Election Security: More Than Cyber | Antonia-Laura Pup (Full Interview)

Welcome to the security cocktail hour. I'm Joe Patti.

I'm Adam Roth.

Adam, we have a guest today, as usual. We have Antonia-Laura Pup. Antonia, welcome.

Thank you so much for having me.

Glad you could make it. So you are an expert in the kind of thing Adam's more into than me. Not the hard technology, but warfare, I guess. But a very interesting kind. cognitive warfare is what we're going to be talking about. And we have spoken about it before. so why don't you tell us a little bit about your work and how you see it.

Thank you so much again for having me and for looking into my work. ever since 2024, when the Romanian presidential elections were heavily influenced by a coordinated Russian interference campaign, I wanted to look more into this phenomenon, precisely in the Black Sea region, which is the region I'm from as a Romanian. And

I wanted to look not only at the demand side, so what the Russians and their proxies are doing to influence the infrastructure of our democratic systems, but also at what the governments are doing or not doing to assure a coherent deterrence by denial for such operations.

and I think that the case in Romania, I'm sure many of your listeners accidentally or not looked into it because it was the first time a democratic country, a NATO member member annulled its presidential elections, the most important elections in our country because of interference.

on a unanimous vote from the constitutional court, which is an independent court in Romania. And later I looked at how governments are tackling this growing challenge of cognitive warfare. we can call it cognitive warfare, we can call it information operations, we can call it influence operations. It doesn't really matter. It's basically the same playbook that Russia had.

since the Cold War, which was to disrupt our societies, to disrupt the social contract by manipulating voters in not only when before they go to the polls, but really to erode the trust in our societies through active measures, how the literature calls it. And I looked into not only

what was going on in in my own country but also in countries like Moldova and Georgia. And I think these countries, how I call the what happened in Romania, it was like a special electoral operation carried out by Russia. And prior to that we have seen it in Georgia, we seen

it

in the parliamentary elections in Moldova in 2025. I think it we are witnessing a laboratory in Eastern Europe that obviously later it's going to be scaled in Western Europe and might maybe even we can draw some some some lessons from these case

studies

as we are approaching the midterm season in the United States. So that's broadly what I've been studying for the last years and what I've presented at CyCon from those case studies.

So y we yeah,

we actually met at CyCon and my travels there was for me preparing to do my dissertation, about cyber ethical warfare. And the irony here, Antonia, is you know, w we look at the different methodologies and how warfare happens and it's chemical, biological, radiological, kinetic and then you know, cyber, right? We talk about cyber

generally about how people utilize c cyber attacks in order to influence infrastructure and other things. But you you brought a new thing to my mind about this this cognitive warfare. And it's ironic, I I've been doing a lot of research, not specifically about cognitive warfare, about more about stress and everything else and how there's cognitive behavioral therapy and ruminative influences your mind.

But that brings me to what you're talking about, how people are influenced from from cognitive warfare or c or cognitive attacks that are either if I understand correctly put into social media and other methodologies. So we don't even have a a treaty for that, right? So, you know, it's amazing how people can influence or organizations or countries can influence people.

I I would say definitely it's very challenging for democracies to fight against that because it's a it's an asymmetric fight. We are democracies so we cannot let's say shut down or like have this great firewall like China has one, without our citizens questioning it and and obviously there is a a there is a tight rope.

We are working on as we develop the toolkit to respond to this type of warfare between free speech and and what I would say is might be a proportionate measure to respond to things like fake accounts, coordinated inauthentic behavior, which we have seen in the Romanian elections. I sometimes like to call what happened in Romania.

to describe it to an American audience as this is what might happen when you use a Chinese social media platform which was TikTok and you load into it a lot of Russian money because this is what happened to grow a far-right candidate Kalin Georgescu which became in just two weeks before the polls

before the ballot boxes were casted. One of the most popular TikTokers in the world, not only for a Romanian audience, and Romanians are already a lot of them on TikTok. I think one of the most active platforms no definitely is the most popular platform in Romania, but Romani

God, I'm sorry.

Yeah, Romanians

are using TikTok to get their information from more than the other countries in Europe. I think at one point we were the country in Europe in the European Union with the largest number of people that had an account on TikTok. So obviously it's something that it's very hard to reverse once the

attack surface is so big. I remember that the because and and we have in the European Union something that maybe other countries outside of it are a bit behind in terms of legal framework we have a thing called the Digital Services Act which right now is a product of discord between Brussels and Washington because through this Digital Services Act

It's not the countries themselves, but the countries can report to the European Commission, and the European Commission med mediates with the platforms the importance of moderating the content that is there. But it's largely based on the fact that the platforms, the big tech, cooperates and respects these guidelines, which obviously TikTok.

didn't do in the case of Romania. This is why the European Commission launched an investigation into it. The TikTok CEO was summoned in the European Parliament for hearings just after these elections happened. But it's very hard to to act after the the operation was finished, if I can say.

