“How do we increase”: Ellen Nakashima, “Cyber Chief: Efforts to Deter Attacks Against the US Are Not Working,” Washington Post, March 19, 2015.
“probably one or two”: Patricia Zengerle, “NSA Chief Warns Chinese Cyber Attack Could Shut U.S. Infrastructure,” Reuters, Nov. 21, 2014, http://www.reuters.com/article/2014/11/21/usa-security-nsa-idUSL2N0TB0IX20141121.
“The American public”: Liberty and Security in a Changing World: President’s Review Group, 62.
INDEX
A note about the index: The pages referenced in this index refer to the page numbers in the print edition. Clicking on a page number will take you to the ebook location that corresponds to the beginning of that page in the print edition. For a comprehensive list of locations of any word or phrase, use your reading system’s search function.
Abizaid, John, 159, 173
cyber warfare as priority of, 145–48, 149–50
Abkhazia, 164–65
Abraham Lincoln, USS, 147
Absolute Weapon, The (Brodie), 277
Adelson, Sheldon, 265–66, 267
Afghanistan, 147, 182, 199, 229
U.S. war in, 208
Against All Enemies (Clarke), 240
agent.btz (computer worm), 182
Air Combat Command, Information Warfare Branch of, 107, 110
Air Force, U.S., 64, 70, 79
Office of Special Investigations of, 85, 87
Air Force Cryptology Support Center, 62
Air Force Information Operations Center, 225
Air Force Information Warfare Center (Air Intelligence Agency), 7, 32, 58–59, 85, 107, 108, 110, 111, 112, 122–23, 126, 137, 161, 176, 212, 223, 225, 292n–93n, 296n
Computer Emergency Response Team of, 62–63, 69, 73
demon-dialing counter-C2 plan of, 59, 64
Network Security Monitoring program of, 60–61, 62
Air Force Scientific Advisory Board, 51
Air Force Systems Command, 50
Alexander, Keith, 148–49, 173, 213
as Army deputy chief of staff for intelligence, 149–50
as Army Intelligence and Security commander, 148, 152, 154–55, 196
BuckShot Yankee and, 182–84
CNE and, 180
as CyberCom head, 189, 211
cyber warfare expertise of, 149, 157–58
Hayden’s conflicts with, 152–53, 154–55
infrastructure security and, 280–82
metadata and, 230, 231, 233, 253, 256
as NSA director, 152, 155–56, 174, 178–81, 182–84, 185–86, 187, 189, 204, 211, 214, 231, 244, 247, 252, 253, 256
Obama information-sharing bill opposed by, 281–82
PRISM and, 247
and Snowden leaks, 231
Stuxnet attack and, 204–5, 206
Turbulence and, 157–58
al Qaeda, 140, 142–43, 147, 151, 171, 192, 197, 240–41, 245
U.S. drone strikes on, 201, 208
Amazon, 102
American Civil Liberties Union (ACLU), 239
American Electrical Power Company, 167
Anderson, Jack, 288n–89n
Andrews, Duane, 54
Andrews Air Force Base, cyber attack on, 73, 74
AntiOnline, 77
AOL, PRISM and, 247
Apple, PRISM and, 247
Aristide, Jean-Bertrand, 58, 59
Army, U.S., 70, 79, 151
Intelligence and Security Command of, 148, 152–55, 196
Land Information Warfare Activity of, 32, 123
Army Intelligence Center, 148–49
ARPANET, 7–9, 276
Arquilla, John, 291n
ASD(C3I), 6, 20, 54, 119, 125
Asia Society, Donilon’s speech at, 221–22, 226–27
Assad, Bashar al-, 160–61, 198
Assante, Michael, 166–67
@stake, 103
Aurora Generator Test, 166–69, 171, 174, 204, 206, 241
Australia, see five eyes
auto industry, 199
automobiles, hacking of computers in, 273n–74n
back doors, 8, 37, 73, 93, 235, 257
Baghdad, 22
Balad Air Base, Iraq, 159
Balkans, 1999 NATO bombing of, 112–14, 115, 119, 161
banking industry:
cyber attacks and, 104, 275
