How the United States Lost to Hackers

Pandora’s Box

There’s a reason we believed the fallacy that offense could keep us safe: The offense was a bloody masterpiece.

Starting in 2007, the United States, with Israel, pulled off an attack on Iran’s Natanz nuclear facility that destroyed roughly a fifth of Iran’s centrifuges. That attack, known as Stuxnet, spread using seven holes, known as “zero days,” in Microsoft and Siemens industrial software. (Only one had been previously disclosed, but never patched). Short term, Stuxnet was a resounding success. It set Iran’s nuclear ambitions back years and kept the Israelis from bombing Natanz and triggering World War III. In the long term, it showed allies and adversaries what they were missing and changed the digital world order.

In the decade that followed, an arms race was born.

N.S.A. analysts left the agency to start cyber arms factories, like Vulnerability Research Labs, in Virginia, which sold click-and-shoot tools to American agencies and our closest Five Eyes English-speaking allies. One contractor, Immunity Inc., founded by a former N.S.A. analyst, embarked on a slippier slope. First, employees say, Immunity trained consultants like Booz Allen, then defense contractor Raytheon, then the Dutch and the Norwegian governments. But soon the Turkish army came knocking.

Companies like CyberPoint took it further, stationing themselves overseas, sharing the tools and tradecraft the U.A.E. would eventually turn on its own people. In Europe, purveyors of the Pentagon’s spyware, like Hacking Team, started trading those same tools to Russia, then Sudan, which used them to ruthless effect.

As the market expanded outside the N.S.A.’s direct control, the agency’s focus stayed on offense. The N.S.A. knew the same vulnerabilities it was finding and exploiting elsewhere would, one day, blow back on Americans. Its answer to this dilemma was to boil American exceptionalism down to an acronym — NOBUS — which stands for “Nobody But Us.” If the agency found a vulnerability it believed only it could exploit, it hoarded it.

This strategy was part of what Gen. Paul Nakasone, the current N.S.A. director — and George Washington and the Chinese strategist Sun Tzu before him — call “active defense.”

In modern warfare, “active defense” amounts to hacking enemy networks. It’s mutually assured destruction for the digital age: We hacked into Russia’s troll networks and its grid as a show of force; Iran’s nuclear facilities, to take out its centrifuges; and Huawei’s source code, to penetrate its customers in Iran, Syria and North Korea, for espionage and to set up an early warning system for the N.S.A., in theory, to head off attacks before they hit.