Dr. Eileen Culloty:

I thank the committee for this invitation to address it on the topic of disinformation and hybrid threats. The Institute for Future Media, Democracy and Society is a research centre based in Dublin City University. Through our research and outreach work we aim to address the major challenges arising from the digital transformation of media, democracy and society. With regard to disinformation, DCU co-ordinates the Ireland hub of the European Digital Media Observatory, EDMO. Through this and other projects DCU conducts research on the effectiveness of disinformation countermeasures, supports the implementation of practical measures such as media literacy campaigns, and contributes to Irish and EU policy development. This is most notably through our work on the EU code of practice on disinformation, and through our work on the national counter disinformation strategy. I must stress that we do not have expertise in defence, security or cybersecurity. The EU network of EDMO hubs is typically focused on national and public facing dimensions of disinformation. Nevertheless, I would like to present some insights that I believe may be helpful for this committee to consider.

First, disinformation is a complex concept to define, and certain dimensions of it are more prominent in the defence context than in other contexts. The most commonly accepted definition of disinformation is as false information that has been created or shared with the intent to deceive or cause harm. However, in practice it can be difficult to ascertain intentions or to trace false claims back to an original source. Moreover, in many scenarios intentionality matters far less than the harm or outcomes that arise. For example, if false claims lead to widespread distrust in vaccines, or undermine the electoral process, the intentionality behind those claims is secondary to the negative public outcomes. For that reason, and because it is often so difficult to identify intentionality, many of the stakeholders involved in countering disinformation focus their attention on preventing disinformation harms, rather than identifying or trying to find the source. Yet, it seems clear that identifying sources and their intentionality matters a great deal in the context of foreign affairs, security and defence. The concepts of hostile influence operations, grey zone techniques - such as those discussed by the Institute of International and European Affairs, IIEA, last week - and the concept of hybrid warfare all presuppose an actor intending to cause harm. In other words, the way people approach the problem in the context of defence and security is somewhat different from the way people approach the problem in other spheres. It is not that they are incompatible, but that the resources at work in one sphere do not automatically translate to another.

The second point is that it is important to avoid assuming a cause and effect relationship between exposure to disinformation and public attitudes. Popular discussions of disinformation tend to assume that people blindly believe the content they consume. For example, news and research reports often state how many times a disinformation video has been viewed or shared online. That just tells us about the popularity of that video; it says nothing about people’s attitudes towards disinformation. Research on this topic indicates that people engage with disinformation for all kinds of reasons and, more important, people’s acceptance or endorsement of disinformation narratives and false beliefs tends to be tied to a wider set of factors or issues, including their levels of objective knowledge about a topic. Put simply, if people have lower levels of objective knowledge about a topic, they are more likely to believe false claims about that topic. It is also tied to their levels of trust, perhaps in media or government, and their ideological biases, beliefs and opinions. In the context of defence and security, it is potentially worth thinking about public vulnerabilities in those contexts and not simply that exposure to disinformation itself is what creates the problem.

Third, there is growing evidence for the effectiveness of pre-bunking disinformation. Pre-bunking aims to neutralise the effects of disinformation by warning people that there is a threat and explaining how manipulation tactics work. The underlying idea is to pre-empt the disinformation people are likely to encounter and provide them with the tools to recognise it. For example, if people are told that something is a common manipulation tactic, when they see it in the real world or their everyday media experience, they should be able to recognise and reject it. Given the promise of this approach, researchers are now investigating how to integrate pre-bunking into fact-checking and media literacy but also strategic communication that goes out by any kind of organisation or public body. The idea is to pre-empt how actions might be distorted or confused. As with all disinformation countermeasures, the challenge lies in reaching the people who need it the most.

Finally, research on disinformation has been hampered by a lack of access to data from the online platforms. Currently, independent researchers and policymakers are unable to determine the true scale and impact of online disinformation because they lack access to reliable data that the platforms have. There are voluntary EU mechanisms, such as the code of practice on disinformation, where the major platforms agreed to provide data on disinformation relevant to member states. However, so far, this has failed to actually generate usable, informative data. In the absence of co-operation from the platforms, researchers, journalists and others must invest considerable time and resources to simply understand what is happening online. A great burden is often placed on public funding but also on civil society to understand what is happening when platforms could often provide us with a much better picture.

I thank members for their time. I am happy to answer any questions they have.

Ms Caitr?ona Heinl:

My statement aims primarily to emphasise the constantly changing nature of hybrid threats and their import to nation states, including Ireland. While members will see in the statement that there is no agreed definition for "hybrid threats", they are understood to comprise a combination of different types of tools, some expected and known and some unexpected and clandestine, applied to achieve an undeclared strategic objective. In short, our conceptual understanding of their nature is not just an academic point. It is important that we establish a baseline common understanding to then develop appropriate national, regional and international responses.

Actors’ objectives generally include undermining public trust in democratic institutions, deepening unhealthy polarisation both nationally and internationally, challenging the core values of democratic societies, gaining geopolitical influence through undermining others and affecting the decision-making capability of political leaders. It is well established that both state and non-state actors undertake this type of activity. Campaigns can be understood as co-ordinated actions across different domains. Members will also note that actors are observed to be constantly refining their tactics, techniques and procedures. In the written statement, they will find for their perusal annexe 1 and an image I have included which show the breadth of the tools and types of domains.

Specifically with a view to understanding the cyber and FIMI - foreign information manipulation and interference - disinformation nexus in the context of hybrid threats, I refer to the EU’s 2020 cybersecurity strategy, which explains how hybrid threats can combine disinformation campaigns with cyberattacks on infrastructure, economic processes and democratic institutions. The challenge is that this has the potential for causing physical damage, obtaining personal data, stealing industrial or state secrets, sowing mistrust and weakening social cohesion. It is understood that these activities undermine international security and stability and the benefits that cyberspace brings for economic, social and political development.

Members will note that the current national cybersecurity strategy for Ireland explains clearly that many hybrid threats have had a cyber component. It goes on to explain that as an open, liberal democracy, Ireland is vulnerable to campaigns of this type in much the same way as other EU member states. Similarly, the first annual progress report on the implementation of the EU strategic compass for security and defence, released in March 2023, specifies how FIMI is increasingly used as part of broader hybrid campaigns. In this regard, while so-called disinformation is not a new issue, there is a need to distinguish what is disinformation and what is security-related. It is also understood to be a security challenge comprising the deliberate activity of actors that use the information environment and manipulation of it as a strategic tool. It seems that in the Irish context, this conception of disinformation has not been overly focused on the geostrategic or security aspects with this FIMI-hybrid threat lens in processes like the Future of Media Commission.

