Cyber attacks on the horizon- threaten international escalation

NSA overreach makes cyber-security impossible – 2 internal links

First is overreach – NSA surveillance of American companies undercuts cybersecurity – creates vulnerabilities

In addition to influencing standards-setting bodies, the NSA also goes straight to American and international tech companies to ensure that it can exploit vulnerabilities in their products. The NSA spends $250 million a year—more than 20 times what it spends on the much-discussed PRISM program—on a project to develop relationships with companies in order to weaken standards and convince them to insert backdoors into their products. According to documents released by ProPublica, the NSA’s SIGINT Enabling Project “actively engages the US and foreign IT industries to covertly influence and/or overtly leverage their commercial products’ designs. These design changes make the systems in question exploitable through SIGINT collection.”262 The Fiscal Year 2013 budget documents indicate that the goals of the project include inserting vulnerabilities into commercial encryption systems, IT networks, and communications devices as well as making it easier to exploit next generation encryption used for 4G wireless networks. The documents reference “continued partnerships with major telecommunications carriers to shape the global network to benefit other collection accesses” and other relationships with commercial IT providers.263 One of the goals for that year is to “shape the worldwide commercial cryptography marketplace to make it more tractable to advanced cryptanalytic capabilities being developed by NSA/CSS [Central Security Service].”264 Programs like SIGINT Enabling are a central piece of the NSA’s covert strategy to weaken commercial encryption, demonstrating how the agency switched from a public approach for a government mandate in the 1990s to developing a set of private partnerships with the tech industry over the past two decades. “Basically, the NSA asks companies to subtly change their products in undetectable ways: making the random number generator less random, leaking the key somehow, adding a common exponent to a public-key exchange protocol, and so on,” explains Bruce Schneier. “If the back door is discovered, it’s explained away as a mistake. And as we now know, the NSA has enjoyed enormous success from this program.”265

Beyond SIGINT Enabling, the NSA appears to have other programs aimed at leveraging private sector relationships to insert and maintain vulnerabilities in commercial products as well. According to The Guardian, the NSA’s Commercial Solutions center—the program which offers technology companies an opportunity to have their security products assessed and presented to prospective government buyers266—is also quietly used by the NSA to “leverage sensitive, co-operative relationships with specific industry partners” to insert vulnerabilities into those security tools.267 Similarly, a general classification guide details the relationships between industry partners and the NSA, as well as the agency’s ability to modify commercial encryption software and devices to “make them exploitable” and obtain otherwise proprietary information about the nature of company’s cryptographic systems.268 Even before SIGINT Enabling was disclosed, The Guardian reported that the NSA worked with Microsoft directly to circumvent the encryption on popular services including Skype, Outlook, and SkyDrive,269 although Microsoft denies those allegations.270 New information has also come to light about backdoors planted in foreign-bound network routers from companies like Cisco, apparently without the knowledge of the companies that sell them.271 Cisco CEO John Chambers also spoke out after the May 2014 revelations that the NSA had inserted backdoors into network routers, writing a letter to the Obama Administration asking it to curtail the NSA’s surveillance activities and institute reforms that rein in its seemingly-unchecked power.272 In a blog post, Cisco’s Senior Vice President Mark Chandler wrote, “We comply with US laws… we ought to be able to count on the government to then not interfere with the lawful delivery of our products in the form in which we have manufactured them. To do otherwise, and to violate legitimate privacy rights of individuals and institutions around the world, undermines confidence in our industry.”273

