12 ms·
China hacked a Navy contractor and secured sensitive data on submarine warfare
- deleted 8y ago[deleted]
- walrus01 8y ago> The data stolen was of a highly sensitive nature despite being housed on the contractor’s unclassified network. Former government contractor here: Dumbasses need to keep their sensitive data air gapped and inside a SCIF. If you need to network stuff, there are ways for contractors to implement NSA-approved "type 1" crypto with the appropriate personnel and infrastructure. Also, I think whoever improperly classified that as not requiring SECRET level protections is going to have a hard time justifying it to their bosses.
- ManFromUranus 8y agoThere's stupid and then there's "stupid" putting my tinfoil hat on here: maybe they were allowed to steal the data. I mean really? Oh WOOOPS we stored 613 GB of classified data on an unsecured network in the EXACT place hackers would look... aww that sucks, welp we'll try to do better next time. I call BS, this level of incompetence smells more like treason disguised as stupidity.
- jessaustin 8y agoA true believer would say the point was to suggest intentionally bad technology (e.g. screen doors!), to retard progress in Chinese submarine design...
- lainga 8y agoExactly. Or trick them into thinking American technology is weaker than it really is (cue F-35 fanboys).
- geezerjay 8y agoForcing China to waste their spook manpower sifting through half a TB of crap data would also be quite funny.
- ManFromUranus 8y agoGood point, there's always free cheese in a mouse trap.
- jessaustin 8y agoAre there penalties written into contracts to address failures like this? ISTR when China got loads of F-35 data, Lockheed was "punished" by getting to spend another year and hundreds of millions more dollars "fixing" the plane.
- 1024core 8y ago> Are there penalties written into contracts to address failures like this? Of course not. Which is why this crap keeps happening.
- bb88 8y agoSo it's not like you're going to take the F-35 and move it over to another contractor. More likely, you'll just cancel it and start gain. The other aspect is that it's not really the contractor's fault if the exploit was done with a zero-day.
- jessaustin 8y agoWow I really disagree with that. 0-days are a fact of life. If billions of dollars aren't enough to set up a secure supply chain and air gaps, what would be?
- bb88 8y agoYou conflate the way the world is with the world you wish it would be.
- jessaustin 8y agoNo, I wish we didn't spend trillions of dollars on killing machines for no reason. It's pretty difficult to confuse that world with this one. Your magical phrase "zero-day" doesn't "win this argument" for you... You're imagining some Stuxnet-level pyramid of remote BIOS and NIC firmware hacks when we all know this was just a poorly configured firewall. That's why "TOP SECRET" exists, CYA.
- excalibur 8y agoThe article states clearly that this was Controlled Unclassified Information. Massive volumes of industrial data fit this description. It does call for special protections, which are outlined in NIST SP 800-171. Nowhere in this document does it imply that CUI data should be kept in a SCIF.
- LordHog 8y agoFrom the article, Cmdr. Bill Speaks, a Navy spokesman, said, “There are measures in place that require companies to notify the government when a ‘cyber incident’ has occurred that has actual or potential adverse effects on their networks that contain controlled unclassified information.” This does not indicate the data was or was not classified. Now, at the beginning of the article, "The data stolen was of a highly sensitive nature despite being housed on the contractor’s unclassified network. The officials said the material, when aggregated, could be considered classified, a fact that raises concerns about the Navy’s ability to oversee contractors tasked with developing cutting-edge weapons." The article suggest the data, in aggregated form, could be viewed as classified. I am quite sure not all the details have been made public nor will they be for some time. I am sure it will take many years for that true nature of the breach to enter public domain. Submarines are the US primary means of nuclear deterrence and any breach to limit that deterrence might be considered harmful.
- zip1234 8y agoWhy doesn't the US do something about that? China almost seems overt about stealing secrets like that.
- kchr 8y agoAre you implying that the US are not actively doing the same against nations they see as a threat? It's basically how and why any intelligence service operates - know your enemy and keep up with their technological advances.
- zip1234 8y agoI mean overtly responding by taking action against trade or something of the sort.
- deleted 8y ago[deleted]
- ancorevard 8y agoThe difference is that China has been stealing in order to copy, while the China itself has nothing that the US want to copy. This has been true since the birth of the US. But the future may be different. China is advancing very fast through copying, and years from now we might stop thinking of them as a copycat.
- vkou 8y ago> The difference is that China has been stealing in order to copy, while the China itself has nothing that the US want to copy. The US may not care to copy Chinese submarines, but it would love to get its hands on all sorts of information surrounding them.
- fma 8y agohttps://www.bbc.com/news/world-us-canada-42713108 https://www.bbc.com/news/world-us-canada-42713108 There has been a huge setback in US espionage in China...