The second section of the written statement draws on some key pointsvis-à-visthe threat landscape. In this regard, regular strategic threat assessments are necessary to develop better national security strategy and, by extension, our national responses to hybrid threats in the context of a constantly changing geostrategic and geopolitical environment. By way of example, at regional EU level, the first ever EU threat analysis was conducted in 2020 in order to properly prepare the EU strategic compass. The compass, as many members will be aware, specifies a number of relevant trends. I will speak to a few but not the entire list, in the interest of time. I also note that the White Paper and the 2019 update as well as the report of the Commission on the Defence Forces mentioned hybrid aggression specifically and related trends. In fact, there are approximately 50 mentions of “hybrid” in the commission's report.

In short, vis-à-vis the types of trends that the compass alludes too, hybrid threats are growing, both in frequency and their impact. Both state and non-state actors are using hybrid strategies, cyberattacks, disinformation campaigns, direct interference in elections and political processes, economic coercion and the instrumentalisation of irregular migration flows.

Two other trends are worth drawing members’ attention to. First, in respect of the armed aggression against Ukraine, the compass specifically finds that Russia is showing readiness to use the highest level of military forces, combined with hybrid tactics, cyberattacks and FIMI, and economic and energy coercion. It is also said to use crises, including by using disinformation and mercenaries as well as hybrid tactics, compromising the stability of other countries and their democratic processes. Most notably, this is viewed as having direct implications for European security. In this regard, I also note that the compass mentions other nation states that are also described as using hybrid tactics too. On the latest trends related to the compass, the March implementation report flags the instrumentalisation of food specifically.

Next in this regard, I draw to members’ attention some notable evolving and emerging trends that require our attention in the immediate term.

Four in particular are listed. First, drawing on United States threat assessments from earlier this year, those assessments identify that efforts by other countries to promote authoritarianism and spread disinformation is helping to fuel larger competition between democratic and authoritarian forms of government, exploiting global information flows, which is said to impact nearly all countries, contributing to democratic backsliding, threats of political instability and violent societal conflict. The second trend to note, from a number of different sources, is the indicators about the expansion of malign influence globally, including in other regions such as Africa, which could impact nations at home. A third notable trend is that some democratic states, and I emphasise "democratic states", are apparently engaging in digital repressions against the backdrop of broader digital influence operation. Fourth are indicators of increasing use of emerging and disruptive technologies for future geostrategic information purposes. For example, artificial intelligence, AI as a powerful information tool, could target societies and political establishments by impacting the content, speed and volume of information delivery and perception.

That brings me to the third section of the written statement, which focuses on responses. As the committee will see, in short, national and EU conceptual approaches to hybrid threats and increasing resilience continue to develop and mature. Annex 2, which I have attached to the statement, describes in particular Finland's approach to hybrid influencing, and it does so to provide an overview of the complexity and the breadth of measures which are being put in place by another EU nation state. Some examples of good practice measures, six in total, are included, but these are not exhaustive. As mentioned, first, establishing a baseline common understanding is key, as are regular strategic threat assessments. Third, a very important measure is that of a co-ordinated cross-governmental approach, given the combined and co-ordinated nature of hybrid tactics. The committee will note, from its reading of the Commission on the Defence Forces report, that there is no overarching national counterhybrid strategy. In this case, an overarching national framework would bring different relevant instruments together in a co-ordinated manner for the breadth of combined hybrid threats. The idea here is that this would increase co-ordination where in fact there are a number of relevant measures being implemented already by Ireland. The committee will also be aware of the specific report findings within the Commission on the Defence Forces report calling for a whole-of-government approach and the need to increase co-operation.

A fourth good practice measure is that of increasing situational awareness, where there is still an acknowledged gap globally in our understanding about what is actually happening. Deeper clarity is needed about who the actors are, their tools, tactics and techniques, and the nature of the threat level. In this regard, enhanced intelligence capacities would likely also be needed. A fifth very important point is that of building out societal resilience and developing whole-of-society solutions. It is widely acknowledged that this can be very difficult to achieve, but for example, raising resilience to foreign information manipulation and interference, FIMI, is by definition a whole-of-society effort. On this note, the committee will see within the written statement that governmental strategic communication mechanisms would provide a verifiable governmental source of content outside times of crisis and during peacetime. Members will also note new developments preceding the invasion of Ukraine, whereby intelligence was declassified and communicated as a counter-disinformation method. This is an example of one of the latest evolutions of communicating more transparently on intelligence and national security matters while also protecting sources and methods but with a view to bringing about consequences for nefarious actors.

Another good practice is to communicate transparently that government does not always have all the solutions and it must work together with the whole of society, specifically with regard to cyber. A next related point is that there is a need for support of non-governmental independent research enterprises and engagement with the media to inform independent content. The idea is that this would foster a fact-based information environment and increase our ability to access information from many different trusted sources. There is naturally value in continuing to draw on, learn from and engage with EU responses and like-minded partners. Some examples of good practice in EU initiatives include the work of the European Centre of Excellence for Countering Hybrid Threats, which releases new methodologies regularly and assists with ongoing capability development. As the committee knows, Ireland became a member in January 2023.

There are a number of EU directives relevant to this space and enhancing resilience which are being implemented or are due to be implemented. I will conclude and look forward to the discussion. I thank the Chair.

Professor Brigid Laffan:

I thank the committee for the invitation to be here to participate in these deliberations. The last time I spoke at this committee, it was not the Joint Committee on Foreign Affairs and Defence, just foreign affairs. That is an important development with regard to the parliamentary accountability for those very important areas. It is also important that I emphasise to members that I do not consider myself a specialist on defence and security. I have spent 40 years of my academic career working on the European Union and on the dynamic of European integration, and that is the perspective I can bring here. However, it is not possible to analyse the EU today or where it is going without due recognition of the shifts and shocks in global politics and that so much of the future of the EU will be determined by forces outside of Europe and how Europe responds to those forces. In that context, security has ratcheted up the agenda of the EU in that the Foreign Affairs Council is meeting much more frequently together with defence ministers, and there is also the institutionalisation of meetings involving the Foreign Affairs Council and the chiefs of staff of the armed forces of member states. There is no doubt there has been a sea change within the EU regarding the centrality of security, broadly defined.