Mm-hmm.

it

that way. So I think that countries like the ones in NATO need to develop early warning systems to share this type of intelligence with each other on cyber threats and maybe do what the what the US government calls a defend forward approach, which is that we could disrupt these

troll farms before they actually produce effects in our countries.

Okay.

And this is something that the US did before the for the former el elections, general elections that we you had, I believe it was in 2018, as a lesson learned from the 2016 incidents. So we are definitely not doing enough. I think that the Romanian case

Showed the limits of the Digital Services Act because you cannot really take for granted the willingness of the platforms to cooperate in time because they were asked by the Romanian electoral authority, please take these posts down because they are not marked.

As electoral content, as the Romanian electoral legislation urges all candidates to do. So he benefited through the algorithm, he benefited from a lot more exposure just even by not having his content marked, which

Okay.

is something that the DSA requires you to have.

Okay, well you covered a lot of ground there, including some pretty controversial stuff, especially for us Americans. But but just so we have the basis of what we're talking about, can you tell us what the Russians

supposedly, did to influence the Romanian election specifically and, you know, what was it all TikTok? Was it you know and what did they do there? Was it a mix of other things too? because, you know, from from our perspective, I know from my perspective, to get an really any election overturned, I know in the US is p I can't remember.

ever hearing about it. I mean, we have even elections that are known to be you know, crooked and compromised, but they still won't overturn them. I mean, Adam, have you ever heard heard of such a thing here?

I

I was gonna say I would probably have to Google it, but I I I get what Antonia is saying.

So Antonia what was the the operation? What did they

Yeah.

actually do? And and also it's kind of interesting, i if you know how they did the attribution of it, because we know that's notoriously difficult.

what to show the attribution to who co who who created it. 'Cause when when you have all these fake accounts and all these other accounts, you know, th there's there's there's two actors involved in this. It's it's the actors that are c that are perpetrating and then it's TikTok themselves that have to actually act on it and and show that these that these accounts are fake or not fake.

So that's a great question. Thank you so much. And I actually came with some data points to say b what the decl declassified intelligence reports said.

You've got those? Awesome.

Yeah, we're gonna end up having the FBI visiting our house. So you you're involved and classified. Yeah.

Yeah, really.

S seriously, d do you did you say classified or declassified? Declassif thank God, yeah, really. I don't wanna get any visits from Okay.

No, declassified. Declassified. They were yeah. They were I would not have had access. I'm also

ooh.

He's

in the United States, so I would not have had access to

that's right. You're here

too, so yeah. Okay okay, sorry. So so what was the what was the analysis, the the evidence?

D declassified.

Yes, the declassified the public stuff.

Yeah, exactly. Because they were

declassified. This is also actually i we are joking here, but it's an important point and again a lesson learned. the declassification occurred in between the first and the second round of the elections. which then yeah,

there are two there are two rounds.

it's the first yeah,

Well the null fight and the new one, yeah.

no, no, no, it's the first.

round where there as many candidates as they can be. And then the there's the final round which just two candidates.

I see. Okay. H here we here we call that a a runoff,

Primary.

but okay. Yeah, runoff, yeah. All right.

Yeah, a runoff. Yeah. B between the first round and the runoff,

there was this declassification that occurred at the request of many civil society organizations that told the then president of Romania, we want to know what happened. How is it possible that a candidate that was not even present present in the polls

a few weeks before the elections, or if it was, it was around two percent, ended up winning the whole thing. What happened? yeah.

to paraphrase Brad Pitt we got a word for that and the word is suspicious, you know.

Yeah, so the reports highlighted some interesting data points like for example 25,000 coordinated TikTok accounts that were activated two weeks before the vote took place, out of which nearly 800 were created since 2016.

They had a lot of followers and they were kept dormant and activated right before the election. They were coordinated through Telegram to post certain messages that were obviously about questioning Romania's membership to the European in the European Union, in NATO, our help for Ukraine, the fact that our government is corrupt and is not doing

A lot to support the middle class, which are genuine, I would say, worries that the Romanians have even today. so they amplified those messages. then we had roughly eighty five thousand cyber attacks and intrusion attempts on election IT infrastructure.

Which was assessed as state sponsored in the days in which, because in, for example, the diaspora could vote for three days since Friday, Saturday to Sunday, but

okay.

in this whole realm. Then we had

what is ch

this candidate, which is interesting, like you can have as many accounts as you can. The Romanian law says you have to declare the funds that you use.

to finance your campaign. There were a close to one million euros in undeclared payments to influencers for this candidate that declared zero campaign spending to the authorities.

