U.S. Outgunned in Hacker War
DEVLIN BARRETT
WASHINGTON—The Federal Bureau of Investigation's top cyber cop offered a grim appraisal of the nation's efforts to keep computer hackers from plundering corporate data networks: "We're not winning," he said.
Shawn Henry, who is preparing to leave the FBI after more than two decades with the bureau, said in an interview that the current public and private approach to fending off hackers is "unsustainable.'' Computer criminals are simply too talented and defensive measures too weak to stop them, he said. His comments weren't directed at specific legislation but came as Congress considers two competing measures designed to buttress the networks for critical U.S. infrastructure, such as electrical-power plants and nuclear reactors. Though few cybersecurity experts disagree on the need for security improvements, business advocates have argued that the new regulations called for in one of the bills aren't likely to better protect computer networks.
Mr. Henry, who is leaving government to take a cybersecurity job with an undisclosed firm in Washington, said companies need to make major changes in the way they use computer networks to avoid further damage to national security and the economy. Too many companies, from major multinationals to small start-ups, fail to recognize the financial and legal risks they are taking—or the costs they may have already suffered unknowingly—by operating vulnerable networks, he said.
'You never get ahead, never become secure, never have a reasonable expectation of privacy or security,' says Shawn Henry, executive assistant director of the FBI.
"I don't see how we ever come out of this without changes in technology or changes in behavior, because with the status quo, it's an unsustainable model. Unsustainable in that you never get ahead, never become secure, never have a reasonable expectation of privacy or security,'' Mr. Henry said.
James A. Lewis, a senior fellow on cybersecurity at the Center for Strategic and International Studies, said that as gloomy as Mr. Henry's assessment may sound, "I am actually a little bit gloomier. I think we've lost the opening battle [with hackers].'' Mr. Lewis said he didn't believe there was a single secure, unclassified computer network in the U.S.
"There's a kind of willful desire not to admit how bad things are, both in government and certainly in the private sector, so I could see how [Mr. Henry] would be frustrated,'' he added.
High-profile hacking victims have included Sony Corp., SNE -1.46%which said last year that hackers had accessed personal information on 24.6 million customers on one of its online game services as part of a broader attack on the company that compromised data on more than 100 million accounts. Nasdaq OMX Group Inc., NDAQ -2.69%which operates the Nasdaq Stock Market, also acknowledged last year that hackers had breached a part of its network called Directors Desk, a service for company boards to communicate and share documents. HBGary Federal, a cybersecurity firm, was infiltrated by the hacking collective called Anonymous, which stole tens of thousands of internal emails from the company.
Mr. Henry has played a key role in expanding the FBI's cybersecurity capabilities. In 2002, when the FBI reorganized to put more of its resources toward protecting computer networks, it handled nearly 1,500 hacking cases. Eight years later, that caseload had grown to more than 2,500.
Mr. Henry said FBI agents are increasingly coming across data stolen from companies whose executives had no idea their systems had been accessed.
"We have found their data in the middle of other investigations,'' he said. "They are shocked and, in many cases, they've been breached for many months, in some cases years, which means that an adversary had full visibility into everything occurring on that network, potentially.''
Mr. Henry said that while many company executives recognize the severity of the problem, many others do not, and that has frustrated him. But even when companies build up their defenses, their systems are still penetrated, he said. "We've been playing defense for a long time. ...You can only build a fence so high, and what we've found is that the offense outpaces the defense, and the offense is better than the defense,'' he said.
Testimony Monday before a government commission assessing Chinese computer capabilities underscored the dangers. Richard Bejtlich, chief security officer at Mandiant, a computer-security company, said that in cases handled by his firm where intrusions were traced back to Chinese hackers, 94% of the targeted companies didn't realize they had been breached until someone else told them. The median number of days between the start of an intrusion and its detection was 416, or more than a year, he added.
In one such incident in 2010, a group of Chinese hackers breached the computer defenses of the U.S. Chamber of Commerce, a major business lobbying group, and gained access to everything stored on its systems, including information about its three million members, according to several people familiar with the matter.
In the congressional debate over cybersecurity legislation, the Chamber of Commerce has argued for a voluntary, non-regulatory approach to cybersecurity that would encourage more cooperation and information-sharing between government and business.
Matthew Eggers, a senior director at the Chamber, said the group "is urging policy makers to change the 'status quo' by rallying our efforts around a targeted and effective information-sharing bill that would get the support of multiple stakeholders and come equipped with ample protections for the business community."
The FBI's Mr. Henry said there are some things companies need to change to create more secure computer networks. He said their most valuable data should be kept off the network altogether. He cited the recent case of a hack on an unidentified company in which he said 10 years worth of research and development, valued at more than $1 billion, was stolen by hackers.
He added that companies need to do more than just react to intrusions. "In many cases, the skills of the adversaries are so substantial that they just leap right over the fence, and you don't ever hear an alarm go off,'' he said. Companies "need to be hunting inside the perimeter of their network," he added.
