Pentagon discloses largest-ever cyber theft

WASHINGTON—The Pentagon on Thursday revealed that in the spring it suffered one of its largest losses ever of sensitive data in a cyberattack by a foreign government. It is a dramatic example of why the military is pursuing a new strategy emphasizing deeper defenses of its computer networks, collaboration with private industry and new steps to stop “malicious insiders.”

William Lynn, the deputy secretary of defense, said in a speech outlining the strategy that 24,000 files containing Pentagon data were stolen from a defense industry computer network in a single intrusion in March. He offered no details about what was taken but in an interview before the speech he said the Pentagon believes the attacker was a foreign government. He didn’t say which nation.

“We have a pretty good idea” who did it, Lynn said in the interview. He would not elaborate.

Many cyberattacks in the past have been blamed on China or Russia. One of the Pentagon’s fears is that eventually a terrorist group, with less at stake than a foreign government, will acquire the ability to not only penetrate US computer networks to steal data but also to attack them in ways that damage US defenses or even cause deaths.

In his speech at the National Defense University, Lynn said that sophisticated computer capabilities reside almost exclusively in nation-states, and that US military power is a strong deterrent against overtly destructive cyberattacks. Terrorist groups and rogue states, Lynn said, are a different problem and harder to deter.

“If a terrorist group gains disruptive or destructive cybertools, we have to assume they will strike with little hesitation,” Lynn said.

The Pentagon has long worried about the vulnerability of its computer systems. The concern has grown as the military becomes more dependent not only on its own computers but also on those of its defense contractors, including providers of the fuel, electricity and other resources that keep the military operating globally.

At his Senate confirmation hearing last month, new Defense Secretary Leon Panetta cited “a strong likelihood that the next Pearl Harbor” could well be a cyberattack that cripples the US power grid and financial and government systems. He said last weekend that cybersecurity will be one of the main focuses of his tenure at the Pentagon.

The Pentagon operates more than 15,000 computer networks and 7 million computers in dozens of countries.

A surprise Japanese attack on a US naval base at Pearl Harbor in Hawaii brought the United States into World War II.

“For the Department of Defense, our networks are really our lifeblood,” Marine Gen. James Cartwright, vice chairman of the Joint Chiefs of Staff, told reporters in an interview prior to Lynn’s release of the new strategy.

As shown by the March attack on a defense industry computer network that contained sensitive defense data, the military’s vulnerability extends beyond its own computers. In a new pilot program, the Pentagon is sharing classified threat intelligence with a handful of companies to help them identify and block malicious activity.

Lynn said intrusions in the last few years have compromised some of the Pentagon’s most sensitive systems, including surveillance technologies and satellite communications systems. Penetrations of defense industry networks have targeted a wide swath of military hardware, including missile tracking systems and drone aircraft, he said.

In Cartwright’s view, a largely defensive approach to the problem is inadequate. Lynn said the Pentagon currently is focused 90 percent on defensive measures and 10 percent on offense; the balance should be the reverse, he said. For the federal government as a whole, a 50-50 split would be about right, Cartwright argued.

“If it’s OK to attack me and I’m not going to do anything other than improve my defenses every time you attack me, it’s difficult” to stop that cycle, Cartwright said. “There is no penalty for attacking (the US) right now.” He added that a number of complex legal and cultural issues need to be sorted out before the Pentagon can devise a comprehensive offensive strategy.

In response to an audience member’s question after his speech, Lynn the White House could be expected to consider using military force in response to a cyberattack “if there is massive damage, massive human losses, significant economic damage.”

Earlier this year, President Barack Obama signed executive orders that lay out how far military commanders around the globe can go in using cyberattacks and other computer-based operations against enemies and as part of routine espionage. The orders detail when the military must seek presidential approval for a specific cyberattack on an enemy, defense officials and cybersecurity experts told the AP.

The strategy unveiled by Lynn is oriented toward defensive rather than offensive measures. It calls for developing more resilient computer networks so the military can continue to operate if critical systems are breached or taken down. It also says the Pentagon must improve its workers’ cyber “hygiene” to keep viruses and other intrusions at bay. And it calls for fuller collaboration with other federal agencies, companies and foreign allies.

The strategy also is focused on insider threats. Without citing specifics, it says it will try to deter “malicious insiders” by “shaping behaviors and attitudes through the imposition of higher costs for malicious activity.”

Stewart Baker, a former assistant secretary at the Department of Homeland Security, called the plan thoughtful but lacking in some aspects.

“It’s an incomplete description of a defensive strategy,” Baker said. “If the Pentagon announced that our nuclear warfare strategy centered on fallout shelters, we’d all hope that they had a real strategy that was better than that.”