Fred Kaplan

For all the headlines about cyber warfare as a new type of conflict, few realize that it in fact dates back nearly 50 years, to the birth of the Internet. And while most news stories on cyber attacks focus on Russia, China, North Korea, and Iran, the first and still most serious hacks were mounted—and the first ideas about cyber war were conceived—by the United States. In DARK TERRITORY: The Secret History of Cyber War (March 1, 2016/$28.00 hardcover), Pulitzer Prize-winning journalist and New York Times best-selling author Fred Kaplan probes the inner corridors of the National Security Agency, the beyond-top-secret cyber units in the Pentagon, the “information warfare” squads of the military services, and the national security debates inside the White House, to tell the story of the officials, officers, scientists, and spies who devised this new form of conflict and who have been planning—and, more than most people know, fighting—these kinds of wars for decades. Kaplan reveals the never-before-told story of the computer scientists and policymakers who invented—and now explore, exploit, and worry about—cyber war, which has spawned the world’s fastest-growing, most mysterious sector of military activity. Kaplan shows that this “new” kind of war actually has a long secret history, stretching back to the birth of the Internet, in the late 1960s, involving an entire community of technologists and spies, mainly in the National Security Agency, the Air Force Information Warfare Center, the Navy cryptology departments, and a special-access bureau within the Pentagon’s Joint Staff called J-39. Drawing on little-known documents and exclusive interviews with more than 100 participants in the story (ranging from cabinet secretaries, generals, and admirals—including six NSA directors—to midlevel officials and analysts, to technical wizards in the secret labs of the national-security bureaucracy), Kaplan delivers many news-making revelations, including the role that “information warfare” has played in tilting the outcomes of conflicts in Haiti, Serbia, Syria, the former Soviet republics, Iraq, and Iran. Spanning half a century, DARK TERRITORY also shines an unsettling light on our future. The cyber era allows almost every country to become a cyber war power, with the ability to disable critical infrastructure around the world with lightning speed. Ironically, Kaplan argues, this leaves America—the innovator and most technologically advanced country in the art and science of cyber war—most vulnerable of all, because we are the most advanced, the most immersed in a matrix of computer networks, which are all vulnerable. With all the resources at our disposal, the U.S. still has no effective defense against a determined cyber attack. REVELATIONS FROM DARK TERRITORY A pivotal moment in U.S. cyber policy came when President Ronald Reagan watched WarGames, the popular 1983 movie about a teenage tech wiz who unwittingly hacks into the military’s early-warning computer and almost triggers World War III. Four days after screening the film at Camp David, during a meeting of his national-security advisers, Reagan asked Gen. John Vessey, chairman of the Joint Chiefs of Staff, “Could something like this really happen?” Vessey came back a week later and replied, “Mr. President, the situation is much worse than you think.” This exchange led, a year later, to a National Security Decision Directive, NSDD-145, the first White House policy statement on computer security. The directive put the National Security Agency in charge of setting security standards for all American computer systems and networks. Civil-liberties advocates in Congress—noting that the NSA’s charter allowed it to monitor only foreign communications—overrode the policy. The tensions between security and privacy, which the battle set off, persist to this day, most dramatically in the controversy over Edward Snowden’s leaks. Vessey answered Reagan’s question the way he did because a small group of national-security scientists had been worrying about the looming problem for more than a decade. Sixteen years before WarGames, in 1967, on the eve of the rollout of ARPANET (the military’s precursor to the Internet), Willis Ware, a computer scientist at the RAND Corporation (an Air Force-sponsored think tank), warned in a classified paper that putting information “on-line” (perhaps the first use of that phrase), and thus allowing access by many people at unsecured locations, would create inherent vulnerabilities; it would no longer be possible to keep secrets. The engineers who built ARPANET read Ware’s paper but argued that the project was hard enough without saddling it with security requirements; besides, they reasoned, it would take America’s foes decades to exploit the program’s flaws. It did take three decades, but meanwhile whole