Communications of the ACM
From 007 to 'Agent 111'
Credit: Naval Postgraduate School.
The information revolution has changed just about every aspect of society and security in our time, so it's no surprise that the spy business has been transformed as well. Yes, there are still human "moles" who scurry about inside organizations, gathering up vital information for their foreign masters, and no doubt those "sleepers" deported from the United States back to Russia in a 2010 prisoner swap were not the last of their kind; a real-life version of the television series "The Americans" likely continues, in many countries.
Yet adventurous James Bond-like spies have been fully eclipsed by a new generation of operatives who don't travel the world (not physically, anyway) or even drink martinis, shaken or stirred. Indeed, most of their time is spent tapping away at keyboards in cool, windowless rooms, their favored beverage some brand of highly caffeinated energy drink. Bond is giving way to Agent 111 ("007" in binary), who oftimes might just be a smart bot.
The latest exploit of some Chinese Agent (or agents) 111, which has just been made public this month, has to do with very sensitive data about American submarine operations. Access apparently was gained by hacking a private contractor doing work in this area for the U.S. Department of Defense. By infiltrating in this indirect manner, the cyber-spies were able to vacuum up over 600 gigabytes of data that, when the many pieces are put together, may provide a valuable picture of how the U.S. Navy intends to operate in contested waters like the East China Sea.
This serious breach, a real coup for Chinese intelligence, has come in the wake of a long string of damaging hacks aimed at strategic targets in the U.S. One of the worst was revealed on March 15 of this year —talk about "Beware the Ides!"—in a joint report issued by the FBI and the Department of Homeland Security that asserted a well-crafted Russian-sponsored intrusion effort had gotten in, quite deeply, to our power and water infrastructures. Given that these systems are highly reliant upon automated controls, the idea that some latter-day virtual James Bond might be able to "cybotage" them at will is most troubling. And for those who worry about how such hacks might hurt our military, just give Pete Singer and August Cole's Ghost Fleet a close read.
Back in 2015, one of the things U.S. President Barack Obama and China's President Xi Jinping discussed when they met was the matter of curbing hostile cyber activities aimed at the theft of commercial intellectual property. This Information-Age form of industrial espionage was costing the U.S. in the range of hundreds of billions of dollars each year. Both leaders agreed to declare a moratorium on this aspect of cyber-spying, though the Trump Administration has recently charged the Chinese with serial violations to it. Yet it is important to note, of the Obama-Xi agreement, that conducting cyber espionage in the military and security realms was not addressed. This omission has signaled to intelligence agencies in both countries—and to their counterparts around the world—that a new "cool war" was under way, and it was not to be curtailed.
There are two problems with tacit acceptance of cyberspace-based spying on militaries and other security-related actors. The first is that intrusions, though they may be for intelligence-gathering purposes, are nevertheless observationally equivalent to attack preparations. How is one to know whether the mapping of one's systems is prelude to an imminent attack, or to an attack coming at some undetermined time in the future? Either way, this form of cyber espionage is unsettling in the extreme, because of the threat of actual attack that may undergird it.
The second problem is that the line between military and non-military targets can be blurry, given that much of advanced information technology is inherently "dual use;" that is, the hardware and software that enliven commerce can do the same for conflict. So, in terms of the Obama-Xi agreement, hackers might legitimately claim, in going after sensitive intellectual property—for example, plans to the F-35 fighter plane—that all the tech related to design and production of this aircraft were fair game. Indeed, one need only look at the Chinese knock-off of the F-35 to see the strong similarities, and to infer what happened.
That raises another point about the threat posed by Agent 111: by gaining access to massive amounts of highly sensitive information via cyber-spying, as in this most recent intrusion into the computers of the U.S. Navy contractor, sufficient knowledge may be gained to allow the intruding party to leap immediately to the most advanced technology without having to go through the typically long, repetitive cycles of research, development and design. Thus, Agent 111 is key to a beneficial phenomenon Alexander Gerschenkron labeled "late modernization."
In short, Agent 111 may prove far more effective—and far more lethal, in terms of military effects—than 007 could ever have hoped to be. Further, cyber-spying is nearly impossible to deter, and when it comes to the views of heads of state, it seems to be accepted, in the context of military and security affairs at least, as "just a new form of espionage." The only viable answer, given the sorry trail of high-level intrusions into American and other countries' information systems, is that full emphasis must be placed on improving defenses. Firewalls and anti-virals will simply not do. The Cloud, the Fog, and the ubiquitous use of strong encryption should be emphasized as first steps toward mitigating the terrible vulnerabilities that can, thanks to the generation of human and virtual Agents 111 coming on line (literally), hold any nation at grave risk.
John Arquilla is professor and chair of defense analysis at the U.S. Naval Postgraduate School. The views expressed are his alone.
No entries found