DeepDive Discussion on How Much Russia and China Are Hacking the USA

This Memorial Day weekend, we honor the brave Americans who have given the ultimate sacrifice for our country. And while we pray for the end of war, history says we are bound to be disappointed. So as we consider potential threats to the United States, there is increasing concern that the next significant attack on America may arrive via the internet. Welcome to Deep Dive. I'm James Freeman of The Wall Street Journal. Joining us to assess the cyber threats facing the United States, Charlie Sowell is a 30-year national security veteran who serves as Chief Operating Officer for Iwerks Corporation. Morgan Wright is an internationally recognized expert on cybersecurity strategy, cyberterrorism, identity theft, and privacy, as well as Senior Fellow for the Center for Digital Government. And Robert Siciliano is a cybersecurity analyst, identity theft expert, author, and President and CEO of the online resource Safer.me. Thanks to all of you for being here. A few years ago, CBS asked at that time Secretary of Defense James Mattis, former Marine Corps general, what kept him up at night, and he responded, "Nothing. I keep other people up at night." And so it's encouraging to have people like that in charge of our defense. And Charlie, I know you also have ice water in your veins, but if you— If you were a nervous guy and you look, as you look at the technology cybersecurity landscape, what are the threats that would keep you up at night?

Sure. A ton of threats in the cyber realm. You know, when you look at the threats to just our way of life, the power grid, the way that we do commerce, it's a challenge that we're facing across multiple,— to the spectrum. So I think the actors that we're talking about, whether it's Russia, China, Iran, North Korea, diverse set of actors and a diverse set of threats.

And is this primarily, Morgan, a threat to our wealth, to our lives? I mean, the reason I ask this is you read a lot. It seems like every day there's a story about hacking of one kind or another, and it's often with a commercial purpose, ransomware or—

Right.

The theft of identities. Obviously, you two study that a lot. Should we most be concerned about that sort of property threat, or is it a traditional sort of national security threat to our lives?

Yeah, I think it's bigger than that. Look, they're— by the way, Russia and North Korea were the two biggest perpetrators of ransomware threats. So NotPetya was Russia, WannaCry was North Korea. Obviously, they needed some economic stuff. What concerns me, though, is the role of Chinese intelligence and about how they have been pilfering everything from the Office of Personnel Management records Charlie and I were talking about on the way up here. They're combining that with the— they indicted two Chinese nationals for stealing healthcare information. We combine that with the hacking of United, of all the different hotels, and what you've got is what concerns me in this realm from a national security standpoint is China is building an intelligence version of Facebook. They are connecting the dots. We have seen in my area, Northern Virginia, they just arrested a guy that lived over in Leesburg for conspiring with the Chinese to sell national security secrets. Very likely because he was targeted. Why? Because he was in financial distress, owed money, you know, had— so they are looking from a behavioral standpoint to do this and target us. So that's— I'd say there will always be the consumer piece of this, but the national security threat is the one that worries me most because that gets into our national secrets and our defense capability.

Okay, just so I'm clear, when you talk about targeting individuals and knowing their vulnerabilities, is that for purposes of blackmailing people?

Absolutely.

Okay. So people who work in the national security establishment.

And he was a CIA, I think, employee at one time and then a contractor. And so they targeted him. This is my belief. I used to instruct this out at the National Security Agency on— with the damage assessment agents. But it's my belief that if I was going to target somebody, I'd look at who's in financial trouble, who's getting divorced, you know, who's got other types of issues. And you get that from medical records. Hacking Equifax, which we believe is also state-sponsored by China. It's this combination of factors that is really worries me. If something's going to keep me up at night, it's stuff like that and what they're— them and Russia are doing.

And Robert, is— would China be the main threat? Is it— is it another country? Is it a non-state actor? As you think about this sort of list of potential threats here, who is most likely to be the adversary or potential adversary?

Well, your non-state actors don't necessarily have the resources that China and Russia have. Certainly we know both China and Russia have been looking at elements of the grid, looking for vulnerabilities. And the reality is, if the grid goes down for any lengthy period of time, we are back in the dark ages pretty quickly.

