First, let’s start with the reality that a Cyber-Economic War is already underway. If the Sony hack by North Korea wasn’t sufficient proof, then the hacking of Centcom’s social media should demonstrate the purpose. Enemies of the United States have ill intentions and verifiable capabilities. No, this is not simple cyber-vandalism as the President has suggested. Neither is it as simple as cyber-graffiti despite media efforts to portray it as such. It is nascent 21st Century Economic Warfare and unfortunately, at least so far, we have done little to prepare for it. And it will get worse.
What made the Sony hack so important? The fact that it was state-sponsored, for starters. More importantly, it showed the power of a simple hack to change global dynamics even by a less-advanced power like North Korea. In fact, estimates of North Korea’s $40 billion GDP is not even double the $22 billion market cap of Sony. Yet, anonymous hackers were able to humble the media giant. They might have had inside help. But so what? That doesn’t diminish the problem. We know that insiders such as Edward Snowden can represent huge vulnerability. Some have questioned how the government was certain that North Korea was behind the Sony attack. The answer is that the NSA was essentially watching. Which is sort of creepy and reassuring all at once. What is scary, however, is that while they saw and could trace the activity, they weren’t sure what exactly was happening and thus not in a position to stop the attack. From a New York Times article (posted at CNBC):
The N.S.A.’s success in getting into North Korea’s systems in recent years should have allowed the agency to see the first “spear phishing” attacks on Sony — the use of emails that put malicious code into a computer system if an unknowing user clicks on a link — when the attacks began in early September, according to two American officials.
But those attacks did not look unusual. Only in retrospect did investigators determine that the North had stolen the “credentials” of a Sony systems administrator, which allowed the hackers to roam freely inside Sony’s systems.In recent weeks, investigators have concluded that the hackers spent more than two months, from mid-September to mid-November, mapping Sony’s computer systems, identifying critical files and planning how to destroy computers and servers.
“They were incredibly careful, and patient,” said one person briefed on the investigation. But he added that even with their view into the North’s activities, American intelligence agencies “couldn’t really understand the severity” of the destruction that was coming when the attacks began Nov. 24.
What happens if a similar effort were made against a systemic company (like JP Morgan or NASDAQ)? What happens if the attacks are made by Russia or China? And, how does a company respond to a state-sponsored attack? Would we go to war over the hacking of a company? While that question seems odd, wouldn’t we do anything required to protect American interests from a physical attack like blowing up a commercial building?
The Centcom hack is equally vexing. Yes, hacking the social media websites is not the same as hacking Centcom itself. But that misses the point. Facebook and Twitter are about P/R and ISIS thrives on it. This became a huge recruiting poster for ISIS, funded by the United States government. It appeared as cyber sophistication for ISIS and an embarrassment for us. And, it showed that even the best of the military can be vulnerable. When you factor in the possibility of insiders loyal to the opposition, the impact of cyber exposure becomes very real. We cannot afford to ignore the fact that our national defenses are cyber targets. Don’t forget that Iran successfully hacked elements of the Marine Corps and Navy databases.
Yet, despite the troubling nature of these high-profile attacks, they are really just the tip of a very large iceberg. Yes, there are the commercial hacks against Target and others to steal credit cards. But that is more criminal than warfare. And, there are the hacks to steal technology. That’s more cyber espionage. And, there are the hacks to shut down websites. Maybe that could be a sophisticated prank. But all of these point the same direction. The stakes are increases and so is the frequency. For example, there were 19,000 attacks on French websites over the weekend described as jihadist retaliation. Much of our critical infrastructure was hacked by Iran for two years and we learned about it AFTER the fact. If that’s not cyber warfare, then nothing really is.
One of our challenges is that we have been facing Cyberattacks without a playbook according to The New York Times:
“Until now, we’ve been pretty ad hoc in figuring out what’s an annoyance and what’s an attack,” James Lewis, a cyberexpert at the Center for Strategic and International Studies, said last week. “If there’s a lesson from this, it’s that we’re long overdue” for a national discussion about how to respond to cyberattacks — and how to use America’s own growing, if unacknowledged, arsenal of digital weaponry.
This is despite the fact that all sectors of the government have openly warned of a coming “cyber-Pearl Harbor.” Democrat Leon Panetta warned us as Defense Secretary in 2012. We have been warned again this year by Republican Congressman Michael McCaul, chairman of the House Committee on Homeland Security. Nearly every CIA head, Homeland Security Secretary, and NSA chief has echoed these concerns.
