China: Our Incompetent Master Adversary?

According to an article in today's Guardian, State Department and Pentagon officials with their Chinese counterparts have engaged in at least two cyber war games in 2011 and have another planned for next month. These war games are coordinated by two think tanks: Center for Strategic and International Studies for the U.S. and the China Institute of Contemporary International Relations. The goal is to try to manage escalating hostilities between the two nations over China's perceived massive cyber espionage campaign against U.S. companies.

It's distressing to see that the tensions have risen to this point because its based on a seriously flawed evaluation of the facts by well-known companies plus former and present U.S. government officials. For example:

U.S. information security companies like RSA, McAfee, Mandiant, and others routinely issue reports blaming China and ONLY China for intrusions that they've encountered. It's incredible to me that in spite of the 30+ countries actively engaging in acts of cyber espionage, these security giants have only caught China in the act.

Secretary of State Hilary Clinton has been quick to blame China for cyber attacks that targeted Google but for no other reason then because Google said so. And the Secretary has never once warned other countries to cease their cyber attacks against the U.S.

The U.S. China Economic and Security Review Commission routinely puts out alarmist reports about China's military cyber buildup while deliberately refusing to hear testimony by experts who have contrary views to the commission's anti-China agenda.

Richard Clarke's sinophobic, alarmist op-eds routinely get published in the Wall Street Journal and elsewhere even though Mr. Clarke has no standing as a cyber security expert.

No wonder that the Chinese government's irritation with the U.S. has risen to the point where we need CSIS and its Chinese counterpart to conduct a mediation. Beijing is getting tired of being blamed for every attack against every company everywhere in the world, and they're right to be mad. As I've said many times before, it's not that China doesn't do it; they absolutely do, but so do many other countries and just as frequently yet we almost never hear about a major breach being blamed on any country other than China. Either China is the greatest and dumbest adversary that we've ever had, or the real dummies are those in the InfoSec industry who can't be bothered to question the obvious when doing incident response, or who choose to cater to the rising tide of Sinophobia in the U.S. in order to boost their sales; or to politicians and journalists who parrot back the faulty claims of those same companies thereby perpetuating a bad cycle that has resulted in real-world tensions that could have been handled in a more constructive way all along.

While the marketing of anti-China sentiment by some in the InfoSec industry is clearly one part of this disaster in foreign relations, Media deserves its share for opting to print stories that cater to China FUD because it results in higher readership which means more advertising revenue. Since the American public is generally naive about cyber operations by nation states, they believe what they hear about China in the media and cast their votes for the politician who will save them from the menacing red dragon who's sopping up their brain waves and living inside their electric wires. Politicians being what they are cater to that fear and make pronouncements and threats accordingly in order to win votes.

The solution to this problem is simple. As a nation, we need to ask more questions. Accept nothing at face value no matter which "authority" tells it to you, including me. Good intelligence analysts uses negative analysis to test their findings before sending it on to their customers. A little more negative analysis by all parties involved may be what's needed to reduce U.S.-China tensions and improve U.S. security. And it doesn't cost any money to do it. 

Add to Cart View detail

The Google-Clinton-China Martini With A Cyberwar Twist

There has recently been a lot of media attention focused on a relatively unsophisticated and even mundane act of information exploitation against high level Gmail users and, not surprisingly, a Chinese IP address. There’s absolutely nothing new or sophisticated about the attacks which have been going on for a year or more and which essentially add a forwarding instruction so that others can read copies of everything coming to your Gmail account or even be allowed access to your account - all without you knowing about it. In fact, a Washington D.C.-based security researcher published samples on her blog last February and I recall giving it a quick read back then and thinking how the simple strategies are still the best when it comes to hostile or criminal acts in cyberspace. Spear phishing attacks are simple, elegant things that cost almost nothing to develop except a bit of homework on the potential targets, and they continue to work regardless of millions of dollars being spent to stop or intercept them.

For example, EMC’s RSA security division, the company that makes SecurID tokens that help protect sensitive and classified data around the world, had its own network breached through a spear phishing attack last March. It was a potentially devastating attack because it apparently provided the attackers with the ability to duplicate the security tokens and within a matter of weeks gain access to Lockheed Martin, L3 Communications and possibly Northrup Grumman’s networks - all massive Department of Defense contractors. But that incredibly important set of multiple breaches with the possibility of many more occuring in the near future was completely pushed off the international media screen by two much less important but certainly juicier events: that of the US Secretary of State Hilary Clinton inserting herself into the 2nd annual Google - China squabble and the Pentagon’s announcement that it may defend against a cyber attack with a military strike. Let’s talk about the more boring of the two items first - the Pentagon’s new cyber strategy, which no one has seen yet because it isn’t due to be  released until later this month.

Based on what the Washington Post and Wall Street Journal have written, there’s nothing novel or unusual about the Pentagon adapting to a new warfighting environment and crafting a strategy for it. What would really be newsworthy is if a developed or even developing nation state wasn’t adding cyber operations to its military command. Frankly speaking, any country’s leadership who opposed moving military operations into cyberspace should be immediately fired for incompetence. We fight in the domains that we live in. Today and for the last 20 years, we live more and more in cyberspace so we need to be prepared to wage war in that domain as well. I expect that the United Kingdom will soon have a comparable strategy in place as will the rest of the EU, the Russian Federation, and the Peoples Republic of China, and that suitable treaty regimes will follow. Not that those treaties will have one iota of impact over the type of warfare that we’re actually fighting right now - a war over intellectual property theft and technology transfer between East and West - but again, the Pentagon is far sexier a topic than the gradual eroding of our technological and intellectual capital, which is in my opinion much more critical.

The most intriguing part of recent events surrounding Google and China is Hilary Clinton. I searched the Web for any time in the last year when she spoke out about cyber attacks that didn’t impact Google and couldn’t find a single example. In fact, earlier last month Secretary Clinton was taken to task by U.S. Congresswoman Rosa DeLauro (D-CT) for not speaking out about cyber attacks from China being directed against Change.org. As far as I know, she still hasn’t said a word about that free speech issue but she sure spoke out about a few hundred high profile Gmail customers who were tricked by a spear phishing attack. Maybe it’s because she and Eric Schmidt (Google’s Chairman) were both speaking at the Climate One “leadership dialogue” in San Francisco yesterday (June 2) or because Schmidt donated to her campaign back in 2008, or because she invited him and a few other members of the Technorati to a private dinner at the State department just before the news broke about Operation Aurora in January, 2010. Really, Madame Secretary - what’s up with you and Google?

NOTE: A re-named and slightly edited version of this article appears in today's Guardian online newspaper.

Add to Cart View detail