The director of the National Security Agency issued a warning Thursday about cyberthreats emerging from other countries against networks running critical U.S. infrastructure systems.
Adm. Michael Rogers said he expects a major cyberattack against the U.S. in the next decade. “It’s only a matter of the ‘when,’ not the ‘if,’ that we are going to see something dramatic,” he said.
His testimony Thursday at a House Intelligence Committee hearing was the most specific public warning from the government to date about the likelihood of major attack, and included a candid acknowledgment that the U.S. isn’t yet prepared to manage the threat.
Adm. Rogers, who became director of NSA about six months ago, also heads the U.S. Cyber Command, a military division.
He was questioned by senators about the agency’s surveillance programs, the subject of harsh criticism after revelations of domestic spying last year in leaks by former NSA contractor Edward Snowden .
The Senate this week rejected legislation to revamp the program, and Adm. Rogers said the agency hasn’t begun making preparations for an overhaul.
Adm. Rogers highlighted several threats emerging that will become significant problems in the coming year. At the top of his list are nation-states, including China and “one or two others,” that U.S. officials maintain are infiltrating the networks of industrial-control systems, the electronic brains behind infrastructure like the electrical grid, nuclear power plants, air traffic control and subway systems.
“There shouldn’t be any doubt in our minds that there are nation-states and groups out there that have the capability to do that,” Adm. Rogers said. “We’re watching multiple nations invest in that capability.”
Such an attack could mean power turbines going offline or segments of power transmission systems incapable of delivering power.
The Wall Street Journal reported in 2009 that U.S. spy agencies were alarmed that they were seeing Russian and Chinese cyberspies conducting surveillance on networks running the U.S. electric grid, leaving behind computer code that could be used to disable the networks in the future.
The Chinese and Russian governments repeatedly have denied that they conduct such surveillance.
Chinese Embassy spokesman Geng Shuang rebutted charges that the Chinese and others were probing U.S. networks running critical infrastructure.
“Chinese laws prohibit cybercrimes of all forms. We have no intentions to take ‘destructive actions’ towards U.S. infrastructure control systems,” he said. “Our intention is to work with the U.S. and other countries to promote a peaceful, secure, open, and cooperative cyber space.”
Another growing threat cited by Adm. Rogers is increasing coordination between cybercriminal groups and foreign governments.
U.S. intelligence officials have seen cybercriminal groups acting “as a surrogate for other groups, other nations,” he said. “I’m watching nation-states attempt to obscure, if you will, their finger prints.”
At the hearing, Rep. Mike Rogers, (R., Mich.), who chairs the intelligence committee, called them “cyber hit-men for hire.”
While neither man cited a specific country, other U.S. officials note that Russian officials have implied that some criminal hackers have gone to work for the government.
U.S. officials say privately that while they believe the Russian government is working with criminal groups, it is difficult to tell in specific cases because both tend to use similar cyber surveillance tools.
The infiltration of J.P. Morgan earlier this year has been tough to pin down. U.S. officials believe it was carried out by Russian criminal hackers, but have yet to find evidence of a government role. The Russian embassy didn’t respond to a request for comment.
Adm. Rogers also warned of increasing cyberattacks on mobile devices as “a coming trend,” because they are difficult to secure. Officials are concerned about hackers using mobile devices as entry points into larger central government or corporate networks.
“We need to define what would be offensive, what would be an act of war,” he said. “Being totally on the defensive is a very losing strategy to me.”
Separately, at a Senate intelligence committee hearing later Thursday, the nominee to become director of the National Counterterrorism Center, Nicholas Rasmussen said the potential for Islamic State militants to use cyberweapons in the future is a concern.
“It’s certainly a capability they aspire to develop and exercise,” he said.
Adm. Rogers described a nascent and so-far inadequate U.S. response to these threats, compared with the minimal cost to other nations and groups in mounting cyber operations against the U.S.
“You can just do literally almost anything you want, and there isn’t a price to pay for it,” Adm. Rogers said of those launching cyberattacks on the U.S.
He said the U.S. needs to work more on how to deter cyberattacks, but acknowledged that the U.S. government hasn’t answered basic questions about operating in cyberspace, and suggested it needs to take more offensive action.
Separately, Adm. Rogers was asked by lawmakers whether NSA had begun to make plans for revamping its program that collects and searches data on millions of American phone calls.
Adm. Rogers said his agency hasn’t made any preparations for a future overhaul. However, he said with the delay in the Senate, NSA may rethink that position.
The agency, he said, has been directed by President Barack Obama to continue the current surveillance program until Congress passes a law to change it.