cyber security as low priority of, 175
2008 crisis in, 199
Basra, 22
Bates, John, 250
Baywatch (TV show), 112
beacons (cyber tracking code), 83, 181–82, 207
Beers, Rand, 46, 48, 49, 89, 95, 97
Bejtlich, Richard, 137, 223
Bell Corporation, 44
Bellknap, Lloyd, 62
Berger, Sandy, 89, 96
bin Laden, Osama, 89, 90, 140, 142–43
killing of, 239
Black, William, 132, 156, 219
Black Chamber, 11
Bloomberg Businessweek, 268
BND, 235
Boeing, 132
Booz Allen Hamilton, 132, 172, 173, 176
Border Gateway Protocol, 93
Bosnia-Herzegovina, 110–11, 146
Bremer, L. Paul, 147
Brezhnev, Leonid, 12
Broderick, Matthew, 1, 59
Brodie, Bernard, 277, 278
Brooks, Jack, 20, 34
Brown, Michael, 187–88
Bryan, James D., 122, 147
Buckshot Yankee, 185, 207, 276
Alexander and, 182–84
Bush, George H. W., 21, 24, 44, 66
Bush, George W., 3, 103, 171, 173, 175–76, 216, 225, 304n–5n
FISA revision and, 193, 195
Iraq insurgency and, 150
Iraq invasion and, 142–43, 145, 147
Iraq troop surge ordered by, 158, 173
McConnell’s cyber warfare briefing of, 173–75, 187
NSPD-54 of, 178, 199
Obama’s Stuxnet briefing by, 203
Stellar Wind and, 155n
Stuxnet and, 203, 205, 206, 208, 209, 212, 215
in 2000 election, 103, 139–40
Bush (G.W.) administration:
cyber security as viewed in, 140–41
cyber warfare and, 3
terrorism as low priority of, 140–41
warnings on al Qaeda ignored by, 240–41
Butler, Robert, 279
Campbell, John “Soup,” 70–71, 110–11, 121, 122
JTF-CND headed by, 81–82, 83–84, 88
Canada, see five eyes
Cannon, Lou, 287n–88n
Carter, Ashton, 283
Carter, Jimmy, 13, 15, 59
Cartwright, James, 219
Casablanca (film), 234–35
Casey, William, 27
Central Command, U.S., 145–46, 147–48, 149, 152, 207,
cyber attack on, 181–84, 185
Central Intelligence Agency (CIA), 6, 27, 45, 49, 126, 146, 147, 151, 185, 229, 238–39
civil liberties abuses by, 192
Critical Defense Technologies Division of, 7
Hayden as director of, 215
Information Operations Center of, 113, 134, 161, 207
NSA interaction with, 133–34
Cerf, Vint, 102, 103
Charney, Howard, 235
Cheney, Dick, 24, 140, 174, 203–4
Chilton, Kevin, 183
China:
information warfare and, 224
U.S. hacking of computer systems in, 227–28, 229
U.S. relations with, 221–28
China, cyber warfare by, 4, 85n, 198, 213, 220, 221–28, 242, 269
financial theft in, 224, 227
Google attack of, 234
intellectual property and trade secrets as targets of, 224–27, 308n
Obama and, 221–28, 235
see also People’s Liberation Army
Christopher, Warren, 12–13
Church, Frank, 37, 192, 285
&nb
sp; Church Committee, 37, 230, 252
“CIA Eavesdrops on Kremlin Chiefs” (Anderson), 288n–89n
Cisco, 137, 235
Citibank, Russian hackers’ attack on, 42
civil liberties:
intelligence community and, 251–52, 259, 260
NSA and, 3, 20, 188, 192, 194–96, 231, 239, 244–52, 264
Protect America Act and, 194–95
Stone and, 239, 244, 251, 259, 264
Civil War, U.S., 4
Clapper, James, 231–33
Clark, Wesley, 112, 113, 115
Clarke, Richard, 139, 174, 175–76, 177, 191n, 200, 225, 274
books written by, 240–42
in Bush (G.W.) administration, 140–41, 143
as Clinton’s counterterrorism adviser, 89, 95–97
critical-infrastructure plan of, 239–40
FBI briefing and, 254–55
Hamre and, 95–96
L0pht and, 91–4
National Plan for Information Systems Protection written by, 100–105, 141–42
9/11 attacks and, 141
9/11 Commission testimony of, 240
PDD-63 as drafted by, 97–99
presumptuousness of, 95–96, 98, 101, 240
