WASHINGTON — Nearly a month after reports emerged of a massive hack of U.S. government agencies and corporations, the Trump administration announced Tuesday that it had formed a task force to deal with the repercussions of what it formally acknowledged — for the first time — was likely a damaging Russian espionage operation.
“This is a serious compromise that will require a sustained and dedicated effort to remediate,” said a joint statement by from the FBI, the National Security Agency, the Office of the Director of National Intelligence and the Cybersecurity and Infrastructure Security Agency.
The statement said that “fewer than 10” federal agencies had been compromised by “an intelligence gathering effort” that is “likely Russian in origin.”
The statement did not name the agencies that have been hacked, but NBC News has reported that among them are Treasury, Commerce, State and Energy.
The acknowledgement that the hack appeared to have been carried out by Russia — sources have told NBC News it was likely the SVR, Russia’s equivalent of the CIA — came despite President Donald Trump having cast doubt on that finding, saying last month it could have been China.
The Trump administration is still working to understand the scope of the hack, the statement said, including what information was compromised.
“As the lead agency for threat response, the FBI’s investigation is presently focused on four critical lines of effort: identifying victims, collecting evidence, analyzing the evidence to determine further attribution, and sharing results with our government and private sector partners,” the statement said.
The hack was first flagged by the cybersecurity company FireEye, and it’s not clear that the government independently detected it. Last week, software giant Microsoft acknowledged that it, too, had been breached, and that the attackers had viewed some of the company’s source code, an alarming development. It’s not clear how many other corporations were hacked, nor is it known what sensitive government or corporate data was stolen.
Officials have said the Russians may have had access since as far back as March, and that it may take months or years to insure that the hackers have been expelled from the networks.
Dec. 20, 202007:28
But while the cyber breach is a serious national security threat, experts say there is no evidence thus far that it constitutes what is officially regarded as an “attack” or an “act of war,” despite the use of that language by members of Congress and some corporate victims.
Tuesday’s government statement says that “at this time, we believe this was, and continues to be, an intelligence gathering effort.” Left unsaid is that the NSA and CIA seek to break into foreign computer networks on a daily basis, and that there are no international norms governing espionage.
“In terms of gaining access to government networks, it is certainly something that our intelligence community would try to gain,” said Michael Daniel, who was the cybersecurity czar in the Obama administration and now heads the Cyber Threat Alliance. Though, he added, “I think operations on this scale might be a little unusual for us.”
At least one way the hackers breached networks was by piggybacking on software updates by a company called SolarWinds, which counted among its customers most government agencies and major corporations.
Cybersecurity expert Dmitri Alperovitch, head of the Silverado Policy Accelerator, told NBC News that what happened constitutes “a massive intelligence failure,” because the American spy agencies didn’t detect the Russians in federal networks for months.
“This is really going to hinder the Biden administration,” he said. “They have to assume that all their emails are being read and their networks are infiltrated by the Russians.”
Dec. 21, 202001:38
Officials say there is no evidence thus far that any classified networks were breached.
Daniels warned, however, that it’s foolish to believe the government can completely stop successful breaches by Russian or Chinese intelligence agencies.
“You’re talking about an adversary that is incredibly technicaly sophisticated and very patient,” he said. “Anybody that thinks we are going to totally prevent the Russians from being able to gain any access to a U.S. government network, ever — that’s crazy.”
Kevin Collier contributed.
Source: | This article originally belongs to Nbcnews.com