The existence of these programs, in addition to undermining confidence in the Internet industry, creates real security concerns. The SIGINT Enabling budget request suggests that the secrecy of the endeavor acts as a safeguard against any security concerns about the manufactured vulnerabilities, including an assurance that “to the consumer and other adversaries, however, the systems’ security remains intact.”274 This assertion relies on the false assumption that if the program is not made public, then others will never discover or exploit those vulnerabilities—and that the program’s benefits outweigh the cost.275 Stephanie Pell, a non-resident fellow at the Center for Internet and Society at Stanford Law School and a former prosecutor at the Department of Justice, explains in a recent paper that “building in back door access…inevitably produces security vulnerabilities” because such back doors “create additional ‘attack surfaces.’”276 And as security researcher Dr. Susan Landau noted in testimony to Congress, “building wiretapping [capabilities] into communications infrastructure creates serious risk that the communications system will be subverted either by trusted insiders or skilled outsiders, including foreign governments, hackers, identity thieves and perpetrators of economic espionage.277 Furthermore, creating a back door in an encrypted communications service requires access to the unencrypted data, which means that “if and when security flaws in the system are discovered and exploited, the worst case scenario will be unauthorized access to users’ communications… [W]hen compromised, an encrypted communications system with a lawful interception back door is far more likely to result in the catastrophic loss of communications confidentiality than a system that never has access to the unencrypted communications of its users.”278

The fact that only the NSA was supposed to know about these backdoors does not alleviate the concerns. Matthew Green, a cryptography researcher at Johns Hopkins University, warned in The New York Times that “the risk is that when you build a back door into systems, you’re not the only one to exploit it,” since anyone else who discovers the weakness, including U.S. adversaries, can exploit it as well.279 These risks are not theoretical; there are numerous examples where technologies intended to facilitate lawful intercepts of communications have created additional vulnerabilities and security holes that have been exploited by unauthorized actors.280 As the white paper from the Institute of Electrical and Electronics Engineers concludes, “While the debate over how we should value both privacy and security is important, it misses a critical point: The United States might have compromised both security and privacy in a failed attempt to improve security.”281

That’s a threat magnifier – makes it easier for cyberterrorists to attack

WASHINGTON — This month a four-month investigation by The Washington Post reported that nine out of 10 people targeted by the National Security Agency’s surveillance program were normal Internet users, most of whom were American citizens. While there seems to be no doubt how the NSA’s spying into our daily lives violated the Fourth Amendment against unreasonable search and seizure, its harm to cyber security and U.S.-based technology companies hasn’t been well recognized by the public because of the issue’s complexity.

How does the NSA, whose mission is to protect American people and the government, create a more dangerous domestic and international internet environment through surveillance? Earlier this month experts gave the answer in a panel discussion titled “National Insecurity Agency: How the NSA’s Surveillance Programs Undermine Internet Security” at the New America Foundation in Washington, D.C.

“The issue is that they are deliberately weakening the security of everyone else in the world in order to make that spying easier,” said Bruce Schneier, a cryptology expert and author who contributed to The Guardian’s coverage on former NSA contractor Edward Snowden’s leaks.

Instead of targeting specific “bad guys,” Schneier argued, the NSA was creating a more vulnerable cyber network that exposed both the agency’s enemies and harmless regular people to greater outside threats. While it was easier for the NSA to attack whoever it wanted, Internet terrorists could also do the same thing to anyone else.

“That’s exactly what the NSA has become: the best hacker in the entire world,” said Joe Hall, chief technologist at the Center for Democracy and Technology.

One way the NSA can make it easier for bad guys is by requiring U.S. tech companies to insert backdoors into their commercial products so that the agency could hack in whenever it identified any targets. However, the backdoors inevitably weaken the security of those products, leading to unpredictable risks.

“Put a backdoor in,” Schneier said, “three years from now, criminals are using it.”

In addition, when the NSA found the weakness of a software or system, experts said, the agency wouldn’t alert companies to fix the problem. Instead, the NSA would keep the secret to itself for potential future actions.

Second is US-Chinese cooperation – NSA overreach makes cyber-surveillance cooperation with China impossible

Online warfare between China and the United States simmered in the background, until in early 2013 the Obama Administration began to make it center stage. In January 2013, the New York Times reported that Chinese hackers had infiltrated its computers following a threat that if the paper insisted on publishing a story about its prime minister, consequences would follow.17 The following month, a security firm, Mandiant, revealed that the Chinese military unit 61398 had stolen data from U.S. companies and agencies.118 In March 2013 President Obama's National Security Advisor publicly urged China to reduce its surveillance efforts-after which classified documents leaked to the public demonstrated the extent to which China had infiltrated U.S. government servers. Two months later, the National Security Advisor flew to China to lay the groundwork for a summit, in which cyber surveillance would prove center stage. Two days before the Obama-Xi meeting was scheduled to take place, The Guardian ran the first story on the NSA programs. On June 7, when Obama raised the question of Chinese espionage, Xi responded by quoting The Guardian and suggesting that the U.S. should not be lecturing the Chinese about surveillance. Although differences may mark the two countries' approaches (e.g., in one case for economic advantage, in the other for political or security advantage), the broader translation for the global community has been one in which the United States has lost the high ground to try to restrict cyber-surveillance.

