John P. Carlin has a fascinating new book out about “how we tried to take cyberthreats out of the shadows and used the criminal justice system to shine light on cyberattacks.” Co-authored by journalist and historian Garrett M. Graff, the book takes you through the Obama years where, as former Assistant Attorney General for National Security and National Coordinator of the Computer Hacking and Intellectual Property (CHIP) program, John battled behind the scenes in The Dawn of the Code War.
Like the Cold War, the Code War is not what we think of as war; it is “complicated, multidimensional, international period of tension that requires resources across government and the private sector.” Unlike the Cold War that was about a single adversary, the Code War is more complex. It is being fought online in an environment of anonymity, against adversaries who may be individuals – hacktivists, criminals, terrorists – organizations and nation states.
And unlike the Cold War that predated the Internet, this Blurred World War is different in 6 fundamental ways:
Government secrets used to be about military and diplomatic secrets. With the “weaponization of information”, internal DNC emails, government personnel records and the Amazon shopping list of a movie executive created damage. We worried about critical infrastructure – the power grid, water supply and air traffic control – but Russian interference in the 2016 elections was our “first true cyber Pearl Harbor” where “Russia attacked America’s confidence in America.”
The book goes on to describe how over the last decade, prosecutors, federal agents and the intelligence community worked with private sector security researchers and others to impose law and order.
Public attribution is important; they sent a message across government that it was possible to prove in a court of law who was behind an attack, they sent a message to the private sector that the government would be aggressive in confronting bad behavior online and they sent a message to foreign adversaries that this behavior was not acceptable and that there would be consequences.
Much remains to be done, but thanks to John and others in service, as he says, “it was a start”.