When looking at the shifts and shocks in global politics, the first is obviously the ending of the geopolitical holiday in the world. It was possible, after 1989 and the collapse of communism, to think that the singular US hegemon would bring order and security to the world, but that is not the case. We now live in a world of great power competition, and how that works out will have major implications for the EU and, inevitably, for Ireland. Obviously, the balance between competition and co-operation in the relationship between the US and China is very important. However, what we can certainly say is that the unipolar world is over. We now live in a multipolar world where the rules-based international order is much weaker and under threat, and we do not know what kind of pole the EU can be or what it will achieve in the next phase or, in other words, where it places itself in this world order or disorder.

The second momentous development has been the return of war to the European Continent with the invasion of Ukraine. It is really important we grasp the impact or importance of this because this is the first time there has been an interstate war in Europe since the Second World War. It is the first time that a country has invaded another with the express intention of taking its sovereignty and overwhelming its culture. Prior to the invasion of Crimea in 2014 and then the broader war, the Russian state engaged in multiple subversive activities against Ukraine, including every element of cyber threat. At least now in Europe, for the EU, the war in Ukraine has shattered any pervasive complacency that Europe's security and way of life is assured. It should also shatter any complacency on this island.

The hardening of geopolitics poses immense dilemmas for the EU, because the EU is largely driven, or was historically, by the management of economic interdependence. To have to suddenly confront the changing security landscape is a challenge for the EU but also for all of the members states.

Mr. Olaf Schultz, the Chancellor of the Federal Republic of Germany was not wrong when he said that this was a zeitenwende, a transformative phase. It is that important. We must situate any discussion on hybrid threats and disinformation in the context of this very different security landscape and very different political dynamic that we now find ourselves in, in Europe. Obviously there has been a transaltantic response to what has happened in Ukraine, but a very strong battles of narratives about the war is going on within Europe. It is also within the transatlantic area but also, more importantly, with the global self. I hesitate to use that phrase because I dislike the term.

Concern for hybrid threats and disinformation is not new but of course it accelerates with all of the new communications tools. Digitalisation and developments in computational capacity mean that hybrid threats can vary, they can morph into different things, and they are essentially designed to go below the radar and to have plausible deniability. In other words, to be able to say "not us". So they are difficult to detect and it is difficult to see who is at fault and who is to blame. We should be under no illusion that the purpose of hybrid threat is to undermine. These threats are usually perpetrated by non-democratic states against democratic states and open societies are particularly vulnerable precisely because of the strength of the openness. The intention is always to undermine the institutions of a state or of a group of states, and to potentially undermine its economy, elements of the political system, public administration, and also critical infrastructure. Disinformation is part of the hybrid toolkit. It is the most visible element in terms of the manipulation, information warfare and all of that.

There is no doubt that addressing hybrid threats and disinformation is very high on the EU and NATO agendas and on the agendas of the member states today. We see in the EU response to all of this that the EU responds as it does to everything. It starts by institutionalising. It puts in place structures to begin to think about the problem. It goes into problem-solving mode. From around 2016 onwards the EU set up the EU Hybrid Fusion Cell within the European External Action Service. It then created strategic communication capabilities to counteract disinformation and as already mentioned established the European Centre for Excellence for Countering Hybrid Threats in Helsinki. That is a network-type organisation to bring best practice, practitioners and academics, shared experience, training and new ideas. It is also a forum for EU and NATO co-operation.

We have to ask ourselves why it took Ireland until January 2023 to become a member of this centre of excellence. It was initiated in 2016 and copperfastened in 2017 with 16 states. There are now 33 states and Ireland was either number 32 or 33 to join. We have to ask ourselves why it took Ireland so long to join a centre of excellence for hybrid threat. In the EU strategic compass a whole set of the strategic compass deals with hybrid threats and is developing what they call the hybrid toolkit to look at all of the countermeasures and to develop new ones. Within the EU Council of Ministers system there is now a working party on enhancing resilience and countering hybrid threats. That is where national officials link into the council system which in turn goes up the hierarchy to ministerial council level. Therefore a lot of work is being done in the European Commission, in the European External Action Service, EEAS, and in the European Council.

There are countries that are much more active than we are in this space. Finland was mentioned. If one wants to look at a country that for sound geographical reasons inevitably takes security very seriously then we should look no further than the Finns. Finland was one of the few countries that continued to focus on territorial defence and on all potential threats after 1989. What is happening in the Arctic is interesting, and again this is something that I do not think we are conscious of here. Every country north of Ireland is involved in the Arctic and I do not think it crosses our horizon.

I will finish with two questions. How active and embedded is Ireland in all of these different elements of institutionalisation? Is Ireland's system, at domestic level, sufficiently co-ordinated with clear tasks in different Departments to feed into this? Do we know, for example, who the contact points are in these various elements? What relationship do we envisage to NATO activities in this sphere, particularly in terms of critical infrastructure and the much-identified undersea cables that we hear an awful lot about now? I thank the committee.

James Lawless (Kildare North, Fianna Fail)
Link to this: Individually | In context | Oireachtas source

I thank the three witnesses for the really comprehensive overview of the issues. We are lucky and privileged to have such expertise and experience available to us. I apologise in advance as I have to leave the meeting shortly after I ask my questions because I have another committee meeting. I will try to catch the answers before I leave. I have a couple of points. All the witnesses touched on this in different ways and Professor Laffan mentioned Ireland was late joining the European Centre for Excellence for Countering Hybrid Threats. We have probably been late to the table in a few fields. My own view is that there has been a certain degree of complacency, naivety, ignorance, or lack of awareness in this country to date. I think that has shifted since Ukraine but it should have shifted a long time before that but for whatever reason it did not. We are getting there. The Tánaiste is doing an exemplary job in leading us on the path we need to go down at the moment in terms of the consultations etc. that are under way.

