U.S. Electrical Grid Breached By Cyber Spies

Cyberspies from China, Russia, and elsewhere around the globe have breached the U.S. electrical grid and installed backdoor software that could lead to future damage, The Wall Street Journal reported Wednesday.

"The Chinese have attempted to map our infrastructure, such as the electrical grid," an unidentified senior intelligence official told the Journal. "So have the Russians."

The report is uncharacteristic in its specificity: Incidents of cyberespionage can often be traced to a specific country, but definitively stating that those involved are acting on behalf of a foreign government is rare because cyberattacks usually come through proxies or compromised systems.

The Journal states that many of the intrusions were not detected by the companies operating the compromised infrastructure, but by U.S. intelligence agencies, which presumably have tools at their disposal to more accurately identify those conducting attacks.

Chinese and Russian officials denied any wrongdoing.

The idea that cyberspies are running rampant on U.S. networks and critical infrastructure is not new. In November, a congressional advisory committee warned that Chinese cyberattacks on civilian, government, and military networks were increasing.

"China is targeting U.S. government and commercial computers for espionage," said the U.S.-China Economic and Security Review Commission's (USCC) 2008 Annual Report to Congress.

The USCC report stated that Alan Paller, research director at the SANS Institute, believes that in 2007 the unclassified networks of the 10 most prominent U.S. defense contractors, including Raytheon, Lockheed Martin, Boeing, and Northrop Grumman, were penetrated by cyberspies.

The 2007 USCC report summary offered a similar warning: "Chinese espionage activities in the United States are so extensive that they comprise the single greatest risk to the security of American technologies."

In early 2008, CIA senior analyst Tom Donahue confirmed that online attackers had caused at least one blackout in a city outside the United States. And the list goes on. Late last month, Canadian researchers published a report documenting an international spying operation, dubbed "GhostNet," that had stolen documents from hundreds of governments and organizations, including the office of the Dalai Lama.

As always, the Chinese government denied any involvement, stating that it opposes and forbids cybercrime. Curiously, accusations of U.S. involvement in cyberespionage are rare, at least in the U.S. press.

A report released last month by the Task Force on National Security in the Information Age found that the United States is still vulnerable to attack because government agencies and other organizations haven't yet learned how to share information effectively.

On Feb. 9, President Obama said that former Booz Allen consultant Melissa Hathaway would conduct an immediate 60-day review of the government's cybersecurity. That report is due next week.

The unnamed sources quoted in The Wall Street Journal report may be motivated in part by a desire to see greater cybersecurity funding, which could affect their government agency. Highlighting the weakness of U.S. cybersecurity just prior to the release of Hathaway's review might well do that.

However, Paller believes people who see a plot here to get more money are wrong. "The timing is, I believe, that the attacks are so vicious and the damage is increasing (or being recognized) at a high rate and someone inside got frustrated and told [the Journal]," he said in an e-mail.

Despite this, some security researchers appear not to be too worried. "[F]or those of us in the security space, this should be nothing too terribly alarming," observed security researcher Joel Esler on the SANS Internet Storm Center blog.

Another day, another breach.

Attend a Webcast on why bad security breaches keep happening to good organizations. It happens April 15. Find out more and register.