Commercial Intelligence in the Gray Zone

Posted: April 25th, 2022

Ian Conway is a private intelligence analyst supporting international legal investigations and investors in high-risk frontier markets. He has more than two decades of analytical and investigative experience, including cases involving political warfare, influence operations, enterprise risk, and subversion.

Kathleen Cassedy is an open source intelligence specialist with over two decades of experience across the private, academic, and public sectors. Her range of applied experience includes red teaming, technology development, mergers and acquisitions, theater-level intelligence, and support to legal investigations.

Chris Goebert is a retired intelligence professional and police investigator, and currently specializes in private intelligence and investigations for international clients. He has more than two decades of experience in human and technical collections in support of litigation proceedings and national missions.

OPINION — As intelligence professionals come to grips with the shift away from the Global War on Terror and towards strategic competition, it’s time to reassess the tools, techniques, and methodologies we relied on previously. Software tools and methodologies that were designed to support the relentless find, fix, finish, exploit, analyze, disseminate (F3EAD) cycle are not the right tools and methods for gaining advantage in global strategic competition.

The recently released National Defense Strategy – consistent with current administration’s Interim National Security Strategic Guidance – indicates that terrorism is no longer the priority. That being the case, it seems the US Marine Corps is the only national security organization that appears to have had a hard conversation with themselves about their roles, missions, and fitness for purpose in this fight, and then demonstrated the vision and leadership to make the necessary changes. Why did The Special Operations community give themselves an extra ten years to implement changes? Where is the Intelligence Community’s plan to adapt? US leadership’s focus is now squarely on the threat posed by resurgent great power adversaries and will likely expand to emerging regional powers, but the requisite vision, force structure, tools, tactics, knowledge, and experience do not appear to be keeping pace.

We believe most of this competition occurs in the gray zone, which CSIS defines as “hybrid threats, sharp power, political warfare, malign influence, irregular warfare, and modern deterrence.” And includes “information operations, political coercion, economic coercion, cyber operations, proxy support, and provocation by state-controlled Forces.”

The authors challenge readers to identify a single modern instance of these lines of effort that does not involve one or more commercial entities. In fact, in our experience, commercial entities are often the operational platforms, the aggression vectors, and the targets. Media and social media platforms are (mostly) commercial entities. Political coercion involves lobbyists, non-profits, and B2B financial transactions. Paying proxy forces and mercenaries (who are often themselves employed by incorporated entities) also involves the private sector. Chinese state-owned enterprises are at the center of the PRC’s Belt and Road initiatives. Russian oil giants are the crown jewels of their economic warfare efforts. We would argue that the gray zone is actually the private sector, and that this effectively outmaneuvers American military power.

Russia’s use of commercial entities to conduct statecraft appears to be designed to conduct covert action, or at a minimum, create plausible deniability for the Kremlin. China’s Military-Civil Fusion program creates almost no distinction at all between PRC-flagged commercial activity and government actions. Our old partners in the Middle East are grand masters at the game, exploiting American lobbying, financially rewarding senior officials to do their bidding, subverting Congress through unregistered foreign agents in politically influential roles to obtain nuclear technology, and oscillating between private sector and nation-state status in litigation. This latter instance is tantamount to a non-official cover officer getting caught and claiming diplomatic immunity.

Today’s constant barrage of information makes it easy for countries to wage disinformation campaigns and your emotions are the weapon of choice. Learn how disinformation works and how we can fight it in this short video. This is one link you can feel good about sharing.

It has been said of gray zone conflict that the “defining characteristic is ambiguity.” That’s not wrong. It has also been written that “attribution of specific outcomes to actions of conflict participants has created a challenge for the legitimation and implementation of standardized punitive measures in gray-zone conflicts.” Also correct. Especially when the adversary is supported by a fifth column, in which it is all but impossible to prove who is witting and unwitting, who the useful idiots are, who are the grifters using this conflict for revenue, and who are simply the feeble minded who have chosen the dopamine rush of confirmation bias over their moorings to reality and succumbed to the logical fallacies, conspiracy theories, and “alternative facts” of agitation propaganda.

In short, the private sector’s role in gray zone operations so saturates the battlespace with ambiguity that we can’t even correlate effects to actions, much less actions to their perpetrators. And when a savvy investigative journalist does accomplish attribution, the political warfare machine turns on them with personal attacks and litigation designed to smear, discredit, and impoverish.

The unfortunate reality is that outside of platitudes in strategic policy documents, gray zone conflict is all but ignored by western nations. Gray zone combatants are mostly private citizens and commercial enterprises, and they are litigated in international courts while the national defense capabilities of nation states defer to civil courts and law enforcement, but otherwise sit idly on the sidelines – at best observing competition below armed conflict, and at worst remaining ignorant of the operational and tactical levels of this war. Discovery is the de facto attribution process. There is no real intelligence playbook or toolkit in the gray zone. There is no lead federal agency, no doctrine, no chain of command, and no strategy.

