OK, that title is an exaggeration. But they have recently presented vastly differing viewpoints on the dangers our nation faces via cyber attacks.
Col. Mateo Martemucci, USAF, soon to join the Joint Chiefs in DC, is our top military guy in cybersecurity. He spoke April 29, 2015, to CFA Pittsburgh (FB) at the Duquesne Club.
He began by defining the internet of things – it includes anything with an IP address, meaning not only your phone, but also your smart thermostat, cars, etc. Then he defined the levels of mischief: Cyber attack (4DM – Defeat, Deny, Diminish, Destroy), Exploit (to copy and steal information, like account information), and Espionage (which may be attack or exploit or both).
The three kinds of attacks are Information, which is propaganda and denial of service, Infrastructure, and Economic Infrastructure.
The sources of the attacks are the internet (outside), supply chain (the hardware or software as purchased on the computers you use), and Insiders, which is the hardest to control.
The bad guys are nation-states, NGOs (like terrorist groups), and individuals (hacktivists).
He stated that there are currently no disincentives to this hacking. But I think the people he talked about who have been arrested for it would disagree. However, this is largely true for people outside the US, as well as nations and companies.
Colonel Martemucci concluded with his opinion that economic espionage is the SINGLE GREATEST THREAT to our national security.
He noted that the military currently has no legal standing to defend any website, IP address, company, or person against cyber attack from within or outside the US, and that it would take legislation for them to be able to act in that realm, other than .mil and .gov. He also compared the situation to the Barbary Wars, which was the impetus for the formation of the US Navy and Marines in their current form. At the same time, he stated “the less we give the government to do, the better.” His opinion is that we should defend at the lowest possible level, with public private partnerships as appropriate.
In contrast, former NSA chief Keith Alexander was recently interviewed by Ambrose Evans-Prichard of the Telegraph.
“The greatest risk is a catastrophic attack on the energy infrastructure. We are not prepared for that,” said General Keith Alexander, who has led the US battle against cyber-threats for much of the last decade.
Gen Alexander said the “doomsday” scenario for the West is a hi-tech blitz on refineries, power stations, and the electric grid, perhaps accompanied by a paralysing blow to the payments nexus of the major banks.
“We need something like an integrated air-defence system for the whole energy sector,” he said, speaking at a private dinner held by IHS CERAWeek in Texas.
More insidiously, there is now a systematic effort by state-backed hacking teams to steal technology from Western companies. “This is the biggest wealth transfer in history,” he said.
…
Gen Alexander, who served as head of US Cyber Command as well as director of the electronic eavesdropping agency, listed five countries able to conduct cyber-warfare at the highest level: the US, UK, Israel, Russia, and surprisingly Iran.
He did not include North Korea, describing the cyber-sabotage of Sony last year as relatively primitive. The attack could have been prevented with early warning sensors that pick up changes in the “behaviour” of computer systems.
China clearly has first-rate hackers, allegedly concentrated at a 2,000-strong cell of the People’s Liberation Army in Shanghai. The current NSA chief Michael Rogers testified late last year that China is capable of cyber-attacks that could cause “catastrophic failures” of the water system or the electricity grid.
…
There is no suggestion that China has an intention to use its power to damage US infrastructure. NSA officials are less confident that Iran will show self-restraint.
The Iranians revealed their skill in August 2012 with a taunting virus attack on Saudi Aramco, Saudi Arabia’s state-owned oil giant. Hackers erased most of the company’s emails and documents, leaving an image of a burning American flag on the computer system as their calling card. There was a similar attack on Qatar’s state-energy group RasGas.
The action was a form or retaliation for economic sanctions against Iran, but also a warning shot to Riyadh in an escalating battle for Mid-East dominance by the two regional superpowers. It is highly pertinent today given comments by leading figures in Tehran that the Saudis will be “punished” for their decision to drive down the price of oil.
A report by the cybersecurity firm Cylance Corp claimed that Iran’s experts have hacked into the email systems of the US navy and marines, as well as other critical computer systems in Britain, France, and Germany.
The American Enterprise Institute has issued its own report concluding that the nuclear deal with Iran will merely enable the country to step up its step up its attacks. “It would be comforting to imagine that a new era of détente will end this cyber arms race. There is, unfortunately, no reason to believe that that will be the case,” it said.
Interesting. Colonel Martemucci stated that he is not at all concerned about any nation-state attacking infrastructure, because our economies are now so interconnected that if the US East Coast was shut down, it would cause a great deal of economic pain world wide, including the source of the attack. I think this is certainly true for China, and as sanctions are lifted, the incentives for Iran would all be on the side of NOT attacking, as they integrated back into the world economy. Also, you can’t sell oil if all the gas stations are shut down! This is a disincentive even for Daesh.
For My Benefit 