systems and networks grew up and spread with no provision for security. All of today’s problems with cyber attacks stem from this omission. Willis Ware (who, in a coincidence that Kaplan also uncovered, advised the screenwriters of WarGames on a crucial plot point) could envision the future because he was also on the Scientific Advisory Board of the NSA. He knew that the NSA was intercepting Russian and Chinese phone calls and radio transmissions. (This was before these Communist foes had computers, but for many years all computer modems were hooked up to phone lines.) Ware knew that if we could hack them, they could hack us—if not at the moment, then sometime soon. It took another 15 years after Reagan for senior officers and politicians—who, like most people at the time, knew little about computers—to take the threat seriously. In a highly classified 1997 war game called “Eligible Receiver,” a team of 25 NSA operatives, using commercially available equipment and software, easily hacked into Defense Department computer networks worldwide—halting, rerouting, and distorting communications—without their targets even knowing they’d been hacked. A few months later, real-life hackers penetrated the networks of several military agencies and command posts. The hackers turned out to be a pair of mischievous teenagers in northern California. Some officials heaved a sigh of relief, but others were more panicked: if a couple of kids could pull this off, what could a nation-state do? A few months later, the answer was clear: in an operation codenamed Moonlight Maze, Russian intelligence services did the same thing the kids had done—but far more widely, in a more sophisticated and persistent fashion. A few articles have been written over the years about Moonlight Maze. But Kaplan tells the previously untold story of a trip that U.S. officials made to Moscow in April 1999—at the dawn of warm, post-Cold War relations between the two former rivals—to confront Soviet officers about the hack. At first, one Russian general cooperated with the probe, supplied the Americans with files, and cursed what he assumed were rogue elements in the intelligence service who’d committed these outrages. The next day, the cooperation ended, contact was cut off. It was clear that the hackers weren’t rogues. The cyber-attacks stopped for a while, but soon resumed—and, no later than 2001, the Chinese entered the field as well. But long before this time, the United States was already secretly hacking enemy networks. Kaplan provides previously unrevealed details about these operations • In the months leading up to the first Gulf War of 1990-91, a joint NSA-Pentagon intelligence team discovered that Saddam Hussein had laid fiber-optics cable from Baghdad to Kuwait, so he could send commands to his officers. No one yet knew how to intercept those kinds of communiqués (that would come later), but the intel team found out from Saddam’s European contractors where the cable’s switches were laid. When the war started, U.S. bombers blew up the switches. As a back-up, Saddam sent orders through microwave transmissions. A new secret U.S. spy satellite, designed to scoop up microwaves, was positioned right overhead. The U.S. commanders won the war swiftly, in good part because they knew the precise locations, plans, and movements of Iraqi soldiers. (The head of the intelligence team was Rear Admiral Mike McConnell. A few years later, when he became NSA director, he created a new office called the Director of Information Warfare; he filled it with an NSA field agent named Richard Wilhelm, who had been his deputy during the Gulf War.) • In 1994, President Bill Clinton planned an invasion of Haiti to oust a gang of warlords who had toppled the elected government. The Pentagon was looking for a way to fly combat and transport planes across its borders without detection by radar. Some young analysts at the Air Force Information Warfare Center in San Antonio, Texas, discovered that Haiti’s air-defense system ran on the island’s commercial phone network—and one of these analysts knew how to make all the phones in Haiti busy at the same time, thus disabling the air defense system too. (The invasion proved unnecessary; after a stern warning, the coup-plotters fled.) • Soon after Haiti, the Air Force created the 609th Information Warfare Squadron. In its public statements, the unit was said to develop plans to defend against foreign attacks on U.S. military communications networks. But in fact, two-thirds of its time and budget were devoted to planning U.S. attacks on foreign communications networks. • In 1998-99, during NATO’s air war on Serbian president Slobodan Milosevic, the NSA, CIA, Britain’s GCHQ, and other secret agencies expanded the notion of “information warfare,” not only tapping into Serbian air-defense radar—which, like Haiti’s, operated