Defense Secretary Leon E. Panetta warned Thursday, Oct 11, 2012 that
the United States was facing the possibility of a “cyber-Pearl Harbor”
and was increasingly vulnerable to foreign computer hackers who could dismantle the nation’s power grid, transportation
system, financial networks and government. According to Elisabeth
Bumiller and Thom Shanker of The New York Times, Defense Secretary Panetta's warnings of a dire threat of cyberattack on the U.S. is being voiced now as he seeks new standards to protect vital infrastructure.
In a speech at the Intrepid Sea, Air and Space Museum in New York, Mr. Panetta painted a dire picture of how such a cyberwar
might unfold. He said he was reacting to increasing aggressiveness and
technological advances by the nation’s adversaries, which officials
identified as China, Russia, Iran and militant groups.
“An
aggressor nation or extremist group could use these kinds of cyber tools
to gain control of critical switches,” Mr. Panetta said. “They could
derail passenger trains, or even more dangerous, derail passenger trains
loaded with lethal chemicals. They could contaminate the water supply
in major cities, or shut down the power grid across large parts of the
country.”
Defense officials insisted that Mr. Panetta’s words
were not hyperbole, and that he was responding to a recent wave of
cyberattacks on large American financial institutions. He also cited an
attack in August on the state oil company Saudi Aramco, which infected
and made useless more than 30,000 computers.
But Pentagon
officials acknowledged that Mr. Panetta was also pushing for legislation
on Capitol Hill. It would require new standards at critical
private-sector infrastructure facilities — like power plants, water
treatment facilities and gas pipelines — where a computer breach could
cause significant casualties or economic damage.
In August, a
cybersecurity bill that had been one of the administration’s national
security priorities was blocked by a group of Republicans, led by
Senator John McCain of Arizona, who took the side of the U.S. Chamber of
Commerce and said it would be too burdensome for corporations.
The
most destructive possibilities, Mr. Panetta said, involve “cyber-actors
launching several attacks on our critical infrastructure at one time,
in combination with a physical attack.” He described the collective
result as a “cyber-Pearl Harbor that would cause physical destruction
and the loss of life, an attack that would paralyze and shock the nation
and create a profound new sense of vulnerability.”
Mr. Panetta
also argued against the idea that new legislation would be costly for
business. “The fact is that to fully provide the necessary protection in
our democracy, cybersecurity must be passed by the Congress,” he told
his audience, Business Executives for National Security. “Without it, we
are and we will be vulnerable.”
With the legislation stalled,
Mr. Panetta said President Obama was weighing the option of issuing an
executive order that would promote information sharing on cybersecurity
between government and private industry. But Mr. Panetta made clear that
he saw it as a stopgap measure and that private companies, which are
typically reluctant to share internal information with the government,
would cooperate fully only if required to by law.
“We’re not
interested in looking at e-mail, we’re not interested in looking at
information in computers, I’m not interested in violating rights or
liberties of people,” Mr. Panetta told editors and reporters at The New
York Times earlier on Thursday. “But if there is a code, if there’s a
worm that’s being inserted, we need to know when that’s happening.”
He
said that with an executive order making cooperation by the private
sector only voluntary, “I’m not sure they’re going to volunteer if they
don’t feel that they’re protected legally in terms of sharing
information.”
“So our hope is that ultimately we can get Congress to adopt that kind of legislation,” he added.
Mr.
Panetta’s comments, his most extensive to date on cyberwarfare, also
sought to increase the level of public debate about the Defense
Department’s growing capacity not only to defend but also to carry out
attacks over computer networks. Even so, he carefully avoided using the
words “offense” or “offensive” in the context of American cyberwarfare,
instead defining the Pentagon’s capabilities as “action to defend the
nation.”
The United States has nonetheless engaged in its own
cyberattacks against adversaries, although it has never publicly
admitted it. From his first months in office, Mr. Obama ordered
sophisticated attacks on the computer systems that run Iran’s main
nuclear enrichment plants, according to participants in the program. He decided to accelerate the attacks, which were begun in the Bush
administration and code-named Olympic Games, even after an element of
the program accidentally became public in the summer of 2010.
In a
part of the speech notable for carefully chosen words, Mr. Panetta
warned that the United States “won’t succeed in preventing a cyberattack
through improved defenses alone.”
“If we detect an imminent
threat of attack that will cause significant physical destruction in the
United States or kill American citizens, we need to have the option to
take action against those who would attack us, to defend this nation
when directed by the president,” Mr. Panetta said. “For these kinds of
scenarios, the department has developed the capability to conduct
effective operations to counter threats to our national interests in
cyberspace.”
The comments indicated that the United States might
redefine defense in cyberspace as requiring the capacity to reach
forward over computer networks if an attack was detected or anticipated,
and take pre-emptive action. These same offensive measures also could
be used in a punishing retaliation for a first-strike cyberattack on an
American target, senior officials said.
Senior Pentagon officials
declined to describe specifics of what offensive cyberwarfare abilities
the Defense Department has fielded or is developing. And while Mr.
Panetta avoided labeling them as “offensive,” other senior military and
Pentagon officials have recently begun acknowledging their growing focus
on these tools.
The Defense Department is finalizing “rules of
engagement” that would put the Pentagon’s cyberweapons into play only in
case of an attack on American targets that rose to some still
unspecified but significant levels. Short of that, the Pentagon shares
intelligence and offers technical assistance to the F.B.I. and other
agencies.
Brought to you by NetLingo: Improve Your Internet IQ
Subscribe to the NetLingo Blog via Email or RSS here!
Posts