The interesting thing about this, and I had not heard all this before, it sounds like it was not subtle at all.

No, it

it was not subtle if you would have looked into it and no and it's important to know where to look, right? And then TikTok that that was what the Romanian agencies were saying, but TikTok itself removed forty-five million fake likes and twenty-seven million fake followers in Romania since September twenty twenty-four.

Tonya. Yeah.

a global witness test found that

TikTok's algorithm served the ProGiurescu content. and the the data that that this organization highlighted is 14 times more often showed to the user than than his rivals. And I must say that there are two ongoing investigations.

One is carried out by the European Commission that opened formal DSA proceedings against TikTok on this in December 2024, and we will see how it will how it will unfold. And there is also the Romanian own investigation that was pledged to be accelerated under the

New president, he really wants to not only put forward a comprehensive report to gather all this data, but also to create a new structure within the Romanian presidency that will only tackle disinformation reportedly. We will see. These are ongoing talks. And since you mentioned the impact.

I would say that this phantom of Georgescu and of the annulled elections and of the fact that roughly not even my government or the the other allies did enough to explain to the citizens.

Persuasively what happened and why this is a national security risk, because as you said, it's an extraordinary measure, never happened before. Hopefully, it will never happen again. To need to really knock down a whole democratic exercise because of that. you can really see the fact that our political elites failed to explain these complex phenomena.

It has effects even to this day. Because as we are talking today, we have an ongoing political crisis in Romania. We have not had sitting government since two months ago. So and the trust of the citizens, to to Adam's point, it's very important to not forget about.

thinking of how we can do to reverse that, because you can do it through obviously it's important to invest in education, in civic literacy, in digital media literacy from the early ages, but short term, how can you reverse these effects? It's something that governments are all over the world are struggling to find a recipe.

I

I have a question, Antonia, 'cause this is w this is what my concern is, right? TikTok is considered the the cognitive or the the the the methodology or or the the way this this was this attack happened. But did all these citizens just look at these TikToks and say, and was the message that strong in the TikTok messages that

These citizens decided to vote for that candidate and that was it because that's some pretty powerful strong cognitive manipulation. I mean, like we we we had that issue in the United States where people influence whether on the right or the left. I don't want to get into the politics of it, but I will get into the fact that there is influencing. But this seems like people just literally said, I'm gonna watch this.

And change my vote to one individual and that's it.

I I think that it's it would be intellectually dishonest for me to say that I know exactly how the causal chain worked

Okay.

and I wouldn't wanna go there. I would say definitely it was an enabler, a very strong enabler that was built because that's what Russians do. They don't create something out of a vacuum to

achieve their cognitive effects. They usually look broadly at how the society, how the economy is doing, and they amplify the existing cracks. This is what we have seen happen in in Brexit, for example, right? like they take some and and the Romanian people were not

We w they were genuinely furious on the political class. Let's not forget that twenty twenty-four was one of the craziest electoral and and most packed electoral years for the whole globe. But all the more it came after some very hard shocks that really had an impact on people's income, on people's

own capacity to purchase. We were after COVID, after the war in Ukraine. And the war in Ukraine, I must say, has real tangible spillover effects in Romania. I don't know if you guys saw, but we were having drone attacks in our airspace that unlike in any other country hit a residential building and blow up

people's apartments and they had to relocate in the middle of the night because of that. So

i it's it's after a few shocks, let's not even forget forget the energy crisis we are going after. and these types of cognitive effects can be achieved way easier when the people are furious on the political class and they

Yeah.

Yeah, it's really interesting the way they did the operation. you're right. They they hit you where, I don't want to say you were most vulnerable, but where it would have the most effect. Obviously, if you're big on TikTok, they went big into TikTok. but you know, I was thinking that there are really two levels to this attack and it at least its effect. you know, they got the election

You know, they got what they want wanted in the election, apparently, even though it was overturned. But when it was overturned, it sowed doubt and you know, unhappiness and dis and mistrust in the government, which is probably more strategic and longer term. And from what I understand, that is even outside of you know, TikTok and technology technology, a very classic

intelligence goal and operation.

Yeah, more the moral the

I I I don't want to say PSYOP because then that sounds like a conspiracy theory, but it is a PSYOP, yeah.

It is a psyop. But it's a but i i

i if it's acknowledged that it did happen, then it is a psyop. But the morale of the of the citizens and the overall I guess temperature of the citizens was was very low. I mean susceptible. Good word, right? Good word? Good word?

