If the problems for nation states are difficult to solve in the cyber domain, they are close to intractable at present when it comes to the related but very different area of information warfare. Yet the threats are every bit as real, and the need for an effective ability to counter adversaries arguably just as urgent.

What used to be referred to as information operations – or, perhaps less euphemistically, propaganda – has taken on new shapes and forms in recent years, as the internet, smartphone technology and social media have combined to offer different entities a potentially very powerful means of destabilizing their adversaries. These attacks seek to poison the wells of public discussion, and sow discord by amplifying divisions or increasing polarization. That they are working is no longer a matter of serious debate.

Both cyber and information warfare present similar difficulties over attributing attacks, and for policymakers, determining a proportionate response is at least as challenging in either situation. The key difference is that in cyber warfare, technical capabilities (or errors) in networks and software are used to deliver effects, thus leaving clues that skilled analysts can eventually pull together to understand what has happened, and prevent it from being possible in future. Cyberspace may be used to spread weaponized information, but in attacks, networks are not used as an active delivery mechanism but as a passive distribution channel.

So cyberspace may be the medium by which the disruptive effects are achieved, but any technical preventative measure risks undermining western democracies’ fundamental principles of openness and freedom of expression. And, often, those spreading the damaging or destabilizing “payload” are unwitting citizens of the states under attack. No security agency, defense department or police force is realistically able to thwart attacks of this type – and no government other than the most authoritarian is likely to ask them to.

“We were always very reluctant, in the agencies, to get involved in that,” says former GCHQ director Robert Hannigan, responding during the Infosec Europe conference in London to a question from ShowNews about agencies’ role during information attacks. “There’s a civil-liberties issue, in terms of agencies getting into social networks and social media. Indeed, there are legal constraints. [Security agencies are] not the right place to go to.”

There are, nevertheless, things that governments can do to counter digital propaganda and influence operations. One state that has been in the crosshairs for broad-based information attacks is Lithuania. During the Global SOF (Special Operations Forces) Foundation’s European Symposium last year, a speaker from that country (presentations at the event were given on a non-attributable basis) explained how the pushback to information attacks on the country was catalyzed by government, and came from ordinary people.

“Lithuanians conducted a large public-awareness-raising campaign to educate their citizens about information-warfare and propaganda,” the speaker said. “Some active Lithuanian citizens organized into a group and called themselves Elves. They are active in disclosing propaganda of Russian trolls in social networks and media web pages. Among these elves we can find people of various professions, from IT specialists to technologists. What unites them is an understanding that they are an important part of the fight against propaganda.”

Hannigan argues that tech companies and social-media platforms have a role to play, and that technology may be able to be deployed to counter information warfare – but only in certain narrowly defined aspects.

“This is a kind of weaponizing of information that is very serious, and a serious threat to democracy,” he says. “But it’s not a technical or cyber threat, except insofar as they’re manufacturing [web and social-media] accounts. But that’s pretty basic, I think – and ultimately it’s a problem for the tech companies to solve, not for government.”

Using democratic structures and concepts to shore up democratic institutions will probably prove more effective in the long term than attempting to impose top-down solutions.

“There are different rules of the game,” the Lithuanian says. “We have very strict democratic rules – on freedom of speech, usage of law, and so on. Our opponents don’t have rules at all – they just do what they like. They’re using all the tools and networks to achieve a result, and this is a challenge. The defense is not only tanks and patriots and boots on the ground and cyber professionals, but it’s also the need to share information and make efforts with information warfare. That [will give a] common understanding, and from a common understanding we can build resilience.