The SolarWinds Hack Is Just The Same Sort Of Espionage The US Government Engages In Every Day

from the ugly-and-inconvenient-truth dept

A historic hack of unprecedented scale has set off alarms in the US government -- itself a target of suspected Russian hackers who leveraged IT infrastructure company SolarWinds' massive customer base to compromise an unknown number of victims. Among those victims were several US government agencies, including the DHS's cybersecurity wing, which announced its own breach hours after issuing a dire warning to potentially affected government agencies.

Is it time to panic? No, says the lame duck president, who claims this is already "under control" -- something that very definitely isn't true. SolarWinds says it has 18,000 customers using the affected Orion software. And many of those customers (which include Fortune 500 companies and major telcos/service providers) have thousands of customers of their own -- all of which may be operating compromised systems. The DHS said the only way to ensure systems are clear of this threat was to airgap them and uninstall the infected software.

Others who have been briefed on the hack are far less cheery about its ongoing impact. Trump tweeted there was nothing to worry about. Republican allies seem more concerned than the man who won't have to worry about this for much longer.

Shortly after Mr. Trump’s tweet, Sen. Marco Rubio (R., Fla), acting chairman of the Senate Intelligence Committee, said it was “increasingly clear that Russian intelligence conducted the gravest cyber intrusion in our history.”

Mr. Rubio added on Twitter that efforts to determine the extent and damage of the hack were ongoing and that remediation would take significant time and resources. “Our response must be proportional but significant,” he said.

The 2050s will be like 1950s, apparently: with America in the midst of another Cold War.

But is it true this is the "gravest cyber intrusion in our history?" Or is it just the "gravest" intrusion that's targeted us? After all, the Russians don't have a monopoly on government-ordained hacking. Our intelligence and security agencies deploy their own persistent threats -- something we've done for years with minimal blowback. These calls for a cyber war by pundits and government officials aren't anything to be applauded. I don't think America really wants to get involved in another forever war -- one whose wins and losses can't be tallied with temporary "liberations" and body bag back orders.

Let's be cautious, says Jack Goldsmith. Better yet, let's be aware of the hypocrisy of the stance some government officials are demanding we take.

The lack of self-awareness in these and similar reactions to the Russia breach is astounding. The U.S. government has no principled basis to complain about the Russia hack, much less retaliate for it with military means, since the U.S. government hacks foreign government networks on a huge scale every day.

Turning a cyber war into a shooting war isn't just an overreaction. It's illegal under international law. That doesn't mean nothing should be done about it. It just means the US government can't pretend it doesn't engage in the same activities some now want to go to war over. What's happened here might be unprecedented in scale, but it's the same thing every government with enough resources has done for years. It's not a war waiting to happen. It's business as usual.

Peacetime government-to-government espionage is as old as the international system and is today widely practiced, especially via electronic surveillance. It can cause enormous damage to national security, as the Russian hack surely does. But it does not violate international law or norms.

In recent years, the US government has deployed more offensive weapons in hopes of deterring cyber attacks. It really hasn't worked. Meeting escalation with more escalation is unlikely to change the standard operating procedures of espionage, especially since the US government hasn't rolled back its offensive efforts in the wake of massive breaches.

But there may be a way forward -- one almost impossible to achieve but promising enough it shouldn't be dismissed out of hand.

[The US government] has not seriously considered the traditional third option when defense and deterrence fail in the face of a foreign threat: mutual restraint, whereby the United States agrees to curb certain activities in foreign networks in exchange for forbearance by our adversaries in our networks. There are many serious hurdles to making such cooperation work, including precise agreement on each side’s restraint, and verification. But given our deep digital dependency and the persistent failure of defense and deterrence to protect our digital systems, cooperation is at least worth exploring.

There's no moral high ground to claim here. And refusing to consider bringing some of our cyber boys back home leaves us with nothing but continuous escalation. This hack is raising uncomfortable questions about our own practices. Let's see if anyone in the White House is willing to honestly confront the consequences of our own actions and find another route towards safety and national security.