Yeah, they were very, H susceptible. Right. There was it

was

Yeah, it worked. And I would use a term that was first introduced in our regional security conversation by the former Georgian president Salome Zurabish Vili. She called these types of operations special electoral operations. And obviously the Russians can achieve a lot by winning by this

w winning without fighting mode they are in. the question is at the end of the day, yes, what we are doing to to to be able to make our institutional resilience stronger. And I think

Yeah, that that's

I just want to say that's the interesting thing. I'm really interested to hear this because it was obviously the most obvious thing, the control of, you know, TikTok or the you know, big platforms and that's a very divisive discussion. But also, so please tell us about that. But also I I'm interested to know what other things they're doing. I I certainly hope that they learn some very strong lessons from you know, the way

From the PR, from the way it was handled and how the trust in the in the people was lost.

I think it's very important to have control over the narrative. And this is something that the Moldovan state, which I don't know, have you guys see how small Moldova is? And they have like there are two million people society out of which one million doesn't even live there. So it's half outside the country. They are either in Romania because

Or all

It's like Luxembourg.

right yeah, Antonia, I'm gonna be honest. I can't point out Moldova on a map. Sorry, Moldovans. Except if I had to guess, I would guess it's probably next to Romania based on what you're saying.

Yes. And it's very interesting, not a lot of people know, but most Moldovans have Romanian citizenship too. So Moldova used to be part of Romania until nineteen forties and then it was annexed by the USSR. and now

that's interesting.

So 'cause I I I gotta ask this 'cause I think it's significant. So are they, as we'd say, kinda culturally Romanian? Do they speak Romanian and everything?

Yeah, they speak

their f official language is Romanian. Their president

Okay.

is also a Romanian citizen. Half their government also has Romanian passports, so

so is

it almost like like what happened with the communists and I didn't know this, but almost like East Germany and West Germany part went to the Soviets

Exactly.

and part went to the West re I I n I just learned something. I never knew that. Okay.

It's interesting because obviously as the war in Ukraine has become a war of attrition, but Russia is losing militarily and relying more and more on these unconventional hybrid warfare forms to have the upper hand. Moldovans which were very dependent on Russian gas. this create and

And their their pre their the the projection right now the discussion is if Moldova will not be able to adhere to the European Union and they are a can candidate country alongside Ukraine. They just opened the cluster of negotiations last month. no, they are mean

Okay. are th are they a NATO or no? No, okay. So they're not EU, they're not NATO, okay.

No.

no, so they are very exposed, right? They are

Right.

They have a military neutrality embedded in their constitution. And the discussion right now is that maybe at one point if they will have a referendum, they might join Romania. They might decide to unite

wow.

with Romania. Like more than 10 years ago, the support for unionism cause was very low.

In Moldova it was around 3-4%. But since Russian aggression became so hard to bear for the Moldovans, it went up to now it's about around 50%.

So so

this is a country that, at least during the Cold War, was in the Soviet sphere of influence and the Russian sphere, and now they're becoming disaffected and going more towards the EU in the West. Is that is that it? Okay.

But it it yeah.

And they are part yeah, and they are also

partially occupied by Russia in the Transnistria region. So

Really?

you have I would say the perfect storm, a very sensitive cultural background, the poorest country in Europe. They don't have alternative for investments, they are dependent were dependent on Russian gas now.

things are a bit different because they because the European Union and Romania help them a lot since the war in Ukraine started. Obviously, a very culturally divided country. Geopolitical divisions are very persistent every time they have elections. So one would see how this weak state, by all indicators.

is a target for Russia, an easy tar would be an easy target by Russia. And it was

can can I

can I just ask that I can see they're they're an easy target for them. do they have any does the country have any strategic value? In geographically

or in terms of I don't know, resources or anything like that?

They have some prospects, I would say,

Prospects, okay.

of of becoming at one point relevant in the critical minerals game. And they were

tha that's interesting. Okay.

yeah and and together with like the Odessa region, the at one point there was some discussion of doing some hydro

project for yeah hydro power

Hydropower? Okay.

actually, Moldova is a successful case in which if that showed that even this very weak state can prevail. What they did

is they kind of did the reverse of what Romania did. They use a lot of pre bunking tools and a lot of declassification before the election.

Moreover, there were because in Moldova's case, they are also highly susceptible, highly exposed when it comes to Russian illicit financial flows. There were a lot of vote buying schemes, oligarchs that were paying people $3,000 even in crypto to attend protests against the government.

Y y th that Yeah, th that's

Three thousand dollars per month.

the old fashioned way to rig an election. Yeah, okay.

