The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age

by David E. Sanger

A year into Donald J. Trump’s presidency, his defense secretary, Jim Mattis, sent the new commander-in-chief a startling recommendation: with nations around the world threatening to use cyberweapons to bring down America’s power grids, cell-phone networks, and water supplies, Trump should declare he was ready to take extraordinary steps to protect the country. If any nation hit America’s critical infrastructure with a devastating strike, even a non-nuclear one, it should be forewarned that the United States might reach for a nuclear weapon in response.

While this book deals largely with the “Seven Sisters” of cyber conflict—the United States, Russia, China, Britain, Iran, Israel, and North Korea—nations from Vietnam to Mexico are emulating the effort. Many have started at home by testing their cyber capabilities against dissidents and political challengers. But no modern military can live without cyber capabilities, just as no nation could imagine, after 1918, living without airpower. And now, as then, it is impossible to imagine fully how dramatically this invention will alter the exercise of national power.

“I do know this,” Hayden concluded. “If we go out and do something, most of the rest of the world now feels that this is a new standard, and it’s something that they now feel legitimated to do as well.” That is exactly what happened.

Nitro Zeus would be the opening act of the war plan: turning off an entire country so fast that retaliation would have been extremely difficult. It was also, in the minds of some of its creators, a glimpse of the future. The idea was to plunge the target country into blackness and confusion from the very beginning of a conflict. That would give Israel and the United States time to bomb the many suspected nuclear sites, take pictures of how much damage was done, and if necessary bomb them again.

They reported that at around eleven-thirty in the morning computers across the country abruptly stopped working. ATMs were failing. Later the news got worse. There were reports that the automatic radiation monitors at the old Chernobyl nuclear plant couldn’t operate because the computers that controlled them went offline. Some Ukrainian broadcasters briefly went off the air; when they came back, they still could not report the news because their computer systems were frozen by what appeared to be a ransomware notice. Ukraine had suffered cyberattacks before. But not like this one.

It was not until World War II that the concept of a “single battle space”—air, land, and sea—took hold. In some corners of the world that concept was already happening in cyber.

I cannot forecast to you the action of Russia. It is a riddle wrapped in a mystery inside an enigma; but perhaps there is a key. —Winston Churchill, October 1939

Britain then became the critical hub—the “termination point”—for even more cables laid across Europe and into Russia. “Termination points” are where the cables come ashore. And in both the United States and Britain, the intelligence agencies paid “intercept partners”—like AT&T and British Telecom—to keep teams of technicians at the termination site to mine and hand over data.

Brennan later argued that Putin and his top aides had two goals: “Their first objective was to undermine the credibility and integrity of the US electoral process. They were trying to damage Hillary Clinton. They thought she would be elected, and they wanted her bloodied by the time she was going to be inaugurated,” he said in a conversation in Aspen, Colorado, in the summer of 2017, six months after he had left the CIA. But Putin was hedging his bets, Brennan surmised, by “also trying to promote the prospects of Mr. Trump.” Whether Russia could succeed in tampering with votes depended on the resilience of the voting infrastructure.

Meanwhile, the tech companies became gradually aware of another international threat to their future: China’s carefully laid-out plan to become the world’s dominant economic and technological power by 2049, the hundredth anniversary of Mao’s revolution. To accomplish this goal, Beijing developed a new strategy—one in which Chinese investors, rather than the venture capitalists of Sand Hill Road, were quietly becoming a critical source of cash for a range of new start-ups. Suddenly, the valley’s billionaires discovered they needed something that they had never really thought about before: a foreign policy.

Carter wrote a blistering assessment of how the cyber operations had played out. “I was largely disappointed in Cyber Command’s effectiveness against ISIS,” he wrote in late 2017, in a remarkably candid account. “It never really produced any effective cyberweapons or techniques. When Cybercom did produce something useful, the intelligence community tended to delay or try to prevent its use, claiming cyber operations would hinder intelligence collection. This would be understandable if we had been getting a steady stream of actionable intel, but we weren’t.” “In

At the core of these uprisings is a concept of corporate identity that is the complete reverse of the Cold War. Raytheon and General Dynamics flourished because they were part of an American defense establishment that armed the Western alliance. They were serving governments, not consumers, and so of course they willingly picked a side. Google and Microsoft do not share this view. Their customers are global, and the bulk of their revenue comes from outside the United States. They view themselves, understandably, as essentially neutral—loyal to the customer base first and individual governments second.

SEN. DAN SULLIVAN (R-ALASKA): What do you think our adversaries think right now? If you do a cyberattack on America, what’s going to happen to them? LT. GEN. PAUL NAKASONE (COMMANDER OF US ARMY CYBER COMMAND): So basically, I would say right now they do not think that much will happen to them. SULLIVAN: They don’t fear us. NAKASONE: They don’t fear us. SULLIVAN: So is that good? NAKASONE: It is not good, Senator. —Lt. Gen. Paul Nakasone’s confirmation hearing, as commander of US Cyber Command, March 1, 2018

Deterrence by denial requires an exquisite defense. And while American intelligence officials will not concede the point, internal government assessments say it will be a decade—at least—before the United States can reasonably defend our most critical infrastructure from a devastating cyberattack launched by Russia or China, the two most skilled adversaries in the field. There are simply too many vital networks, growing too quickly, to mount a convincing defense. Offense is still wildly outpacing defense. As Bruce Schneier, a cyber expert whose work is a must-read on the topic, put it so well: “We are getting better. But we are getting worse faster.”

Now, as then, we have to think more broadly about where our security will be found. Clearly, it is not in an unending cyber arms race where victories over adversaries are fleeting, and where the greatest objective is to break another nation’s encryption or turn off its factories. We need to remember that we built these technologies to enrich our societies and our lives, and not to find yet another way to plunge our adversaries into darkness. The good news is that because we created the technology, we have a chance of controlling it—if we concentrate on how to manage the risks. It has worked in other realms. It can work in cyberspace as well.