This Is How They Tell Me the World Ends: The Cyberweapons Arms Race

by Nicole Perlroth

“Beyond a certain community focused on grid security, nobody was treating this as a Code Red situation,” a senior Obama official told me. “It was a concern, sure. But you also have to remember where we were. There was a lot going on.” Indeed. China was pillaging U.S. intellectual property. Iran was just coming online. But the escalating cyberattacks on the U.S. energy sector that began to spike in 2012 presented a far graver threat. Russia emerged as the chief suspect, but only because the hackers had gone to great lengths to hide their tools and cover their tracks. Perhaps the NSA hackers at TAO knew who they were, but if they did, they weren’t sharing this intel with their defense counterparts at DHS. DHS analysts told me that nobody at the agency knew who was behind the attacks, and nobody had been able to crack the attackers’ payload. This was telling in its own right. Iran’s code was destructive but crude. If Tehran could disguise their payloads, they would have. Likewise, China’s cyberattacks on American companies were brazen but relatively trivial to attribute. Whoever was now embedding itself in the American electrical grid was demonstrating levels of obfuscation and sophistication that analysts had only seen in America’s own cyber campaigns. And they were succeeding at an alarming rate. By the end of 2012, DHS analysts had responded to 198 attacks on U.S. critical infrastructure systems—a 52 percent increase from the previous year.