Category: Policy

  • Shortcut to Superpower? Rethinking Intelligence and Learning in the Age of AI

    Shortcut to Superpower? Rethinking Intelligence and Learning in the Age of AI

    If I can get the information faster and more efficiently with AI, is that really a bad thing?

    In national security, cyber defense, and intelligence work, speed and accuracy aren’t luxuries, they’re requirements. The faster an analyst can detect, assess, and act on information, the more resilient our posture becomes. So, it’s worth asking: if tools like AI can help us get to those insights faster, does it matter how we got there?

    This isn’t just a classroom debate anymore. It’s a matter of operational advantage that I’m afraid adversarial states may be addressing quicker.

    Intelligence Work is Changing

    In the traditional model, analysts were trained to research exhaustively and reason independently. Today, the volume of data is overwhelming, the velocity of conflict is increasing, and the information space is more contested than ever. Memorizing doctrine or manually parsing SIGINT is outdated.

    AI changes the workflow. It doesn’t remove critical thinking; it simply relocates it. Instead of spending hours searching for the right piece of intel or policy precedent, analysts can use AI to surface patterns, contextualize alerts, and propose early assessments. That frees up cognitive space to focus on what it means and what to do next.

    Another key shift in modern intelligence work is the sheer volume of internally generated reporting, ranging from post-incident summaries and investigative writeups to tactical threat advisories. Over time, these internal repositories have grown so vast that referencing older yet still-relevant documents in future reporting becomes a major challenge. Analysts often know the insight exists somewhere in the backlog, but tracking it down quickly, especially under time pressure, is inefficient or even unfeasible.

    This is where private, domain-specific AI models trained exclusively on an organization’s own corpus can change the game. By indexing historical reports and enabling semantic search across them, these models can retrieve and summarize relevant findings in seconds. For example, if a threat actor resurfaces after a long dormancy, the AI can instantly surface prior incidents, TTPs, and internal commentary, giving analysts a head start and ensuring continuity across time. Rather than reinventing the wheel, intelligence teams can build on their own institutional knowledge more effectively. While some organizations may already employ this functionality, I believe most companies and agencies have yet to adopt it at scale; at least for now.

    The Real Threat Isn’t AI, It’s Passive Use

    Threat actors are already using AI to generate disinformation, automate phishing, and map attack surfaces. If defenders don’t leverage the same tools, they fall behind.

    The real concern isn’t that AI makes us weaker thinkers. It’s that some people will use it to skip thinking entirely. I wouldn’t say that’s the AI’s fault, it’s the user’s intent. A disengaged mind won’t be saved or spoiled by technology. A sharp one, however, can be enhanced.

    Stategic Implications

    In a contested world both geopolitically and informationally, the competitive edge doesn’t go to the one who remembers the most. It goes to the one who can interrogate input, synthesize perspectives, and act decisively. AI, used correctly, accelerates the process.

    National security professionals, educators, and leadership teams should embrace AI not as a crutch, but as a force multiplier. Train people not just to consume answers but to pressure-test them. To ask better questions. To turn good input into greater output.

    Final Thought

    Whether you’re an analyst, policymaker, or digital defender, the real skill today isn’t thinking in isolate, it’s knowing how to think with assistance. The people who learn that now will be the ones driving strategy tomorrow.

  • [Deep Dive] Cyber Tactics and Counterterrorism Post-9/11

    [Deep Dive] Cyber Tactics and Counterterrorism Post-9/11

    Disclaimer: This research uses data derived from open-source materials like public intelligence assessments, government publications, and think tank reports. This report is based solely on my personal insights and independent analysis. It does not contain any sensitive or classified information and does not reflect the views of my employer. This report’s purpose is to serve as an exercise in analysis and critical thinking. 

    Introduction

    Since 9/11, the global terrorism threat landscape has expanded from traditional kinetic attacks to include cyber approaches. Terrorist groups like Al-Qaeda, ISIS, Hamas, and Hezbollah have increasingly adopted digital tools for propaganda, recruitment, surveillance, and humble cyber operations. This shift has pressured counterterrorism (CT) strategies to evolve, integrating cybersecurity, intelligence, and offensive capabilities to address both physical and digital threats.

    Evolution of Terrorist Cyber Capabilities

    In the early 2000s, jihadist groups used the internet mainly for communications and propaganda. By 2014, ISIS had transformed its online presence by actively exploiting social media and encrypted messaging apps to recruit followers, spread propaganda, and coordinate activity beyond traditional battlefields. Though their cyber skills remained limited, some supporters engaged in doxing (public release of personal information), defacements, and minor breaches. A notable case involved a Kosovo hacker passing stolen U.S. personnel data to ISIS [1]. More recently, terrorist networks have begun experimenting with AI tools for media production, reconnaissance, recruitment, and influence operations.

