Cyberwar: The Next Threat to National Security & What to Do About It

by Richard A. Clarke

created citizen hacker groups, engaged in extensive cyber espionage, including of U.S. computer software and hardware, taken several steps to defend its own cyberspace, established cyber war military units, and laced U.S. infrastructure with logic bombs. While developing cyber strategy, China also made use of private hackers closely aligned with the state’s interests. The U.S.-China Economic and Security Review Commission estimates that there are up to 250 groups of hackers in China that are sophisticated enough to pose a threat to U.S. interests in cyberspace.

The problem is, however, that deterrence only works if the other side is listening. U.S. leaders may not have heard, or fully understood, what Beijing was trying to say. The U.S. has done little or nothing to fix the vulnerabilities in its power grid or in other civilian networks.

Other nations known to have skilled cyber war units are Israel and France. U.S. intelligence officials have suggested that there are twenty to thirty militaries with respectable cyber war capability, including those of Taiwan, Iran, Australia, South Korea, India, Pakistan, and several NATO states. “The vast majority of the industrialized countries in the world today have cyber-attack capabilities,” said former Director of National Intelligence Admiral Mike McConnell.

The most common software error for years, and one of the easiest to explain, is something called “buffer overflow.” Code for a webpage is supposed to be written in such a way that when a user comes to that webpage, the user can only enter a certain amount of data, like a user name and password. It’s supposed to be like Twitter, a program where you can enter, say, no more than 140 characters. But if the code writer forgets to put in the symbols that limit the number of characters, then a user can put in more. Instead of just putting in a user name or password, you could enter entire lines of instruction code. Maybe you enter instructions to allow you to add an account. Think about those instructions overflowing the limited area where a public user is supposed to be able to add information and then those instructions falling into the application. The instruction code reads as if a systems administrator had entered it and—ping!—you are inside.

If the U.S. cannot deter others with its secret cyber weapons, is it possible that the U.S. itself may be deterred by the threat from other nations’ cyber warriors? In other words, are we today self-deterred from conventional military operations because of our cyber war vulnerabilities? If a crisis developed in the South China Sea, as in the exercise described above, I doubt that today anyone around the table in the Situation Room would say to the President, “You better not send those aircraft carriers to get China to back down in that oil dispute. If you do that, Mr. President, Beijing could launch a cyber attack to crash our stock market, ground our airlines, halt our trains, and plunge our cities into a sustained blackout. There is nothing we have today that could stop them, sir.” Somebody should say that, because, of course, it’s true. But would they? Very unlikely. The most senior American military officer just learned less than two years ago that his operational network could probably be taken down by a cyber attack. The Obama White House did not get around for a year to appointing a “cyber czar.” America’s warriors think of technology as the ace up their sleeves, something that lets their aircraft and ships and tanks operate better than any in the world. It comes hard to most of the U.S. military to think of technology as something that another nation could use effectively against us, especially when that technology is some geek’s computer code and not a stealthy fi...

Imagine if the FBI announced that it had arrested dozens of Chinese government agents running around the country strapping C4 explosive charges to those big, ugly high-tension transmission line towers and to some of those unmanned step-down electric substation transformers that dot the landscape. The nation would be in an outrage. Certain Congressmen would demand that we declare war, or at least slap punitive tariffs on Chinese imports. Somebody would insist that we start calling Chinese food “liberty snacks.” Yet when the Wall Street Journal announced in a headline in April 2009 that China had planted logic bombs in the U.S. grid, there was little reaction. The difference in response is indicative mainly of the Congress, the media, and the public’s inexperience with cyber war. It is not reflective of any real distinction between the effects those logic bombs could have on the power grid, compared to what little parcels of C4 explosives might do.