It is well-funded and pursued by mature individuals and groups of professionals with deep financial and technical resources, often with local government (or other countries’) toleration if not support. It is already responsible for billions of dollars a year in losses, and it is growing and becoming more capable. We have largely ignored it, and building our military capabilities is not responding to that threat.
That’s from Eugene Spafford, a computer scientist at Purdue and one of the world’s leading cyber-security experts, as quoted by James Fallows in his March Atlantic piece on Cyber Warriors.
Well worth a read, in it Fallows says:
[N]early everyone in the business believes that we are living in, yes, a pre-9/11 era when it comes to the security and resilience of electronic information systems. Something very big—bigger than the Google-China case—is likely to go wrong, they said, and once it does, everyone will ask how we could have been so complacent for so long. Electronic-commerce systems are already in a constant war against online fraud. […]
As a matter of domestic U.S. politics, [former head of the National Security Agency and the director of national intelligence under George W. Bush, retired Admiral Mike] McConnell argues that we now suffer from a conspiracy of secrecy about the scale of cyber risks. No credit-card company wants to admit how often or how easily it is cheated. No bank or investment house wants to admit how close it has come to being electronically robbed. As a result, the changes in law, regulation, concept, or habit that could make online life safer don’t get discussed. Sooner or later, the cyber equivalent of 9/11 will occur—and, if the real 9/11 is a model, we will understandably, but destructively, overreact. While trying to build bridges to the military, McConnell and others recommend that the U.S. work with China on international efforts to secure data networks, comparable to the Chinese role in dealing with the world financial crisis.
Reporting on the cyber threat has picked up this year and moved into hyperdrive when Google made public a cyberattack on its infrastructure by China in which hackers tried to access the e-mail accounts of human rights activists. That coverage includes:
- Google has asked the National Security Agency for help in figuring out how to defend Google’s network. The thinking is that Google chose the NSA instead of Homeland Security to avoid having its services regulated as “critical infrastructure.”
- A survey of 600 computing and computer-security executives in 14 countries commissioned by computer security specialists McAfee, Inc. finding that attacks on the Internet are ongoing and pose a growing threat to our energy and communication systems, as reported in the NYTimes and Wired.
- At a senate hearing last month, Dennis C. Blair, the director of national intelligence, testified that “Malicious cyberactivity is occurring on an unprecedented scale with extraordinary sophistication.” From The NYTimes reported:
His emphasis on the threat points up the growing concerns among American intelligence officials about the potentially devastating results of a coordinated attack on the nation’s technology apparatus, sometimes called a “cyber-Pearl Harbor.”