You're talking about the electric grid?

Oh, absolutely.

So what is it— if you could draw this out for us a little bit, what would an attack look like and how would it affect society, health, et cetera?

Well, we have become so dependent on the internet, which is dependent on the grid and vice versa. And so when the internet goes down or the grid, there's no clean or running water, there's no food being delivered. And we were farming and providing sustenance to ourselves 60, 70 years ago. Today we rely on trucks to bring our food to us.

When you say no water, for example, you mean certain systems that have implemented more technology than others, or pretty much nationwide water systems don't work if the internet is down?

Pumps aren't working, clean water isn't being produced. Uh, essentially all sustenance— food, water, uh, air conditioning, medicine, uh, just ceases. And then we are, again, left in the dark. And our society, our culture is not prepared for that in any way, shape, or form. Most people don't have a supply of food or water or medicine that would last more than a week for that matter.

Hey, can I play off that for just one second? Yeah. There was an Israeli general that said one time, if you want to bring a nation to its knees, you go after two things, power and water. That will put people into chaos. In fact, the first black energy attack, the targeted attack against energy was Ukraine, the Zaporizhzhia hydroelectric plant, which by the way, was also targeted by Russia during World War II to stop the invasion of Germans. But what was significant about that, the reason I say Russia is such a strategic threat, they have such a sense of history. That attack was done exactly 1 year to the date after the Ukrainian parliament voted like 330 to 80 to change their status from non-aligned to aligned so they could join NATO. And what does Russia not want on its border? Is a NATO ally.

So, Charlie, this sounds pretty scary. Why has it not happened yet? Or, I mean, Sort of how likely is it? Are we— do we have defenses that maybe would make it difficult for some people to pull this off?

Sure. It has happened, I think, is the challenge that we're facing, is that whether it's a non-state actor that's launched a ransomware attack that affected the city of Atlanta or a major medical center in the East Coast, a hospital system, it's already happening to us. We've been attacked by state actors as well. You know, they've attributed North Korea to the Sony hack. And so we're under attack as we speak. How do you defend against it? Well, fortunately—

Before we move on to that, just sort of this idea we're under attack, I mentioned there, it seems like a constant stream of stories about these attacks of various levels. Verizon does an annual sort of rundown of all the attacks, and I think it's over 40,000 it tracks worldwide, more than 2,000 of them categorized as breaches, which I guess means the intruder actually got into some critical system. Sure. But we haven't seen often, for example, you read about credit card data and that, that's something that hasn't really hit the consumer. You mentioned the potential of water systems going out, electricity could be fatal for some people, but Have we just been lucky to this point, or are there reasons why it hasn't risen to that sort of catastrophic level?

Well, as Morgan and Robert both talked about, I think it has hit the consumer. When you look at the Equifax breach, for example, I mean, that's a direct assault on consumer credit and our livelihood when it comes to financial issues. So I think those attacks have absolutely hit the consumer. Or not we've seen direct nation-state attacks on the individual consumers may be a different issue.

Well, for example, I used to work for the government. I think my file, I assume, was one of those stolen by the Chinese. I mean, are they doing bad stuff with this and we'll figure out 10 years from now, or has that been managed?

As Morgan wrote his piece on what could China do with their Facebook-like capability. I think in China's situation, they're holding that data and waiting for the right time of conflict with the United States to leverage it. Other countries are using cyberattacks against us in a kind of a staged approach where they'll take one action, then they'll take another action. I was targeted by the Fancy Bear group, a GRU-affiliated cyber attack group in Russia.

Now, GRU is the internal intelligence?

Military.

Russian military intelligence.

Military intelligence, okay.

Right, and there were about 500 former government officials that were targeted by them through Gmail. And they also targeted folks in cleared defense industry, Lockheed Martin, Boeing, folks that are working on very sensitive programs in industry that affect our national defense.

