How the US Lost to Hackers – The New York Times
Theres a reason we believed the fallacy that offense could keep us safe: The offense was a bloody masterpiece.
Starting in 2007, the United States, with Israel, pulled off an attack on Irans Natanz nuclear facility that destroyed roughly a fifth of Irans centrifuges. That attack, known as Stuxnet, spread using seven holes, known as zero days, in Microsoft and Siemens industrial software. (Only one had been previously disclosed, but never patched). Short term, Stuxnet was a resounding success. It set Irans nuclear ambitions back years and kept the Israelis from bombing Natanz and triggering World War III. In the long term, it showed allies and adversaries what they were missing and changed the digital world order.
In the decade that followed, an arms race was born.
N.S.A. analysts left the agency to start cyber arms factories, like Vulnerability Research Labs, in Virginia, which sold click-and-shoot tools to American agencies and our closest Five Eyes English-speaking allies. One contractor, Immunity Inc., founded by a former N.S.A. analyst, embarked on a slippier slope. First, employees say, Immunity trained consultants like Booz Allen, then defense contractor Raytheon, then the Dutch and the Norwegian governments. But soon the Turkish army came knocking.
Companies like CyberPoint took it further, stationing themselves overseas, sharing the tools and tradecraft the U.A.E. would eventually turn on its own people. In Europe, purveyors of the Pentagons spyware, like Hacking Team, started trading those same tools to Russia, then Sudan, which used them to ruthless effect.
As the market expanded outside the N.S.A.s direct control, the agencys focus stayed on offense. The N.S.A. knew the same vulnerabilities it was finding and exploiting elsewhere would, one day, blow back on Americans. Its answer to this dilemma was to boil American exceptionalism down to an acronym NOBUS which stands for Nobody But Us. If the agency found a vulnerability it believed only it could exploit, it hoarded it.
This strategy was part of what Gen. Paul Nakasone, the current N.S.A. director and George Washington and the Chinese strategist Sun Tzu before him call active defense.
In modern warfare, active defense amounts to hacking enemy networks. Its mutually assured destruction for the digital age: We hacked into Russias troll networks and its grid as a show of force; Irans nuclear facilities, to take out its centrifuges; and Huaweis source code, to penetrate its customers in Iran, Syria and North Korea, for espionage and to set up an early warning system for the N.S.A., in theory, to head off attacks before they hit.
Originally posted here:
How the US Lost to Hackers - The New York Times