on the local phone system—but also using this penetration as a prelude to tracing Milosevic’s social network, then sending threats and messages to his cronies warning them to drop their support of the dictator. • Long before this, in the 1980s, when the Reagan administration was warning of an overwhelming Soviet threat, the NSA had in fact so thoroughly penetrated Soviet command-control networks that many analysts believed the U.S. could win a major war before it had begun. At first this inspired Reagan to push the U.S. advantage in hawkish rhetoric—but then led him to back off and seek arms-control treaties, after he realized the Soviet leaders felt encircled. • During this era, the U.S. spies in Moscow were monitoring Soviet leaders’ telephone calls by beaming microwaves from the embassy’s 10th floor. When a fire broke out in the embassy, the Moscow firemen said they wouldn’t put it out unless they were given access to the 10th floor. The State Department asked NSA director Bobby Ray Inman what they should do. Inman replied, “Let it burn.” These information-war campaigns were conducted with pre-cyber technologies—phone lines, radio and microwave transmissions—but they set the pattern for cyber-war tactics and strategies after the NSA caught up with the new technology. Much of this catching up was done by the NSA’s Office of Tailored Access Operations, a special unit of elite hackers that grew in size from a couple dozen—when it was created in 1999—to several thousand, in remote locations around the world by the middle of the next decade. TAO was the cyber equivalent of the CIA’s “black-bag” operations. (Its motto: “Getting the ungettable.”) Just as CIA spies stole documents out of foreign safes or planted taps on enemy phones, TAO’s operatives hacked into foreign computers and cell phones. Sometimes CIA and NSA worked together: a CIA office known as the Information Operations Center would plant a device on a foreign target, which then allowed the TAO to hack the system and network. (Their first joint operation was in Serbia: CIA attached the tap at the headquarters of Belgrade’s phone company; TAO used the assist to hack its network.) The combination of TAO, higher-speed computers, and new processing technologies, many of them conceived at NSA headquarters, led to a major ratcheting up of cyber warfare’s possibilities. The story of Stuxnet—the U.S.-Israeli computer virus that sabotaged Iran’s nuclear program for a year, starting in 2009—is well known, but Kaplan reveals other, equally elaborate, secretive, and consequential cyber operations. • In the latter part of the Iraq war, beginning in 2007, U.S. forces suddenly experienced a dramatic decline in casualties. Many accounts attribute this trend to President George W. Bush’s “surge” of U.S. troops and to a shift in strategy under the new U.S. commander, Gen. David Petraeus. These accounts are true, to some extent, but another reason for the change was cyber warfare. The NSA started hacking into insurgents’ computers. Then, with Bush’s permission (because presidential authorization is required for cyber operations that could kill people or wreak physical destruction), NSA linguists wrote phony emails to insurgents, instructing them to meet at a certain place—where U.S. Special Operations Forces would be lying in wait to kill them. More than 4,000 insurgents were killed in this fashion. Over a period of a few years, in Iraq and Afghanistan, 6,000 NSA analysts were deployed to the battlefield; 22 of them were killed, mainly by roadside bombs, while they were looking for more enemy computers. • In June 2007, four Israeli F-15 fighters flew more than 100 miles into Syrian territory and dropped bombs on a nascent nuclear reactor. They were able to do this because Israel’s secret NSA counterpart, Unit 8200, hacked the data link between Syria’s radars and radar screens and injected false images making it seem that no planes were in the sky. • In 2015, after Sony Entertainment was famously hacked, U.S. officials knew—and announced in unusually certain language—that North Korea had launched the attack because the NSA had long ago penetrated North Korea’s computer networks. NSA analysts weren’t tracking the country’s activities in real time, but they could pull out the files and watch what the Korean hackers were watching on their screens at the time of the hacking. • When China hacks into defense networks, including some defense industries, the NSA is frequently able to watch what the hackers are doing. In some cases, when Chinese hackers think they’re stealing American trade secrets, they’re in fact grabbing phony documents—“honey pots”—that the NSA has planted to mislead them deliberately and to follow their movements. • In 2010 Pentagon officials drafted public statements acknowledging America’s own cyber-offensive strategies