So this is, I mean, would the Pentagon call this a low-level conflict? It's sort of all the time with some of these, or low intensity.

It's a digital version of low intensity conflict, which the Russians have actually mastered. They're constantly probing, looking for weaknesses. They are planting things so that they can come back later. In other words, in a lot of our industrial control systems, they have created, they have penetrated, they have created what we call operation-specific firmware. In other words, when the dam in Ukraine was attacked, they created firmware that only attacked the serial-to-ethernet converter that was very unique to that. So they are very good. They were actually in that system for over 6 months, and they got into it through a phishing email, a spear phishing email that came in from the Ukrainian government that had an Excel spreadsheet that said enable macros, which you should never do. And inside that, guess what, was the first step of the Black Energy package. And they worked their way, they compromised the Outlook, basically the place that contains all the passwords, And from that they got to the VPN that got them through to the industrial control systems. But they had the patience, to Robert's point too, they've got the logistics, the wherewithal, the time to do it. 6 months they were inside that system before anybody knew about it.

And Russia and China similarly capable or one more than the other?

I would say that Russia's probably a bit more capable, that they are more advanced in regards to the cyber aspect of intrusions. You know, we are essentially at peace I would say at this point we're not at war with any of these countries. It's a silent war. They're constantly probing. And in the event of actual cyber war, the first thing to go down will be the grid. And when that happens, you know, we'll be legless for a period of time until we get back online. And in the meantime, we are fighting off attacks all day, every day within government and corporations everywhere. Hundreds of thousands of, if not millions of attacks every single day that are, again, probes to see what those vulnerabilities might be. And they're creating arsenals of weapons, software, viruses, malware that they'll deploy when necessary.

James. Robert's spot on. And I think that when you look at which, whether it's Russia or China, that might have more capability, I'd flip the question a little bit. I just got back from a security conference in Orlando, Florida, where the National Counterintelligence Executive, laid it out this way. He said, China needs us. Now China's strategic goal is to overtake the US economically by 2050, but they need us right now. Russia doesn't need us. Putin doesn't want us. He wants to see the United States disappear in his ideal world. So capabilities may be the same, but the initiative—

Russia has less to lose by—

—exactly—

by confronting us in this. China's playing the long game though. It's the difference between the Chinese game called Go, which is about acquisition and strategy over time and lulling your opponents into a sense of security, and then Russia playing chess. They're very good at the strategy piece, but China is willing— they have waited thousands of years already. They're willing to wait tens of years and decades so that they can get all of the stuff in place. You've got the Confucius Institutes. 80%, I think, or at one time 70% of all the foreign exchange students in the United States were from China. They're in our PhD programs. I mean, they are basically surrounding everything. They're buying big interests in Hollywood. Why? To manage the narrative and the influence.

So I would hope maybe we would find a way to recruit some of them, those who aren't spies, to come live in the U.S. Entrepreneurs and people who develop technology, obviously not enjoying life in China as much as they did maybe in the pre-Xi Jinping era. But obviously that's, that's a tough question, I guess. I'm trying to figure out, as we talk about these threats, a lot of the targets you're mentioning obviously are, are private assets. They're corporations, whether it's a utility, a water company, etc. There's a question of who is best equipped to defend them, to create the technologies to counter them. I'm assuming given the pace of government, we don't necessarily want government entirely responsible. What's kind of the the division of labor that should be happening here if you want some commercial system to be well defended against this kind of threat?

Well, I would say the good news is the entrepreneurial assets that we have here in the U.S. We have extremely talented information security professionals that have various products and services to keep networks and those that operate them in relative security. I mean, we would be in the dark at this point if we didn't have that in place. So it is a battle that goes on, you know, 24/7, 365, and we are sustaining at this point. I would say to a certain degree we're winning, but, you know, due to the fact that the financial system is still operative, that, you know, all our money really is just, you know, X's and zeros, or ones and zeros. And it's not cash on hand. It's all, you know, and it could vaporize any moment, but it hasn't. And it's not to Russia or China's advantage for that to occur. So meanwhile, we're maintaining a relative degree of security due to the fact that we have a lot of intelligent people making sure that that is the case.