Filed Under: cyber war, cybersecurity, dhs, hacks, hypocrisy, nsa, russia, surveillance, us
Companies: solarwinds

Hillary Clinton Thinks Real-World Military Responses To Hacking Attacks Are A Nifty Idea

from the bombing-for-the-lulz dept

While hacking and "cybersecurity" threats have long been used to justify awful government policy, the entire concept is clearly about to be turbocharged. With the rise in hacking attacks on the DNC, many were quick to call for renewed cyberattacks on Russia despite the fact that hard, transparent proof of Russian nation state involvement remains hard to come by (the idea being unsound either way). But in a speech last week, Presidential hopeful Hillary Clinton took things one step further by suggesting that she'll make it an administration goal to respond to cyberattacks with real-world military force:

"As President, I will make it clear that the United States will treat cyberattacks just like any other attack. We will be ready with serious political, economic, and military responses," she told the attendees, largely made up of veterans and their supporters. "We are going to invest in protecting our governmental networks and our national infrastructure," she continued. "I want us to lead the world in setting the rules in cyberspace. If America doesn't, others will."

There are several things wrong with this narrative. The US government and Western media seem to frequently go out of their way to imply that the United States is an innocent little hacking daisy, nobly defending itself from a wide variety of evil international threats. But as we saw with Stuxnet, the United States is very often the country doing the attacking, often with major negative impact on countries, companies and civilians worldwide. That the US has the moral high ground on cybersecurity is little more than a stale meme, and it needs to be put out of its misery.

And granted, while Clinton was clearly trying to appeal to her veteran audience at the American Legion National Conference (most of whom likely can't tell a terabyte from T-Mobile), America's moral cybersecurity superiority was on proud display all the same:

"We need to respond to evolving threats from states like Russia, China, Iran and North Korea," Clinton said in the speech. "We need a military that is ready and agile so it can meet the full range of threats and operate on short notice across every domain – not just land, sea, air and space but also cyberspace. "You've seen reports. Russia's hacked into a lot of things, China has hacked into a lot of things. Russia even hacked into the Democratic National Committee, maybe even some state election systems. So we have got to step up our game. Make sure we are well defended and able to take the fight to those who go after us."

Again, you'll note that the United States is portrayed as an innocent and noble defender of cybersecurity freedom, when it's the one often engaging in frequently-unprovoked attacks the world over. Of course, Clinton and friends are well aware that the vast majority of the time it's impossible to know where an attack came from, and any hacker worth his or her salt simply doesn't leave footprints. That makes a real-world military or economic response to a nebulous, usually-unprovable threat simply idiotic. You'd assume Clinton knows this and was just doing some light pandering to the audience.

But this rhetoric alone is still dangerous in that it opens the door wide to using hacking -- much like communism and Islamic extremism and numerous "isms" before them -- as a nebulous, endlessly mutable justification for a litany of bad US behavior. You could, for example, covertly hack a government, publicize its hacking response to your hack, using the press to help you justify military action. Given the US and global media's historical complicity in helping governments begin wars with jack shit for evidence, it shouldn't be hard to see how hacking is going to be a useful bad policy bogeyman du jour for decades to come.

Despite some repeated, painful lessons on this front stretching back generations, forcing the government to show its math before it resorts to violence is simply not the US media's strong suit. And with hacking and cybersecurity being subjects the press and public are extra-violently ignorant about, we've created the opportunity for some incredible new sleight of hand when it comes to framing and justifying US domestic and international policy. If history is any indication, by next time this year we'll be blaming everything under the sun on Russian hackers because after all, two anonymous senior government officials said so.

Healthy skepticism will be our ally as we stumble down the rabbit hole. While it's no surprise that Russia, like the United States is deeply-involved in nation state hacking, you'll note that actual evidence linking the Putin Administration to the recent rise in US hacking attacks remains fleeting. Most reports simply cite a single anonymous US government source, or security firms with a vested interest in selling services and products. That's not to say Putin and friends aren't busy hacking the US, but whether a country is responding to similar attacks by the United States (pdf) -- or is actually involved at all -- is rather important to transparently document before you begin trotting out awful new policies or worse, real world bombs.

Filed Under: attack, cyber war, cybersecurity, hacking, hillary clinton, military