Executive Summary: Use of everyday technology to collect personal data is increasing, and as these efforts become more intrusive, popular resentment is likely to grow. If that irritation reaches a tipping point, existing privacy protection services will expand enormously—creating an Information Disruption Industry (IDI) dedicated to thwarting the collection, storage, and sale of personal data. The expanded IDI’s efforts will do direct and indirect damage to a wide range of systems—even systems unrelated to personal data collection. This likely scenario has the potential to seriously impact the information landscape in 2035, if not sooner. End of Summary I presented the paper in a webinar hosted by the Mad Scientist Initiative and Georgetown University on May 10, 2020. The complete webinar can be viewed at: https://www.youtube.com/watch?v=j2-cjW1cmrQ&t=75s

1. The Information Disruption
Industry and the Operational
Environment of the Future
By Vincent H. O’Neil

2. Outline
• Executive Summary
• Introduction
• The Expanding Information Disruption Industry
• Ramifications for the Operational Environment
• What to Do—First Steps
• Summary

3. Executive Summary
Use of everyday technology to collect personal data is
increasing, and as these efforts become more intrusive,
popular resentment is likely to grow.
If that irritation reaches a tipping point, existing privacy
protection services will expand enormously—creating an
Information Disruption Industry (IDI) dedicated to thwarting
the collection, storage, and sale of personal data.
The expanded IDI’s efforts will do direct and indirect damage
to a wide range of systems—even systems unrelated to
personal data collection.
This likely scenario has the potential to seriously impact the
information landscape in 2035, if not sooner.

4. Collection of Personal Data
People are already concerned about this collection:
• Mentioning a product in an electronic communication often
causes the appearance of online ads about that product
• Cases such as the Cambridge Analytica scandal show large-
scale collection of personal data goes on without public
consent
• News stories and/or personal notifications about corporate
data breaches feed the belief that no collected information
is safe

5. Popular Resentment
Resentment: Bitter indignation at being treated unfairly
The targets of the data collection dislike the invasion of their
privacy already. That feeling is multiplied by the realization:
• They’re paying for the devices (phones and cars) commonly
used to track their behavior, habits, and movements
• The tracking and collection is often concealed from them
• Their personal devices could potentially be accessed as part
of legal proceedings

6. The Tipping Point
Public opinion could be shifted to outright resistance by news
stories showing data collection can cause actual harm:
• Domestic violence victims hiding from their tormentors who
were uncovered by technological tracking
• Conviction of innocent people through the use of
circumstantial evidence gained through personal data
collection
• Social media analysis by employers and/or universities that
rejected qualified candidates

7. Expansion of the Disruption Industry
Entities offering services designed to thwart the collection
and sharing of personal data already exist.
Once people see data collection and technological tracking as
a real threat, they’ll pay to protect themselves. That funding
will generate the expanded IDI.
The IDI’s techniques will range from covert alteration of data
to the crashing of entire systems.
PRECISION
• Overt
• Damaging
• Low-margin
• Stealthy
• Sophisticated
• High-end

8. Precise Disruption
• Target specific information as directed by the client
(movements, purchases, personal communications)
• Leave other information intact (high credit score, records of
education & employment)
• Key goal is to do this without detection
• Attracts staff from the collection industry—better pay and
more socially acceptable
• Will still do damage to systems:
• Disruption of normal system functions
• Unintended consequences
• Numerous, uncoordinated actors

9. Imprecise Disruption
• Monkey wrench-in-the-gears approach
• Low-end, low-margin business
• Not concerned with stealth
• May crash entire systems
• Cover for hackers—identifying a Trojan Horse is difficult
when it arrives in the middle of a stampede
• May give a significant boost to privacy protection overall:
• Cast doubt on the reliability of collection efforts
• Reduce the value of purchased data

10. Legal Acceptance
• Numerous court cases (lawsuits and criminal actions) are
likely to arise from this conflict
• Supreme Court rulings that connect the IDI—or its clients—
with the defense of individual rights will make the IDI even
more socially acceptable and give it legal protection
• Even if the collectors pledge to stop gathering personal
information, the public is unlikely to believe it
• The more precise operators could also offer a service where
they monitor clients’ personal information and repair it
when it’s damaged by the IDI

11. Continuous and Widespread Disruption
The IDI will attack the collection, storage, and dissemination
of personal data at every level and at every step in those
processes.
This will create a kaleidoscopic information landscape
populated with data that requires frequent verification and
systems that malfunction randomly.
All of this will generate second-order effects that will be as
harmful as they are unpredictable.

12. Second-Order Effects
The increasingly interconnected nature of the technological
world will magnify the impact of any disruptions and generate
problems in unexpected areas.
Hooking everything from household appliances to hospital
information systems to the internet creates a myriad of
opportunities for intentional—and unintentional—disruption.

13. Second-Order Effects - Example
Tracking technology that utilizes the GPS system will be a
particularly important target for the IDI. Disrupters seeking to
prevent the collection of information regarding a client’s
movements could attack the system itself or leverage systems
that connect to it.
The argument that barriers are in place to prevent this is not
sufficient, because the tech is constantly changing. Seemingly
minor adjustments to code, hardware, and protocols can
create unexpected vulnerabilities.