Yeah, and certainly in this town at the banks here, enormous sums being spent on this. This type of defense. Is that— is sort of a vibrant economy and a vibrant financial sector a better answer than a new huge Cyber Security Command in government?

I don't think it's an either/or. I think the government's made huge investments in protecting both the industrial and private side of our economy as well as government systems. I mean, look, where do you go and attack a nation like the US? Do you knock on the door of the secure agencies like CIA or NSA to get secrets, or do you go into industry members that support them? When you look at the F-35 program, for example, I think it's pretty widely acknowledged that that program was compromised by the Chinese very early on through getting in and stealing relatively low-level information, unclassified but sensitive information. And all of a sudden they have a competing 5th generation fighter.

And speaking of the Chinese, I wanted to ask you, they're also, I believe there was a recent New York Times report talking about how they are using tools developed by our National Security Agency. And I think, I guess we maybe were using them to probe their systems and they said, "Oh, that looks good." And now they use it.

Well, here's two things that happened. It's the Shadow Brokers. So when a lot of that came out and was released, people got that. But what China got good at—

So this is a third party that sort of markets— there's a black market in cyber tools.

Well, Shadow Brokers, what they actually got access to, it was like that— it all started with that NSA contractor who downloaded all of these attack tools onto a USB drive, brought it home on his laptop, which had Kaspersky software on it. Kaspersky, I have no doubt in my mind, they collaborate with the FSB, which is the, you know, the modern version of KGB.

This is a large security company, right?

Yes, it is. And that's one of the reasons they got banned from the United States. They got banned from inside DOD because It identified and it flagged, and then it ended up sharing that information with Russia, with the FSB, with their intelligence services. What China got good at doing, as they were attacked, they would capture this and they would do reverse engineering and analyze the tools, rebuild the tools, and then launch them back at us. But to your point earlier too, the one thing about critical infrastructure we should be— to let folks know is 85% of the critical infrastructure in the United States is owned by the private sector. The government owns very little. So what they've done is they've collaborated. You've got DHS, which has done a really good job. You've got what's called the Cybersecurity Framework, which is a collaboration between public and private industry. But I was at SAIC when we created the first, called Information Sharing Analysis Center. And to your point, the financial services industry was the first one on board after Clinton created what's called Presidential Decision Directive 63 to protect critical infrastructure. They got on board. Now we have over 20 ISACs to include healthcare, defense industrial base, IT and communications, power, water. So people are collaborating. The biggest thing, though, to stop this is to share information. We're getting better at sharing threat information. Than we ever have, and that's how we're going to defeat this.

Okay, on the news you can use topic, so if you work at the NSA, don't download stuff and bring it home. That would be bad.

Don't put it on your personal laptop and connect to the internet.

But I mean, is there some basic advice for people working in large organizations who maybe aren't the cybersecurity expert in the office to do their part to prevent these kind of attacks?

Well, certainly awareness is key, and security awareness Training is on the forefront of most IT security professionals' minds today. I think only though maybe 60% of American corporations are engaging in some form of information security awareness training, which isn't enough. So 6 out of 10 are being trained. And with that, usually it's a phishing simulation training. So they're getting phishing emails sent to them that look like they're coming from the CEO or the company's charity, given charity. And so they're— so the employees are maybe clicking links or not, responding or not, providing sensitive or personal information or not. And that's how the organization will determine who's the weak link in the company's chain. That security awareness training is fundamental, or it should be at least, in 100% of America's corporations, but it's not. Security awareness is just one aspect of it. The right hardware and software and making sure that everything's properly updated certainly plays a huge role in making sure that those networks' hardware and software isn't vulnerable.