The authors – all veterans of government service and government contracting – have all but disengaged from trying to work these issues for the government and are now in commercial intelligence. After all, take a look at the dearth of procurements available to support this fight using key search terms like “gray zone,” “political warfare,” or “influence operations.” Any discussions with potential government clients invariably devolve into requests to see a tool or technology demonstration, devoid of the requisite human understanding of data, structures, roles, relationships, and functions in the commercial space. Sorry, but there is no “easy button.”

We’ve tried continually to share our lessons learned and our experiences working in the commercial space with our former community. The problem is the prevailing attitude we’ve encountered is either that “that’s not our job,” or “we can’t do anything about it because it might involve US persons.” When we share the details of what gray zone competition actually means for American industry, we’re asked if we’re “suggesting we [the US government] become more like them [gray zone competitors].” When we asked a former NSC member why this fight is seemingly invisible to the government, we were told “we don’t have collection priorities in this space.” When we asked if we have developed measures of effectiveness (MOE) or measures of performance (MOP) for hostile foreign influence operations against American citizens, the answer was “that’s a gray area.” Policy documents and guidance say strategic competition is a national security priority, but funding, training, planning, capabilities, and thought work are nowhere to be seen. We appear to be adrift.

Conversely, hostile foreign powers support their commercial activities in the gray zone with the full complement of instruments of national power. This is the equivalent of a US firm going to market in a foreign country with the support of CIA, NSA, State, Treasury, Justice, and Commerce. Not to put too fine a point on it, but we’re not competing. We’re getting our asses kicked.

The commercial intelligence practitioners who support American industry in this fight are on an island. They are under financed, under resourced, working to stay under the radar to avoid crushing litigation and stay on the right side of the foreign corrupt practices act (FCPA), with no official status, no cover, and no support.

Earlier this year, fellow Cipher Brief writers Cynthia Saddy, EJ Alam, and Kelli Holden made an excellent case for the inclusion of commercially sourced intelligence (CSINT) in the Intelligence Community’s modern toolkit. We applaud this call, and drawing on our own experience in commercial intelligence, we offer the following necessary expansion of the toolkit, if the US hopes to level the playing field in strategic competition.

We believe that CSINT is much more than an array of big data tools and platforms that provide insight to queries. CSINT is actually a combination of many traditional intelligence disciplines, which have been privatized and are available on the open market. IMINT, HUMINT, SIGINT, TECHINT, OSINT, and CI can all be legally obtained at the speed of business for far less than the $80 billion per year the American taxpayer currently spends. Many of the firms that do this work were founded by former government professionals that have full careers of experience behind their business models.

However, there is a pervasive misconception that technical solutions alone provide results. The reality is that the technology portrayed on MI5 or NCIS, where a cell phone number punched into a computer reveals that the suspect purchased duct tape and a shovel at the hardware store, is pure fiction. For CSINT to be effective, intelligence analysis is as necessary in the commercial domain as it is in government. Seasoned analysts with advanced investigative mindsets who have left government service are an integral component of effective CSINT firms. These same analysts should be integrated into the teams responsible for training machine learning to spot and assess patterns that have successfully broken cases.

The Cipher Brief hosts expert-level briefings on national security issues for Subscriber+Members that help provide context around today’s national security issues and what they mean for business. Upgrade your status to Subscriber+ today.

Commercial diligence works when the objective is investigative, not compliance. Understanding the know your customer (KYC) process, Ultimate Beneficial Ownership (UBO), corporate structures and executive leadership, offshoring, tax havens, shell companies, and investor portfolios are the keys to commercial attribution. But these answers are not to be found in the SCIF. They’re found in press releases, industry media, trade journals, anti-money laundering / counter-threat finance (AML/CTF) databases, securities exchanges, mercantile registries, and corporation registrations. The answers are obfuscated by jurisdictional privacy laws, periodicities of corporate filings, and transliterated name variations, not cryptography algorithms.

So, what percentage of investigations could be done using CSINT? Although it’s difficult to put an exact number to the question, 50% would not be an unreasonable estimate. Moreover, if restricted government tools were used to compliment CSINT, the percentage would increase dramatically. There is clear evidence that US adversaries, competitors, and even alleged partners contract either witting or unwitting CSINT firms to quickly get them across the 50-yard line. Comparatively speaking, it is inexpensive, low risk, inherently compartmentalized, and when planned and executed effectively, creates plausible deniability.

Using the same methodology, US federal agencies could increase capacity and effectiveness, optimize bloated bureaucracy, reduce risk, and move at the speed of business. In the time it takes for the government to award a simple contract, an oligarch can move money through multiple jurisdictions and asset classes leaving a trail of obfuscation in his wake. Rules of engagement are not a constraint that US adversaries contend with as they eat our lunch. In fact, our rules of engagement are their return on investment.

It has been written that “one of the most important debates regarding gray-zone conflict has focused on how nondemocratic states conduct hybrid operations using nonstate actors against their democratic adversaries and what democracies can do to respond to these tactics.”

We should start by doing commercial attribution.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business