Yeah. But

in in addition to that we had obviously a lot of AI amplified disinformation, AI generated content showing the governmental figures saying that Moldova might be occupied by the European countries. In the day of the elections there were a lot of DDOS attacks that took down four thousand websites that were

affiliated with the state. Other narratives, because I think it's also interesting as I mentioned that they are military neutral, the fact that NATO would attack Transnistria, which is the Russian-occupied region. And what the very mighty government in Kishinao did was inform rapidly the citizens about these developments, communicating time

re rapid response mechanisms, cooperate with the civil society to fact-check narratives, to have these early warning mechanisms that I believe are very important. In the day of the elections, there were also bomb threats at polling stations in Romania, Italy, Spain, Belgium, and even in the US.

To discourage the Moldovan diaspora that large votes pro-European Union integration to show up to the polls. And because they didn't have that many resources, they just communicated very clearly that look, this is what's happening. We were not going to wait, I don't know how many days, weeks for this narrative to be developed to say that they were the Russians.

come and and and put it forward. They ha they were doing rides at people's houses that that were smuggling money illegally in the country they blocked close to 100 websites for Russian propaganda which was very which was dismissed by even some civil society leaders that was disproportionate.

But they did that. They went and asked help from the European Union. we had asset freezes of on Russian proxy party leaders. what else? Something very interesting is that it was for the first time because also the geopolitical context matter. US was withdrawing a lot of funding for Moldova on USAID projects.

In the meantime, even hitting them with tariffs, if you remember what happened last year on Liberation Day. So it was the the need for Europeans to to jump, and it was the first time the EU cybersecurity reserve was deployed at the request of the Moldovan government outside the European Union. So that helped to have first incident response.

that it's trustworthy because let's face it, how many good I would say people to to handle these very sophisticated hackers can a country in which the medium salary is around five hundred euros per month do you think they had? So they had a lot of help from the outside too.

And the the the result is that the pro-European forces won. And it's sensitive to say if it was if it was a proportionate response, but I know the OSCE, the Organization for Security and Cooperation in Europe, and also there were some other international observing missions, a lot of them, they applauded the

response of the k government in Kishinev as decisive and measured. but i I think that the the most important thing in the toolkit that I think more governments should replicate and the Brits did it before in the context of the war in Ukraine, the US did it to inform allies that the Russian attack in on in Ukraine is imminent in 2022 is to

be proactive and declassify these informations when it's still time to for citizens to make their own judgement, not when it might look like it's politically motivated the moment of declassification.

So we we spoke ab we we spoke a lot about, you know, what has transpired. But do you think this problem has been resolved from a cognitive warfare attack? Has is TikTok still influence? Do you think this will happen again and how do we fix this moving forward?

I think that it has not been fixed. it's very hard to have I would say to have a no one has a a recipe on how to tackle cognitive warfare. I think that as I said, being proactive matters, having trustworthy institutions like Moldova's StratCom Centre that can

deliver rapid responses and qualitative information is important. And I would say it's a team effort. it's not something that one country could do alone. This is why NATO is important to give international legitimacy to these issues. But at the same time if we were not to have

consensus within NATO for these types of measures. I think that we are going to be increasingly seeing more like coalition of the willing type of formats that might develop tools to to equ equip our societies to fight these types of operations. I think that we obviously we

it's very hard to achieve consensus in the European Union too. we can have all any day another Viktor Orban like we had in Hungary that will prefer to keep it measures and keep it soft on Russia. I think that the future is yes, fighting against these f these threats together with the ones that are willing and ca capable to do so. And not really only NATO countries but also countries

that can bring regional expertise against China, for example. I know that Australia is thinking about this too because they just had a visit in Romania this spring with some high level delegation and countries in in Asia because we are seeing that this stuff is happening in the United States too not through Russia but through

Chinese operators and AI really allows for the cognitive warfare to be become an industrialized business where the barrier to entry is very low.

I know I know I said this earlier and we we spoke about this, right? The reason why I met you, I was travelling to Tallinn, t to go to the CyCon conference, not knowing what it was all about and hoping to find people like you, yourself, that have knowledge about this. But my concentration was about cyber ethical warfare, not thinking about cognitive. my my dissertation itself, my research is specifically about NATO because as any of my professors have told me, it's one drop in the ocean.

But I think it's safe to say, right? The Tallinn manual is non enforceable, but it's a framework for how we discuss things in cybersecurity and and you know, specifically what happened to Estonia. I I I I know we don't get people we don't get organizations, we don't get countries like China and we don't get countries like Russia to be a part of these treaties. But I think it's fair to say that we do need some framework of what is acceptable and what is not.

whether or not these countries come to the table and sign that, we don't know, right? but cognitive warfare is obviously a vector of attack and we have to find ways to one maybe enter into treaties with these other countries to pref to prevent it, but two, to put framework in place electronically in technology, that stops this from happening because

One, we want to do prevention, but two, we want to be able to respond as necessary.