I wanted to ask you about one particular item in the news recently. That was a— I believe he's a scholar at the Belfer Center at Harvard who I think hacked into a commercial satellite. It was meant to show how— I'm shocked. —vulnerable it was. Well, the Belfer Center is in the Kennedy School of Government. Now, I guess they have a focus on science, but I was thinking if the If the political science crew can do this, there are probably a lot of people in the engineering department who also could figure out how to do it. But was this a wake-up call kind of for that industry as well? Along with, we talked about power and water systems, et cetera.

Yeah, you know, I think our national security assets in space are pretty well protected. Okay. I think in general, just like Robert Siciliano's talking about, you know, when companies don't spend a lot of time and/or energy training their folks on the cyber threat, you see results like what the Harvard group was able to demonstrate. Look, in space, whole different frontier, you know, no pun or anything intended. When you're talking about the ability to take over large mass or even small satellites and disrupt operations in orbit, not just for one nation, but for the entire planet. You mentioned GPS earlier. When you look at the different orbits that you could affect, This could really, really cause challenges for the economy, for the way that our average life, you know, the way we spend our average lives.

So GPS, obviously huge part of our lives now. It's how people navigate around, basically. Which brings us— this is not hacking, but the Journal had a story recently about how China is barred from buying various American satellite technology, but it rents what it is not allowed to buy. And it was talking about how this could be used to target weapons, among other scary uses.

Absolutely. One of the free— one of the issues with— not to pick on the Navy, but you know, when that one Navy ship, they had that collision, and they were wondering, did somebody interfere with our GPS on board? That's what we're talking— we're talking about precision-guided munitions. We're talking about fighter jets deploying strike packages And they need to be accurate. That's the reason why during this, what's called the second offset of war, we were able to stop the advance of the Soviet military at that time because we could look deep and shoot deep. Now in this third offset of war, which we're looking at artificial intelligence and machine learning, having accurate information about where we're going and what we're doing. And to your point, one of the reasons the Chinese do this, a lot of people don't realize too, is they can't build a lot of their technology except with things like chips from Qualcomm. American technology. So they build it, or they— I call it the 3 Rs. They rob us of it, they replicate it, and then they replace us. And so a lot of this technology, like with Huawei, what hurts Huawei is they can't organically manufacture all the technology they need to do.

All right, I know it's hard to find a bright side in this story, but, uh, Robert, even, uh, it's terrible. It's bad. Morgan was mentioning, uh, the, uh, our victory over the Soviet Union. Really, I think largely because of our technological edge, talking about how still China needs our technology, they don't create a whole lot of it. We're still, as far as I can tell, the world's leader in developing technology. Is this at least hopeful in the sense that this battle is happening in a field where we lead the world?

Well, certainly. You came to me for the happy advice. Well, I'm looking for it. Maybe have to wait for another Well, you know, look, it's important to, for, for, you know, everyone to understand that battles traditionally were fought on the ground. And if you won the battle on the ground, then, you know, you, you, you were able to claim land and win. And then eventually that moved to sea and then to air. And now it's cyberspace. But now it's actually outer space. So whoever wins the battle in outer space will ultimately win that battle.

And, and— Okay, Charlie says we're actually, our satellites are pretty secure. Is that one area where you're not too worried at the moment?

So the, the, they are pretty secure, but with the addition of private corporations involved in launching satellites into orbit, there are some vulnerabilities there. And as companies like Amazon and others get more involved. SpaceX. Yeah. 60 satellites just launched.

Yeah. You know, SpaceX.

And there's no such thing as 100% security. Nothing is completely unhackable. There's always, especially anything that's wireless, there's always going to be a vulnerability. The key is obviously to, you know, maintain as close as you can get to 100%. And the U.S. is the best at that. At this time. Yeah.

I mean, this rise of sort of private rocket and space technology development in the US, it seems like that's overall a benefit for all of the things we've been talking about.

Absolutely. Anybody that can land a rocket on a floating barge, I want to be in that country. I think that's great. So good for Elon. I think another bright spot is what President Trump has done in blacklisting Huawei and ZTE technology. Look, we're facing a massive threat from China when it comes to the 5G network. And if they own that network, they essentially own the data that national security organizations down to private citizens are using. And so President Trump taking that stand, and I think it was very courageous to blacklist those companies, particularly in the middle of the trade discussions. I think that's a great indicator that we're pushing back.