Loss of US cyber credibility strikes at the core of US- China technological collaborations

Li 13 – Director, John L. Thornton China Center, Senior Fellow, Foreign Policy (Cheng, “NSA Revelations Have Irreparably Hurt U.S. Corporations in China”, Brookings, 12/12/13, http://www.brookings.edu/research/opinions/2013/12/12-nsa-revelations-hurt-corporations-china-li-mcelveen)//GK

After the Sunnylands summit, the Chinese government turned to official media to launch a public campaign against U.S. technology firms operating in China through its “de-Cisco” (qu Sike hua) movement. By targeting Cisco, the U.S. networking company that had helped many local Chinese governments develop and improve their IT infrastructures beginning in the mid-1990s, the Chinese government struck at the very core of U.S.-China technological and economic collaboration. The movement began with the publication of an issue of China Economic Weekly titled “He’s Watching You” that singled out eight U.S. firms as “guardian warriors” who had infiltrated the Chinese market: Apple, Cisco, Google, IBM, Intel, Microsoft, Oracle and Qualcomm. Cisco, however, was designated as the “most horrible” of these warriors because of its pervasive reach into China’s financial and governmental sectors. For these U.S. technology firms, China is a vital source of business that represents a fast-growing slice of the global technology market. After the Chinese official media began disparaging the “guardian warriors” in June, the sales of those companies have fallen precipitously. With the release of its third quarter earnings in November, Cisco reported that orders from China fell 18 percent from the same period a year earlier and projected that overall revenue would fall 8 to 10 percent as a result, according to Reuters. IBM reported that its revenue from the Chinese market fell 22 percent, which resulted in a 4 percent drop in overall profit. Similarly, Microsoft has said that China had become its weakest market. However, smaller U.S. technology firms working in China have not seen the same slowdown in business. Juniper Networks, a networking rival to Cisco, and EMC Corp, a storage system maker, both saw increased business in the third quarter. As the Chinese continue to shun the “guardian warriors,” they may turn to similar but smaller U.S. firms until domestic Chinese firms are ready to assume their role. In the meantime, trying to completely “de-Cisco” would be too costly for China, as Cisco’s network infrastructure has become too deeply embedded around the country.

Chinese cyber technology is going rogue - increase in cyber espionage and breaching of intellectual property rights of American firms

Li 13 – Director, John L. Thornton China Center, Senior Fellow, Foreign Policy (Cheng, “NSA Revelations Have Irreparably Hurt U.S. Corporations in China”, Brookings, 12/12/13, http://www.brookings.edu/research/opinions/2013/12/12-nsa-revelations-hurt-corporations-china-li-mcelveen)//GK

