@War: The Rise of the Military-Internet Complex (28 page)

The next day, January 12, 2010, Google's chief legal officer, David Drummond, posted a lengthy statement to the company's blog, accusing hackers in China of attacking Google's infrastructure and criticizing the government for censoring Internet content and suppressing human rights activists. “We have taken the unusual step of sharing information about these attacks with a broad audience not just because of the security and human rights implications of what we have unearthed, but also because this information goes to the heart of a much bigger global debate about freedom of speech,” said Drummond.

Back at the State Department, officials saw a rare opportunity to put pressure on China for spying. That night Hillary Clinton issued her own statement. “We have been briefed by Google on these allegations, which raise very serious concerns and questions. We look to the Chinese government for an explanation,” she said. “The ability to operate with confidence in cyberspace is critical in a modern society and economy.”

As diplomatic maneuvers go, this was pivotal. Google had just given the Obama administration an opening to accuse China of espionage without having to make the case itself. Officials could simply point to what Google had discovered as a result of its own investigation. “It gave us an opportunity to discuss the issues without having to rely on classified sources or sensitive methods” of intelligence gathering, Steinberg says.
The administration had had little warning about Google's decision, and it was at odds with some officials' reluctance to take the espionage debate public. But now that it was, no one complained. “It was their decision. I certainly had no objection,” Steinberg says.

The Obama administration began to take a harsher tone with China, starting with a major address Clinton gave about her Internet Freedom initiative nine days later. She called on China to stop censoring Internet searches and blocking access to websites that printed criticism about the country's leaders. Clinton likened such virtual barriers to the Berlin Wall.

For its part, Google said it would stop filtering search results for words and subjects banned by government censors. And if Beijing objected, Google was prepared to pull up stakes and leave the Chinese market entirely, losing out on billions of dollars in potential revenues. That put other US technology companies in the hot seat. Were they willing to put up with government interference and suppression of free speech in order to keep doing business in China?

After Google's declaration, it was easier for other companies to admit they'd been infiltrated by hackers. After all, if it happened to Google, it could happen to anyone. Being spied on by the Chinese might even be a mark of distinction, insofar as it showed that a company was important enough to merit the close attention of a superpower. With one blog post, Google had changed the global conversation about cyber defense.

The company had also shown that it knew a lot about Chinese spies. The NSA wanted to know how much.

 

Google had also alerted the NSA and the FBI that its networks were breached by hackers in China. As a law enforcement agency, the FBI could investigate the intrusion as a criminal matter. But the NSA needed Google's permission to come in and help assess the breach. On the day that Google's lawyer wrote the blog post, the NSA's general counsel began drafting a “cooperative research and development agreement,” a legal pact that was originally devised under a 1980 law to speed up the commercial development of new technologies that are of mutual interest to companies and the government.
The agreement's purpose is to build something—a device or a technique, for instance. The participating company isn't paid, but it can rely on the government to front the research and development costs, and it can use government personnel and facilities for the research. Each side gets to keep the products of the collaboration private until they choose to disclose them. In the end, the company has the exclusive patent rights to build whatever was designed, and the government can use any information that was generated during the collaboration.

It's not clear what the NSA and Google built after the China hack. But a spokeswoman at the agency gave hints at the time the agreement was written. “As a general matter, as part of its information-assurance mission, NSA works with a broad range of commercial partners and research associates to ensure the availability of secure tailored solutions for Department of Defense and national security systems customers,” she said. It was the phrase “tailored solutions” that was so intriguing. That implied something custom built for the agency, so that it could perform its intelligence-gathering mission. According to officials who were privy to the details of Google's arrangements with the NSA, the company agreed to provide information about traffic on its networks in exchange for intelligence from the NSA about what it knew of foreign hackers. It was a quid pro quo, information for information. And from the NSA's perspective, information in exchange for protection.

The cooperative agreement and reference to a “tailored solution” strongly suggest that Google and the NSA built a device or a technique for monitoring intrusions into the company's networks. That would give the NSA valuable information for its so-called active defense system, which uses a combination of automated sensors and algorithms to detect malware or signs of an imminent attack and take action against them. One system, called Turmoil, detects traffic that might pose a threat. Then, another automated system called Turbine decides whether to allow the traffic to pass or to block it. Turbine can also select from a number of offensive software programs and hacking techniques that a human operator can use to disable the source of the malicious traffic. He might reset the source's Internet connection or redirect the traffic to a server under the NSA's control. There the source can be injected with a virus or spyware, so the NSA can continue to monitor it.

For Turbine and Turmoil to work, the NSA needs information, particularly about the data flowing over a network. With its millions of customers around the world, Google is effectively a directory of people using the Internet. It has their e-mail addresses. It knows where they're physically located when they log in. It knows what they search for on the web. The government could command the company to turn over that information, and it does as part of the NSA's Prism program, which Google had been participating in for a year by the time it signed the cooperative agreement with the NSA.
But that tool is used for investigating people whom the government suspects of terrorism or espionage. The NSA's cyber defense mission takes a broader view across networks for potential threats, sometimes before it knows who those threats are. Under Google's terms of service, the company advises its users that it may share their “personal information” with outside organizations, including government agencies, in order to “detect, prevent, or otherwise address fraud, security or technical issues” and to “protect against harm to the rights, property or safety of Google.” According to people familiar with the NSA and Google's arrangement, it does not give the government permission to read Google users' e-mails. They can do that under Prism. Rather, it lets the NSA evaluate Google hardware and software for vulnerabilities that hackers might exploit. Considering that the NSA is the single biggest collector of zero day vulnerabilities, that information would help make Google more secure than others that don't get access to such prized secrets. The agreement also lets the agency analyze intrusions that have already occurred, so it can help trace them back to their source.