Sometimes those of us who thought to raise awareness, alerts or concerns about these issues were met with the sort of response of, "Why would anyone be interested in Ireland. Are we not this little old country on the edge of Europe and sure who would be bothered with our affairs?" To counter that, I ask the witnesses if it is true that many such attacks or interests that might be taken are opportunistic in nature and do not necessarily require a high degree of collaboration, resources or effort. In actual fact it is minmax - minimal effort for maximum return - and I assume it would be in the interest of many hostile member states and other organisations to destabilise an EU member state. Ireland is a lot more strategic than some might think in terms of the data that is housed here, the multinationals based here, the economic activity that goes on here and the fact we are on the edge of Europe and the telecoms cables that flow from it. That is my first question in terms of the riposte we sometimes get that, "Oh sure look, we are little old Ireland. We are neutral and innocent and why would anybody be interested?". There are lots of reasons but I am interested in the expert view on that.

My next point is about online disinformation. Ms Heinl spoke about online disinformation and campaigns and all of the witnesses touched on it in different ways. It is so true that it is such a vast canvas to be painted by those who engage in disinformation. To what extent can we learn from pre-online? There has always been disinformation of sorts. I am thinking about aircraft dropping leaflets into enemy territory or onto occupied lands during wartime, and guerilla radio stations. It is a sport somebody might be reluctant to engage in but that has been the case historically, broadcasting into occupied areas or broadcasting out, trying to sow confusion. Even in our own country we have seen a flyer drop, I think around the time of the Lisbon treaty, to every household in the country with a predecessor of the UK Independence Party, UKIP, probably largely behind it. It was possibly sponsored by other interests elsewhere but there was activity to undermine a democratic process here.

That is not a new thing; it happened 20 years ago or more. To what extent have the age-old techniques adjusted to the online age? To what extent can defences learned in the past be deployed?

While we probably will not have time to get into it all today even though it would be of great interest, Professor Laffan made some very interesting points about the new world order, the rules-based order being under threat and the unipolar system being replaced by a multipolar system. The thought that struck me as she was speaking is whether the EU is a great power. I would like to think that it aspires to be, but I am not sure if it is quite there yet. She spoke about the US hegemony and it is usually phrased in the US as being China, Russia, of course, maybe BRIC. That is an interesting question and we might not get to the answer for that one today. She also encompassed the hybrid threat to power, utilities and telecoms. There is much more than disinformation. The hybrid is a very vast space and it is overdue that we got on board with that.

My last question is topical. What lessons, if any, are to be learned? We saw a vulnerability in our 1.13 state last week with The Irish Timesfake tan article. To what extent does that show vulnerabilities in the system as a whole and in terms of how actors for whatever purpose or motivation can actually get in under the hood masquerading as something else to great effect? What lessons can be learned from that experience?

Dr. Eileen Culloty:

The Deputy's first point was about issue awareness. As I mentioned in the opening statement, we know that people are far more vulnerable or susceptible to disinformation when they lack objective knowledge about a topic. Therefore, the less someone knows, the more likely they are to believe false claims or rumours about it. It is not that controversial to say that in Ireland as a whole, through our media system we tend not to get an enormous amount of coverage or pay much attention to international events or events in Europe. That creates a gap where it can be quite easy to put forward claims about what is happening in Europe or what other countries are doing and people do not necessarily have the knowledge to counteract it. As a small island on the west of Europe, it also creates a psychological distance which we need to overcome to make it clear to people that these are issues.

The Deputy said that disinformation is not a new problem and of course it is not. Warfare has always been a battlefield for controlling how people understand and perceive what is going on. What is completely different are the speed, scale, technology and the capacity to generate. The Deputy spoke about dropping leaflets from the sky. Those doing so needed to own planes to be able to do that. Nowadays people do not need much skill or capability at all, which is quite shocking. Enormous attention has been given to things like ChatGPT. It is quite shocking how powerful that could be to generate vast amounts of content.

Sticking with the war metaphor, we are very much in an arms race with these technologies. For example, The Irish Timeshoax at the weekend happened because the image was not up to scratch. I saw that image and did not take any notice of it. People who do that for a living very quickly saw there was something wrong with that. We cannot expect that those images will continue to be of poor quality; they will get better. The same applies with things created by ChatGPT. It is obvious at the moment, but it will get much better. Even things like bots or trying to detect them, they are usually just based on the fact that the technology is not great yet but we know that it will get better. As soon as we start developing the capability to detect something, the technology moves on again. That is the huge difference.

On the lessons that can be drawn from that, we need to be extremely vigilant and have good procedures in place in any scenario. We do not fully know what happened in The Irish Timescase. Many hoaxes have been perpetrated on international media, such as fake profiles, including LinkedIn profiles linking to blog posts which might have been built up over years, making it appear to be a real person.

Ms Caitr?ona Heinl:

I will address the Deputy's question about enhancing resilience and increasing our defence. My broad sense is that there are a number of relevant measures which are either being implemented in Ireland or due to be implemented. However, it is not clear whether they are under a co-ordinated framework. That said, I might give some examples that I am sure he would be aware of already. These include signing up to the declaration for the future of the Internet. Regarding economic resilience efforts, there have been a number of relevant legislative instruments and maturing regimes related to, for example, the strategic investment screening regime, export controls and so forth. There are a number of EU directives that are in the mix to be implemented shortly. I can provide a longer list another time, including, for instance, the critical entities resilience directive, NIS2, and so forth.

Vis-à-vis whole-of-government capability, the role of An Garda Síochána and civilian capability will become paramount. While the findings of the Commission on the Defence Forces report naturally focused on military capability and structures, the group found that the civil-military, civ-mil, contribution from the very beginning is key. Naturally it is up to Government to decide how to implement those recommendations. More information is available vis-à-visstructures and capabilities as they relate to hybrid, but in particular the Commission spent some time looking at how that would integrate across the civilian structures to add value.

I mentioned in my statement the measures within the current iteration of national cybersecurity strategy. It contains the types of cyber measures relevant to the cyber component of hybrid threats. I understand that the mid-term review of that strategy is under way. While it is very broad brush, I think it speaks to the breadth of the issues we are talking about.

Professor Brigid Laffan:

Regarding why we should not be complacent, core Irish economic interests are at stake here. We store so much data that we cannot afford to have a major incident affecting a multinational investment in Ireland. We also need to consider our own critical infrastructure. It is very important that it is now in the public domain and in the political domain with the consultative forum coming up. We need to realise that while geography is important, it is not everything.

Regarding online disinformation, as our educational systems evolve and develop it is important to have adequate media literacy and communications literacy. We also need to develop critical thinking. New knowledge comes so quickly now that the capacity to think critically is probably one of the skills that we need now and more so in the future.

