The Google-Clinton-China Martini With A Cyberwar Twist

There has recently been a lot of media attention focused on a relatively unsophisticated and even mundane act of information exploitation against high level Gmail users and, not surprisingly, a Chinese IP address. There’s absolutely nothing new or sophisticated about the attacks which have been going on for a year or more and which essentially add a forwarding instruction so that others can read copies of everything coming to your Gmail account or even be allowed access to your account - all without you knowing about it. In fact, a Washington D.C.-based security researcher published samples on her blog last February and I recall giving it a quick read back then and thinking how the simple strategies are still the best when it comes to hostile or criminal acts in cyberspace. Spear phishing attacks are simple, elegant things that cost almost nothing to develop except a bit of homework on the potential targets, and they continue to work regardless of millions of dollars being spent to stop or intercept them.

For example, EMC’s RSA security division, the company that makes SecurID tokens that help protect sensitive and classified data around the world, had its own network breached through a spear phishing attack last March. It was a potentially devastating attack because it apparently provided the attackers with the ability to duplicate the security tokens and within a matter of weeks gain access to Lockheed Martin, L3 Communications and possibly Northrup Grumman’s networks - all massive Department of Defense contractors. But that incredibly important set of multiple breaches with the possibility of many more occuring in the near future was completely pushed off the international media screen by two much less important but certainly juicier events: that of the US Secretary of State Hilary Clinton inserting herself into the 2nd annual Google - China squabble and the Pentagon’s announcement that it may defend against a cyber attack with a military strike. Let’s talk about the more boring of the two items first - the Pentagon’s new cyber strategy, which no one has seen yet because it isn’t due to be  released until later this month.

Based on what the Washington Post and Wall Street Journal have written, there’s nothing novel or unusual about the Pentagon adapting to a new warfighting environment and crafting a strategy for it. What would really be newsworthy is if a developed or even developing nation state wasn’t adding cyber operations to its military command. Frankly speaking, any country’s leadership who opposed moving military operations into cyberspace should be immediately fired for incompetence. We fight in the domains that we live in. Today and for the last 20 years, we live more and more in cyberspace so we need to be prepared to wage war in that domain as well. I expect that the United Kingdom will soon have a comparable strategy in place as will the rest of the EU, the Russian Federation, and the Peoples Republic of China, and that suitable treaty regimes will follow. Not that those treaties will have one iota of impact over the type of warfare that we’re actually fighting right now - a war over intellectual property theft and technology transfer between East and West - but again, the Pentagon is far sexier a topic than the gradual eroding of our technological and intellectual capital, which is in my opinion much more critical.

The most intriguing part of recent events surrounding Google and China is Hilary Clinton. I searched the Web for any time in the last year when she spoke out about cyber attacks that didn’t impact Google and couldn’t find a single example. In fact, earlier last month Secretary Clinton was taken to task by U.S. Congresswoman Rosa DeLauro (D-CT) for not speaking out about cyber attacks from China being directed against Change.org. As far as I know, she still hasn’t said a word about that free speech issue but she sure spoke out about a few hundred high profile Gmail customers who were tricked by a spear phishing attack. Maybe it’s because she and Eric Schmidt (Google’s Chairman) were both speaking at the Climate One “leadership dialogue” in San Francisco yesterday (June 2) or because Schmidt donated to her campaign back in 2008, or because she invited him and a few other members of the Technorati to a private dinner at the State department just before the news broke about Operation Aurora in January, 2010. Really, Madame Secretary - what’s up with you and Google?

NOTE: A re-named and slightly edited version of this article appears in today's Guardian online newspaper.