Former UN Ambassador John Bolton wrote an Op-Ed with some powerful truths:
“When foreign states are involved, however, we are edging into the next-higher threat level, namely espionage, hostile clandestine actions and “influence” operations. Intelligence agencies routinely engage both in gathering information and conducting covert actions that can involve significant damage to their targets. We are long past Secretary of State Henry Stimson’s disdainful observation that gentlemen do not read each other’s mail, especially in cyberspace.
The most threatening, most dangerous categories of attacks amount to acts of war or terrorism, at various levels of intensity. This end of the spectrum is difficult for many to grasp because cyberwarfare does not necessarily involve visible physical damage, at least initially. But warfare or terrorism it is nonetheless. Thus, North Korea’s attack on Sony should be seen, at a minimum, as state terrorism, verging on an act of war, not mere vandalism, as Obama opined.
Moreover, for countries like North Korea or China, cyberwarfare is quintessentially asymmetric warfare; such states cannot realistically confront America in the traditional spectrum of military conflict. That is also why the likes of North Korea and Iran have nuclear-weapons programs. And it is gravely important that we grasp that cyberattacks and our responses cannot necessarily be confined to cyberspace but must be evaluated in broader politico-military terms.
America’s posture, therefore, cannot simply be defensive. We need far more muscular offensive cyber capabilities, since in cyberspace, as elsewhere, offense and defense are two sides of the same coin. Enhanced U.S. offensive power will help build the psychology of deterrence to prevent or dissuade future cyberattacks.
Thus, our response to Pyongyang should not be, as Obama asserted, merely “proportional.” It should be disproportional and not confined to cyberspace. The newly announced sanctions against Pyongyang might be a first step but are not nearly enough.
We need both more public debate about cyberspace and far greater awareness of the foreign and domestic threats our citizens, businesses and governments now face. We are behind (although not hopelessly so). But we cannot delay any longer. We have precious few laurels to rest on.”
One problem is that Cyber War is intricately connected to Economic Warfare and both are escalating. Sanctions on Russia may directly lead to cyber retaliation and this could spiral into all out war. The NSA understands this but that doesn’t make us safe. Instead, it means we have entered a digital arms race according to Germany’s SPIEGEL ONLINE:
SPIEGEL ONLINE 01/17/2015 05:07 PM
The Digital Arms Race: NSA Preps America for Future Battle
By Jacob Appelbaum, Aaron Gibson, Claudio Guarnieri, Andy Müller-Maguhn, Laura Poitras, Marcel Rosenbach, Leif Ryge, Hilmar Schmundt and Michael Sontheimer
The NSA’s mass surveillance is just the beginning. Documents from Edward Snowden show that the intelligence agency is arming America for future digital wars — a struggle for control of the Internet that is already well underway….
According to top secret documents from the archive of NSA whistleblower Edward Snowden seen exclusively by SPIEGEL, they are planning for wars of the future in which the Internet will play a critical role, with the aim of being able to use the net to paralyze computer networks and, by doing so, potentially all the infrastructure they control, including power and water supplies, factories, airports or the flow of money.
During the 20th century, scientists developed so-called ABC weapons — atomic, biological and chemical. It took decades before their deployment could be regulated and, at least partly, outlawed. New digital weapons have now been developed for the war on the Internet. But there are almost no international conventions or supervisory authorities for these D weapons, and the only law that applies is the survival of the fittest.
Canadian media theorist Marshall McLuhan foresaw these developments decades ago. In 1970, he wrote, “World War III is a guerrilla information war with no division between military and civilian participation.” That’s precisely the reality that spies are preparing for today.
The US Army, Navy, Marines and Air Force have already established their own cyber forces, but it is the NSA, also officially a military agency, that is taking the lead. It’s no coincidence that the director of the NSA also serves as the head of the US Cyber Command. The country’s leading data spy, Admiral Michael Rogers, is also its chief cyber warrior and his close to 40,000 employees are responsible for both digital spying and destructive network attacks.
The unfortunate thing is that no matter how sophisticated the NSA may be, the reality of cyber-economic warfare is that it is asymmetric. This was explained by James Rickards in The Daily Reckoning:
How Financial Warfare Could Bring America to Its Knees
by James Rickards, December 1, 2014
Financial warfare is coming to the fore. It’s something that’s been talked about for some years, but now it’s actually being played out and practiced. Since 2012 the United States has been in a financial war with Iran. It’s not a shooting war, we’re not invading Iran, but because of their nuclear ambitions, the U.S. has tried to isolate Iran. We kicked them out of the dollar payment system so Iran could not transact in dollars. They said, well who cares, we’ll just transact in Euros or Yen or other currencies.