The Deputy asked if the EU is a great power. It is an economic power, but in my view, it is never likely to be a scaled-up version of a nation state, a big federal system. That is not in prospect. The concept that I am developing in my own work is the EU as a collective power. That is the power to get things done, to be resilient and to respond - the power with the member states. Through Brexit, the pandemic and the invasion of Ukraine, the EU has shown it can be a collective power. Given the world we live in now, another step change is required. Europe should not want to be tethered to Washington with everything that Washington decides somehow becoming European foreign policy. Equally with China, there is a battle royal going on at the moment on China policy, on de-risking and not decoupling. The EU needs to manage to have enough agency and space to be its own player in the world.

I chaired an event in Brussels last night with Commissioner Borrell and his argument was that the EU needs to be a player, rather than a plaything, and needs to learn the language of power. For an awful long time, the EU wanted the world to be like the EU, but that is not the world in which we live. Much is happening at present - with implications for Ireland - that we need to scan, keep abreast of, influence and shape.

Cathal Berry (Kildare South, Independent)
Link to this: Individually | In context | Oireachtas source

I thank the witnesses for their excellent opening presentations and statements. I will start with Dr. Culloty. I take her views on debunking. It is very important. I remember when Ben Wallace, the defence secretary in the UK, published that article in UK newspapers a couple of days before the full-scale invasion of Ukraine by Russia. He introduced words that most people in Ireland had not heard, that is, straw man and false-flag attack. It was an excellent example of how one can inoculate the public in advance of what is likely to happen down the tracks. The article was very good. The other comment Dr. Culloty made is true; it is the first conflict, at least that I remember, where intelligence is declassified almost in real time and pumped out on social media to counteract what the authoritarian states are doing. It is very effective. I have a question for Dr. Culloty on media literacy training. I understand some training takes place in secondary schools at present but I am not sure to what extent, that is, whether it is just in transition year or ingrained throughout the whole cycle. Does Dr. Culloty have any updates for the committee on what kind of media literacy training is taking place for Irish students and whether we can improve it in any way? That would be very useful.

Ms Heinl mentioned, quite rightly, that there is no overarching counter-hybrid strategy in Ireland, but there is not really even a national security strategy. I am trying to establish how normal or abnormal that is. Is it normal for a country not to have a national security strategy? We have the National Security Analysis Centre, NSAC, but apparently the boss, Dermot Woods, has a part-time role, among other roles he has in the Department of the Taoiseach. Is it normal for someone to have such an important position in a part-time capacity, throughout the EU and the developed world? We do not have a national security adviser in Ireland. How normal or abnormal is that? It strikes me as unusual that Ireland, of all countries, does not have a national security adviser.

I take Professor Laffan's point about the Arctic, in that it is a blind spot for us. We are fairly secure to the west, south and east, but there is a blatant gap to our north. There are no countries there. People are under the impression that Russia and Ukraine are thousands of miles away, but I would argue that Russian warships can sail right up to the 12-nautical-mile limit of Irish territorial waters. Thus, sovereign Russia is only 12 nautical miles away. That is a big concern. How is Ireland's lack of defence capacity perceived in the EU? Is it worried? Are we a burden on the EU? I recall that in the run-up to the financial crisis, many rational, moderate voices from the EU were warning Ireland. They were saying it was not normal; that our banks and our property situation were out of control and we needed to take action. Not only were they completely ignored, they were actively mocked. I remember certain politicians at the time shouting back at Europe and saying it was just jealous of the extraordinary economic success we had. I see similarities and parallels in the advice and warnings we were given in the run-up to 2007 and what we are getting now. It is obviously a different sphere. It is not economic anymore; it is more security focused. I am interested to hear Professor Laffan's views on how the EU and even places beyond the EU, perceive Ireland's inability to defend and protect itself.

Dr. Eileen Culloty:

I will start on the media literacy point. It is interesting the Deputy mentioned Ben Wallace and that work on the straw-man fallacy. It is critical thinking, as Professor Laffan mentioned. We know that in conflicts, one of the most common types of objections presented is whataboutism, which we are all very familiar with in this country. Whataboutism is a straw-man fallacy, but most people have never heard that term. They have never had it pointed out to them. The work on prebunking is very positive. One can do a considerable amount just by explaining common arguments to people. It is also worth noting that those types of fallacies appear in all aspects of life and in politics in general. They are not limited to conflicts. It is worth knowing media literacy is separate to critical thinking. As someone who specialises in media, I think media literacy is valuable in itself, but we should not think it will be a panacea and solve all of these problems either. Critical thinking needs to be developed as well.

A media literacy short course is offered in secondary schools, but it is voluntary. The issues are in who signs up to it, who is missing out on it and whether the people who need it most are getting it. We saw during the pandemic that the need for media literacy is not limited to school children. It is a good place to start but there are other people in society who might need it as well. Another issue is that the teachers going in to the schools need to have the training to do it. We can offer things in schools, but do the teachers have training? A national association was set up by Coimisiún na Meán called Media Literacy Ireland. It has brought together all kinds of stakeholders; national media outlets, the library system, schools and university academics and they work on national campaigns such as Be Media Smart and provide training. Media Literacy Ireland is a very promising route to develop capacities in order that different bodies, including charities such as Age Action Ireland, can advance what they are doing in media literacy.

Ms Caitr?ona Heinl:

Some states have a national security strategy and others do not. Some states that have a national security strategy, as the Deputy will probably be aware, do not necessarily publish them either. That said, there is an ongoing debate within a number of countries and among the academic community, as to the value of having a national security strategy. Thus, it is not set in stone. The debate surrounds the value-add and cogency of having such a strategy and the strategic guidance that can be provided by it. A second, related debate is the value in publishing this material publicly, in order to increase transparency and raise awareness. We spoke at length about the importance of making sure that everyone understand the nature of the trends and threats that are under way. This is one method to achieve that.

Whether one is talking about counter-hybrid strategy, national defence strategy or national cyber strategy - the list goes on - the value-add of a national security strategy, be it is public or not, is that it should ideally provide strategic guidance for all aspects of defence and security. From there, those sub-categories have an overarching sense of strategic guidance. That said, a precursor to that type of strategic thinking is to take a step back. If a country does not undertake regular strategic threat assessments, that would possibly undermine the product of the national security strategy, because in order to come up with that type of guidance and overarching framework, one needs to understand the state of play.

