Written January 2008
When YouTube pulled down a leaked Tom Cruise video hyping the Church of Scientology, it unleashed the wrath of the hacker collective Anonymous. The group attacked Scientology websites and rallied protests of the church via social media. Over the next several years, Anonymous became a potent political force. During 2011's Arab Spring, the group launched Operation Tunisia to fight against government surveillance. The next year, Anons claimed to have attacked 650 websites in Israel after the country’s latest actions in the Gaza Strip.
Power Grids and Fighter Jets are where we are now.
Fast forward to April 2009.
Current and former U.S. officials revealed to The Wall Street Journal that Chinese and Russian spies hacked our critical infrastructure, including power grids. One official said that the intruders had not yet sought to destroy these systems, but had left behind software programs that would enable them to do so at the flick of a switch. “If we go to war with them,” he warned, “they will try to turn them on." Department of Homeland Security head Janet Napolitano said that “the vulnerability is something [we] have known about for years.” Reports also implicated China for hacking into the plans for the Pentagon's $300 billion Joint Strike Fighter project. The Chinese Embassy responded in a statement that China "opposes and forbids all forms of cybercrimes” and called the reports “a product of the Cold War mentality…fabricated to fan up China threat sensations."
After sanctions were imposed on North Korea following nuclear tests in late May, the U.S. and South Korea faced days of sustained cyberattacks. In the U.S., computers at agencies including the Defense Department, the Treasury Department, the Secret Service, the State Department, the Federal Trade Commission and the Federal Aviation Administration were subjected to denial-of-service attacks, along with tens of thousands of computers in South Korea, according to that country’s National Intelligence Service. Though North Korea was suspected of having orchestrated the attacks, the source remains unknown.
Google was attacked by hackers in China. Dubbed Operation Aurora, after the type of application the hackers used, the massive case of cyberespionage was later attributed to the Chinese government, with U.S. companies including Adobe, Symantec, Northrop Grumman, Morgan Stanley and Yahoo falling victim. U.S. government officials later said that the hackers breached a secret database with what the Washington Post called “years’ worth of information about U.S. surveillance targets,” specifically Chinese spies being monitored in the United States.
Cyberwar entered a dangerous new era with Stuxnet, a computer worm said to have been created by the U.S. and Israel that attacked a uranium-enrichment plant in Iran. By compromising the industrial systems-operation software, Stuxnet was capable of spying on and controlling the computers, as well as destroying centrifuges. Stuxnet, which could be installed on infected thumb drives, spread out of control to at least five other countries, including the U.S. Defense Secretary Leon Panetta warned of a possible “cyber Pearl Harbor.”
Operation Shady RAT
McAfee, the security-research firm, uncovered a massive five-year wave of hacker attacks against governments, nonprofits and corporations around the world. Called Shady RAT, for the remote-access tool used by the infiltrators, the breaches hit over 70 organizations including government agencies in the U.S., Taiwan, Canada, and India, as well as the International Olympic Committee and several defense contractors. McAfee attributed the attacks to a single state actor, though didn’t name the country, which some sources believe to be China. "This is the biggest transfer of wealth in terms of intellectual property in history,” a McAfee exec said at the time. “The scale at which this is occurring is really, really frightening.”
U.S. Weapons Plans Hacked
In a report prepared for the Pentagon, the Defense Science Board found that hackers from China had accessed plans for more than two dozen of the U.S.’s most advance weapons systems. The targets included the Patriot missile system, Aegis ballistic-missile-defense system, Black Hawk choppers and the $1.4 trillion F-35 Joint Strike Fighter, the costliest fighter jet ever made. “When I look at the theft of intellectual property to the tune of $1 trillion,” said Texas Rep. Michael McCaul, “that’s a serious economic issue for the United States.” A Chinese Foreign Ministry spokesman responded by saying that “China pays high attention to the cybersecurity issue and is firmly opposed to all forms of hacker attacks.”
Iran Hacks U.S. Energy Companies
Hackers, with the support of the Iranian government, were exposed for targeting oil and gas companies in the U.S. "This is representative of stepped-up cyberactivity by the Iranian regime. The more they do this, the more our concerns grow," one U.S. official said. "What they have done so far has certainly been noticed, and they should be cautious."
U.S. Goes on the Cyberoffensive
An unpublished presidential directive from Obama leaked, showing that the U.S. is going on the cyber offense. “Offensive Cyber Effects Operations,” the report stated, “can offer unique and unconventional capabilities to advance U.S. national objectives around the world with little or no warning to the adversary or target and with potential effects ranging from subtle to severely damaging.” Among other things, the report authorized cyberwar attacks when “U.S. national interests and equities” were at stake, but also left room for “anticipatory action” just in case. Adding fuel to the fire, National Security Agency leaker Edward Snowden claimed that the U.S. has already hacked thousands of targets, including computers in China.
Cyberwar, like any war, never rests. Neither does the simulated one taking place at HackMiami, where co-founder Rod Soto, a 38-year-old computer-security specialist from the area, is running a cyberwar game. Though the consequences of their hacking are fake, the technology they’re breaking is real. They actually are hacking Fedora, an operating system used by computers in China, infiltrating Zeus, a malicious “botnet” army of computers, and commandeering North Korean industrial controls for power-plant systems. It’s just that everything’s simulated and run on a closed network, so as not to inadvertently start World War III. The purpose of this event, besides the recruiting going on, is to teach the hackers how to find vulnerabilities in other nation’s machines. “It gives you the blueprint and the knowledge if you ever want to attack them,” Soto says.