Okay, I've got a question for both of you, because

Okay.

both of you know a lot more about NATO than I do. My understanding is kind of American and simplistic. It is a military alliance, largely. And here, even though we're talking about, you know, cognitive warfare or information warfare, it's obviously not kinetic and

Well that's not true either.

Well that well th that that's what I mean. I mean i is this who is it appropriate or what's the appropriate, I don't know, organization or whatever to be doing this? Is it the military or a military alliance? Is this an intelligence thing? Is this a political thing? How how is this sh shaking

But I would say

out? What what are the thoughts on this?

I w I would argue that and this is what was the conclusion of my paper that it's not about capacity. Actually, Georgia, by all indicators, cybersecurity preparedness, government effectiveness me measured by World Bank, even like IT companies within the country, or like institution robustness, by all these indicators.

was more prepared to fight this hybrid c cognitive warfare than Moldova. But they didn't because sorry?

But who but who prepares? That's the th

but who does that preparation? Who makes those decisions and executes

In the case Yeah.

them, especially if you need international cooperation?

But y yeah.

That's why what

I think it's a political it's a

Okay.

political business. I don't think we will be there when we will have NATO have an article type article five type guarantee against cognitive warfare and it's a very sensitive thing to do, like w because it's about who's in power. So I think that the political leaders need to step up and not

kind of park these very sensitive dilemmas in the hands of the military. I think what the military can do is maybe carry out some very targeted, very specific operations against troll farms, against like like the type of operations that NSA does, like defend forward against like really

clear infrastructure, critical infrastructure, not against what's happening in people's minds, because you cannot you cannot do that and still remain a democracy, in my opinion.

So so it's Joe Yeah.

Okay, so that's your view

and your research. Yeah. Adam, the future Doctor Roth, where's your research taking you? What do you see?

Well, I well let's hope let's hope

future Doctor War. But the the so to follow up what Antonia is saying is that th there's two articles that come to mind that reference this. But keep in mind, NATO is NATO, it's not the whole world, right? These are the states that have come together to enter into agreements. NATO article four discusses that when the sovereignty of a nation's NATO nation, security comes into c question. Did a nation get influenced by

by some kind of security incident. Drones flying into the wait. Yeah.

Wha wait, I I just want to ask, 'cause I don't know all these articles like you do.

Is that when you say are they being influenced by another nation, is that militarily? Or is that the entire theater in all spheres? It is. Okay.

the entire gamut, but that's the whole problem that we

have with these NATO articles. Those NATO articles like we'll like from a US as an American, right? We'll argue that the Constitution was written during a different time. W things didn't happen during the Constitution, like freedom of speech, freedom of this, freedom of that. Though all this technology was not in place. Similar to NATO. Article four is when a country's security gets called into question, that their security is being breached, whether it's from cyber warfare, cognitive warfare,

Kinetic attacks, biological, somebody stole my bicycle, whatever it is. NATO article four gets raised. NATO Article Five.

So so

let so let me just ask, 'cause I know NATO is an outgrowth of the Cold War. So would that be including something like this where one side or another is trying to destabilize another country, not necessarily in invade or kinetically attack?

It it's actually the the committees get called to discuss this. There is no threshold that I'm aware of in either either of these articles. The the the nations that are on these committees that are on these articles, they come in to discuss and they say, Did this country violate the security of this country? And then they say, Is it an attack on one? Is an attack on all? And that's when NATO responds. Antonia

But that

Keep me keep me keep me honest

yeah,

here.

yeah, I it's one hundred percent the way you said, and it's the prop it's a proportional response.

Yes.

So what what does proportional mean? For example, Germany can send blankets to that country or tanks, like it's not you have to do this if this happens,

Correct.

and with the article four.

Okay, I

It's very important to say that it's triggered like any country can trigger it. As you

Yes.

say, you can trigger it for the fact that it stole your bicycle or for a other type of threat that it's I don't know, like drone incursions. But

Yes.

Romania I I think that it's it's a dilemma also when because you cannot like realistically you cannot

trigger this article for just these political discussions every day. I will tell you this was the case of Romania. We had two drone incursions very severe in the port of Constanza and I told you about the residential building right when when we were in living from Estonia and Romania didn't call for the article four. Obviously

you have to have a certain political climate to be able to do that within the alliance. Like I don't know if the US government at this point would would have been very prepared to back a NATO response for this time.

As an example,

so

Yeah.

China's not a part of NATO, but the balloons flew through the

Yeah.

US. Supposedly that was Chinese intelligence. That's an article four if the US wanted to raise that. But keep in mind, you're all you can only really raise these articles if other nations cooperate. So were then was NATO going to attack China for a balloon that traversed from Alaska into the Atlantic Ocean?