Chinese technology firms have greatly benefited in the aftermath of the Snowden revelations. For example, the share price of China National Software has increased 250 percent since June. In addition, the Chinese government continues to push for faster development of its technology industry, in which it has invested since the early 1990s, by funding the development of supercomputers and satellite navigation systems. Still, China’s current investment in cyber security cannot compare with that of the United States. The U.S. government spends $6.5 billion annually on cyber security, whereas China spends $400 million, according to NetentSec CEO Yuan Shengang. But that will not be the case for long. The Chinese government’s investment in both cyber espionage and cyber security will continue to increase, and that investment will overwhelmingly benefit Chinese technology corporations. China’s reliance on the eight American “guardian warrior” corporations will diminish as its domestic firms develop commensurate capabilities. Bolstering China’s cyber capabilities may emerge as one of the goals of China’s National Security Committee, which was formed after the Third Plenary Meeting of the 18th Party Congress in November. Modeled on the U.S. National Security Council and led by President Xi Jinping, the committee was established to centralize coordination and quicken response time, although it is not yet clear how much of its efforts will be focused domestically or internationally. The Third Plenum also brought further reform and opening of China’s economy, including encouraging more competition in the private sector. The Chinese leadership continues to solicit foreign investment, as evidenced by in the newly established Shanghai Free Trade Zone. However, there is no doubt that investments by foreign technology companies are less welcome than investments from other sectors because of the Snowden revelations. As 2013 comes to a close, it is now well documented and well-known that both the United States and China engage in extensive espionage efforts for national security interests. But China’s espionage efforts are different in one key respect: China conducts surveillance on U.S. commercial entities, while the United States focuses on government targets. Although the U.S. government classifies its surveillance and does not share business secrets with U.S. companies, Chinese spies readily hand over proprietary information from U.S. firms to Chinese firms, breaching intellectual property rights and stealing the fruits of research and development on which American companies have spent billions of dollars. To address these concerns, the United States must clearly indicate that its primary concern is China’s commercial cyber espionage, and that its goal is to protect future U.S. innovation. This is a goal to which both the U.S. and her allies can commit. By working to forge an agreement with China on the enforcement of intellectual property rights protections, the U.S. will finally be able to move out of the shadow of Edward Snowden. Even then, U.S. technology companies must prepare for their new reality—a greatly reduced share of the Chinese market wherein the enforcement of IPR will only soften their downfall.

(INSERT CHINA CYBER ESCALATION IMPACT)

Chinese cyberattack is likely - will shut down US power grids and critical infrastructure

Lenzner 14 - Robert Lenzner is National Editor of Forbes magazine. He joined Forbes as a Senior Editor in September 1992.Mr. Lenzner has a B.A. (cum laude) from Harvard University and an M.B.A. from Columbia University. (Robert, “Chinese Cyber Attack Could Shut Down U.S. Electric Power Grid”, Forbes, November 28, 2014, http://www.forbes.com/sites/robertlenzner/2014/11/28/chinese-cyber-attack-could-shut-down-u-s-electric-power-grid//DM)

Welcome to the increasingly dangerous world of cyber-warfare. The latest nightmare; a western intelligence agency of unknown origin (according to the Financial Times of London) is infecting the internet service providers and sovereign telecoms operations of Russia, Saudi Arabia, Iran, Mexico and Ireland. To what end is not known, though the cyber security company Symantec calls the malware extremely sophisticated.

Then, there are the criminal elements, who have been hacking into the credit card details of JP Morgan Chase (76 million customers’ names), and retailers like Home Depot, Target and EBay. Or the attempts going on by ne’er-do-well nations to break down the control of energy plants and factories, at times by criminal elements that act like stalking horses for sovereign nations up to no good.

I wrote about this phenomenon a decade ago for Forbes magazine (“The Next Threat”) and raised the problem of private industry, especially public utilities, needing to invest major capital into establishing cyber defenses against the very real possibility that our enemies could break into the internet connections of urban public utilities and cause chaos and massive economic injury by closing down the public’s access to electricity. Threats existed as well against the operations of infrastructure projects like dams, gas pipelines and transportation systems.

A DOD research facility in New Mexico plainly showed me how the nation’s public utility system could be penetrated and closed down via their internet connection. Apparently, we have made little or no progress in the past decade of defending our artificial light and energy.

It appears that our enemies (read competitors) have made exceedingly greater progress in their sophisticated cyber-warfare techniques than we have achieved in defending ourselves. Now comes Admiral Michael Rogers, the head of the National Security Agency and the U.S. Cyber Command, who warned last week that China and perhaps two other unnamed nations had “the ability to launch a cyber attack that could shut down the entire U.S. power grid and other critical infrastructure.”

Such a dire possibility should well have gotten a wider prominent play in the media. Yet Admiral Rogers underscored that software detected in China could seriously damage our nation’s economic future by interfering with the electric utility power companies that the citizens of New York, Dallas, Chicago, Detroit and other urban centers require as the basic life blood of survival. This possibility is a great deal more dangerous than stealing 76 million names from JP Morgan Chase.