I emphasise regularity in some countries. I mentioned the United States in the submission, which conducts annual global threat assessments. That is just one example; I also alluded to the EU. The precursor, or the work conducted in order to properly inform the strategic compass for security and defence for the EU, which is the pathway for security and defence for the next five to ten years, was a classified threat analysis.

In the case of the EU, it remains classified. I will stop there. Hopefully that answers the Deputy's question.

Professor Brigid Laffan:

I thank the Deputy for the questions. On the Arctic, climate change means that the Arctic will come into play with shipping lines in a very real way. The Chinese are looking at that and the Russians come down from Murmansk and right around. There is no doubt that the Finns, the Norwegians, the British, the Americans, the Canadians and the Russians are all there. The Chinese are there. It had a governance system but some of those arrangements and agreements are running out and it is going to be much more difficult in the context of the battle for the resources and the next phase. We have to ask what the implications of that are for Ireland and at least pay some attention to what is happening to our north.

Regarding attitudes towards Ireland, it is very difficult to answer in terms of defence and security. There would be a lot of respect for Ireland's record in peacekeeping and for Ireland's contributions to all the various action groups it has been involved in. Whenever the Irish armed forces are involved, they do a very good and competent job. The bigger question relates to the fact that as the EU develops, it is going to have to become a stronger security provider. It is already there. That is with regard to both the relationship between the EU and NATO but also PESCO and interoperability and all of that. In industrial policy, the EU is going to be there. At a minimum what Ireland cannot do is prevent other countries from doing what they think is necessary in their defence and security. That is the bottom line. We should not be a drag on what other countries feel they need to do.

There probably is a second issue around solidarity. For example, the European peace facility is now being used to provide material benefits to Ukraine, including lethal weapons. Of course, we constructively abstain from that part. I wonder if that is a sustainable policy. Is it something we need to think through? If we are supplying elements or certain things for the Ukrainian army but not lethal weapons, we are still accepting the need to fight. What does that mean? With Ireland's Brexit experience we had the extraordinary solidarity of 26 countries that had our back right along the way. It was an extraordinary display of European solidarity for a country. It is not that that comes with an invoice; it does not. It does not come with an expectation but it should come with at least a reflection about our place in this changing system.

As long as the American security guarantee to Europe persists, there will be no pressure on the EU to have an army or anything like that. That is not even remotely possible. Hypothetically, however, if the US decided that the Pacific was more important or that it did not want to commit to the security of Europe, then Europe would have to face its own security. That would be a very different environment for Ireland.

Professor Brigid Laffan:

Regarding Ireland and security and the agenda, the Cathaoirleach is absolutely correct. Seán Lemass was very clear in the early 1960s that if defence became an EU competence, Ireland would be a fully-paid member of that. I think that lasted for a very long time. Ireland did not have to confront the security dimension of European integration acutely because security remained contested and limited in the EU as long as NATO was there and was stable. Now, we are in a different period with regard to industrial policy, the defence industries in Europe, the hybrid threats we discussed today and ensuring there is a strong European pillar of NATO, all of which revert to the EU either formally or in reality. In other words, it is the EU member states that will do it. In Ireland, because we did not have to confront it, there was a complacency about security and, as we are a small state in a benign security environment, relatively speaking, there was a sense that we were peaceful and were better than countries that saw their security through American-dominated NATO. In fact, we were just lucky. In class, I always tell my students to think of Ireland as being in the middle of the North Sea and what security policy we would have if we were on the other side of the island, as opposed to this side. In other words, it is the luck of geography. There is also a strong pro-neutrality strain in Irish society. I do not envisage Ireland becoming a NATO state but I think Ireland must look to its security and situate that in the wider European dynamic. We cannot, in the next phase, pretend that security is someone else's problem. A lot of work needs to be done in that regard.

On dynamics within the EU and the centre of gravity, the war inevitably pulled it east because that is where the security challenge and the war are. Poland has emerged as the leading pro-Ukraine country in the EU. I was struck just in the last 24 or 48 hours by President Zelenskyy's visits to Germany, France and the UK. Germany will now ratchet up its support for Ukraine. It has been a difficult internal battle in the coalition in Berlin but also for German society rightly because of the memory of the war. I am not so sure the shift will be on everything but I think the war is the coming-of-age of the so-called new member states. They are no longer new member states or in transition, they are fully-fledged member states. It is important to note that they did not do so well on grain because once it threatened their domestic agriculture, they began to kick back. On the Franco-German relationship, it is undergoing a difficult phase at the moment but never underestimate their ability, on some things, to solve their differences. Major developments in the EU cannot be done against Berlin and Paris, they must be done with them, irrespective of the extent to which they lead or not. Another important development I noticed is that the Commission is becoming, particularly in President Von der Leyen, much more comfortable making big foreign policy statements. Her China address in the third week of March was a case in point, in which she basically mapped out an EU response to China. As we know, she went to Beijing with President Macron and they were not exactly on the same page. There is almost a sense that Europe has to make choices about the kind of actor it is in the international system now; the functional pressures are strong. The alternative is you become the Borrell thing, you are a plaything for all the other great powers.

Ireland needs to encompass development in the High Arctic in its foreign policy. We have strengthened our relationship with small states such as the Netherlands, the Hansestadt, but we should always examine development more broadly in the EU and not lock ourselves into any one group of countries. It was interesting that on the Recovery and Resilience Fund, Ireland did not go with the frugal, which I think was smart politics. I do not feel I know enough about the possibilities for us in the High Arctic institutionally but we should absolutely not ignore it, particularly as it comes into play more now and in the future.

Joe O'Reilly (Fine Gael)
Link to this: Individually | In context | Oireachtas source

That was a very interesting exchange between the Cathaoirleach, as a former foreign Minister, and Professor Laffan. I welcome our guests, Professor Laffan in particular. I attended lectures of hers in the past and, I hope, learned a little from them. If I did not, it was not her fault. They were very interesting and good.

I welcome our two other guests as well, obviously.

We now have a vote in the Seanad. I will maybe go on a minute or two and then I will leave. As I am a Whip in the Seanad, it would be bad practice if I were to miss the vote.