We don't know, but that was the sovereignty and security of a nation. But did the US trigger that?

it's very hard to determine what a proportional response means because not only with the balloons but with drones. I don't know a lot about drones, but I think that it's quite disproportionate to talk about using an F sixteen.

raising an an F-16 fighter jet to shoot down a drone, but what if they're sending five hundred drones? No not every day, but like in the course of a month. so

But what if they sent Antonia

a a drone with nuclear material on there and that caused an issue too? So the point I'm making, I guess, is a and and Joe, keep in mind, it doesn't matter what one nation says. It matters as the alliance gets in and discusses it, they have to vote and come to a consensus. One country can say, We're gonna launch nuclear missiles at this country, another country can say we'll send blankets.

Yeah.

Okay, so all right. Alright, I'm start starting to get it a little bit. Proportional response makes sense. I mean, I can I can understand what happened in Romania over a couple of drones that possibly were were unintentional. You don't want to start World War Three or even pull Romania into the war. Okay, I can see that. Makes sense whether you have an alliance or not. but that c you know, the drone example and even arguably the

the balloon example is clearly a a military issue, you know, very clearly. And it sounds like all this flexibility that's good that prevents us from overreacting can also widely expand the scope of what they're going to consider. So I'm thinking that it would be, yes, this cognitive information stuff. Is that how they get to that can be in the

In the NATO space.

I think that this is what makes cognitive warfare so hard to challenge. It's

Okay.

hard to define because I think Russia is betting a lot on our hesitation to respond to these types of threats.

Precisely create

Well I I yeah.

the type of distrust that they waged against us in the el electoral in the electoral times.

Joe Joe, it's also very similar to this, right? I'm a proxy of a foreign country that's adversarial. I use cognitive warfare and I start attacking God forbid Romania. Don't hurt me, Antonia. And you try to figure out okay, are these proxies that took over a network are they a the third party proxy of a nation?

Attribution is usually very hard. Yes, we do have like the ability to eventually hopefully find out who the attribution is, but sometimes it's very hard to figure out who it really is. But like Antonia said, if they're if if if TikTok took down X amount of accounts, they probably acknowledged already that these are adversarial accounts. They've already entered into an agreement saying they shouldn't be there.

But the point I'm making is that's a private organization, a private corporation. That's not a government. The government has to work with. And if you remember what we spoke about the other day with the gentleman from Singapore, right? We spoke

Mm.

about from from from also from Estonia that I met. We we discussed how governments have to work with private companies to f figure out attribution and protecting them as well. It's a new ecosystem.

It used to be I launched a missile at X country and they launched a missile back at me. Now it's I'm a f third party or proxy or I'm a government entity that took over some other corporate network that used cognitive warfare to attack a government. It's a different world. Now we're have a new ecosystem of government and private corps and citizens. It's not what it used to be.

what that makes me think of is I I've heard it said, and I don't know exactly where this came from, that you know, that the government has to have the monopoly on violence. That the government which essentially means the government has to have control, has to have the the levers and the controls of all the power. And it sounds like in this age of information and cognitive warfare

they don't necessarily, that these private entities have quite a bit of power that have influence and can be abused used or abused.

Keep

but keep in mind, even in the US, the NSA cannot attack at you know even in government legally, okay, but

L legally.

but the point I'm making is at least in the US, it's the military that can launch attacks. And those attacks can be to Antonia's point, at least for the US, cognitive, cyber, biological, radiological, kinetic, chemical

TikTok cannot attack a foreign co a government. They have to drop

Well, it sounds

like they can, in a sense, or they can be or they can be used, right,

Whoa, they're a proxy, Joe. They're a proxy.

Antonia? That's what happened in Romania, right?

They're a proxy.

Yeah.

So I mean that's

that's what why we had the TikTok divest law to begin with, right? And and a very bipartisan consensus on why TikTok is a national threat. But I'm to your point, this is why we have this very popular concept of whole of government approach, because you need more tools.

than just the military to do that. And even with attribution like a DDoS attack, the technical attribution, the technical layer of the attribution is just a step. And then what, right? Like you need a politica, the political layer to be willing to go and and and name and shame. But naming and shaming

is just a step in this ladder because then you go, you talk with the press and obviously the journalists and your citizens, if you are in the government, will ask you, and what are you going to do about it? And you have to have a that proportionality dilemma clarified very very early on.

So Antonia, the other way to attack another nation without using weaponry is to use sanctions.

And then the European Union has had a s cyber sanctions regime in place since twenty nineteen. In order to activate it, it's a very lengthy process. As always, we are very big fans of processes in the European Union and building defensible records and and needing unanimity and all that. But

Are you saying

that the EU is a slow bureaucracy? Wow, I've that's not

And I will just tell you that since 2019 it was used just against it was activated only five times against 14 individuals and seven entities. So less than like adding the numbers, less than I would say twenty two

entities as a whole. it's a dilemma for me why we are not using these types of targeted sanctions against at least hackers more often to increase the costs and and change the calculus, the cost benefit calculus of of the attackers. And I personally yeah I personally

Well Yeah.

