Chinese hacking American Corporations @HotspotShield

The United States has taken an unusual step in the world of government-sponsored cybercrime. The Department of Justice has put Chinese officials who run a snooping operation under indictment. International cyber theft is the Inside Story. Cyber espionage and the modern superpower, this time on Inside Story. Yes, the U.S. has indicted Chinese officials, but do the— does the U.S. do the same thing to other countries? Is there evidence of what's been stolen in products produced in China for sale on the international market? And does Attorney General Eric Holder really expect the men running the Chinese operation to ever see the inside of an American courtroom? Joining us to answer these questions and many others, here in Washington, Martin Libicki, a senior management scientist at RAND Corporation. He's the author of "Cyber Deterrence and Cyber War." From Boston, Robert Siciliano, an identity theft expert with Hotspot Shield. And from Edmonton, Wenran Jiang, the director of the Canada-China Energy and Environment Forum. Gentlemen, welcome to the program. Robert Siciliano, you just heard high-ranking Justice Department official, call this the new normal. Isn't it the old normal too?

Yeah, this has been going on for quite some time. You know, it's been going on since the Cold War, but in regards to cyber espionage, you know, we're looking at 20-something years or so. And this is a battle that's going on between the good guys and the bad guys, 24/7, 365. Government is taking an enormous amount of hits on a daily basis. You know, It's, it's why IT security professionals are dutifully employed.

Robert Siciliano, are the tools at the disposal of either side, of both sides, different, better, more thorough, more powerful than they were even a few years ago?

Right now, um, the, uh, you've heard the term used over and over again describing hackers. Uh, the sophistication level today is, uh, never been seen before. The tools that they have at their disposal have are being built with unlimited funding, both from, you know, state-sponsored and criminal hackers themselves. And so with that unlimited funding, the groups are organized. You have the best technologists in the world. When you look at Stuxnet and other viruses that have been created over the past decade, it's just amazing what they're capable of. And, you know, in the end, this is all science, and the technologists that are creating the viruses that give them backdoor access are also working with teams of social engineers. And those social engineers have a multitude of ways to get inside of the heads of the people that they're sending various communications to. And once they click links and visit certain websites, it infects devices, shuts down antivirus, and allows, you know, free access into these systems.

Martin Libicki, this was making me think of the arms race, and people used to talk about those days as predictable, but if somebody makes a mistake, the hell to pay gets worse and worse.

Uh-huh.

Is this a kind of arms race when we throw each other's best technology at each other?

Well, I think the analogy with the arms race doesn't work very well. When you had the United States and the Soviet Union, each of them were progressively building more and more nuclear weapons. But the notion that there's a cyber weapon, I think, underestimates a very important aspect of all the cyber war, cyber espionage stuff. You can only get into somebody's system if there's an error in the system. One of the reasons that our intelligence agencies have such an interest in Huawei is because they're hoping to find errors in how Huawei built their hardware and software which allow our intelligence agencies to penetrate systems through the Huawei routers and get into the networks themselves. So it's just not a question of people building up more armaments. I think the emphasis logically has to be on cyber defense. How can we make the networks that we build more impervious to espionage by anybody? But guys, bad guys, white hats, not so white hats.

Robert Siciliano, doesn't this defeat the very idea that underlies modern industry, that you can just put your laptop under your arm at the end of the day and then log in from home later and still get onto the mainframe in your company, send emails to people around the world. That's extolled, that's lifted up, that's elevated as, as sort of the highest and best use of everybody's time and everybody's technology. But it's that ease of communication and that ease of sending files and designs and drawings here and there— that's undermining this whole system, isn't it?

Well, it absolutely is. And it's that— it's the conveniences of all these technologies that we're enjoying and the fact that you can access, you know, these incredibly secure virtual private networks from the privacy of your own home. And then the fact that your own, say, laptop or own mobile, for that matter, can be hacked, then you become the path of least resistance to get into that secure server. And they're targeting the employees of these corporations and of government agencies through social. You know, they're finding out who they're connected to. They're engaging in advanced persistent threats where they're working 24/7, 365, and eventually those employees, those workers will click links and they'll access files and so forth that will infect their devices. It's as simple as that.

Welcome back to Inside Story. I'm Ray Suarez. Attorney General Eric Holder called today's indictment of 5 Chinese military hackers a wake-up call for the seriousness of the ongoing cyber threat. 3 of the companies allegedly attacked are renowned American manufacturing giants. Alcoa, U.S. Steel, and Westinghouse. On this edition of the program, we're talking about the timing of the indictment and the legal, diplomatic, and business ramifications. Still with us here in Washington, Martin Libicki, a senior management scientist at RAND Corporation. From Boston, Robert Siciliano, an identity theft expert with Hotspot Shield. And from Edmonton, Wenran Jiang, the director of the Canada-China Energy and Environment Martin Libicki does this, and breaches like it, the Heartbleed flaw and many other— the Target invasion and things that are going on of this nature encourage everybody to armor up, encourage everybody to have fewer pathways in and out of their systems. Does this lead to an end to the kind of trust that's made the web the useful tool that it is in many senses?

I think the need for security, particularly security in particular places, means that there has to be a trade-off between security on the one hand and convenience and trust on the other hand. There have— you can't simply do everything you want to do in cyberspace without any regard for security without taking a certain amount of damages. Now, if you run a nuclear power plant, you gotta spend a lot more time and attention for security than if you run a grocery store. But everybody has to spend to spend at least some time and attention on security. That's just a feature of the world in which we live in.

Robert Siciliano, should the United States be threatening retaliatory attacks, return in kind, denial of service attacks? What's the— what's the best way forward if we can't talk our way out of this problem on both sides?

Yeah, it, um, uh, It all boils down to security versus functionality, and users of these conveniences of technology need to understand how to use them, how to not use them, what gets them in trouble, and so on. And all these organizations that were breached, you know, need to take a certain amount of responsibility for their servers being hacked and why that happened and how to prevent it in the future. You know, going forward, this is always going to be the case. It has been for quite some time. And so more attention needs to be paid towards securing the data in which you're responsible for.

Wenrong Zhang, Robert Siciliano, Martin Lubicki, great to talk to you all. Thanks for the conversation. That brings us to the end of this edition of Inside Story. Thanks for being with us. Now, the program may be over, but the conversation continues. We want to hear what you think about the issues raised on this or any day's show, log on to our Facebook page, send us your thoughts on Twitter, @ajinsidestoryam, or you can reach me at Ray Suarez News. See you next time. I'm Ray Suarez.