- jerkstate 8y agoThere's a fantastic book called "Blind Man's Bluff" about submarine spying during the Cold War, including a lot of antics like this one. Gripping storytelling, highly recommended read if you're interested in submarines or spying or both.
- staunch 8y agoThe US nuclear triad currently rests dangerously on the US Ohio-class submarines. If the Chinese military develops technology that can eliminate these subs in a surprise attack, they would potentially have the ability to take over the world. Step 1. Target the 1950s era US ICBM fleet in their static bunkers. This only requires making the POTUS hesitate for ~7 minutes to "use or lose" them. Step 2. Destroy the few dozen 1950s era upgraded B-52s and a few misc aircraft. Some might slip through but maybe not. Step 3. Take out the ~14 outdated US ballistic missile subs using new supersonic anti-ship missiles. Hopefully the US military will be able to upgrade the nuclear triad in time to maintain MAD and eliminate this potential threat. But I think the best solution would be for the entire G7 to develop independent MAD systems so there's never any doubt that it remains in effect.
- jackpirate 8y agoEverything you say is true, but extremely misleading. China's nuclear posture uses what's called the "minimum means of reprisal", which means they have an extremely small nuclear force that is incapable of completing the scenario you outline. Let me just quote the abstract from Jeffery Lewis's phd dissertation on the topic: Among the 5 states authorized under the NPT to possess nuclear weapons, China has the most restrained pattern of deployment: The People"s Republic of China (PRC) operationally deploys about 80 nuclear warheads exclusively for usewith land"based ballistic missiles. Its declaratory doctrine rejects the initiation of nuclear war under any circumstance. The PRC does not maintain tactical nuclear forces of any kind, and its strategic forces are kept off alert, with warheads in storage. This posture has been sustained over time and changes in threat perception, suggesting restraint is the result of choice and not expediency. Furthermore, most of the land based ballistic missiles China has deployed are targeted at India, and not capable of hitting the mainland US. While the dissertation was written in 2004, essentially nothing substantial has changed since then.
- JPKab 8y agoNothing has changed in 14 years with China's nuclear arsenal? Based on what evidence?
- horsecaptin 8y agoIf China did then so did Russia. But let's give Putin a seat at G table.
- aphextron 8y agoSo it's pretty obvious by now that we are actively at war with China and Russia on the cyber front. The question is, are we winning? Are we even fighting back?
- ravenscrow 8y ago> So it's pretty obvious by now that we are actively at war with China and Russia on the cyber front. We are actively fighting a cyber war with every country. The nations who we spy on the most are our allies. And the nations who spy on us the most are our allies. I know it's counterintuitive but it's international politics, geopolitics and intelligence 101. For example, israel, Britain, Canada, germany, japan, south korea, etc spy on us the most. And naturally we spy on them too. And taken a step even further, every nation's government spies the most on their own people. It's almost a certainty that intranational spying makes up most of the spying budgets of china, russia, britain, israel, US, germany, etc. > The question is, are we winning? Considering we are the epicenter of tech, what do you think? Considering our intelligence budgets dwarf both china and russia's budget combined, what do you think? > Are we even fighting back? Are you serious? Who do you think invented cyber spying? The internet was a DARPA project. Do you really think only china and russia are spying?
- 3pt14159 8y agoCitations needed. I know some intelligence people. This isn't what they tell me. They tell me that western governments are obsessed with following the law and limiting what their cyber operations touch. It's born out by what I understand from non-classified sources. For example, I read through the source code of Stuxnet when it first came out. There was a ton of guards put in to limit the potential damage it made. That Canada spies on the USA more than Russia is the biggest bullshit I've ever heard. Read the Snowden leaks and listen to natsec podcasts. The Russians are in a ton of the US infrastructure and the CIA is freaking out about it to the point where they consider cyber to be a bigger existential threat than a nuclear armed DPRK.
- ravenscrow 8y ago
- cronix 8y agoSimply bar them from defense department work/contracts for 5 years and put any current contracts on hold. The other contractors will get the hint. Nothing ever gets done about this stuff, so the status quo remains.
- killjoywashere 8y agoCompare this to Facebook effectively selling a Chinese firm the entire social graph. Not any firm, a firm the US Government indicated should be regarded with caution. That social graph will pay dividends decades after these missiles are decommissioned. Conversely, if DoD contracts are sufficient, why aren't Facebook contracts? China doesn't care about contracts in either case. If you think a Chinese firm is going to honor a contract with an American company, you need to look up the Organization Department.
- bb88 8y agoI blame the classifiers in this one. The data should have been classified from the start. The key words in the article were: > The officials said the material, when aggregated, could be considered classified So, the problem is that the material was probably designated as FOUO, but should have been classified as secret. The difference is that FOUO is okay to be left on desks and the like, but confidential and above needs a safe, and document control.