Companies also need to get their entire leadership, from the chief executive to the general counsel to the chief financial officer, involved in developing a cybersecurity strategy, Mr. Henry said. "If leadership doesn't say, 'This is important, let's sit down and come up with a plan right now in our organization; let's have a strategy,' then it's never going to happen, and that is a frustrating thing for me,'' he said.
Write to Devlin Barrett at devlin.barrett@wsj.com
A version of this article appeared Mar. 28, 2012, on page B1 in some U.S. editions of The Wall Street Journal, with the headline: U.S. Outgunned in Hacker War.
The Meaning of Freedom
Hezbollah Agents, Funders at Large in America
Western Survival Depends on Western Pride
Passover: an inherently American value
Europe's Islamic Future Has Arrived
Salam Fayyad's Hypocrisy
The State Department's Jerusalem syndrome
London warns of hand cream Olympics terror plot
Leaders who lead to surrender
Jasser's Appointment Riles Islamists
Global March to Jerusalem violence update: & +972′...
Did You See the Senate's Gas Price Sideshow?
As Expected – Land Day Turns Violent
Betrayal Glorified: The Bizarre Jewish Movement to...
The Deadly Sounds of Christian Silence
The terrorists and their protectors
The New Anti-Semitism
To stunned silence, Israel's rep scolds J Street t...
The Bankrupt Race Card‏
Another Vision to Solve the Budget Crisis
Sudanese Christians Given Until April 8 to Leave
The Total Power of the Mandate
The Jihad threat against the West and Israel
The Triangle Of Evil
Obama Whispers Away America's Security
Islamic Jihad: Hurry Up or Wait?
All the Pravda
Obama re-assures Vladmir Putin of his "cooperation...
The world needs a leader like Sonny LoSpecchio
Weapon against pancreatic and prostate cancer
Sarkozy bans imams from entering France in fundame...
Islamist Fellow Travelers: An IPT Series
President Obama Asks Medvedev for 'Space' on Missi...
Book "A Gift for the Muslim Couple" tells Muslim m...
The true origins of Islam
The Multi-Layered Gaza Conflict
It Doesn't Matter If You're Black or White
Curing the Migron Migraine
Hating Israel
COP: Obama's Biggest Lies
Obama Hearts Turkish Leader Erdogan As He Oppresse...
Tunisia rally: "Fight the Jews, enter Paradise"
Sharia and the Constitution: An Incompatible Duo
France: Here Comes the Whitewash
"A Toxic Perversity"
Annexation Wins Hands Down over a Two-State soluti...
Mohamed Merah – Man of the West
Syria, the Muslim Brotherhood and the Dubai police...
Islamic terror is alive in France
COP: Seaweed in your gas tank
No, Hasan and Bales Are Not Equivalent
When political correctness kills
The Crisis of Jewish Leftist Islamism
Western world is blind
Salafi Scholars Shura Council support presidential...
HITLER, MUSSOLINI, STALIN, MAO, OBAMA!
Obama's Pipeline to Nowhere
Gun sales explode as election looms
EU Foreign Policy Chief Ashton: Enabler of Antisem...
Israel, Shrinkage Is No More An Option
Al Qaeda's Network in Iran
Islamist Victors in Egypt Seeking Shift by Hamas
Toulouse shooting: killer 'was on US no-fly list'
Harvardstan?
COP: Obamacare's Dreadful Anniversary
Sharia Law Takes Root in Pennsylvania‏
The Transcript of Horowitz's Speech at UNC
Israel's Arabs, living a paradox
Report Claims ICNA Imam Facing Indictment
21st Century Trojan Horse: Sharia Rolls into Ameri...
Israel's Arabs, Living a Paradox
Obama Mocks Critics As Gas Prices Go Up
NYPD says Iran has conducted surveillance in NYC
Hearing: Hizballah, Iran Have Hundreds in the US
A Kafir Brotherhood
History Corrupted
"What Nazi?"
The Socialist Apprentice
Egypt: "Islamocracy" under Military Rule
Afghanistan – the Charade
Part II: Israeli Sovereignty Over Judea and Samari...
'From The Primus Stove to The Microwave Oven: firs...
SHURAT HADIN REVEALS CONCLUSIVE EVIDENCE OF WORLD ...
Hamas Welcomed at UN Headquarters in Geneva Only t...
"The Head Spins"
Gordon Gekko in Red
In 2011 U.S. Primacy in the Middle East Died; In 2...
What Harvard Didn't Want to Hear: Part I
COP: What the Mailman Knows about Ayers and Obama
Iran, Israel and the United States -- what history...
The New Egyptian Parliament Takes Aim at the Camp ...
Muslim Persecution of Christians: February, 2012
Stand by your man: Hezbollah's support for Assad r...
COP: 'The Road We've Traveled:' A misleading accou...
More Than 2/3 of Young British Muslims Believe 'Ho...
"Really, really ugly"
Should Jordan Be a Palestinian State?
Protecting Western Values From Encroaching Sharia