On the opportunistic dimension, the HSE was a great example of a cyberattack and cost the State €90 million. A year or so ago I met a person I know and asked him what he was doing, and he said he had got a job in the Central Bank. He was in charge of trying to head off cyberattacks. I do not know if any of the witnesses are able to comment as to how capable we are of having people like that in the various sectors of our Civil Service etc. Have we got that kind of expertise, and are such staff armed properly, if that is the right word, to do this? Can we spend money on preventing such attacks within our Civil Service and State apparatus?

I would be interested in Professor Laffan's view as to whether the enlargement of the EU to include Ukraine, Montenegro, Georgia and Moldova would be helpful - I think it would - in the context of disinformation in that they might assist. It would be good to have them on board in the whole exercise.

Would the witnesses agree that Brexit was a very good example of disinformation in the UK? It was an example close to us. Putative President Hillary Clinton was on the television recently saying she attributes her non-election to Putin's interference. Was that another example?

It is good that we are joining the cyberdefence at EU level and that we would look to Finland as a model. The debunking thing is interesting in that we should have that done in schools, but it would want to be part of teacher education at primary and secondary level, as Dr. Culloty said.

I would be interested in the witnesses' comments on some of those matters but I must leave because I have to show some level of example.

David Stanton (Cork East, Fine Gael)
Link to this: Individually | In context | Oireachtas source

I am alone here, by the looks of things, but the witnesses are very welcome. This is our second week of excellent but quite frightening presentations. One of my sons told me that I am not a digital native. I am not sure if I am a digital immigrant or a digital refugee, but there is a serious point in that insofar as I understand that people who are digital natives think differently and that even some teachers have problems in communicating in schools because they think differently. Dr. Culloty said: "As with all disinformation countermeasures, the challenge lies in reaching the people who need ... [support]." Maybe she would tell us who these people who need support are. Would they be people like the Chairman, whom I assume is also not a digital native because he talked about 1972 and remembering it clearly, as I do. We have people who think in a certain way and who are used to all this. I came up on the train today and almost everybody in my carriage was on the phone. I came over on the bus afterwards. Everyone on the bus was on the phone. It reminds me of an old "Star Trek" episode in which they were all hypnotised by some kind of device and then had to try to break it. Science fact has overtaken science fiction in many ways. That is just one broad question about that area. Last Sunday I had some issue with my phone and I was amazed that my niece was able to tap, tap, tap and fix it straight away. I would be there two hours looking at it. There is a different way of thinking and manipulating and understanding this space. Dr. Culloty talked about people who need support most. I am aware of people of my vintage who get phone calls, emails and text messages from very persuasive and friendly people. Now and again, unfortunately, they give over bank details and then their money is gone. There is that generational divide, which the witnesses might comment on.

Core values have been mentioned on a few occasions, and I wish to link that with the threat to elections. I do not think that has been mentioned so far. The witnesses might comment on what we should be looking out for with respect to a threat to our electoral process here. Has there been any evidence of interference in past elections? What should we be looking out for in respect of the Electoral Commission, which I assume, rightly or wrongly, is awake to this risk? What can be done about that?

Ms Heinl mentioned the instrumentalisation of food. She might expand on that. I think I get the rest of what she said but I was curious about that.

Lawfare, using the law to cause problems, is also an interesting concept. The witnesses might expand on that as well for us.

If any of the witnesses were the Taoiseach tomorrow and were starting off with a new government, would they appoint a Minister with exclusive responsibility for this area?

I have another question for the witnesses. Would they assume at the moment - I asked this last week - that we are actually in a kind of war? In the past we had boots on ground. That is how we dealt with war. Now we have fingers on keyboards, and it is far more insidious but just as dangerous and quite disabling.

I might leave it at that. A lot of the other questions I wanted to ask have been covered already. They were just some thoughts that struck me on this. I think the whole issue of co-operation between agencies here in Ireland and a whole-of-government approach has been mentioned by everybody. I just wonder where we are there.

Dr. Eileen Culloty:

I will respond to Senator O'Reilly's point first and something he mentioned at the end of his contribution about Brexit and the US presidential election in 2016 being two examples of disinformation; they are two examples that are put out a lot. Yes, there was absolutely lots and lots of disinformation around those events but it is a mistake to assume that the disinformation caused the votes. As members will appreciate, as politicians who have to go out and persuade people to vote for them, it is hard to persuade people about anything. It is very hard to persuade people to vote, to change their mind, to vote for a party they did not vote for before and so on. The problem when we simplify what happened in those two countries down to disinformation is that we may neglect lots of other very important things about what was going on with voters that they were so dissatisfied with the EU in one context or the Democratic Party or Hillary Clinton in another. That is not to discount the importance of disinformation but just not to overstate it.

On Deputy Stanton's point about digital natives and vulnerabilities, again I think we tend to assume that young people, because we call them digital natives, are fine and pick things up very quickly. I think people right into middle age might use smartphones and might do online banking but they are not comfortable with it, do not feel knowledgeable about it and probably do feel a bit vulnerable. Just because you can use the skills does not mean you have the knowledge behind them to understand what is going on and how you might be manipulated. Disinformation vulnerabilities vary hugely. That is why there is no formula to say who is vulnerable. We tend to focus on older people a lot. I think one of the reasons for that is that most older people grew up in a world with limited information sources and they knew what they could trust. If somebody sounded like they knew who you were or it sounded like it came from a bank, you could trust that it was. It is very hard to keep pausing and to go back and to remember that you cannot. What we saw with Covid-19, for example, was that it was often much younger people who were more prone to false claims about vaccines because they did not perceive that the virus was as much a threat to them. Older people were far more attuned to the importance of vaccines. It is very situational, and that is what makes it challenging.

I think the reason schools are emphasised so much is that we hope that there will be a generational influence and that, over time, a resilience will be built up in a generation, and it is easy to access schools. In Ireland, though, we have fantastic networks of community groups, charity organisations and even sports organisations that cross generational divides. We are quite strong in that way, so I think there are opportunities there to get out those kinds of media literacy messages and to help people get through it.

On threats to elections, an advantage we have going into the next cycle of elections, which the Electoral Commission will hopefully benefit from, is that lots of other countries are looking at this and developing toolkits for how to protect elections. We can anticipate that there will be things around questioning the integrity of the electoral process or just putting out false information about how you vote, what kind of information is needed and so on. That can be anticipated well in advance and is not just the job of the Electoral Commission; the media has a big role to play there and there is also the case of being a good citizen and making sure that people are not confused.

