China data thefts expose murky world of hidden motives, tricky responses when nations hack

Recent reports that hackers were able to penetrate a variety of US databases – especially at the Office of Personnel Management and at insurers Anthem and Premera Blue Cross, where the personal information of many government employees was stolen – is unsettling for many reasons.

Usually, breaches like these are carried out by hackers and criminals for monetary gains. The economic incentives are clearly defined. Hackers seek to make some money by selling stolen credit cards or fake identifies or commit internet fraud.

The incentives of the company whose customer data is breached are also well-defined. The company protects the data as well as it can, but the cost of stolen consumer information eventually falls on consumers themselves. So the company’s incentives are not always that well-aligned with consumers.

This potential “externality” – the breach’s impact on consumers who have no role in preventing it – has led to a variety of regulations that force firms to increase their investments in data protection and be more careful in storing and handling personal information.

However, in this recent case, the breach is suspected to have been perpetrated by the government of another nation state, namely China. There does not seem to be any immediate economic motive, and the data may be used in the future for as yet unknown reasons.

This, in turn, raises profound questions of how we can protect US cyberspace and intellectual property while keeping the process transparent to citizens.

Challenges when a nation is the hacker

Both China and Russia have been suspected of carrying out many breaches on government and private companies in the US. Interestingly, they recently signed a pact not to hack each other. Some of the attacks seem to be for the purpose of stealing intellectual property; others have murkier motives. These nations, in turn, have accused the US of carrying out similar attacks.

When nation states enter cyberspace to undermine one another, the economic and legal frameworks become distorted.

How, for example, should we encourage private firms like Anthem and Premera Blue Cross and individual federal agencies to protect data and thwart such attacks?

As long as the market and regulations create the right incentives for companies to protect this data, they will continue to invest in their security policy, technology and organizational training.

Unfortunately, however, expecting private businesses to keep up with state actors like China with their often limitless resources might be asking a lot. A profit-making company or a budget-starved government agency is unlikely to have the sophistication, capital and patience to fight such attacks.

This is especially true for small- to mid-sized entities. Even if they had the resources, it is not clear that extra heightened data protection would be the most efficient allocation of resources.

The NSA reportedly has been trying to find hackers for the past several years.Reuters

Enter the spies

This leads to an even more challenging problem: what role should our government play in protecting our cyberspace and private businesses?

Beyond diplomatic efforts, agencies like the National Security Agency may potentially act proactively by tracing, nabbing and punishing attackers – as a New York Times report this month suggests is already happening in a significant way.

While the effectiveness of these efforts, due to lack of transparency, is unknown, the rationale for these actions is not hard to comprehend. Our intelligence agencies may be in a better position than private companies alone to thwart such attacks. Active efforts might not only deter other nation states, they might also lead to quick detection and remediation.

But these efforts require surveillance, are done in secrecy, and could cause potential violations of our rights that have significant negative consequences. Many private businesses would be reluctant to even cooperate with government agencies because of potential suspicion that information would be used against them in future.

Secrecy, obfuscation and ‘zero days’

The use of cyberspace by nation states to attack other countries is, it’s fair to say, one of the most unfortunate and challenging developments of the last few years. It can only lead to more secrecy, more obfuscation and even less trust.

One example of such actions is vividly on display in the domain of software vulnerabilities.

Many of the sophisticated attacks and data breaches highlighted above exploit so-called zero-day vulnerabilities.

Zero-day vulnerabilities are flaws in the software products that millions of us use every day that are not widely known, but are being sold by hackers for thousands of dollars or much, much more, depending on their rarity.

All of our popular software has flaws, and most of these flaws are found, reported to software vendors and fixed on a routine basis without causing any significant disruptions.

But many governments, including the US, have started to explicitly pay researchers and hackers for vulnerability information rather than report them to the vendors.

These nations, in turn, use these “unknown” flaws for potential exploitation like the data breaches we see now. The more critical the flaw, the greater the chance that it will never be known until it is exploited in future.

Just the beginning

What was once a transparent and well-understood process has now become secretive and uncertain. And it is easy to see that as long as nations see cyberspace as a way to gain the upper hand, there is no easy way to reverse it. If anything, we can expect more of this in the coming years.

As cybersecurity efforts start overlapping with national security efforts, the private and public efforts to protect data will increasingly blur. And as nations increasingly play offense, we will need stronger efforts to find a balance where intelligence agencies can play an active but transparent role in protecting cyberspace.

Most importantly, we will need to clearly define a framework and parameters under which intelligence agencies can function in cyberspace so that they have our trust.

This is not going to be easy, both given our political environment and the fundamental complexity of this problem. Even if we were to find a balance, it must not be forgotten that as nations increasingly insert themselves into cyberspace, they increase the cost of business for everyone.

Firms have to invest more, and so do the intelligence agencies chasing down unproductive leads. Customers are the ones paying for it either way.

Rahul Telang receives or has received research funding from National Science Foundation (NSF), NSA, Sloan Foundation, MPAA (Motion Picture Association of America), Google Research