Dark Territory

by Fred Kaplan

  Thank you for downloading this Simon & Schuster eBook.

  * * *

  Join our mailing list and get updates on new releases, deals, bonus content and other great books from Simon & Schuster.

  CLICK HERE TO SIGN UP

  or visit us online to sign up at

  eBookNews.SimonandSchuster.com

  CONTENTS

  CHAPTER 1 “Could Something Like This Really Happen?”

  CHAPTER 2 “It’s All About the Information”

  CHAPTER 3 A Cyber Pearl Harbor

  CHAPTER 4 Eligible Receiver

  CHAPTER 5 Solar Sunrise, Moonlight Maze

  CHAPTER 6 The Coordinator Meets Mudge

  CHAPTER 7 Deny, Exploit, Corrupt, Destroy

  CHAPTER 8 Tailored Access

  CHAPTER 9 Cyber Wars

  CHAPTER 10 Buckshot Yankee

  CHAPTER 11 “The Whole Haystack”

  CHAPTER 12 “Somebody Has Crossed the Rubicon”

  CHAPTER 13 Shady RATs

  CHAPTER 14 “The Five Guys Report”

  CHAPTER 15 “We’re Wandering in Dark Territory”

  Acknowledgments

  About the Author

  Notes

  Index

  for Brooke Gladstone

  CHAPTER 1

  * * *

  “COULD SOMETHING LIKE THIS REALLY HAPPEN?”

  IT was Saturday, June 4, 1983, and President Ronald Reagan spent the day at Camp David, relaxing, reading some papers, then, after dinner, settling in, as he often did, to watch a movie. That night’s feature was WarGames, starring Matthew Broderick as a tech-whiz teenager who unwittingly hacks into the main computer at NORAD, the North American Aerospace Defense Command, and, thinking that he’s playing a new computer game, nearly triggers World War III.

  The following Wednesday morning, back in the White House, Reagan met with the secretaries of state, defense, and treasury, his national security staff, the chairman of the Joint Chiefs of Staff, and sixteen prominent members of Congress, to discuss a new type of nuclear missile and the prospect of arms talks with the Russians. But he couldn’t get that movie out of his mind. At one point, he put down his index cards and asked if anyone else had seen it. Nobody had (it had just opened in theaters the previous Friday), so he launched into a detailed summary of its plot. Some of the legislators looked around the room with suppressed smiles or arched eyebrows. Not quite three months earlier, Reagan had delivered his “Star Wars” speech, calling on scientists to develop laser weapons that, in the event of war, could shoot down Soviet nuclear missiles as they darted toward America. The idea was widely dismissed as nutty. What was the old man up to now?

  After finishing his synopsis, Reagan turned to General John Vessey, the chairman of the Joint Chiefs, the U.S. military’s top officer, and asked, “Could something like this really happen?” Could someone break into our most sensitive computers?

  Vessey, who’d grown accustomed to such queries, said he would look into it.

  One week later, the general came back to the White House with his answer. WarGames, it turned out, wasn’t at all far-fetched. “Mr. President,” he said, “the problem is much worse than you think.”

  Reagan’s question set off a string of interagency memos, working groups, studies, and meetings, which culminated, fifteen months later, in a confidential national security decision directive, NSDD-145, signed September 17, 1984, titled “National Policy on Telecommunications and Automated Information Systems Security.”

  It was a prescient document. The first laptop computers had barely hit the market, the first public Internet providers wouldn’t come online for another few years. Yet the authors of NSDD-145 noted that these new devices—which government agencies and high-tech industries had started buying at a rapid clip—were “highly susceptible to interception, unauthorized electronic access, and related forms of technical exploitation.” Hostile foreign intelligence agencies were “extensively” hacking into these services already, and “terrorist groups and criminal elements” had the ability to do so as well.

  This sequence of events—Reagan’s oddball question to General Vessey, followed by a pathbreaking policy document—marked the first time that an American president, or a White House directive, discussed what would come to be called “cyber warfare.”

  The commotion, for now, was short-lived. NSDD-145 placed the National Security Agency in charge of securing all computer servers and networks in the United States, and, for many, that went too far. The NSA was America’s largest and most secretive intelligence agency. (Insiders joked that the initials stood for “No Such Agency.”) Established in 1952 to intercept foreign communications, it was expressly forbidden from spying on Americans. Civil liberties advocates in Congress were not about to let a presidential decree blur this distinction.

  And so the issue vanished, at least in the realm of high-level politics. When it reemerged a dozen years later, after a spate of actual cyber intrusions during Bill Clinton’s presidency, enough time had passed that the senior officials of the day—who didn’t remember, if they’d ever known of, NSDD-145—were shocked by the nation’s seemingly sudden vulnerability to this seemingly brand-new threat.

  When the White House again changed hands (and political parties) with the election of George W. Bush, the issue receded once more, at least to the public eye, especially after the terrorist attacks of September 11, 2001, which killed three thousand Americans. Few cared about hypothetical cyber wars when the nation was charging into real ones with bullets and bombs.

  But behind closed doors, the Bush administration was weaving cyber war techniques with conventional war plans, and so were the military establishments of several other nations, friendly and otherwise, as the Internet spread to the globe’s far-flung corners. Cyber war emerged as a mutual threat and opportunity, a tool of espionage and a weapon of war, that foes could use to hurt America and that America could use to hurt its foes.

  During Barack Obama’s presidency, cyber warfare took off, emerging as one of the few sectors of the defense budget that soared while others stayed stagnant or declined. In 2009, Obama’s first secretary of defense, Robert Gates, a holdover from the Bush years, created a dedicated Cyber Command. In its first three years, the command’s annual budget tripled, from $2.7 billion to $7 billion (plus another $7 billion for cyber activities in the military services, all told), while the ranks of its cyber attack teams swelled from 900 personnel to 4,000, with 14,000 foreseen by the end of the decade.

  The cyber field swelled worldwide. By the midpoint of Obama’s presidency, more than twenty nations had formed cyber warfare units in their militaries. Each day brought new reports of cyber attacks, mounted by China, Russia, Iran, Syria, North Korea, and others, against the computer networks of not just the Pentagon and defense contractors but also banks, retailers, factories, electric power grids, waterworks—everything connected to a computer network, and, by the early twenty-first century, that included nearly everything. And, though much less publicized, the United States and a few other Western powers were mounting cyber attacks on other nations’ computer networks, too.

  In one sense, these intrusions were nothing new. As far back as Roman times, armies intercepted enemy communications. In the American Civil War, Union and Confederate generals used the new telegraph machines to send false orders to the enemy. During World War II, British and American cryptographers broke German and Japanese codes, a crucial ingredient (kept secret for many years after) in the Allied victory. In the first few decades of the Cold War, American and Russian spies routinely intercepted each other’s radio signals, microwave transmissions, and telephone calls, not just to gather intelligence about intentions and capabilities but, still more, to gain an advantage in the titanic war to
come.

  In other ways, though, information warfare took on a whole new dimension in the cyber age. Until the new era, the crews gathering SIGINT—signals intelligence—tapped phone lines and swept the skies for stray electrons, but that’s all they could do: listen to conversations, retrieve the signals. In the cyber age, once they hacked a computer, they could prowl the entire network connected to it; and, once inside the network, they could not only read or download scads of information; they could change its content—disrupt, corrupt, or erase it—and mislead or disorient the officials who relied on it.

  Once the workings of almost everything in life were controlled by or through computers—the guidance systems of smart bombs, the centrifuges in a uranium-enrichment lab, the control valves of a dam, the financial transactions of banks, even the internal mechanics of cars, thermostats, burglary alarms, toasters—hacking into a network gave a spy or cyber warrior the power to control those centrifuges, dams, and transactions: to switch their settings, slow them down, speed them up, or disable, even destroy them.

  This damage was wreaked remotely; the attackers might be half a world away from the target. And unlike the atomic bomb or the intercontinental ballistic missile, which had long ago erased the immunity of distance, a cyber weapon didn’t require a large-scale industrial project or a campus of brilliant scientists; all it took to build one was a roomful of computers and a small corps of people trained to use them.

  There was another shift: the World Wide Web, as it came to be called, was just that—a network stretched across the globe. Many classified programs ran on this same network; the difference was that their contents were encrypted, but this only meant that, with enough time and effort, they could be decrypted or otherwise penetrated, too. In the old days, if spies wanted to tap a phone, they put a device on a single circuit. In the cyber era, Internet traffic moved at lightning speed, in digital packets, often interspersed with packets containing other people’s traffic, so a terrorist’s emails or cell phone chatter couldn’t be extracted so delicately; everyone’s chatter and traffic got tossed in the dragnet, placed, potentially, under the ever-watchful eye.

  The expectation arose that wars of the future were bound to be, at least in part, cyber wars; cyberspace was officially labeled a “domain” of warfare, like air, land, sea, and outer space. And because of the seamless worldwide network, the packets, and the Internet of Things, cyber war would involve not just soldiers, sailors, and pilots but, inexorably, the rest of us. When cyberspace is everywhere, cyber war can seep through every digital pore.

  During the transitions between presidents, the ideas of cyber warfare were dismissed, ignored, or forgotten, but they never disappeared. All along, and even before Ronald Reagan watched WarGames, esoteric enclaves of the national-security bureaucracy toiled away on fixing—and, still more, exploiting—the flaws in computer software.

  General Jack Vessey could answer Reagan’s question so quickly—within a week of the meeting on June 8, 1983, where the president asked if someone could really hack the military’s computers, like the kid in that movie—because he took the question to a man named Donald Latham. Latham was the assistant secretary of defense for command, control, communications, and intelligence—ASD(C3I), for short—and, as such, the Pentagon’s liaison with the National Security Agency, which itself was an extremely secret part of the Department of Defense. Spread out among a vast complex of shuttered buildings in Fort Meade, Maryland, surrounded by armed guards and high gates, the NSA was much larger, better funded, and more densely populated than the more famous Central Intelligence Agency in Langley, Virginia. Like many past (and future) officials in his position, Latham had once worked at the NSA, still had contacts there, and knew the ins and outs of signals intelligence and how to break into communications systems here and abroad.

  There were also top secret communications-intelligence bureaus of the individual armed services: the Air Intelligence Agency (later called the Air Force Information Warfare Center) at Kelly Air Force Base in San Antonio, Texas; the 609th Information Warfare Squadron at Shaw Air Force Base in Sumter, South Carolina; scattered cryptology labs in the Navy; the CIA’s Critical Defense Technologies Division; the Special Technological Operations Division of J-39, a little known office in the Pentagon’s Joint Staff (entry required dialing the combination locks on two metal doors). They all fed to and from the same centers of beyond-top-secret wizardry, some of it homegrown, some manufactured by ESL, Inc. and other specialized private contractors. And they all interacted, in one way or another, with the NSA.

  When Reagan asked Vessey if someone could really hack into the military’s computers, it was far from the first time the question had been asked. To those who would write NSDD-145, the question was already very old, as old as the Internet itself.

  * * *

  In the late 1960s, long before Ronald Reagan watched WarGames, the Defense Department undertook a program called the ARPANET. Its direct sponsor, ARPA (which stood for Advanced Research Projects Agency), was in charge of developing futuristic weapons for the U.S. military. The idea behind ARPANET was to let the agency’s contractors—scientists at labs and universities across the country—share data, papers, and discoveries on the same network. Since more and more researchers were using computers, the idea made sense. As things stood, the director of ARPA had to have as many computer consoles in his office as there were contractors out in the field, each hooked up to a separate telephone modem—one to communicate with UCLA, another with the Stanford Research Institute, another with the University of Utah, and so forth. A single network, linking them all, would not only be more economical, it would also let scientists around the country exchange data more freely and openly; it would be a boon to scientific research.

  In April 1967, shortly before ARPANET’s rollout, an engineer named Willis Ware wrote a paper called “Security and Privacy in Computer Systems” and delivered it at the semiannual Joint Computer Conference in New York City. Ware was a pioneer in the field of computers, dating back to the late 1940s, when there barely was such a field. At Princeton’s Institute for Advanced Studies, he’d been a protégé of John von Neumann, helping design one of the first electrical computers. For years now, he headed the computer science department at the RAND Corporation, an Air Force–funded think tank in Santa Monica, California. He well understood the point of ARPANET, lauded its goals, admired its ambition; but he was worried about some implications that its managers had overlooked.

  In his paper, Ware laid out the risks of what he called “resource-sharing” and “on-line” computer networks. As long as computers stood in isolated chambers, security wouldn’t be a problem. But once multiple users could access data from unprotected locations, anyone with certain skills could hack into the network—and after hacking into one part of the network, he could roam at will.

  Ware was particularly concerned about this problem because he knew that defense contractors had been asking the Pentagon for permission to store classified and unclassified files on a single computer. Again, on one level, the idea made sense: computers were expensive; commingling all the data would save lots of money. But in the impending age of ARPANET, this practice could prove disastrous. A spy who hacked into unclassified networks, which were entirely unprotected, could find “back doors” leading to the classified sections. In other words, the very existence of a network created sensitive vulnerabilities; it would no longer be possible to keep secrets.

  Stephen Lukasik, ARPA’s deputy director and the supervisor of the ARPANET program, took the paper to Lawrence Roberts, the project’s chief scientist. Two years earlier, Roberts had designed a communications link, over a 1200-baud phone line, between a computer at MIT’s Lincoln Lab, where he was working at the time, and a colleague’s computer in Santa Monica. It was the first time anyone had pulled off the feat: he was, in effect, the Alexander Graham Bell of the computer age. Yet Roberts hadn’t thought about the security of this hookup. In fact, Ware’s paper annoyed him. He b
egged Lukasik not to saddle his team with a security requirement: it would be like telling the Wright brothers that their first airplane at Kitty Hawk had to fly fifty miles while carrying twenty passengers. Let’s do this step by step, Roberts said. It had been hard enough to get the system to work; the Russians wouldn’t be able to build something like this for decades.

  He was right; it would take the Russians (and the Chinese and others) decades—about three decades—to develop their versions of the ARPANET and the technology to hack into America’s. Meanwhile, vast systems and networks would sprout up throughout the United States and much of the world, without any provisions for security.

  Over the next forty years, Ware would serve as a consultant on government boards and commissions dealing with computer security and privacy. In 1980, Lawrence Lasker and Walter Parkes, former Yale classmates in their late twenties, were writing the screenplay for the film that would come to be called WarGames. They were uncertain about some of the plotline’s plausibility. A hacker friend had told them about “demon-dialing” (also called “war-dialing”), in which a telephone modem searched for other nearby modems by automatically dialing each phone number in a local area code and letting it ring twice before moving on to the next number. If a modem answered, it would squawk; the demon-dialing software would record that number, and the hacker would call it back later. (This was the way that early computer geeks found one another: a pre-Internet form of web trolling.) In the screenplay, this was how their whiz-kid hero breaks into the NORAD computer. But Lasker and Parkes wondered whether this was possible: wouldn’t a military computer be closed off to public phone lines?

  Lasker lived in Santa Monica, a few blocks from RAND. Figuring that someone there might be helpful, he called the public affairs officer, who put him in touch with Ware, who invited the pair to his office.