Contrary to former Defense Secretary Leon Panetta's ominous warning last year that the U.S. could be vulnerable to a "cyber Pearl Harbor," director of national intelligence James Clapper said there were no current cyberthreats of this scale to U.S. infrastructure.
As Wired's Kim Zetter reported on Clapper's comments to the Senate Select Committee on Intelligence on Tuesday, he said "that lack of skills on the part of most attackers and the ability to override attacks on critical infrastructure with manual controls would make such attacks unfeasible in the near future. He also said that nation states that might have the skills to pull off such an attack lack the motive at this point."
Clapper stated (via Wired):
We judge that there is a remote chance of a major cyber attack against U.S. critical infrastructure systems during the next two years that would result in long-term, wide-scale disruption of services, such as a regional power outage... The level of technical expertise and operational sophistication required for such an attack — including the ability to create physical damage or overcome mitigation factors like manual overrides — will be out of reach for most actors during this time frame. Advanced cyber actors — such as Russia and China — are unlikely to launch such a devastating attack against the United States outside of a military conflict or crisis that they believe threatens their vital interests.
Recent evidence obtained by security firm Mandiant indicates that a unit of the Chinese military is responsible for sustained cyberattacks aimed at U.S. corporations and institutions. The Los Angeles Times Wednesday highlighted blog posts authored by a member of this hacker unit that, according to Mandiant's security chief, "provided the most detailed first-person account known to date of life inside the hacking establishment."
The Los Angeles Times reviewed the blog posts, which told of bleak daily life but evidenced the fact that uniformed members of People's Liberation Army were carrying out regular cyberattacks against the U.S. (something the Chinese government has consistently denied):
The hacker, whose real family name is Wang, posted some 625 entries between 2006 and 2009. "Fate has made me feel that I am imprisoned," he wrote in his first entry on Sina.com. "I want to escape."
Los Angeles Times reporters tracked down Wang and his blog through an email address that was listed on a published 2006 paper about hacking. A coauthor of the paper was Mei Qiang, identified by Mandiant as a key hacker who operated under the alias "Super Hard" in Unit 61398.
... In the blog, Wang did not disclose which unit he worked for, but he made it clear that he was wearing a uniform and carrying a military badge. He described his building as being far from the Shanghai city center, one of his many complaints...
The hackers were required to speak English, the international language of technology, as well as an essential for phishing attacks on mostly U.S. targets.
Meanwhile, Clapper's comments aside, the majority of statements to Congress on Tuesday over foreign cyberthreats amped up gravity and imminence. "U.S. intelligence officials said Tuesday that attacks and espionage now pose a greater potential danger than Al Qaida and other militant organizations," The L.A. Times noted. The Pentagon’s Cyber Command will create 13 offensive teams by the fall of 2015 to help defend the nation against major computer attacks from abroad, Gen. Keith Alexander testified.
“I would like to be clear that this team . . . is an offensive team,” he said.
Shares