Google took a risk forming an alliance with the NSA. The company's corporate motto, “Don't be evil,” would seem at odds with the work of a covert surveillance and cyber warfare agency. But Google got useful information in return for its cooperation. Shortly after the China revelation, the government gave Sergey Brin, Google's cofounder, a temporary security clearance that allowed him to attend a classified briefing about the campaign against his company.
Government analysts had concluded that the intrusion was directed by a unit of the People's Liberation Army. This was the most specific information Google could obtain about the source of the intrusion. It could help Google fortify its systems, block traffic from certain Internet addresses, and make a more informed decision about whether it wanted to do business in China at all. Google's executives might pooh-pooh the NSA's “secret sauce.” But when the company found itself under attack, it turned to Fort Meade for help.

 

In its blog post, Google said that more than twenty companies had been hit by the China hackers, in a campaign that was later dubbed Aurora after a file name on the attackers' computer. A security research firm soon put the number of targets at around three dozen.
Actually, the scope of Chinese spying was, and is, much larger.

Security experts in and outside of government have a name for the hackers behind campaigns such as Aurora and others targeting thousands of other companies in practically every sector of the US economy: the advanced persistent threat. It's an ominous-sounding title, and a euphemistic one. When government officials mention “APT” today, what they often mean is China, and more specifically, hackers working at the direction of Chinese military and intelligence officials or on their behalf.

The “advanced” part of the description refers in part to the hackers' techniques, which are as effective as any the NSA employs. The Chinese cyber spies can use an infected computer's own chat and instant-messenger applications to communicate with a command-and-control server. They can implant a piece of malware and then remotely customize it, adding new information-harvesting features. The government apparatus supporting all this espionage is also advanced, more so than the loose-knit groups of cyber vandals or activists such as Anonymous that spy on companies for political purposes, or even the sophisticated Russian criminal groups, who are more interested in stealing bank account and credit card data. China plays a longer game. Its leaders want the country to become a first-tier economic and industrial power in a single generation, and they are prepared to steal the knowledge they need to do it, US officials say.

That's where the “persistent” part comes into play. Gathering that much information, from so many sources, requires a relentless effort, and the will and financial resources to try many different kinds of intrusion techniques, including expensive zero day exploits. Once the spies find a foothold inside an organization's networks, they don't let go unless they're forced out. And even then they quickly return. The “threat” such spying poses to the US economy takes the form of lost revenue and strategic position. But also the risk that the Chinese military will gain hidden entry points into critical-infrastructure control systems in the United States. US intelligence officials believe that the Chinese military has mapped out infrastructure control networks so that if the two nations ever went to war, the Chinese could hit American targets such as electrical grids or gas pipelines without having to launch a missile or send a fleet of bombers.

Operation Aurora was the first glimpse into the breadth of the ATP's exploits. It was the first time that names of companies had been attached to Chinese espionage. “The scope of this is much larger than anybody has ever conveyed,” Kevin Mandia, CEO and president of Mandiant, a computer security and forensics company located outside Washington, said at the time of Operation Aurora.
The APT represented hacking on a national, strategic level. “There [are] not 50 companies compromised. There are thousands of companies compromised. Actively, right now,” said Mandia, a veteran cyber investigator who began his career as a computer security officer in the air force and worked there on cybercrime cases. Mandiant was becoming a go-to outfit that companies called whenever they discovered spies had penetrated their networks. Shortly after the Google breach, Mandiant disclosed the details of its investigations in a private meeting with Defense Department officials a few days before speaking publicly about it.

The APT is not one body but a collection of hacker groups that include teams working for the People's Liberation Army, as well as so-called patriotic hackers, young, enterprising geeks who are willing to ply their trade in service of their country. Chinese universities are also stocked with computer science students who work for the military after graduation. The APT hackers put a premium on stealth and patience. They use zero days and install backdoors. They take time to identify employees in a targeted organization, and send them carefully crafted spear-phishing e-mails laden with spyware. They burrow into an organization, and they often stay there for months or years before anyone finds them, all the while siphoning off plans and designs, reading e-mails and their attachments, and keeping tabs on the comings and goings of employees—the hackers' future targets. The Chinese spies behave, in other words, like their American counterparts.

No intelligence organization can survive if it doesn't know its enemy. As expansive as the NSA's network of sensors is, it's sometimes easier to get precise intelligence about hacking campaigns from the targets themselves. That's why the NSA partnered with Google. It's why when Mandiant came calling with intelligence on the APT, officials listened to what the private sleuths had to say. Defending cyberspace is too big a job even for the world's elite spy agency. Whether they like it or not, the NSA and corporations must fight this foe together.

 

Google's Sergey Brin is just one of hundreds of CEOs who have been brought into the NSA's circle of secrecy. Starting in 2008, the agency began offering executives temporary security clearances, some good for only one day, so they could sit in on classified threat briefings. “They indoctrinate someone for a day, and show them lots of juicy intelligence about threats facing businesses in the United States,” says a telecommunications company executive who has attended several of the briefings, which are held about three times a year.
The CEOs are required to sign an agreement pledging not to disclose anything they learn in the briefings. “They tell them, in so many words, if you violate this agreement, you will be tried, convicted, and spend the rest of your life in prison,” says the executive.