Spies hacked US military computers with a flash drive

WASHINGTON - An infected flash drive put in a US military laptop in 2008 set off the most significant cyberattack ever against the military by a foreign spy agency, according to a top US defence official.

The previously classified incident, which took place in 2008 in the Middle East, was disclosed by Deputy Defense Secretary William J. Lynn in an article titled “Defending a New Domain” posted on Foreign Affairs magazine’s web site Wednesday.

This “most significant breach of US military computers ever” served as “an important wake-up call” that led to a new Pentagon counterattack strategy dubbed Operation Buckshot, he wrote in the article also released by the defence department.

“An enormous amount of foundational work remains, but the US government has begun putting in place various initiatives to defend the United States in the digital age,” Lynn wrote.

“The flash drive’s malicious computer code, placed there by a foreign intelligence agency, uploaded itself onto a network run by the US Central Command,” his article said.

“That code spread undetected on both classified and unclassified systems, establishing what amounted to a digital beachhead, from which data could be transferred to servers under foreign control.”

He continued: “It was a network administrator’s worst fear: a rogue programme operating silently, poised to deliver operational plans into the hands of an unknown adversary.”

Lynn’s article provided no details on specific files lost or stolen in the attack, which he called one of countless attempts to intrude into US military networks.

Others also have succeeded, he said, with adversaries acquiring “thousands of files from US networks and from the networks of US allies and industry partners, including weapons blueprints, operational plans, and surveillance data.”

In response, he wrote, the Pentagon has built layered defences around military networks and launched the new US Cyber Command to “integrate cyberdefence operations across the military.”

“The Pentagon is now working with the Department of Homeland Security to protect government networks and critical infrastructure and with the United States’ closest allies to expand these defences internationally,” Lynn wrote.

Pentagon officials are also developing a cyber strategy document to be released in the fall. It will address, among other things, any statutory changes needed for cyber defence, and the capability for “automated defences,” such as the ability block malware at top speed, he wrote.

(Arun Kumar can be contacted at arun.kumar@ians.in)