and capabilities. But after President Obama started publicly criticizing China for its widespread hacking, Secretary of Defense Leon Panetta spiked the drafts and halted the plans for more openness, fearing that they might make Obama look hypocritical. (Obama has since signed a top-secret Presidential policy directive, PPD-20, that outlines cyber-offensive operations in far greater detail than any previous president—and has also let Secretary of Defense Ashton Carter issue public statements that are far more open about these policies.) However, as Willis Ware predicted back in 1967, what America can do to its foes, its foes can someday do to America—and that someday is now. • After Stuxnet, Iran launched a massive cyber-attack on Aramco, the Saudi-Arabian oil company, melting 30,000 hard drives and planting the image of a burning American flag on all of its computer screens. Iran also hacked records and destroyed thousands of hard drives belonging to Las Vegas Sands Corp.’s hotels and casinos after its owner, right-wing billionaire Sheldon Adleson, advocated dropping a nuclear bomb on Iranian territory. • As far back as 1997, during the Eligible Receiver game, the NSA team noticed signs of real-life French hackers roaming inside a Pentagon network—a discovery that was kept quiet, even in many top secret briefings about the game’s results. • Over the past several years, in every Pentagon war game testing the vulnerability of Defense Department networks, the hackers have broken into the networks. In recent classified studies, advisers have concluded that there is no defense against competent hackers. This is distressing since the U.S. military’s qualitative advantage hinges on high-tech weapons and sensors that depend on computer connections. The Pentagon has started to focus more on the ability to detect cyber attacks and to recover the damage quickly. Kaplan also tells, in great detail, the behind-the-scenes story of the five-man commission, appointed by President Barack Obama, that proposed NSA reforms after the Snowden disclosures. The most controversial proposal, which Obama accepted, involved removing “metadata” files from NSA headquarters and storing them with telephone companies. Kaplan reveals that this idea—which many Republican politicians warned would “blind” our intelligence capabilities—came from the NSA director at the time, Gen. Keith Alexander, who assured the panelists that storing the files elsewhere wouldn’t impede investigations. (The panelists discovered that metadata hadn’t helped nab any terrorists, though they also concluded that another controversial program, called PRISM, which involved using FISA court orders to hack into Internet networks, had helped stop 53 terrorist plots.) Like the commission, Kaplan concludes that the NSA has only rarely abused its intrusive powers for domestic political purposes, but that the potential for abuse is enormous. He also concludes that U.S. Cyber Command—which was created in 2009 and, by charter, is headed by the same four-star general or admiral who directs the NSA—is putting too much emphasis on cyber-offensive operations, even though no one has thought through such basic questions as what a prolonged cyber war would look like, how to keep it from escalating, or how to deter it from happening in the first place. One key problem, Kaplan concludes from his history, is excess secrecy. When the NSA was strictly into making and breaking codes, extreme secrecy made sense: if enemies knew we had broken their codes, they would make new ones, and we’d have to start all over. But now that the NSA is wrapped up in a combat command, it’s dangerous that it operates in total darkness without outside influence or public debate. The title Dark Territory comes from Robert Gates, who, as secretary of defense in the late Bush and early Obama administrations, proposed that the major cyber powers get together behind closed doors to set informal “rules of the road,” barring cyber-attacks on critical infrastructure—electrical power grids, air-traffic control systems, water works, etc. Even during the worst days of the Cold War, the Russians and Americans followed some rules: for instance, barring each side from killing the other’s spies. In cyberspace, though, there are no rules. “We’re wandering in dark territory,” Gates said. The term was coined by North American railroads to signify stretches of track ungoverned by signals. Gates’ grandfather had been stationmaster on the Santa Fe Railroad for almost 50 years. Gates heard lots of railroad terms growing up in Kansas, used it frequently through his adult life, and thought this one was a neat parallel to cyberspace—except that the latter’s dark territory was much vaster and more dangerous because its engineers were unknown, its trains were invisible, and its collisions could be far more deadly.