    Groups like ISIS-K, Hamas, and Hezbollah have explored AI-generated videos and deepfakes to amplify their messaging. Hamas has also used fake dating apps to hack phones, and Hezbollah has engaged in cyber espionage aligned with Iranian interests. These adaptations primarily support propaganda and recruitment, not large-scale cyberattacks.

    Traditional vs Cyber Terrorism

    Cyber capabilities have not replaced traditional terrorism but serve as force multipliers. Cyber tools are used to support kinetic attacks, plan operations, and magnify impact. Examples include cyber-assisted target identification and using drones for surveillance or attacks. Analysts conclude that terrorists aim to pair physical destruction with digital disruption. These tactics are not unique to the narrow view of Middle Eastern, or Islamic extremist, terrorist groups, but are also employed by modern Russian intelligence supporting their war with Ukraine.

    Counterterrorism Strategy Shifts

    1. Cybersecurity integration: Governments treat cyber as central to CT. Coordination between state agencies and the private sector protects critical infrastructure (ISACs, CISA, Infragard, etc).
    2. Digital Intelligence and Surveillance: Intel agencies use AI and data analytics to monitor online radicalization and terrorist planning. Tools flag extremist content and behaviors on encrypted platforms.
    3. Offensive Cyber Operations: States have launched direct cyberattacks on terrorist infrastructure. Operation Glowing Symphony by US Cyber Command disrupted ISIS media operations [2].
    4. Online Radicalization Prevention: Governments promote alternative narratives and partner with communities to counter online extremism.
    5. Infrastructure Protection and Crisis Response: CT planning now includes simulations of cyber-physical attacks. Agencies collaborate to ensure emergency response continuity.

    Persistent Challenges

    One of the primary challenges in countering cyber-assisted terrorism is actor attribution. In cyberspace, it is often difficult to determine who is behind an attack, especially when threat actors use anonymization techniques or false flag operations. A disruption to infrastructure or a breach of data originate from a lone hacker, a terrorist cell, or a hostile state, complicating response strategies and legal recourse. This ambiguity forces intelligence agencies to closely examine digital footprints, motives, and affiliations before responding, often in real time.

    Resource limitations and skill gaps also slow down effective CT operations in cyber. Traditional law enforcement and CT units often lack the deep technical expertise needed to triage malware, decrypt communications, or conduct forensics on seized devices. Recruiting and retaining cyber talent remains difficult for public agencies, especially as adversaries continue to innovate rapidly using widely available technology. The widespread use of encrypted communication platforms like Telegram and Signal compounds the problem, allowing terrorists to organize and recruit while remaining hidden from surveillance.

    Another pressing issue is the overwhelming volume of data. Every day, analysts must sift through massive amounts of online content to detect meaningful threats. AI tools can assist but are prone to false positives and blind spots, sometimes flagging harmless content or missing cleverly disguised plots. Legal and jurisdictional barriers further complicate enforcement efforts, especially when attackers operate across multiple countries. Existing laws are often outdated or inconsistent with the pace of modern cyber threats. Finally, terrorist groups remain highly adaptive, quickly shifting tactics, platforms, and tools in response to enforcement measures. This constant innovation challenges even the most capable security agencies, requiring them to remain agile and proactive in their strategies.

    Conclusion/Policy Implications

    Cyberterrorism has not replaced traditional terrorism but increasingly complements it. CT efforts now require a holistic approach integrating digital capabilities with conventional methods. Policymakers should focus on:

    • Cross-sector partnerships
    • Legal modernization
    • Investment into talent and tech
    • Infrastructure resilience

    The post-9/11 period demonstrates that success in CT depends on anticipating how terrorists will exploit emerging technologies and being ready to disrupt both their online and offline operations.

    References

    [1] Doxing and Defacements: Examining the Islamic State’s Hacking Capabilities – Combating Terrorism Center at West Point

    [2] https://icct.nl/sites/default/files/2023-01/Chapter-29-Handbook-.pdf

    https://icct.nl/publication/exploitation-generative-ai-terrorist-groups

    https://www.theguardian.com/world/2018/jul/03/israel-hamas-created-fake-dating-apps-to-hack-soldiers-phones

    https://www.dhs.gov/sites/default/files/2024-10/24_0930_ia_24-320-ia-publication-2025-hta-final-30sep24-508.pdf