Information overload - digital services, email, email privacy, social media,

York-Earwaker · August 29, 2024, 3:35pm

Executive Summary
Vectors of attack on individuals or organisations have increased greatly since digitisation of human existence. Now most activity is mediated through the internet all individuals and all organisations in ‘modern’ digital societies are open to attacks. In the analogue era snail mail intercept was one of the only ways to engage in man in the middle MITM. With the telegraph and then telephony wire taps. Software as a Service SaaS, and other XaaS offerings, make vectors of attacks many times greater. Most private sector and public sector service offerings are now via digital channels. Some services are only available via digital channels.

“There are many reasons an insider can be or become malicious including revenge, coercion, ideology, ego or seeking financial gain through intellectual property theft or espionage.” - ASD

Use Case 01
Title: compromise service integrity to individual
Scenario: man in the middle attack

Social media algorithms force people down dangerous content rabbit holes. To reputational harm, legal harm, financial harm, radicalisation harm, and so on.
Groups, and individuals, with appropriate knowledge and skills can deliberately put content liable to harm an individual into the ‘recommendations’ stream. So that it appears as the content was suggested by the social media algorithm.
2.1 By people at a social media org. Which might be, directed by the social media orgs management hierarchy or directed by external groups who control social media employees.
2.2 By people external to social media who inject content into the http stream.

Threat actor (perpetrator): Malicious insider, Insider threat,
User actor (target): Anybody,

Use Case 02
Title: Release / publish private or sensitive information
Scenario: Doxing
Threat actor (perpetrator): Malicious insider, Insider threat
User actor (target): Anybody,

Use Case 03
Title: Radicalise someone
Scenario:
Threat actor (perpetrator): Malicious insider, Insider threat
User actor (target): Anybody,

Use Case 04
Title: Discredit / malign someone
Scenario:
Threat actor (perpetrator): Malicious insider, Insider threat
User actor (target): Anybody,

Use Case 05
Title: Impersonate someone
Scenario:
Threat actor (perpetrator): Malicious insider, Insider threat
User actor (target): Anybody,

Use Case 06
Title: Induce anxiety/fear in someone
Scenario: man in the middle attack, very similar to social media MITM

Use multiple channels to psychologically harm individual
Use digital channels, social media, sms, email, …
Use analogue channels, local advertising, local services MITM actors, …
…

Threat actor (perpetrator): Malicious insider, Insider threat
User actor (target): Anybody,
Extension points: Intrude by click bait, Intrude by Email, Intrude by SMS, Intrude by phone call, Intrude track by phone, …

Use Case 07
Title: Intrude by click bait
Scenario: MITM attack, Click bait, induce anxiety/fear in someone

Click bait news sites, manipulate the news story feeds, headlines and images, to psychologically manipulate someone.
To purposely lead someone to content which might harm them.
Induce negative emotion to manipulate them.
Cause them to go into a negative emotional spiral.
Cause them to go down specific internet rabbit holes. Into human spider traps of endless harmful content.
Cause them to go to ‘find’ other content which would lead to negative outcomes; reputational harm, legal harm, occupational harm, worst case radicalisation harm, and so on.
Sow fear paranoia and distrust. Presenting images other third parties, or headlines about them, who might be know, to the target even if tangentially. Implying some negative or harmful action by the third party against the target.
Sow fear paranoia and distrust. We know you know we are doing this to you. But who are we? We’re coming to get you? But at a time of our choosing.