20100122 In US’ cyberwar, Google is on the front line

In US’ cyberwar, Google is on the front line

By Misha Glenny
THE GUARDIAN , LONDON
Friday, Jan 22, 2010, Page 9

The conflict between Google and China is no run-of-the-mill business dispute. The corporate leviathan and national behemoth have come to blows in a serious skirmish whose outcome remains unpredictable. While mere mortals should be concerned if not afraid when rivals like these clash, the conflict does shine a light on what is going on in the hidden world of cybersecurity.

Without doubt the Chinese are up to no good, but it is hard to feel much sympathy for Google. As Faust, it entered into a pact with China by readily acceding to Beijing’s demand that the company censor its search results on Google.cn in exchange for a 30 percent share of the Chinese market. Do No Evil As Long As It Doesn’t Interfere With Your Business Plan. Well, Mephistopheles has now claimed his first payment, and Faust wants to pull out of the deal.

This is not the first time China has tried to steal a march on its commercial competitors. Hundreds of US and other foreign firms fear that companies or government agencies from China have penetrated their computer systems in search of design blueprints and other intelligence.

In the wake of the Google revelations, however, the administration of US President Barack Obama has accused the Chinese of violating freedom of speech and human rights. It has further charged Beijing with perpetrating industrial espionage because the attacks appear to have probed for the secrets of the search engine and Gmail.

The presidency has never gone so public with criticism of China’s human rights policy and its disregard for intellectual copyright law. However, that’s not the reason why it has become so involved in the controversy. Google is the most powerful presence on the Internet, with the largest repository of data in the world. And for all its global reach, it’s a US company. The Chinese hack goes well beyond a plot to nick ideas on improving the manufacture of widgets. Attack Google and you attack the US’ critical infrastructure. Washington regards this as a major security issue.

In the past decade, several powers have started to integrate the cyberworld into their defense strategies. Cybersecurity broadly comprises two elements. The first is not new: exploiting advanced technology to improve conventional weapons. The drones that now make most of the battlefield sorties in Afghanistan are steered from Nevada by a computer operator.

The more interesting sphere concerns critical infrastructure: water, energy, banking, communications, air traffic control and almost all military systems are dependent on the smooth running of complex computer systems. If a virus or hacker can provoke a collapse, then water won’t come out of the taps, petrol won’t flow from the pumps, ATMs won’t dispense cash, the phones won’t work — and your missiles won’t launch.

In conventional and even nuclear warfare, your assets are relatively easy to measure against those of your opponent. You have 75 tanks and your opponent has 125, but yours are fitted with better weapons systems — roughly even.

Cyberwarfare is not like that. Your assets consist of your opponents’ vulnerabilities and your ability to exploit them. This means that to defend yourself, you have to breach your opponent’s defenses: Implicit in any cyberdefense strategy is the development of a comprehensive offensive capability.

This was the thinking behind the former US president George W. Bush’s Total Information Office (TIO), created under the Patriot Act, which in effect mandated security agencies and the Pentagon to gather up all information possible about actual or potential enemies, using any means — including probing weaknesses in cyberdefenses. The TIO was disbanded, though most core programs have been spread around departments.

For the most part, however, the Bush administration’s cybersecurity policy was characterized by incompetence and organizational chaos. But Obama has made clear that this is now a strategic priority for the US. The recent appointment of Howard Schmidt — a hardnosed former cop who is extremely tech savvy — to the post of cybercop suggests that Washington means business.

The US and NATO have invested considerable resources in monitoring the defenses of their major rivals, as well as non-state actors suspected of hostile intent. Russia, China, India and Israel have been replying in kind. The Russian FSB’s Department M maintains a close watch on all Internet activity in collusion with the Russian military. China regularly mobilizes its “netizen” army to probe the systems of perceived enemies beyond its borders. And Israel, in comparative terms, has by far the most sophisticated cyberintelligence on the planet. In the military sphere, far from bringing the world closer together, the Internet is underscoring national interests.

There are few rules in this brand new sector of security and warfare. Anybody launching attacks has the ability to disguise their origin, so the potential for double and triple bluff is endless.

One security analyst described this chaotic scramble to me as “like playing a seven-dimensional game of chess in which you’re never sure who the opponent is at any one time.”

Let the games begin.