14. Ramifications for the Operational Environment
The expanded IDI has the potential to seriously impact the
operational environment in 2035— if not sooner.
Most US military technology is created by civilian businesses,
and modified versions can be sold in non-military markets.
That intersection alone has the potential to render many
military systems vulnerable.
Former military personnel will also join the ranks of disrupter
organizations, bringing valuable knowledge about the setup,
operation, and weaknesses of those systems.
Additionally, the confused nature of the information
landscape will assist actual enemy actors in their attempts to
attack government and military systems.

15. Non-Military Targets
These attacks won’t necessarily need to be directed at military
targets:
Disruptions of civilian communication systems will have a
negative impact on deployed troops who have gotten used to
being able to contact their loved ones.
Other disruptions such as compromised credit scores and
frozen bank accounts cannot help but distract deployed
soldiers from their missions and focus their attention back
home.

16. GPS Disruption
Revisiting the previous example regarding the GPS system, any
disruption of satellite location functionality could have
enormous consequences for the operational environment.
Lost units, misdirected supplies, and errant ordnance are just
a few of the potential ramifications.
No matter how advanced the technology becomes, it’s only
going to be as accurate as the information it uses and as
secure as the other systems it accesses.

17. Support Systems
Use of civilian technology for maintenance and logistical
functions leaves these vital areas open to the effects of any
disruptions that occur in those systems worldwide.
Patches and updates for these products are usually
mandatory and, while they may be designed to address a
problem or shortcoming in the existing system, they could
also carry code or information from disrupter organizations.

18. What to Do—First Steps
Operating in this future environment calls for a broad
approach designed to prepare for and manage the wide-
ranging impact of the expanded IDI.
A supervisory authority should be tasked to direct this effort,
and every level of the national defense apparatus has a role.

19. Verify the Data
Establish a mechanism to continuously verify information
and generate alerts: The national defense apparatus uses
many technological systems, frequently with overlapping
capabilities. That overlap could be leveraged to verify
information used across these systems and provide warning
when data is inaccurate or a function has been disrupted.
The systems don’t need to interface to create these
verification capabilities—on the contrary, connection would
make them vulnerable to the same threats.
As an example, this mechanism could provide ongoing checks
that geographical location A is actually situated at
geographical location A—and raise a red flag when one
system says it is not.

20. Ask, “What If?”
Conduct wargaming at all levels: The operational
environment includes a multitude of systems that could be
impacted by the IDI.
The supervisory authority mentioned earlier should require
the owners/operators of each system to identify every system
that connects to it and every entity that uses it.
Each of those systems and entities will undergo similar
analysis, creating a continuously updated nodal diagram
showing how these separate factors influence each other.
That will be the start point for wargaming the possible results
of disruptions anywhere across those nodes.

21. Create Redundancy
Identify substitutes and replacements: No amount of
wargaming or testing will prevent disruptions. Commands and
units must be ready to lose systems and keep functioning until
those systems are available again.
Lessons learned in the wargaming will help identify key
capabilities that must be maintained. It will also identify
systems that might be leveraged to do the different tasks of
the missing system in an emergency.
When no such temporary replacement can be found, or when
a system is simply too important, the creation of a redundant
system may be necessary.

22. Repair the Damage
Fix broken systems quickly: Identifying the “last functioning
point” before a disruption can help recover a malfunctioning
system. Frequent archiving of data and programming can offer
a chance of “resetting” the system to an earlier point that
brings it back into operation.
Lessons learned from cyber attacks and security breaches that
occur in peacetimes should be analyzed for techniques that
can be applied during wartime.
Existing disaster recovery and data recovery programs, both
public and private, could be good sources of additional tips
and techniques for this.

23. Identify Quick Fixes
Analyze field-expedient solutions: The supervisory authority
should create a “best practices” center that solicits, verifies,
tests, and disseminates information on variations, substitutions,
and workarounds developed in the field.
These best practices should be promulgated widely, so that
people working with System A will be aware of a workaround in
System B that can also be applied to System A in an emergency.

24. Provide Incentives
Encourage innovation and participation: Get everyone
involved in conducting “What if?” analysis and identifying
field expedients by creating a rewards program.
Money, public acknowledgment, medals, and promotions can
help motivate people to ask these questions and come up
with solutions ahead of time.

25. Train With Manual Options
Train with manual options: Leverage the results of the “what
if?” analysis and field expedients to identify every possible
means of manual intervention or substitution when a
system—or part of a system—is disrupted.
Make training on these manual options mandatory, and
include them in all operational manuals.
No matter how much effort goes into preparing for the loss of
a system, the force must be ready to do without a system for a
protracted period of time when necessary. When a substitute
system isn’t available and a manual option is, the force needs
to be trained and ready to use that manual option.

26. Summary
• Popular resentment of personal data collection is likely to
cause a dramatic expansion of the Information Disruption
Industry (IDI)
• The IDI’s efforts will do direct and indirect damage to a wide
range of technological systems—even systems unrelated to
personal data collection.
• This likely scenario has the potential to seriously impact the
information landscape in 2035, if not sooner.
• Operating in this future environment calls for a broad
approach designed to prepare for and combat the wide-
ranging impact of the IDI.

27. About the Author
Vincent H. O’Neil is a risk manager, writer, and public speaker.
He holds degrees from West Point and The Fletcher School.
He’s also the author of the Frank Cole mystery novels from St.
Martin’s Press and the Sim War military science fiction series
(written as Henry V. O’Neil) from HarperCollins.
www.vincenthoneil.com
www.linkedin.com/in/vincenthoneil