industry.To put that in some perspective, in the same year the government planned to spend $11.6 billion on direct efforts to combat climate change, which Obama has called âthe global threat of our time.âOver the next five years, the Defense Department alone plans to spend $26 billion on technology for cyber defense and offense. Precisely how much the United States intends to spend on the offensive component is classified. But in cyberspace, the line between offense and defense is blurry and constantly shifting. The same infrastructure that is being put in place to defend networks is the one that is used to launch attacks. Government officials prefer to talk publicly about defense, which is a strategic and a cynical calculation: itâs easier to drum up funds and political support for repelling invaders than it is for building a cyber army to attack and spy on other countries. And yet, that is precisely what the United States is doing, and using some of the billions of dollars nominally appropriated for âdefensiveâ purposes to do so.
Â
The business of cyber security is booming. Companies and individuals around the world spend $67 billion a year protecting their computers and networks. Many of the experts they hire learned their trade in the military or an intelligence agency. Indeed, the Pentagon has become a training ground for private cyber sentries, who can double or even triple their salaries when they jump to a private security firm. The same defense contractors that were once the target of cyber spies now sell the expertise to protect networks and wage war on them to their customers, including utilities and banksâthe very companies that the government had set out to protect in the first place.
The struggle to control cyberspace is defining American national security in the twenty-first century. But the response to cyber threats promises to change the shape of cyberspace more than the threats themselves do. The decisions that government and business leaders make today will have profound implications not just for Americans but for people around the world, who are increasingly united in their reliance on a broad, distributed, and often hard-to-define space that is neither entirely a commons nor the property of one corporation or government. That threats exist in cyberspace is undeniable. Answering them is a befuddling and often perilous exercise, but one in which we all have a stake.
Â
Â
Â
Â
PART I
ONE
The First Cyber War
B OB STASIO NEVER planned to become a cyber warrior.After he graduated high school, Stasio enrolled at the University at Buffalo and entered the ROTC program. He majored in mathematical physics, studying mind-bending theories of quantum mechanics and partial differential equations. The university, eager to graduate students steeped in the hard sciences, waived the major components of his core curriculum requirements, including English. Stasio never wrote a paper in his entire college career.
Stasio arrived at Fort Lewis, Washington, in 2004, when he was twenty-two years old. His new brigade intelligence officer took one look at the second lieutenantâs résumé, saw the background in math and physics, and told Stasio, âYouâre going to the SIGINT platoon.â
SIGINT, or signals intelligence, is the capture and analysis of electronic communications. Like all branches of intelligence, itâs a blend of science and art, but itâs heavy on the science. The brigade intelligence officer had worked at the National Security Agency and recognized that Stasioâs physics training would come in handy, because so much of SIGINT involves the technical collection of radio signals, fiber-optic transmissions, and Internet packets.
Stasioâs military training in college focused on how to use a rifle and lead a squad. But he had spent six months learning the basics of intelligence gathering and analysis at the armyâs intelligence