in Review Group, 240, 243, 245, 247, 251, 253, 254–55
Zatko and, 90–95, 103–4
Clinton, Bill, 3, 40, 55, 74, 87, 89, 96, 102, 115, 175–76, 239
cyber security summit of, 102–4
Executive Order 13010 of, 47, 48–49, 74
Haitian invasion planned by, 58–59, 107–8
Lewinsky affair and, 103, 115
PDD-39 of, 39–40
PDD-63 of, 95
Clipper Chip, 36–37, 40, 58, 100, 128, 239, 244
CNCI, see Comprehensive National Cybersecurity Initiative (CNCI)
Coalition Vulnerability Assessment Team, 65–66
Cohen, William, 113, 120, 121
Cold War, 4, 84, 129, 184, 284
cryptology in, 13
end of, 29, 30, 123, 124
espionage in, 138–39
NSA and, 12
nuclear options in, 218
unspoken rules in, 272–73
command-control systems, 13, 15, 43, 51, 65, 224
Commerce Department, U.S., 34
cyber security as viewed in, 172–73
Comprehensive National Cybersecurity Initiative (CNCI), 177–78, 180, 198–99, 278
Computer Crime Initiative Plan, 41–42
computer industry:
cyber security as low priority of, 102–3, 104–5, 176
PDD-63 resisted by, 98, 99–100
Snowden leaks and, 234
Computer Network Attack (CNA), 122, 137–38, 180, 204, 211, 212, 219, 220, 281, 283
Computer Network Defense (CND), 122, 137–38, 180
Computer Network Exploitation (CNE), 137–38, 180, 204, 212, 281
computer networks, 33
back doors in, 8, 73
IDS devices in, 176
infrastructure and, 41, 45, 52–53
inherent vulnerability of, 172, 174, 176–77, 179, 206–7, 241, 276–77
see also Internet
computers, computer software:
omnipresence of, 5
race between hackers and patchers in, 136–37
security of, see cyber security
zero-day vulnerabilities in, 137
Computers at Risk (National Research Council), 54
Computer Sciences Corp., 132
Computer Security Act (1987), 34
Computer Security Center (NSA), 18–19, 34, 60
Congress, U.S., 192
CNCI and, 178–79
defense authorization bills of, 46–47
NSA and, 3, 20, 27, 195–96
select intelligence committees of, 256
Congressional Budget Office, 71
Constitution, U.S., Fourth Amendment of, 192, 250
Cornerstones of Information Warfare (Weaver), 108
corporations:
cyber security as low priority of, 102–3, 104–5, 176, 274
regulations feared by, 98–99, 101, 176, 200, 274–75
as reluctant to share information, 281–82
Cotter, George, 18–19
counter command-control (counter-C2) warfare, 15–16, 33, 41, 58, 59, 76, 84, 220
in Desert Storm, 21–25
counterinsurgency strategies, 148, 158–59, 160
Critical Foundations (Marsh Report), 53–55, 72, 80, 89, 94, 100, 139, 142, 166, 199, 241
“Critical Infrastructure Protection” (PDD-63), 95, 139
Clarke’s draft of, 97–99
computer industry objections to, 98, 99–100
see also National Plan for Information Systems Protection
Critical Infrastructure Working Group, 40–41, 42–43, 48, 51
report of, 46, 47–48, 50
Cryptolog, 219–20
cryptology, 5, 7, 11, 13, 18
Cuckoo’s Egg, The (Stoll), 61, 82–83
“cyber,” first use of term, 45–46
cyber attacks, cyber warfare, 4–6, 53
Abizaid’s prioritizing of, 145–48, 149–50
as acts of war, 214, 271, 317n
Alexander’s expertise in, 149, 157–58
banking industry and, 104, 275
Bush (G.W.) administration and, 3
on Central Command, 181–84, 185
by China, see China, cyber warfare by
denial-of-service, 102–3, 162–63, 213, 216
distinction between national security and property theft in, 227
Eligible Receiver in, see Eligible Receiver 97 cyber attack exercise
escalation of, 213–20, 273–74, 284
on Estonia, 162–64, 165, 241
Gates’s concern about, 272–73
