Cyber-Enabled Economic Warfare: An Evolving Challenge Edited by August 2015 Samantha F. Ravich, Ph.D. Research Report Cyber-Enabled Economic Warfare: An Evolving Challenge A Research Report Edited by Samantha F. Ravich, Ph.D. © 2015 Hudson Institute, Inc. All rights reserved. For more information about obtaining additional copies of this or other Hudson Institute publications, please visit Hudson’s website, www.hudson.org ABOUT HUDSON INSTITUTE Hudson Institute is an independent research organization promoting new ideas for the advancement of global security, prosperity and freedom. Founded in 1961 by strategist Herman Kahn, Hudson Institute challenges conventional thinking and helps manage strategic transitions to the future through interdisciplinary studies in defense, international relations, economics, health care, technology, culture, and law. Hudson seeks to guide public policy makers and global leaders in government and business through a vigorous program of publications, conferences, policy briefings and recommendations. Visit www.hudson.org for more information. Hudson Institute 1015 15th Street, N.W. Sixth Floor Washington, D.C. 20005 P: 202.974.2400 [email protected] www.hudson.org TABLE OF CONTENTS ACKNOWLEDGMENTS ………………………………………………………………………………………………..……………………4 INTRODUCTION Cyber-Enabled Economic Warfare: An Evolving Challenge by Samantha F. Ravich .……………………………………………………………………..………………………………..5 CHAPTER 1 Cyber-Enabled ‘Swift’ Warfare: Power, Blowback, and Hardening American Defenses by Mark Dubowitz and Annie Fixler ……………………………………………………………..………………..……14 CHAPTER 2 Cyber-Enabled Economic Warfare and State Actors by Abe Shulsky …………………………………………………………………………………………..……………………..49 CHAPTER 3 Intellectual Property Piracy as Economic Privateering by Michael Hsieh ………………………………………………………………………………..….…..…….……….………73 CHAPTER 4 The Cyber Financial Wars on the Horizon: The Convergence of Financial and Cyber Warfare and the Need for a 21st Century National Security Response by Juan C. Zarate ………………………………………………………………………………………………………………93 CHAPTER 5 Threats to Critical Infrastructure and the Transportation Sector by Tiffany Rad ………………………………………………………………………………………………..………………..121 CHAPTER 6 Conclusions by Samantha F. Ravich ………………………………………………………………………..…………….……………..147 ABOUT THE AUTHORS ……………………………………………………………………………………………..…………..………172 ACKNOWLEDGMENTS It is always interesting to note how an intellectual pursuit moves from some random musings to more structured thought to an eventual written product that seeks to ask and answer the questions raised at the beginning. For this work, the origin goes back nearly twenty years ago to a discussion with Marin Strmecki of the Smith Richardson Foundation about the intersection of economics and national security. That conversation waxed and waned over the years but never really ended. Over the last few years, however, our discussion once again picked up in intensity as we noticed with alarm the increasing scale and scope of cyberattacks on financial and economic institutions around the world. Marin encouraged me to start thinking in a more structured way about cyber-enabled economic warfare and this project was born. The support of Marin, Nadia Schadlow, and the Smith Richardson Foundation was instrumental for this project’s success. My goal for this work was never to write the definitive text on cyber-enabled economic warfare. It was to help energize a much broader conversation about the threats the U.S. and our allies are now facing from a range of hostile actors seeking to undermine critical economic assets and systems in order to cause harm to a target state’s security capabilities. I also hoped it would serve as a clarion call to energize the U.S. government to create both the strategy and the capabilities needed to confront this menace. Each of the authors I recruited for this volume—Abe Shulsky, Mark Dubowitz, Annie Fixler, Michael Hsieh, Juan Zarate, and Tiffany Rad—bring a particular knowledge base to the problem set and I hope that each will use their chapter as a launching pad for continued work in the area. I thank each of them for their hard work, dedication to the topic, and forbearance with my questions, comments, and editorial process. In addition, I thank Jeffrey Cooper, Drew Lomax, Doug Feith, Karen Evans, Terry Boston, Michael Madon, Michael Schrage, Charles Wolf, Kevin Gates, Lewis Libby, Ken Weinstein, Emily Goldman, Andrew May, Laurence Zuriff, and Chris Rodriguez for attending the working seminar at Hudson Institute where the other authors and I presented and defended our theses. The seminar participants were critical in helping us hone our thinking. I thank the fine people at Hudson Institute, including but not limited to Joel Scanlon, for shepherding this project from proposal to publication. Finally, I thank my husband Richard Brahm, whose guidance and intellectual rigor helped make this work a reality. 