This Is How They Tell Me the World Ends: The Cyberweapons Arms Race

by Nicole Perlroth

Mitch McConnell, the Senate majority leader, made it clear that he would not sign onto any bipartisan statement blaming the Russians; he dismissed the intelligence, admonished officials for playing into what he wrote off as Democrats’ spin, and refused to warn Americans about efforts to undermine the 2016 election.

It wasn’t so much that Trump won in 2016 as that Clinton lost.

Tom Bossert penned another op-ed for the Wall Street Journal blasting Russia for the attack and outlining a new American strategy for cyber deterrence. But Bossert’s op-ed never saw the light of day. The president ultimately kiboshed it—out of fear it might anger Trump’s friend, Putin.

The agreement Obama had reached with Xi Jinping to cease industrial espionage ended the day Trump kicked off his trade war with China. Trump’s abandonment of the Iran nuclear deal—the only thing keeping Iran’s hackers on good behavior—unleashed more Iranian cyberattacks on American interests than ever before.

China’s Second Artillery Force—the division responsible for China’s nuclear weapons—Xi told his soldiers that nuclear weapons were critical to China’s status as a global superpower. Absent from the speech was any mention of no first use.

Trump’s trade war, and it was safe to assume that the 2015 agreement Xi had struck with Obama to cease commercially motivated attacks was off. By the time Trump was ensconced in the West Wing, Chinese hackers were back to popping American companies with renewed gusto.

In Trump, the Gulf monarchies had hit the jackpot. The president was willing to overlook their human rights abuses in the name of economic prosperity and the hope of a UAE-Israeli peace deal that the president’s son-in-law, Jared Kushner, could one day call his own. Kushner, officials told me, bragged about his regular correspondence with UAE crown prince Mohammed bin Zayed (known as MbZ) and MbS. (Their preferred method of communication? WhatsApp.) Having seen just how much the Gulf monarchies had gotten away with under Trump, some suspected they might try to leave their own mark on the next election. “You don’t think they’re going to just let their prince walk off into the night, do you?” one former White House official asked me in late 2018. It took me a moment to realize the “prince” in this case wasn’t MbZ or MbS. It was their WhatsApp buddy, their best asset in the White House, Kushner.

Trump signed the secret, still-classified order known as National Security Presidential Memorandum 13 in September.

My source had gotten his hands on an urgent DHS-FBI alert. It was meant solely for the utilities, the water suppliers, the nuclear plants. The bureaucrats were trying to bury it on a holiday weekend. And as soon as I got eyes on it, I could see why: the Russians were inside our nuclear plants.

Wolf Creek, the 1200-megawatt nuclear power plant near Burlington, Kansas. This was no espionage attack. The Russians were mapping out the plant’s networks for a future attack; they had already compromised the industrial engineers who maintain direct access to the reactor controls and radiation monitors that could affect the kind of nuclear meltdowns the world had only witnessed in Chernobyl, Three Mile Island, and Fukushima. This was Stuxnet. Only it wasn’t the United States doing the hacking. It was Russia. And the goal wasn’t to stop the boom. It was to trigger one.

Rob Joyce, who served as the last White House Cybersecurity Coordinator before that position was eliminated, released a high-level map of the government’s VEP in November 2017 because he said it was “the right thing to do.”

In 2017, a bipartisan group tried to enshrine the VEP into law with the PATCH Act—Protecting our Ability to Counter Hacking Act. The bill would mandate that any zero-days retained be periodically reevaluated and require annual reports to Congress and the public. PATCH stalled in the Senate but its sponsors say they plan to reintroduce it.