on Georgia, 164–66, 241
infrastructure as targets of, 104
and inherent vulnerability of networks, 276–77
Iran and, 4, 213, 265–68
against Iraq insurgents, 158–60, 173, 180
on Las Vegas Sands Corporation, 265–68
Law of Armed Conflict and, 25
Moonlight Maze and, 78–79, 81–88, 98, 119, 123, 187, 212–13, 223, 241, 276
morality of, 215
by North Korea, 4, 213, 216, 268–71, 272n
nuclear weapons vs., 215–16, 218
Obama administration and, 3–4
physical damage from, 166–69, 174, 198, 214, 215
political influence as goal of, 267
race between hackers and patchers in, 136–37
Reagan administration and, 1–3, 6–7
risks of, 212–13
by Russia, 4, 42, 164–66, 224
secrecy of, 212, 214–15, 216, 219, 284–85
Solar Sunrise and, 74–78, 80, 81, 98, 101, 119, 120, 123, 183, 187, 241
strategic role of, 168, 215
terrorists and, 98
unintended consequences of, 217
U.S. military’s resistance to, 117–18, 119, 120
U.S. offensive operations in, 4, 48–49, 174, 211–12, 291n
zero-day vulnerabilities and, 137
see also hacking, hackers; information warfare; specific operations and attacks
Cyber Command, U.S., 4, 211, 279–80
Alexander as head of, 189, 211
combatant support mission of, 280, 283
consolidation of armed services cyber agencies under, 195
critical-infrastructure security mission of, 280–83
Defense Department network security mission of, 280, 283
fusion of NSA and, 243, 260
McConnell’s proposal for, 185
Review Group recommendations for, 257
Rogers as head of, 282
Cyber Council, 176
cyber crime, 41–42, 46
CNE and, 139
cyber deterrence, 283
asymetrical response in, 277–78
Defen
se Science Board and, 278–79
McConnell and, 278
nuclear deterrence vs., 284–85
cyber-offensive teams, 211–12
Cyber Operations Policy Working Group, 217
cyber security, 17, 186, 243, 257
active defense (offensive operations) in, 281, 282, 283
air gaps in, 206–7
ARPANET and, 8–9
back doors and, 8, 37, 73
banking industry’s low priority for, 175
Bush (G.W.) administration complacency about, 140–41
Clinton’s summit on, 102–4
CNE and, 139
computer industry’s low priority for, 102–3, 104–5, 176
computer networks and, 33
Defense Science Board report on, 275–79
detection as goal of, 277
exponential rise in breaches of, 273–74
information-sharing and, 281–82
infrastructure and, 186–89
Internet and, 52–53
McConnell’s briefing of Bush on, 174–75
McConnell’s focus on, 172, 198, 278
military’s complacency about, 64, 105, 119
Obama’s prioritizing of, 200–201
resilience as goal of, 277
Review Group’s prioritizing of, 257–58
Wilhelm’s focus on, 40
cyberspace, 41, 45
as domain of warfare, 6
Cyberspace Policy Review, 199–200
Cyber War (Clarke), 241–42, 243
DarkSeoul, 269
data packets, 5–6, 131, 156, 157–58, 192–93, 194, 248, 249–50
Dayton Accords, 110, 112
DEF CON Hacking Conference, 136
defense contractors:
Chinese cyber attacks on, 224–25
hacking of, 41
Defense Department, U.S., 6, 18, 54, 67, 100, 257
Advanced Research Projects Agency (ARPA), 7
Critical Infrastructure Commission and, 49
cyber attacks on, 47
in Eligible Receiver, see Eligible Receiver 97 cyber attack exercise
hacking and, 41
IDS devices and, 81, 120, 176
infrastructure policy directorate of, 43–44
Internet connections to, 280
J Department of, 43, 44
Microwave, Space and Mobile Systems office of, 19
Moonlight Maze cyber attack on, 78–79, 81–88, 119, 123, 212–13, 223
National Communications System of, 177