to advanced cyber protections or staff. If that site is required to meet advanced cyber resiliency capabilities but cannot, the site may drop out of the trial, resulting in a lack of access for their underserved population. Furthermore, if a site’s leaders have minimal access to cyber expertise, it would be prudent for those cyber resources to focus on basic cyber protections for the clinic, as opposed to focusing on federal compliance documentation. The balance needs to tip away from paper compliance toward strong cyber capabilities.
Fourth, the well-documented shortage in cyber professionals must be addressed proactively, and a new generation should be trained specifically in health security. Organizations should adequately staff their core information security roles and functions but also consider building hybrid expertise that can translate and implement within critical operational functions. For example, public health systems and research institutions may consider having greater cyber and disinformation expertise on institutional review boards and risk management teams.
Finally, any good sports coach will tell you that you cannot win games by defense alone. The previously mentioned ethical hacker community in partnership with cybersecurity professionals within individual institutions can be very effective at using toolsets, such as honey pots, that set traps to detect adversaries who may be surveilling an institution or network. In addition to technical expertise, individuals at all levels of institutions can get involved and come together to engage locally in the battle against troll farms and armies, such as the ones that successfully disrupted the Women’s March. This can seem quite daunting, yet we have all already benefited from the leaders in our communities that have taken to the internet and social media platforms to personally combat misinformation and disinformation. Imagine the power to be had if we could organize effectively.
At first glance, the above can appear to require a lot of investment, but we believe that pursuing these best practices will also achieve greater value. Improving cyber resilience from disinformation requires, most of all, awareness of the intersection of these threats. Further progress depends on the simplification of complex workflows, the centralization of data into fewer, more trusted sources, and the opportunity to retire older, higher-risk systems. Done right, these techniques will improve the efficacy and efficiency of public health communication.