So, then the United States got together with our allies and kicked Iran out of the international payment system, so suddenly they were at a point where they could ship oil, but they couldn’t get paid, at least not get paid in any currency that they would actually want. So, they started doing workarounds, barter deals, they put hard currency in Chinese and Russian banks and let those Chinese and Russian banks front for them to the international payment system. So the money was moving, but it looked like it was coming from Russia, and not from Iran, and Russia never disclosed who is the real party in interest.
There was a run on the bank and Iran’s people wanted to get their local currency out, convert to dollars on the Black Market to preserve the value against what was collapsing in their own economy. They had to raise interest rates, and it caused inflation in Iran. It was very, very disruptive and destructive to the Iranian economy. It was almost to the point that if we had pursued it longer, we might have got regime change in Iran without firing a shot. But last December, the President relieved some of those sanctions and freed up tens of billions of dollars for use by the Iranians, so we kind of let them off the mat.
There’s another financial war brewing right now, which is with Russia around Crimea. Russia of course invaded Crimea. No one – left, right or center thinks the U.S. should use military force in Crimea. We’re not sending the 82nd Airborne into Sevastopol anytime soon, but the U.S. doesn’t want to be seen to be doing nothing, and so we’re engaging in economic sanctions, which is a form of financial warfare.
There’s a big difference, however, between confronting Russia and confronting Iran. Russia has a much greater ability to strike back — and just to show how this could escalate, so we put sanctions on, you know, some mid level bureaucrats, who cares, that’s no big deal.
But recently, we put sanctions on Igor Sechin, who is one of the most powerful men in Russia, close crony of Putin’s, former KGB. Russia might decide to escalate. What could they do? They could freeze U.S. assets in Russia, they could dump U.S. treasury bills, drive up U.S. interest rates, sink our housing market and our stock market, which are sort of propped up by low rates and ultimately, they could unleash their hackers and shut down the New York Stock Exchange, which they’re completely capable of doing.
And people say well, wait a second, don’t we have hackers? Can’t we close down the Moscow Stock Exchange and I say, of course we can, but who wins? The Moscow Stock Exchange is practically irrelevant to global capital markets, but the New York Stock Exchange is the beating heart, so we shut down each other’s stock exchanges, the Russians win.
So, these are the kind of things that could come out of the blue. Most investors aren’t thinking about it at all. Why should they? They’re not expert necessarily in international politics or financial warfare, but if we’re going to have wars that are not shooting wars, that are cyber and financial wars, but capitals markets are the collateral damage that investors can suffer even if they don’t see it coming.
I appeared with Jim Rickards on the Glenn Beck program a couple of weeks ago (watch here, subscription required) and Mr. Rickards reiterated this concern. Basically, because America is more dependent on the Internet and our financial system than our primary adversaries, we are more at risk. That is also something that has been shared by the former head of the NSA, General Alexander, who said a foreign power could crash our financial system. His successor, Admiral Rogers, admitted that the Chinese and others could take down our power grid. Either could potentially end America as we know it.
While the media seems to be avoiding this reality and Americans prefer to keep their heads in the sand, we have noticed that the London- and New York-based financial industries are beginning to work with the FBI/NSA and MI5/GCHQ to conduct joint cyber war games according to the January 16 issue of the UK Independent:
The first of a series of joint UK-US “war games” will simulate online attacks on the City of London and Wall Street in moves to assess the quality of the large financial institutions’ defences against malicious hacking designed to paralyse their operations. It will involve UK and US intelligence agencies as well as organisations such as the Bank of England and several large commercial banks.
The “war game” will be followed by further exercises to test critical national infrastructure in the two countries, such as the computer systems controlling power supplies and the road and rail networks. Britain and the US are also to establish a joint “cyber cell” on each side of the Atlantic where intelligence agents will work together to share information about threats and respond to any attempted attack. The first time the UK has established such an operation overseas, it will bring together MI5 and GCHQ with their counterparts in the National Security Agency and the FBI.
This is a positive step, but it does not yet connote a true war footing and does little to directly protect your family. In traditional warfare, there is a physical battle space that must be prepared. In cyber-economic warfare, the battle space involves private industry, government, and the general public. We have a long way to go to prepare for what is undoubtedly coming. And, since the Internet, infrastructure, and financial system are connected to virtually every home in America, this means that a cyber-economic war can touch you where you live. This requires personal preparation for your finances, family’s safety, and investments. Don’t wait, start preparing now. This includes developing a personal cyber-security plan, keeping paper copies of transactions, reviewing your investments, keeping some extra cash on hand in case ATMs go down, storing at least some extra food and water, and developing a communication plan in case the cellular networks go down even temporarily. I covered some of these thoughts (especially in regard to investing) in Game Plan; How to Protect Yourself from the Coming Cyber-Economic Attack.