That's an interesting approach. That's very interesting.

that Romania should have at least because or Romania

Poland, other countries should group themselves and take to the European Union the many attacks, cyber attacks that are targeting our critical infrastructure, Russia con through Russia connected proxies, and and increase the costs for them, at least when it comes to

Let's say cognitive warfare is a very sensitive business, especially in electoral context. But when it comes to critical infrastructure, I think like water systems, energy and so on and so forth, I think that things must be straightened out.

Well I I

That moves into

your your world, right, Adam?

I I mean, yeah, I mean I I have cohorts in my class that discuss this exact same thing, utilities, how to prevent foreign nations from compromising it and then how the US 'cause obviously we have we're one of the bigger nations and when we get upset we we target sanctions at not

at hackers and not at entities. Don't don't get me wrong. We've actually said we're not gonna let these people come to the country. We're not gonna let these people do business with certain nations and certain and certain financial institutions. But then we use sanctions against these countries to leverage to get those individuals to stop what they're doing. So again, to Antonia's point, it's a political game most of the time and that political game

changes into the methodology and the attacks and and how do we do things. Like if you look at some I don't want to get into the politics, but if you look at some of the current world events, it goes from sanctions to military actions to sanctions to military actions, and then sometimes both. And we try to leverage different ways and you know there's a lot of

Outside influences, why things are done, some of it has to do with money, some of it has to do with leverage, some of has to do with other things that you and I will never be aware of. But I I get it, Antonia you're right. And I don't want to say out loud out you're right, but I said it.

Yeah, he never says that to me, so that's a great compliment from Adam.

Thank you. But right being right

is not enough. I think that we need to be credible too when it comes to explaining these threats to people that don't necessarily understand how this type of operation is on national security issues and what are the authorities that governments need to have and deploy to

protect our democracies and you guys are obviously doing a lot of good work to to this benefit through this podcast but we need to have more people, we need to have the political will for for taking control on the narrative at least.

and speaking of that, everybody remember, like, subscribe, follow, tell your friends, help us bring this message to more people so we can do more good.

So from a final thought standpoint, you know, Antonia, as you probably know, I'm hoping to to present next year at at CyCon. And one of the things that hopefully by then I I will complete my doctorate and my dissertation will get published. But it's people like you and I and most likely Joe, but if we publish and bring to the to the to the public these thoughts, these these these these ideas

hopefully they get looked at more often. If everything goes well for me, I'm hoping to create my own framework. similar to the Tallinn manual. And I think this conversation has instilled a level of thought that I haven't explored all avenues. And I've said this to you before. I've spoken about cyber warfare

But I think a subset of cyber warfare is the use of cognitive warfare via social media, via the internet. So I'm gonna have to incorporate that into my to my research and hopefully that will bring the attention to others. And maybe by next year in Estonia I'll be able to present that and we'll see how that goes. But we need to bring more focus to this and more and more light to it.

I would say again as a final thought that it's great that maybe we are struggling to find the political consensus to act very firmly, but at least the direction I think it's it's good. just the fact that we are aware of this stuff. Like for example, we have a European cyber sanctions regime.

Activated very slowly and not when it actually matters, but it's good that at least we have it. In the US case, it's good that for now we have with this administration an inaugural director for cognitive advantage at the National Security Council level. I think it's a great sign of institutional resilience and just taking this.

as a national security issue. And I'm just going to look at what's going to happen in the context of the midterm elections and hope that the US can use the lessons of countries that are smaller like mine, like Moldova, like Georgia, to sharpen this toolkit.

I would say, Antonia, keep us up to date because we can publish this in our newsletter and maybe follow up on it eventually. But this is important for for everybody. I mean this is this is not like my machine got attacked with a virus. This is more like this can change world views and we would love to keep visibility on it.

And by the way I finished

Yeah, and Tonyath.

my glass, it's not enough.

Okay. Well, Antonia, thank you so much for joining. This really has been really interesting. I know for me this is a new world and as Adam's saying, probably a lot more significant than the one I I usually play in. so it's been fascinating. And I gotta tell you, after this, I've gotta go to a cocktail party and if this stuff comes up, I'm gonna sound so smart. It's gonna be great. So thank you. And speaking of the drinks, Antonia's drink was the Negroni, which we've been enjoying for this

Thank you so much.

for this show

so thank you so much for joining and for recommending that

Thank you.

Thank you.

Okay. Adam, always fun to do this? Yes.

Thank you. Yes, said

Thank all of you. Okay. And thanks to everyone for listening.