This not a Sci-Fi fantasy being perpetrated as a hoax on the American public. The NSA head flatly predicted that “it is only a matter of the when, not the if, that we are going to see something traumatic.” He admitted NSA was watching multiple nations invest in this dangerous capability. He called the danger a “coming trend,” where our vulnerability will be equivalent to a hole in our software systems that are unseen by the multinational company, the public utility, the telecom giant, the defense manufacturer, the Department of Defense.

NATO took the threat seriously enough to organize mock cyber-wargame trials in Estonia several days ago that indicated the western nations are aware of the need to fight on a new battlefield where the enemy cannot be seen physically. It was the largest digital warfare exercise ever attempted, a trial run to test dealing with a new non-military threat to global security.

Consider the financial damage to our nation from an attack that could shut down the power systems of major cities. As Forbes pointed out a decade ago, there was a very great need to spend the money building firewalls around our infrastructure’s internet communications network. We are in worse shape today, since NSA chief Rogers plainly told the congressional intelligence committee last week “the Chinese intelligence services that conduct these attacks have little to fear because we have no practical deterrents to that threat.”

The cyber threat is real. America had better wake up to the need to defend the cogwheels of our economy from the electronic reconnaissance attacking our industrial control systems. Public opinion needs to be aroused by the media and security officials into a threat that no one can see as it is invisible. It is not Soviet missiles we fear, but inroads by nation states and criminal elements fronting for them. Our cyber command capabilities are as crucial as our Special Forces in beating back ISIS and other Islamic terrorists.

Grid attacks take out command and control ---causes retaliation and nuclear war

Tilford 12 [Robert, Graduate US Army Airborne School, Ft. Benning, Georgia, “Cyber attackers could shut down the electric grid for the entire east coast” 2012, http://www.examiner.com/article/cyber-attackers-could-easily-shut-down-the-electric-grid-for-the-entire-east-coa] //khirn

To make matters worse a cyber attack that can take out a civilian power grid, for example could also cripple the U.S. military. The senator notes that is that the same power grids that supply cities and towns, stores and gas stations, cell towers and heart monitors also power “every military base in our country.” “Although bases would be prepared to weather a short power outage with backup diesel generators, within hours, not days, fuel supplies would run out”, he said. Which means military command and control centers could go dark. Radar systems that detect air threats to our country would shut Down completely. “Communication between commanders and their troops would also go silent. And many weapons systems would be left without either fuel or electric power”, said Senator Grassley. “So in a few short hours or days, the mightiest military in the world would be left scrambling to maintain base functions”, he said. We contacted the Pentagon and officials confirmed the threat of a cyber attack is something very real. Top national security officials—including the Chairman of the Joint Chiefs, the Director of the National Security Agency, the Secretary of Defense, and the CIA Director— have said, “preventing a cyber attack and improving the nation’s electric grids is among the most urgent priorities of our country” (source: Congressional Record). So how serious is the Pentagon taking all this? Enough to start, or end a war over it, for sure (see video: Pentagon declares war on cyber attacks http://www.youtube.com/watch?v=_kVQrp_D0kY&feature=relmfu ). A cyber attack today against the US could very well be seen as an “Act of War” and could be met with a “full scale” US military response. That could include the use of “nuclear weapons”, if authorized by the President.

Directory: wp-content -> uploads -> sites
sites -> 587 Return function, r i(X) r i(0) r i(1) r i(2) r i(3) 1 0 2 4 6 Thermal Station, I 2 0 1 5 6 3 0 3 5 6 10
sites -> Medical Radiography Program
sites -> Background on the Haitian Earthquake
sites -> Desk review yemen
sites -> Safe Transitions for the Elderly Patient (step)
sites -> District profile Haripur Introduction
sites -> Germanie VanTrease and Tyler Tetzloff
sites -> For more information
sites -> To be completed by the cerf secretariat. Type of submission
sites -> Sponsor Content Above the Clutter with Pete Krainik

Download 152.87 Kb.

Share with your friends: