War by Other Means

by Robert D Blackwill

  64. Aside from the initial bulletin (Lloyd’s Market Bulletin Ref. Y4463, “Iran-EU Sanctions,” January 20, 2011), Lloyd’s also conducted extensive sanctions due diligence, issuing a longer report in February 2012 (“Sanctions Due Diligence Guidance for the Lloyd’s Market”).

  65. In the most recent report to Congress, released February 2015 and covering CY 2013, CFIUS undertook 193 investigations from 2009 to 2013. The report is available at http://www.treasury.gov/resource-center/international/foreign-investment/Documents/2014%20CFIUS%20Annual%20Report%20for%20Public%20Release.pdf.

  66. Geoff Dyer, “Sanctions: War by Other Means,” Financial Times, March 30, 2014.

  67. Daniel W. Drezner, “Serious about Sanctions,” National Interest, Fall 1998, 67–68.

  68. Ibid.

  69. David Wessel, “From South Africa to Iran, Economic Sanctions Evolve,” Wall Street Journal, December 11, 2013.

  70. Betty Glad, An Outsider in the White House: Jimmy Carter, His Advisors, and the Making of American Foreign Policy (Ithaca, N.Y.: Cornell University Press, 2009), 208.

  71. “Russia’s Gazprom Neft to Sell Oil for Rubles, Yuan,” Ria Novosti, August 27, 2014; Jack Farchy, “Gazprom Looks to Drop the Dollar to Avoid Sanctions’ Bite,” Financial Times, April 7, 2014.

  72. Certainly there is enough “new” about the geopolitical struggles now playing out in the cyber domain to warrant treating cyber as among the newest geoeconomic tools. Still, there remains an interesting question about the extent to which cyber issues, rightly understood, actually belong within a larger tradition in Anglo-American statecraft of prizing control over global information flows—dating back, for example, to the United Kingdom’s efforts to have the world telegraph and cable lines under its sway in the nineteenth century; U.S. government efforts in the Cold War to support global distribution lines for content, such as Reader’s Digest; and, perhaps, pre-Internet telecom satellite policy in the United States. This question strikes us as still unsettled and worth further thought; we are grateful to one of our anonymous readers for Harvard University Press for raising it.

  73. The November 2011 NCIX report, as characterized by the Financial Times, “directly names the Chinese and Russian governments as being behind many efforts to steal technology.” Geoff Dwyer, “U.S. Takes Aim at China and Russia over Cyber Attacks,” Financial Times, November 3, 2011. See also the 2012 Breach Report, available at www.wired.com/images_blogs/threatlevel/2012/03/Verizon-Data-Breach-Report-2012.pdf. The report breaks down 620 data breaches documented by various organizations such as the U.S. Secret Service and European Cyber Crime Center. Among its findings, the report states: “Ninety-six percent of espionage cases were attributed to threat actors in China and the remaining 4 percent were unknown.”

  74. Tony Capaccio, “China Most Threatening Cyberspace Force, U.S. Panel Says,” Bloomberg Business, November 5, 2012.

  75. Adam Segal, “Shaming Chinese Hackers Won’t Work,” Guardian, May 30, 2013.

  76. “It is now evident that intellectual property and commercially strategic information stored on IT systems are being accessed and infiltrated, perhaps to a degree that affects America’s economic position.” Richard Danzig, “Surviving on a Diet of Poisoned Fruit: Reducing the National Security Risks of America’s Cyber Dependencies,” Center for a New American Security, July 2014, 8.

  77. Ian Traynor, “Russia Accused of Unleashing Cyberwar to Disable Estonia,” Guardian, May 16, 2007.

  78. Joshua Davis, “Hackers Take Down the Most Wired Country in Europe,” Wired, August 21, 2007.

  79. Ibid.

  80. What evidence is available suffers from an enormous observation bias—especially in terms of what companies voluntarily disclose—which should not be underestimated.

  81. Evan Osnos, “China’s 863 Program: A Crash Program for China’s Clean Energy,” New Yorker, December 20, 2009.

  82. Ellen Nakashima, “U.S. Said to Be Target of Massive Cyber-Espionage Campaign,” Washington Post, February 10, 2013. See also David Sanger, David Barboza, and Nicole Perlroth, “China’s Army Is Seen as Tied to Hacking against U.S.,” New York Times, February 18, 2013.

  83. This point was initially raised by a cyber expert for a private security firm in a not-for-attribution meeting. Cyber expert James Lewis also makes this point: “It also takes time for an acquirer to turn stolen IP into a competitive product. In some cases, the damage may not be visible for years.” James Lewis, “Raising the Bar for Cyber Security,” Center for Strategic and International Studies, Washington, D.C., February 2013.

  84. As one Economist piece explains, “Other victims of hacking attacks included the International Olympic Committee and the World Anti-Doping Agency after the 2008 Beijing Olympics; Tibetan and Uighur activists and Chinese dissidents; think-tanks that analyze China (including its hacking capabilities); and NGOs operating in China. None of these seemed to have any commercial value.” “Masters of the Cyber Universe,” Economist, April 6, 2013.

  85. Although, in the case of the 2010 Google attacks, experts later reported that hackers did obtain sensitive data pertaining to U.S. government surveillance targets. See, e.g., Charlie Osborne, “U.S. Officials Report Chinese Cyberattack on Google Exposed Spy Data,” ZDNet, May 21, 2013.

  86. Nicole Perlroth, David Sanger, and Michael Schmidt, “As Hacking against U.S. Rises, Experts Try to Pin Down Motive,” New York Times, March 3, 2013.

  87. Author interview.

  88. Including Bloomberg, the cyber security firm Mandiant, the Project 2049 Institute, the Washington Post, and the New York Times, among others. These investigative efforts have linked the preponderance of attacks back to PLA Unit 61398, formally known as the 2nd Bureau of the People’s Liberation Army’s General Staff Department’s 3rd Department.

  89. Ellen Nakashima, “U.S. Decides against Publicly Blaming China for Data Hack,” Washington Post, July 21, 2015.

  90. Ellen Nakashima, “U.S. Said to Be Target of Massive Cyber-Espionage Campaign,” Washington Post, February 10, 2013. Also see Mandiant, “APT 1: Exposing One of China’s Cyber Espionage Units,” April 2013, http://intelreport.mandiant.com.

  91. Adam Segal, “Curbing Chinese Cyber Espionage,” Global Public Square blog, CNN, May 9, 2011. And see Mark Thompson, “Execs Say Cyber-Attacks a Top Threat,” CNBC Online, February 6, 2013. One Economist Intelligence Unit survey found that roughly 70 percent of senior executives believed cyberattacks “occurred regularly or are rampant.” A separate February 2013 survey of CEOs found that cyberattacks topped their list of concerns. Of the 258 executives surveyed, 85 percent said they were very or somewhat concerned about cyberattacks on their organizations—topping concerns over income loss, property damage, and securities and investment risk.

  92. Jesse Riseborough, “Rio Tinto, BHP Billiton, Fortescue Hit by China Computer Hackers, ABC Says,” Bloomberg Business, April 19, 2010; Ben Elgin, Dune Lawrence, and Michael Riley, “Coke Gets Hacked and Doesn’t Tell Anyone,” Bloomberg Business, November 4, 2012.

  93. Mark Clayton, “US Hacking Charges against China for Economic Cyber-Spying: Why Now?,” Christian Science Monitor, May 21, 2014.

  94. He revealed that one “major London listed company” was estimated to have lost around £800 million following a hostile-state cyberattack. Tom Whitehead, “Cyber Crime a Global Threat, MI5 Head Warns,” Telegraph, June 26, 2012.

  95. Daniel Schearf, “North Korea’s ‘World Class’ Cyber Attacks Coming from China,” Voice of America News, November 21, 2013.

  96. According to a 2014 report by McAfee, “a conservative estimate would be $375 billion in losses, while the maximum could be as much as $575 billion.” See “Net Losses: Estimating the Global Cost of Cybercrime” (report presented at the Center for Strategic and International Studies, Washington, D.C., June 2014), available at www.mcafee.com/us/resources/reports/rp-economic-impact-cybercrime2.pdf. In 2012, NSA chief Keith Alexander estimated U.S. losses to be closer to $114 annually; Josh Rogin, “NSA Chief: Cybercrime
Constitutes the ‘Greatest Transfer of Wealth in History,’ ” Foreign Policy, July 9, 2012.

  97. McAfee “Net Losses.”

  98. Ibid.

  99. Zain Shauk, “Malware on Oil Rig Computers Raises Security Fears,” Houston Chronicle, February 22, 2013.

  100. Mark Clayton, “Energy Sector Cyberattacks Jumped in 2012. Were Utilities Prepared?,” Christian Science Monitor, January 7, 2013.

  101. The 2012 virus Shamoon erased data on three-quarters of Aramco’s corporate PCs—documents, spreadsheets, emails, files—replacing the files with an image of a burning American flag; see Nicole Perlroth, “In Cyberattack on Saudi Firm, U.S. Sees Iran Firing Back,” New York Times, October 23, 2012. Just a week later, Qatar’s RasGas was targeted with, many suspect, the same virus; see Camilla Hall and Javier Blas, “Qatar Group Falls Victim to Virus Attack,” Financial Times, August 30, 2012, and Kim Zetter, “Qatari Gas Company Hit with Virus in Wave of Attacks on Energy Companies,” Wired, August 30, 2012.

  102. Blake Clayton and Adam Segal, “Addressing Cyber Threats to Oil and Gas Supplies,” Council on Foreign Relations Energy Brief, June 2013, 2.

  103. Ibid.

  104. Ibid.

  105. Ellen Nakashima, “Iran Blamed for Cyberattacks on U.S. Banks and Companies,” Washington Post, September 21, 2012. Daniel Fineren and Amena Bakr, “Saudi Aramco Says Most Damage from Computer Attack Fixed,” Reuters, August 26, 2012.

  106. Perlroth, “In Cyberattack on Saudi Firm, U.S. Sees Iran Firing Back.”

  107. Clayton and Segal, “Addressing Cyber Threats to Oil and Gas Supplies.” Citing interviews with anonymous U.S. cyber-security specialists, Clayton and Segal report that “some security experts believe the [Aramco] attack could have been damaging had it penetrated further into the network.” Abdullah Al Sa’adan, Aramco’s vice president for corporate planning, stated, “The main target in this attack was to stop the flow of oil and gas to local and international markets and thank God they were not able to achieve their goals” (quoted in “Shamoon Was an External Attack on Saudi Oil Production, Infosecurity, December 10, 2012, http://www.infosecurity-magazine.com/news/shamoon-was-an-external-attack-on-saudi-oil/).

  108. Clayton and Segal, “Addressing Cyber Threats to Oil and Gas Supplies.”

  109. Nakashima, “Iran Blamed for Cyberattacks on U.S. Banks and Companies.” These were “probes that suggest that someone is looking at how to take control of these systems,” as one official put it.

  110. David E. Sanger and Nicole Perlroth, “New Russian Boldness Revives a Cold War Tradition: Testing the Other Side,” New York Times, October 30, 2014.

  111. Ellen Nakashima, “U.S. Rallied Multinational Response to 2012 Cyberattack on American Banks,” Washington Post, April 11, 2014. U.S. officials considered the possibility of hacking into the attacker’s network in Iran before dismissing the idea as too confrontational. Support also briefly cohered around another option, forwarded by NSA director and head of U.S. Cyber Command Keith Alexander, that would, through a series of covert NSA actions, permanently shut down the process responsible for the cyberattack without risking collateral damage. Ultimately, U.S. officials chose neither.

  112. Nakashima, “U.S. Rallied Multinational Response to 2012 Cyberattack on American Banks.”

  113. Ibid.

  114. Associated Press, “Dollar May be Next Screw for U.S. to Tighten on North Korea,” New York Times, April 9, 2015.

  115. Hugh Son, “JPMorgan Assailed by Russia as Bank Blocks Payment,” Bloomberg Business, April 2, 2014; Michael Riley and Jordan Robertson, “FBI Examining Whether Russia Is Tied to JPMorgan Hacking,” Bloomberg Business, August 27, 2014.

  116. Jessica Silver-Greenberg, Matthew Goldstein, and Nicole Perlroth, “JPMorgan Chase Hacking Affects 76 Million Households,” New York Times, October 2, 2014; Matthew Goldstein, Nicole Perlroth, and David Sanger, “Hackers’ Attack Cracked 10 Financial Firms in Major Assault,” New York Times, October 3, 2014.

  117. Silver-Greenberg, Goldstein, and Perlroth, “JPMorgan Chase Hacking Affects 76 Million Households.”

  118. Michael Corkery, Jessica Silver-Greenberg, and David Sanger, “Obama Had Security Fears on JPMorgan Data Breach,” New York Times, October 8, 2014.

  119. Chris Strohm, “JPMorgan Hack May Be Warning, Says Former NSA Chief,” Bloomberg Business, September 3, 2014. See also Gerry Smith, “Vladimir Putin Employs an Army of Skilled Hackers, Report Finds,” Huffington Post, October 28, 2014.

  120. McAfee, “Net Losses.”

  121. “While Warning of Chinese Cyberthreat, U.S. Launches Its Own Attack,” National Public Radio, April 2, 2014. Others, like Greg Gilligan, have echoed similar sentiments. Responding to a recent Pentagon report, Gilligan said, “The salient point [is] … that there is some organized effort by some group attacking business interests” (referring to the Chinese government’s persistent campaign against U.S. companies). “This is not government to government. It’s not military to military. It’s [someone] attacking the economic interests of United States companies.” Tom Gjelten, “U.S. Turns Up Heat on Costly Commercial Cybertheft in China,” National Public Radio, May 7, 2013.

  122. Jane Perlez, “Xi Jinping Pledges to Work with U.S. to Stop Cybercrimes,” New York Times, September 22, 2015.

  123. “Will China Keep its Cyber Promises?,” Washington Post, October 21, 2015.

  124. “While Warning of Chinese Cyberthreat, U.S. Launches Its Own Attack.”

  125. “Foreign Military Financing Account Summary,” U.S. Department of State, Under Secretary for Arms Control and International Security, Office of Plans and Initiatives, www.state.gov/t/pm/ppa/sat/c14560.htm. Also see recent pieces chronicling U.S. military aid to Egypt, such as Ernesto Londoño, “U.S. to Partially Resume Military Aid to Egypt,” Washington Post, April 22, 2014.

  126. Anne Barnard, “Saudis’ Grant to Lebanon Is Seen as Message to U.S.,” New York Times, January 6, 2014.

  127. Ibid.

  128. Ibid.

  129. Ibid.

  130. Ibid.

  131. Michael P. Croissant, The Armenia-Azerbaijan Conflict: Causes and Implications (Santa Barbara, Calif.: Praeger, 1998); RIA Novosti, “Russia Shipping Arms Worth $1 Bln to Azerbaijan—Report,” Sputnik International, June 18, 2013.

  132. Judith Miller, “Clintons Urge Ukraine to Spurn Russian Pressure, Sign Deal with European Union,” Newsmax, September 21, 2013.

  133. Andrew Jacobs, “Asia Rivalries Play Role in Aid to the Philippines,” New York Times, November 14, 2013 (arguing that the outpouring of aid to the hundreds of thousands of homeless Filipinos has been a show of “one-upmanship” directed at Asia’s rising power, China).

  134. The United States and China took two starkly different responses to Haiyan. The United States sent its navy and marines, pledging $20 million in disaster assistance. China, on the other hand, sent an initial $100,000 in government assistance until it folded before the badgering of the international community, increasing its contribution to a paltry $1.6 million. Walter Lohman, “What Typhoon Haiyan Taught Us about China,” National Interest, November 18, 2013.

  135. Claire Provost “Foreign Aid Reaches Record High,” Guardian, April 8, 2014.

  136. Ibid.

  137. “Qatar’s Aid to Egypt Raises Fears on Motives,” Wall Street Journal, May 17, 2013.

  138. Of the $18 billion pledged, $8 billion is for gas/power/iron/steel plants at the northern entrance to the Suez Canal; $10 billion is for a giant tourist resort on the Mediterranean coast. Marwa Awad, “Qatar Says to Invest $18 Billion in Egypt Economy,” Reuters, September 6, 2012. Provost, “Foreign Aid Reaches Record High.”

  139. Iyad Dakka, “How the U.S. Can Capitalize on a Budding Egypt-Saudi Alliance,” World Politics Review, September 10, 2015.

  140. Dana Halawi, “Choucair: Firms Must Hire More Lebanese,” Daily Star Lebanon, January 29, 2014.

  141. Blake Hounshell, “The Qatar Bubble,” Foreign Policy, April 23, 2012.

  142. Mehreen
Zahra-Malik, “Saudi Arabia Loans Pakistan $1.5 Billion to Shore Up Economy,” Reuters, March 13, 2014.

  143. Farhan Bokhari, “Saudi Arabia Gives Financial Aid to Pakistan,” Financial Times, March 14, 2014. “The Saudi support to Pakistan follows a mid-February visit by Salman bin Abdul Aziz al-Saud, Saudi crown prince, amid suggestions that Saudi Arabia is seeking an expansion of its security ties with Pakistan. In February a senior Pakistani intelligence official told the Financial Times that Saudi Arabia was seeking “a large number of [Pakistan] troops to support its campaign along the Yemeni border and for internal security.”

  144. “Pakistan Defends $1.5b Aid from Saudi Arabia,” Gulf News, March 19, 2014.

  145. As Gulf expert and head of the Carnegie Foundation’s Middle East Center, Lena Khatib, explains these regional struggles, “Qatar’s foreign policy decisions and their repercussions have been tightly connected to its long-standing rivalry with Saudi Arabia over the two Gulf countries’ degree of regional influence. Doha had long been a minor regional actor in the shadow of Riyadh. Qatar’s desire to increase its political clout led it into confrontation with the Kingdom over the Syria and Egypt files.” Lina Khatib, “Qatar and the Recalibration of Power in the Gulf,” Carnegie Middle East Center, September 11, 2014, http://carnegie-mec.org/2014/09/11/qatar-and-recalibration-of-power-in-gulf/hofm.

  146. Jodi Rudoren, “Qatar’s Emir Visits Gaza, Pledging $400 Million to Hamas,” New York Times, October 23, 2012.

  147. Claire Provost, “The Rebirth of Russian Foreign Aid,” Guardian, May 15, 2011.

  148. Sarah Teo, Bhubhindar Singh, and See Seng Tan, “South Korea’s Middle-Power Engagement Initiatives: Perspectives from Southeast Asia,” S. Rajaratnam School of International Studies, Singapore, November 28, 2013.

  149. Nackhoon Han, “South Korea & ASEAN: To the Next Phase,” Fair Observer, March 26, 2012.

  150. “National Security Strategy, December 17, 2013 (Provisional Translation),” Government of Japan, Cabinet Secretariat, www.cas.go.jp/jp/siryou/131217anzenhoshou/nss-e.pdf.