The Coming Cyberwar

Foreign Policy magazine is looking ahead at "The Calm Before the Storm".

In one remote attack on the Pentagon's information systems about 10 years ago, the Chinese hauled away up to 20 terabytes of information. If the information had been on paper, they'd have needed a line of moving vans stretching from the Pentagon to freighters docked 50 miles away in Baltimore harbor just to haul it away. Had they done so, the military district of Washington would've become an active theater of operations for the first time since 1865, and the Navy would've blockaded the Chesapeake Bay. But the Chinese did it electronically, so who noticed?

Corporate espionage by both competitors and foreign intelligence services or their surrogates is also increasing. Intelligence officials see this but can't speak openly about the specifics, and I'm seeing it now in my law practice. The victims rarely admit it, for understandable reasons. Oracle, which successfully sued SAP for theft of its software code, was a prominent exception. Google was another.

When the Chinese penetrated Google in late 2009 -- yes, that operation was Chinese, and yes, it was done with the blessing of a member of the Politburo -- they weren't after customer information. They were after the source code that makes Google unique. Nor was Google the only victim: Thousands of U.S. and Western firms were penetrated in that affair. Foreign governments -- and not only the Chinese -- understand that they cannot compete with the United States militarily and politically if they cannot compete with it economically, so their intelligence services want to steal its corporate intellectual property. This is the technology that gives America its competitive edge, and often it has nothing to do with defense. Ordinary companies with valuable technology are now being targeted by nation-states. This is a new era. National security and economic security have converged.

The danger is not limited to the loss of technology and information, however. The owners and operators of the North American electricity grid are hooking up their control systems to the Internet as fast as they can. Exposing the grid to the Internet makes it marginally more efficient, but it also makes it dramatically more vulnerable to disruption. If you can remotely penetrate an electronic system to steal information, you can remotely penetrate it to shut it down or make it go haywire. This is why there is no longer a meaningful difference between information security and operational security. And the biggest operational risk is the grid. In contemporary society, nothing moves without electricity. If the grid goes out, the country stops.

By: Brant