Foreign hackers infiltrated the network of a defense contractor in March, stealing 24,000 military files in a single intrusion, Deputy Defense Secretary William J. Lynn disclosed Thursday.
The disclosure revealed one of the most devastating data breaches suffered by the Defense Department to date and marked the latest instance of hackers successfully penetrating the Pentagon’s cyber armor to obtain sensitive information.
“It is a significant concern that, over the past decade, terabytes of data have been extracted by foreign intruders from corporate networks of defense companies,” Lynn said as he unveiled the Pentagon’s first formal cyber strategy.
While some of the military data stolen by hackers is “mundane,” Lynn said much of it is related to sensitive Pentagon systems, including aircraft, surveillance and satellite communications.
"Current countermeasures have not stopped this outflow of sensitive information,” he said. “We need to do more to guard our digital storehouses of design innovation.”
Back in 2008, a foreign intelligence agency placed malicious code on a flash drive that was inserted into a military laptop connected to a network run by the U.S. Central Command. “That code spread undetected on both classified and unclassified systems,” Lynn wrote in an article published last fall in Foreign Affairs magazine.
In May, military contractor Lockheed Martin revealed that its system was infiltrated by hackers. And on Monday, hackers breached the network of defense contractor Booz Allen Hamilton, releasing what the company reports to be 90,000 military email addresses and passwords.
“Their networks hold valuable information about our weapons systems and their capabilities," Lynn said, referring to government contractors. “The theft of design data and engineering information from within these networks undermines the technological edge we hold over potential adversaries.
Yet for every successful breach by hackers, thousands more are thwarted, officials said. More than 60,000 new malicious software programs or variations are identified every day, “threatening our security, our economy and our citizens,” Defense Secretary Leon E. Panetta said Thursday in a statement.
“I view this as an area in which we’re going to confront increasing threats in the future and think we have to be better prepared to deal with the growing cyber challenges that will face the nation,” said Panetta.
The Pentagon's first formal cyber strategy was short on specifics and focused more on defending the nation from cyber threats than on launching cyber attacks on other countries.
The report called for making cyberspace its own operational domain, which allows the Pentagon to organize, train and equip forces for the cyber battlefield just as it does for other military branches. It also called on the Pentagon to collaborate on cyber-security with other countries and the private sector, since many of the military’s operations rely on Internet Service Providers (ISPs) and global supply chains.
Concerns over cyber-security within the global supply chain were heightened last week when a Department of Homeland Security official told Congress that some imported electronic devices are arriving in the United States with malware already installed on them.
The new report also called for the Pentagon to work with the Department of Homeland Security to protect elements of the nation’s critical infrastructure such as the power grid from cyber attack, and warned the military needed to prepare for being disconnected from the Internet during missions in the event of a cyber attack launched by enemy forces.