How about the Space Force? Is this a good idea or unnecessary? We already have an Air Force. Air Force, it seems to—

No, actually, let me tell you what Robert was getting at. There are 5 domains of warfare now: sea, air, land, space, and then the 5th one that the Air Force declared was cyberspace. So what I want out of Space Force is the uniforms.

I think they're going to be wicked. Oh yeah, yeah.

But we have to realize that these battles now will be fought and you have cyberspace in outer space now. You have cyberspace in air, you have cyberspace on the ground. So it is something we're going to have to fight. Let me tell you, you were talking about the way to defeat the Soviets. A lot of this was because of the Strategic Defense Initiative, and we outspent the Soviets. We bankrupted them. I think Space Force is another one of those things. We have a clear superior advantage. We're the only country that's ever landed a man on the moon and brought him back safely. You know, we have got— so I think our advantage is in space. But I'll tell you, again, what goes back to concern me is we're good, like Robert and Charlie said, we're good now. The question is, what are we doing to keep that? By the way, I was an executive at Alcatel-Lucent Bell Labs when we deployed the first public safety broadband. We politic with a couple of senators, including Rockefeller out of West Virginia, to keep Huawei out of the National Public Safety Broadband Network for those exact reasons. Because even back in 2012, we were concerned in 2011 that— and by the way, the feds never would have played in the National Public Safety Broadband had Huawei or ZTE been in.

By the way, you can say lobbying instead of politic because, you know, you might, you might be lobbying for a very good purpose, right? We're allowed to petition our government. Well, I read that somewhere.

It was competitive. It was competitive. But look, we talk, we're all We're all patriots. Charlie and I have shared probably some common grounds in the intel community and stuff. But at the end of the day, look, we're good at what we do, but the only way we're going to stay good at what we do is having the right effective policies, having the right technology, and having the leadership who's willing— not a political statement, but at least from a policy standpoint, like Charlie said, somebody threw down the gauntlet and said, this far but no farther. We're done doing this with Huawei. They're a clear threat. We've known they've been a threat for how many years? We've got to take action to defend and protect our infrastructure.

Structure. Okay, we got to go soon, but I just— this term that people in your industry use, the detection deficit. I guess this is the time between when bad stuff happens and then we learn that it's happened. Is this deficit generally getting smaller or larger?

That's a tough one. It seems to be getting— well, I mean, I would think at this point maybe smaller. It's hard to say. Discovering a data breach sometimes is years. Small to medium businesses sometimes never at this point. Large corporations have become hardened, much more sophisticated forensics in place. So I mean, the bells and whistles, the alarms are letting them know sooner. Right.

A sloppy thief breaks into your house and you know it.

Yeah. Yeah, that's it.

But on average, on average, they're talking like some of these places are in there for 90 to 95 days before they discover it. Then it takes 60 days to remediate it. But the real issue on a lot of this stuff too is it's the Russians. We're talking about who's capable. One indicator of who's really capable is when the Russians get in, They've been— we're documenting they have— it takes them 18 minutes now to make the next leap, where it takes China 2 to 3 hours and North Korea 3 to 4 hours. The Russians are very good. Once they get in, they move very quickly before the fire department shows up to put out your fire. And they're now into the next system. So it's that— it's not— everybody's going to get breached. Everybody, every single Fortune 500 has been breached. It's how fast you respond to that. And what the Russians are good at doing is moving on before you identify that breach has happened.

So the Russians were not able to hack the 2016 election, but they're hacking a lot of other things, and we ought to be—

not this cup though. They can't hack this cup.

Good. Okay, Charlie Morgan, Robert Siciliano, thanks for joining us today. Appreciate that bracing look at the threats we face. Thanks to all of you. Have a wonderful Memorial Day weekend as we remember American heroes, and please join us next week on Deep Dive on Fox Nation. Thanks.