“Either they are coming from inside Unit 61398,” said Kevin Mandia, the founder and chief executive of Mandiant, in an interview last week, “or the people who run the most-controlled, most-monitored Internet networks in the world are clueless about thousands of people generating attacks from this one neighborhood.” Other security firms that have tracked “Comment Crew” say they also believe the group is state-sponsored, and a recent classified National Intelligence Estimate, issued as a consensus document for all 16 of the United States intelligence agencies, makes a strong case that many of these hacking groups are either run by army officers or are contractors working for commands like Unit 61398, according to officials with knowledge of its classified content.
But now more info is coming out about the guys that are responsible for exposing them.
When Kevin Mandia, a retired military cybercrime investigator, decided to expose China as a primary threat to U.S. computer networks, he didn't have to consult with American diplomats in Beijing or declassify tactics to safely reveal government secrets.
He pulled together a 76-page report based on seven years of his company's work and produced the most detailed public account yet of how, he says, the Chinese government has been rummaging through the networks of major U.S. companies.
It wasn't news to Mandia's commercial competitors, or the federal government, that systematic attacks could be traced back to a nondescript office building outside Shanghai that he believes was run by the Chinese army. What was remarkable was that the extraordinary details — code names of hackers, one's affection for Harry Potter and how they stole sensitive trade secrets and passwords — came from a private security company without the official backing of the U.S. military or intelligence agencies that are responsible for protecting the nation from a cyberattack.
The report, embraced by stakeholders in both government and industry, represented a notable alignment of interests in Washington: The Obama administration has pressed for new evidence of Chinese hacking that it can leverage in diplomatic talks — without revealing secrets about its own hacking investigations — and Mandiant makes headlines with its sensational revelations.
The report also shows the balance of power in America's cyberwar has shifted into the hands of the $30 billion-a-year computer security industry.
"We probably kicked the hornet's nest," Mandia, 42, said in an interview at the Alexandria, Va., headquarters of Mandiant. But "tolerance is just dwindling. People are tired of the status quo of being hacked with impunity, where there's no risk or repercussion."
China has disputed Mandiant's allegations.
Mandiant, which took in some $100 million in business last year — up 60 percent from the year before — is part of a lucrative and exploding market that goes beyond antivirus software and firewalls. These "digital forensics" outfits can tell a business whether its systems have been breached and — if the company pays extra — who attacked it.
Mandiant's staff is stocked with retired intelligence and law enforcement agents who specialize in computer forensics and promise their clients confidentiality and control over the investigation. In turn, they get unfettered access to the crime scene and resources to fix the problem (Mandiant won't say exactly how much it charges, but it's estimated to average around $400 an hour).
Now what we need is an open, frank public dialog about what to do about it.
By: Brant
Posts