4 INTRODUCTION Cyber-Enabled Economic Warfare: An Evolving Challenge By Samantha F. Ravich Project Rationale Economic aggression against adversarial social groups is probably as old as societies’ discoveries of economically productive activities: the economic success of some societies inevitably became intertwined with adversarial relations with others. As societies evolved and inevitably clashed, economic aggression tactics evolved as well. For example, historically notable blockades that were intended to cause economic harm include those imposed by the Athenians against the island of Aegina during the Peloponnesian War; by Fatimid Caliphate against the Kingdom of Jerusalem during the Crusader-Muslim wars; by French and Flemish nobles’ against the island of Cadsand, which triggered the Hundred Years War; by Napoleon’s “Continental System,” which closed European ports to British trade in the early nineteenth century; and by the Soviet Union against Berlin at the start of the Cold War. Today there is a common arsenal for economic warfare consisting of many long established techniques to weaken an adversary through actions—some legal and some not—aimed at economic targets. Examples include trade embargoes, blacklists, blockades, sanctions, tariff and/or quota discrimination, sabotage of economic targets, preclusive purchase of scarce critical resources, freezing of capital assets, counterfeiting, suspension of aid, restrictions on investment and other capital flows, and expropriation. These practices are all well established, and a considerable body of literature exists on them as well. It has also become increasingly common since the initial rise of European nations in the fifteenth and sixteenth centuries for individual nations to utilize economic warfare strategies as vital elements within their Great Power rivalries. England’s attempt to weaken its rebellious American colonies by blockading their ports in the mid-eighteenth century is one example.1 Napoleon’s attempt to blockade British trade with Europe in the early nineteenth century, mentioned above, is another.2 Germany and Great Britain each pursued sophisticated and complex economic warfare strategies during World War I.3 Great Britain created a Ministry of Economic Warfare prior to World War II to help plan and implement its strategies leading up to, and during, the war.4 The U.S. created a similar department prior to WWII,5 implementing a multi-dimensional economic warfare strategy against the Japanese in particular.6 Both the Soviet Union and the United States attempted to implement economic warfare strategies to weaken the other during the Cold War.7 With the advent in recent decades of the information age and its accompanying ‘virtual’ world of ‘cyberspace,’ something new has developed in the realm of economic warfare: the 5 potential for use of cyber-enabled attack methods to cause an adversary economic harm that is far disproportionate to the size or resources of the attacker. Examples of malicious cyber- enabled actions against economic targets include cybercrime (such as cyber fraud against banking and payment platforms), cyberespionage (such as trade secret and intellectual property theft), cybersabotage (such as the malware attack on the Saudi Aramco oil company in 2012), and cyberterrorism (attacks involving the convergence of cyberspace and terrorism that cause violence against persons or property and generate fear—so far mostly theoretical, although the recent North Korean sponsored cyberattack on Sony Pictures Entertainment began to cross that line with the threats that followed the attack). With the information technology revolution having already contributed to growth in annual U.S. gross domestic product by approximately two trillion dollars and with a high percentage of U.S. economic activity now dependent upon information technology and internet connectivity,8 the potential economic stakes are quite high. Numerous pieces of the puzzle have already received considerable attention. During the last few years, the U.S. government has reported on numerous large-scale cyber operations aimed at U.S. businesses, banks, and critical infrastructure.9 General Keith Alexander of NSA/Cyber Command has described this hacking as the "greatest transfer of wealth in history."10 FBI Director Robert Mueller testified in January 2012 that the “threats from cyberespionage, computer crime, and attacks on critical infrastructure will surpass terrorism as the number one threat facing the United States.”11 In October 2012, Defense Secretary Leon Panetta warned that the U.S. faces a rising threat of a “cyber-Pearl Harbor”