So to describe the layers of threats and the potential responses to them: Nation-state actors are coming at us, coming at you. For the most part, they just want to steal your stuff. They want your intellectual property. They want your trade secrets, your negotiating position. There’s some criminals out there who want your PIN number, your credit card number, and so on. But it’s fundamentally stealing your stuff.
For corporations, the actors most likely coming after you are nation-states, and the nation-state most likely coming after you are the Chinese. I was in Singapore and Hong Kong in June when the Snowden thing was really rolling out, and did a couple of interviews for local press and BBC. And they tried to create an equivalency, based on Snowden, between what we were accusing the Chinese of doing and what we were doing here in the United States based, again, on all the Snowden revelations. . . . I ran NSA. We steal stuff. We make no apologies about it. But we steal things to keep our citizens free and keep our citizens safe. We do not steal things to make our citizens rich. And that is a fundamental distinction between what our services do — self-limiting under oversight — and what the Chinese services do.
But the problem is getting worse. There are other actors out there now who are coming to your networks, not just to steal your stuff or maybe not even to steal your stuff. They want to hurt your network. We’ve seen some really good examples of this, almost certainly from the Iranians, over the past year. Shamoon, the virus at Saudi Aramco that wiped clean 35,000 hard drives.
And, then there’s something out there that troubles me: the third group. It’s people who are just mad, people who are mad at the world, and they have demands that maybe you and I can’t understand and demands that you and I will never be able to meet. Blessedly, they’re the least capable now. I think all the boats in the digital harbor have gone up as the tide is coming in. These actors may be unsatisfiable [and] will begin to aquire capacities we now associate with criminal gangs or nation-states over the next one, three, or five years. So great danger is out there. It’s going to get worse before it gets better.
The arms race in cybersecurity
After leaks, NSA struggles for trust
Fort Meade transforming from Army base to cyber city