Were I Taoiseach tomorrow, which is a scary prospect, one thing that would be worth doing is co-ordinating. We were talking about this earlier. Think of the different Departments we mentioned today. There are issues related to defence and foreign affairs as well as education and media. This cuts across so many different Departments so it is a question of how you co-ordinate and bring all that together. One of the reasons these types of issues are a challenge to address is that we tend to have these institutions that were built up before or, rather, we would not start where we are. We can have these fragmented responses so trying to co-ordinate things would be the best way forward.

Ms Caitr?ona Heinl:

Deputy Stanton asked about the instrumentalisation of food. There have been some developments around that in relation to the abuse of supply chains. Critical tech is another one that is crossing our radar where there are questions around how we reduce vulnerabilities and map out dependencies we might not have been aware of. Much of this activity has taken place at EU level but in order to have a full understanding of what is happening across Europe, states, and I expect that will include Ireland, will begin to map out their dependencies or vulnerabilities whether in critical tech or food supply chains.

On lawfare, there is something I did not mention which I probably should have. As well as using illegitimate means, some of these actors also use legal means. Lawfare is an interesting situation where in order to bring about political, military or economic objectives, activity can occur below the threshold of warfare but there is also the understanding of how international law functions to bring about those types of strategic objectives that we might not even be aware of. The Deputy may have heard of the term “unpeace”. Much of this activity, despite what is sadly happening in respect of the invasion of Ukraine, is happening in a period of unpeace. In that context, as well as food you could name a category where it is being instrumentalised. We focused a lot today on Europe but there is a lot of activity happening in other regions such as Africa. The issues surrounding food or supply chains are very prominent there but also tech and so on. It is about trying to figure out how activity in other regions can impact not only Ireland but other nation states at home.

Dr. Eileen Culloty:

Access to online platforms’ data has been a major issue for many years. At EU level, a task force was set up with the specific aim of trying to hear from the platforms what their issues were for not providing this information to independent researchers. It came up with a set of guidelines that would be GDPR compliant so there would be no breaches of people’s personal data or anything like that but this still has not manifested. The reason it is a problem is because, as I said in my opening statement, it takes massive resources for people to try to track and follow what is going on online. It is often not even possible. Platforms have much of this information themselves. This is down to things such as if an organisation puts out a fact check or if we were to put out a prebunk and people see it, what do they do afterwards? That is really basic stuff that would be worth knowing and we need data to actually do that. Work is happening at EU level. As the Chair noted, Ireland has all these platforms here. What politicians can do is to keep raising this and how it is not acceptable that democratic states are left trying to figure things out and that civil society and the public are left paying to try to figure things out when that information is there and could be made available.

It is about that co-ordination and the message that needs to keep being hammered back to those companies.

Ms Caitr?ona Heinl:

To speak to the question about the whole-of-government aspect, I would also like to emphasise the whole-of-society perspective. It will be remembered from the findings of the Commission on the Defence Forces report that the emphasis there was on the whole-of-government perspective. In addition to establishing the frameworks vis-à-vis a whole-of-Government context, it is also necessary to bear in mind that how the whole-of-society response is integrated will be key.

To answer the question concerning what is the priority or how to go about this process, I refer to establishing a framework or an overarching national strategy that can co-ordinate and bring together the relevant instruments that already exist, because quite a few such relevant instruments are already in place and being implemented, or those instruments we see in future as this space builds out. Some examples to which I alluded in the statement included relevant cyber mechanisms, the establishment of mechanisms to deal with FIMI and economic resilience tools. In this case, when we talk about economic resilience tools, we are talking about strategic investment screening mechanisms, export control regimes and the de-risking or reduction of economic dependencies. This is just to give a small example of the breadth of issues that I think need to be caught within this co-ordinating framework.

Mention was also made of NSAC. To be frank, I do not feel I have done enough analysis in this regard. I do not feel certain this is necessarily the right structure or body for this type of co-ordinating function. It might be, but I do not know. We would probably need to think about this aspect more deeply. The nature of this space might warrant a co-ordinating group or a separate framework to deal specifically with this issue. Alternatively, because we have NSAC already, it might be found that it is the perfect organisation for this type of thinking. I do not have the answer to this question, but we could think about this in more depth if necessary.

Réada Cronin (Kildare North, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I understand and will be brief. I thank the Cathaoirleach for letting me in. I was in the Chamber so I missed the start of the meeting. Is Professor Laffan online?

Réada Cronin (Kildare North, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I had a couple of questions for her. Turning to Dr. Culloty, in the last week we have been talking about disinformation. We had the case of the editorial process in The Irish Times being breached by an artificial intelligence, AI, article. Was Dr. Culloty surprised by that happening? If we leave the AI aspect out of this, there is a sense of standards being involved as well. I say this because we would expect the paper of record, which is how we would refer to The Irish Timeshere, to have better standards in the context of the risk of disinformation.

I missed the witnesses giving their opening statements, but I was burning the midnight oil reading the copies supplied last night. It is stated that "it is important to avoid assuming a cause-and-effect relationship between exposure to disinformation and public attitudes". This is interesting. If she can, will Dr. Culloty please talk about this point in respect of the hate speech legislation going through the Seanad now?

Dr. Eileen Culloty:

In terms of The Irish Timesarticle, I do not know all the details of this case, but the important thing is that this is a warning to all media outlets or, indeed, anybody else, engaging with any process like this, that it is liable to be duped. I mentioned earlier that very sophisticated types of hoaxes like this are actually quite common. These might involve having fake LinkedIn profiles, fake histories and lots of faked photographs spread around the Internet to give the impression that somebody is real. There is, therefore, an onus on all of us to be aware of these things.

The point about cause and effect was simply to just not discount all the other reasons involved in people's susceptibility to disinformation or certain narratives. It is not a case of someone seeing a false claim and being duped by it. Other things are usually going on. Similarly, with hate speech, the insidious aspect of this is that over time it is building up and changing people's values and the established norms in respect of what it is acceptable to say. It is not always about the individual instance, but about the cumulative effect over time.

Réada Cronin (Kildare North, Sinn Fein)
Link to this: Individually | In context | Oireachtas source

I am sorry for missing the earlier part of the meeting.