The media is overly excited about the Russian hacking using the SolarWinds update process.
First, was it Russia?
It seems likely that it was Russia, but not certain. Anyone who is good enough to develop the
SolarWinds hack would be smart enough to cover his tracks. He may not have covered them perfectly, and
we may be able to track down the hacker, but he may also have successfully
covered his tracks. He could be a
Chinese hacker who copied the trademark signatures of the Russian hackers and
who routed his hacks through Russian servers or websites. It could be a hacker anywhere who did the same
thing. It requires computer expertise,
but there are a lot of computer geniuses out there, including in the Middle
East and Latin America. I am surprised
that no one has mentioned Edward Snowden in connection with the hacking. He is a computer genius living in Russia who
knows American computer security extremely well. Is it possible that the Russians have gotten
some help from him?
Second, I think that whatever this was, it was not an attack
or the start of a war. It looks more
like intelligence gathering and testing of hacking techniques. The test worked pretty well, since it went
undetected for six months, but of course there may be other hacks out there
that have been even more successful and have still not been detected. In any case, nothing major has been
damaged. They have not even emulated the
ransomware hackers, who have captured and held important data from hospitals
and government offices for ransom. They
have not shut down the electric grid or turned off the water or sewage
treatment in any cities.
I doubt that the hackers knew exactly what organizations
they were going to be hacking into. They
knew that SolarWinds had lots of important clients, but they probably weren’t
sure exactly which ones they would end up getting access to. They may have succeeded far beyond their
expectations, or it might have gone exactly as planned. We don’t know. Were their main targets government agencies,
or private companies? We don’t
know. The fact that the hackers did not
steal money indicates to me that they were probably government-backed, and not
private citizens hacking for fun and profit.
Sen. Mitt Romney compared the hack to the US invasion of
Iraq, when we took out many of Iraq’s communications hubs with our
missiles. I do not think this is an
appropriate comparison. The hackers did
not use their weapons, if indeed they have weapons that could bring down
facilities in the US. It was like
developing and demonstrating new missiles, putting the enemy on notice that you
have these capabilities and can use them if you choose to. But they (whoever they are) have not chosen
to. But just as Saddam should have been
wary of provoking the US, we should beware of provoking these hackers.
As nations develop new weapons they often turn to arms control
to prevent the new weapons from leading to war.
We don’t have much experience with arms control type agreements for
computer hacking, but some of the same principles apply, like Reagan’s maxim, “Trust
buy verify.” I am not sure how you
verify an agreement to control hacking. Bombs
and missiles usually need to be tested in the open, where detection by
satellites or other means is often possible.
Hackers can experiment on their own internal networks, which may be
difficult or impossible for outsiders to monitor. Of course the best test would be to see if
you can penetrate the actual defenses of the country or business you might want
to attack in the future.
Nevertheless, arms control agreements are like speed
limits. Not everyone obeys them, but
they set standards of behavior and provide a basis for at least discussing
violations, if not definitively proving and punishing them.
Another complication is non-state actors who hack for their
own personal purposes. It is a lot
easier for an individual or small group to hack into a network than it would be
for them to develop a bomb or missile. Governments
have developed systems for dealing with violent terrorists that are different from
those for dealing with other governments.
We already have criminal penalties for individual hackers although they
may be hard to apply to hackers operating from foreign countries.
I think it is worthwhile to begin discussions of some kind
of arms control agreement covering hacking to get some idea of what’s possible
and what’s not. In an ideal world
leading tech countries would work together to control individual bad actors and
well as to monitor each other’s conduct.
