U.S. Not Ready for Cyber War Hostile Hackers Could Launch

But, Panetta was scary enough as he issued his warning at a gathering of Business Executives for National Security, appropriately held at the Intrepid Air, Sea and Space Museum, a decommissioned aircraft carrier built in the immediate aftermath of the Japanese attack on Pearl Harbor. The ship was hurried into action, and survived multiple kamikaze attacks as well as being torpedoed. Panetta now spoke aboard it of a new kind of threat not on land or sea or in the air, but in cyberspace.

“A destructive cyber-attack could paralyze the nation,” Panetta said.

As it happens, the Intrepid is docked directly across 12^th Avenue from the consulate general of the People’s Republic of China. The public was still five months away from learning via the New York Times of another Chinese government building, this the Shanghai headquarters of the People’s Liberation Army Unit 61398, which apparently has been busy hacking extensively into American infrastructure. Panetta no doubt was well aware of 61938 and similar units at other nations, as well as hackers in extremist groups.

“We know that foreign cyber-actors are probing America’s critical infrastructure networks,” Panetta told the assembled executives. “They are targeting the computer control systems that operate chemical, electricity, and water plants, and those that guide transportation throughout the country.”

Panetta went on, “We know of specific instances where intruders have successfully gained access to these control systems. We also know they are seeking to create advanced tools to attack these systems and cause panic, destruction, and even the loss of life.”

He could have spoken of a 2007 experiment at Idaho National Laboratory, where researchers staged an experimental cyber-attack that succeeded in commanding a power station generator to destroy itself. He instead chose a more recent and dramatic example—an actual attack using a virus called “Shamoon” to wreck 30,000 computers at the Saudi oil company ARAMCO.

“[The virus] replaced crucial system files with an image of a burning U.S. flag,” Panetta noted.

Panetta did not say that Iran almost certainly was behind the attack or that it may well have been in retaliation for what are believed to be joint American-Israeli attacks that disrupted the Iranian oil business and wrecked a considerable number of centrifuges used to produce nuclear material.

No doubt for national security reasons, Panetta also did not speak of the Chinese Unit 61398’s cyber infiltration of Telvent, a multinational that devises the cyber connections whereby companies can remotely control power grids, as well as oil and gas pipelines. The apparent intent of the hackers was not to steal information, but to obtain the ability to seize control of switches and valves from as far away as the Internet can extend. One cyber security expert calls this capacity the “the holy grail” of those bent on mass destruction.

The knowledge of the Telvent hacking, and who knows how many other classified cyber incidents, must have added to Panetta’s clear sense of urgency as he called on the private sector to join government in responding to the threat.

“The reality is that too few companies have invested in even basic cyber security,” Panetta said. “The fact is that to fully provide the necessary protection, in our democracy, cyber security legislation must be passed by Congress. Without it, we are vulnerable.”

Panetta mentioned in particular the Cybersecurity Act of 2012.

“This legislation has bipartisan support, but it has fallen victim to legislative and political gridlock,” Panetta said. “That is unacceptable to me, and it should be unacceptable to anyone concerned with safeguarding our national security.”

Another thing Panetta did not say was that the successful fight against the bill had been led by Sen. John McCain, who had served as a naval aviator aboard the Intrepid before becoming a POW during the Vietnam War. The McCain who is now a politician contended that the bill would place an onerous burden on the private sector by requiring it to make fundamental cyber-security precautions.

In the absence of legislation, the most President Obama could do was issue an executive order that really amounted to no more than an executive recommendation, providing various ways for the government to offer companies non-binding advice on ways to improve cyber security. Obama signed the order just before the State of the Union address.

“We know hackers steal people’s identities and infiltrate private email,” Obama said during the address. “We know foreign countries and companies swipe our corporate secrets. Now our enemies are also seeking the ability to sabotage our power grid, our financial institutions, and our air traffic control systems. We cannot look back years from now and wonder why we did nothing in the face of real threats to our security and our economy.”

One irony is that Obama’s economic stimulus program may have inadvertently made the grid all the more vulnerable to cyber-attack by earmarking $3.4 billion in 2009 toward upgrading the nation’s electrical system into a “smart grid” with interactive “smart meters” that  consumer can access remotely.

“That may well mean that a hacker in Shanghai with his cell phone could do the same thing,” notes former CIA Director James Woolsey.

The hacker could then proceed on into the system.

“A so-called smart grid that is as vulnerable as what we’ve got is not smart at all,” Woolsey adds. “It’s a really, really stupid grid.”

Smart or stupid, the grid and the rest of our essential infrastructure could be knocked out of action for more time than it seems our civilization could bear if experts such as Joe Weiss are correct. He notes that the built-in safeguards in our infrastructure are against accidents.

“Nobody ever designed them to be safe from intentional acts,” he notes.

He says he is not being a voice of doomsday.

“I’m not trying to come up with worst-case scenarios because I do not know what that could be.”

He adds a  little irony of his own when it comes to the big equipment we would have to replace in the event of a large scale attack: “What’s more, a lot of this stuff is made in China.”

One positive development is our increased ability to identify a hacker, in the case of the Chinese hackers all the way back to a building in Shanghai.

Meanwhile, it is worth considering the concluding words of Panetta’s speech aboard the Intrepid, not only just across 12^th Avenue from the Chinese consulate, but also a just few minutes up West Street from where the Twin Towers once stood.

“Before Sept. 11, 2001, the warning signs were there,” Panetta said. “We weren’t organized. We weren’t ready. And we suffered terribly for that.”

His voice remained measured in the cavernous hold of the ship that once rang with calls to battle stations as the kamikazes closed in.

“We cannot let that happen again. This is a pre-9/11 moment. The attackers are plotting.”