So far, the truth about the extent of the U.S.’s offensive attacks against other countries has been shadowy at best. There’s Stuxnet, which has yet to be officially attributed to the U.S. (or Israel), and NSA leaker Edward Snowden’s recent claim the U.S. has launched widespread cyberattacks against China. Beyond that, the closest we’ve come was Hillary Clinton’s admission last year of a State Department attack on an Al Qaeda propaganda site in Yemen.
The tensions around this topic are partly because the laws governing cyberwar are still being determined. As Rear Adm. Margaret Klein, chief of staff of Cyber Command, the Ft. Meade-based defense center for U.S. military networks, put it last year, “Attorneys and scholars face a variety of complex legal issues arising around the use of this new technology.” But experts are pushing for more offensive measures regardless. The Commission on the Theft of American Intellectual Property concluded that “new options need to be considered.” It seems our government is already heeding the call.
A June leak of a presidential directive from Obama, which had been issued in October, reveals that the U.S. is, at the very least, getting its cyberwarriors in line. In addition to calling for a list of international targets, the directive argued that “Offensive Cyber Effects Operations... can offer unique and unconventional capabilities to advance U.S. national objectives around the world with little or no warning to the adversary or target and with potential effects ranging from subtle to severely damaging.”
But while the government remains quiet about the existence or extent of their offensive measures, hackers and contractors I spoke with are, albeit cautiously, more forthcoming. HackMiami organizers James Ball and Alex Heid, security specialists for a major financial company they prefer not to name so as not to anger their bosses, say they have based this weekend’s cyberwar simulation on real-life hacks they conducted on their own of terrorist networks and organized-crime groups. Ball infiltrated an Al Qaeda forum online and posted the archives on his site, TerroristMedia.com. Heid became notorious for hacking the stealthy Zeus botnet in Russia.
But the government hires private contractors to do such attacks on its behalf as well. The cyberwar underworld is rife with contractors who fashion themselves to be “the Blackwater of the Internet,” as Heid puts it, “information mercenaries…private sector guys who are going on the offensive, but you don’t hear about it.” At least not usually.
Companies like Accuvant are capable of creating custom software that can enter outside systems and gather intelligence or even shut down a server, for which they get can paid up to $1 million. For example, Humperdink says, they would be able to unleash an attack to take a country like China completely offline. “We could stop their cyberwarfare program,” he says. “Five years ago, I remember the North Koreans were doing missile testing, right? If [the U.S. government] came to a company like us and said, ‘Here’s $15 million,’ we could turn a North Korean missile into a brick. If you came to us with $20 million and said, ‘We wanna disable every computer there in Iran, and they’d have to replace them’ – not a problem.” For added flair, each program Accuvant sells gets its own cyberpunk handle – like Purple Mantis – and is delivered on a jet-black thumb drive inside a custom case with the name laser-etched on a plaque.
“So how many offensive plays are going on now?” I ask.
“A lot,” Bonvillain says.
“More than people would realize?”
“Yes,” he replies.
Then Bonvillain falls silent. He puffs his e-cigarette, considering a more diplomatic response. “The U.S. government,” he says, “is great at hiding everything they do.”
To see what the front line of cyberwar really looks like, I visit the National Cybersecurity and Communications Integration Center in Arlington, Virginia, the Department of Homeland Security’s mission control. It’s one of our most important hubs in digital warfare, alongside the FBI and NSA. A wall of video screens show online the attacks on the IRS and NASA – both agencies were compromised by a Distributed Denial of Service Attack, a technique that floods a site with access requests, slowing or downing it completely.
The four-year-old NCCIC – employees pronounce it “enkick” – is the country’s nerve center for online threats. Twenty-four hours a day, teams drawn from a pool of 500 DHS cyberpersonnel sit at the ready in this sprawling, windowless command cave. Flickering diagrams on the front wall track the dangers in real time: traffic anomalies at federal agencies, cyberalert levels for each state’s website, a map of our country’s telecommunications system (“There’s no cyber without fiber!” a steely engineer tells me).
Fortunately, at the moment, the threat against the IRS and NASA proves to be relatively harmless. However, the number of cyberincidents is on the rise. Fiscal year 2012 saw 190,000; this year’s number is already over 214,000.
Overhauling the feds’ image to lure young tech talent has become a major priority. In a way, it’s akin to the shift in Silicon Valley – away from the business suits of IBM to the Adidas sandals of today. The National Science Foundation now offers a CyberCorps Scholarship for Service program that places winning students in government agencies. The DHS is among the sponsors of the invite-only “Cyber Camps,” which hold hacking contests for prospective employees. Aside from the “sense of duty” and high-level security clearance that NCCIC director Larry Zelvin tells me lures his team away from fat paydays elsewhere, the power of being inside the government system is the greatest perk. “You just don’t get that in a corporation,” he says.
Last year, the DHS assembled a cyberskills task force, which drew from hacker hubs including Facebook and DefCon, to recommend changes in their recruiting. To get the estimated 600 more hackers the DHS needs, the report concluded, the agency should “focus more attention and resources on…‘branding’ of cybersecurity positions,” including “cool jobs.”
Napolitano says that “the money and the culture” are the chief obstacles the Department of Homeland Security runs into when recruiting hackers to join. “We don’t require our folks to wear a coat and tie,” she says, “and I’m not interested in the precise hours they work as much as I’m interested in getting the work done” – but she stops short of saying hackers can work from home in Teenage Mutant Ninja Turtle pajamas.
But maybe if you’re young and brilliant and looking for online action, there’s something undeniable about working for the biggest, baddest government on the planet. Sitting here under the dormant red warning lights, there’s a sense of being at the center of the matrix – and this is plenty tantalizing for some, including th3_e5c@p15t, winner of the cyberwar contest back at HackMiami. With his skills, he can write his own ticket, which he hopes to cash in with the feds. He says he wants to be as close to the front line as he can get: “I see it as a righteous cause.”