Cybersecurity: How can I steal from Thee? Let me count the ways.

I have been thinking a lot about the security challenges related to the Internet lately. Partly this is because I was at the same workshop on cybersecurity that David Ignatius summarized in a recent column. And partly it is because I keep reading stories like this one in Vanity Fair or this Washington Times piece or this one in the LA Times, which highlight how new technologies might be putting our national wealth and perhaps security at risk.

A common thread in recent reports is the credible allegation that China is engaged in a systematic effort to use cyberwar techniques to steal massive quantities of information — military and foreign policy secrets, valuable intellectual property, and other information of special value to the regime — and that collectively this theft constitutes a national security threat of the first order.

I am predisposed to worry about this, especially when it is likely that what is publicly known constitutes only a fraction of the true magnitude of the problem. (Cyberwarriors have a saying that there are only two types of companies, those that know they have been hacked and those that don’t know they have been hacked.) And even though close friends and allies like France or Israel are also suspected of being in this same business, the focus on China does strike me as reasonable. 

Yet before I can be confident that I understand the scope of the problem, I think we need to do a bit more parsing of the threat.  In particular: when does stealing rise to the level of a national security threat? One can distinguish between seven types of stealing, arranged in roughly escalating order of concern.  

1. You can "steal" something from me that was never mine in the first place — for instance, robbing my "good name" when, in fact, I never had such a reputation.

2. You can steal something I had no reasonable expectation to keep given choices I made.  For instance, much of the loss of privacy and anonymity on the Internet may simply be an inevitable consequence of operating on the internet.  Should we consider it a theft of privacy if a pseudonymous blogger gets outed after posting a series of hate-speech comments on another person’s website?

3. You can take something from me that you have no right to, but it doesn’t materially reduce my wealth or utility. Neighbors who "borrow" wireless connections might fit this category. I also suspect that some non-trivial amount of the intellectual property losses that are reported fall into this category because they involve the theft of material that the stealer wouldn’t otherwise have bought. When some poor villager gets a pirated song/movie has the recording and movie industry really lost money when, under current distribution and pricing models that villager never would otherwise have purchased the item? It might still be against the law, but it is analytically distinct from other, more consequential forms of stealing. Such as….

4. You could take something from me that involves a real loss to me but not as much of a loss as I would incur if I tried to ensure you couldn’t take it. A non-cyber example might clarify: when my drafty old home "loses" air conditioning it costs me real money, but it may be less money than it would cost me to properly weatherize it. Given the advantages of offense in the cyber-world, and the efficiencies that come from open architecture, it may be that a significant portion of cyber-theft falls into this middle zone.

5. You could take something from me that doesn’t reduce my current wealth but does reduce my future wealth or utility stream. This is the more consequential form of intellectual property theft, where real sales are lost to the legitimate producer because the pirates have made available stolen goods. Companies have a strong incentive to exaggerate such future losses — "if only the pirated version wasn’t available, a billion more people would have paid to watch my movie so you owe me hundreds of millions of dollars in damages" — but even discounting for exaggerations would likely still leave a substantial amount of loss in today’s globalized market.

6. You could take something from me that denies me that very thing. This is perhaps the most ordinary understanding of stealing, as when you take the piece of pie I was holding in the office fridge or, in cyber scenarios, you steal money from my bank account.  Some of this is going on, but I have not seen reports that indicate this is of epic proportions (yet). Of course, financial institutions may have an incentive to under-report this lest they lose the faith and confidence of their customers so the problem is probably bigger than I know. How big? I don’t know.

7. You could take something from me that may only marginally affect my absolute position but reduces my relative position vis-a-vis you and, if we are adversaries, this means your theft allows you to gain on me faster than otherwise would be the case. I suspect this is the most worrying form of theft, and the one that puts the China question front and center. Theft of military technology, theft of information that could be leveraged into industrial sabotage (eg. interfering with critical infrastructure), even theft of run-of-the-mill information that could later be used to hack into otherwise secure networks — all of that sort of stealing, if done by a rival company or non-state actor or country seeking to hurt us, would be a major concern.

I would like to have a better understanding of how much of the cyberstealing falls into the higher categories of theft. The more that it does, the more it constitutes a matter of national security (vice merely law enforcement).

There are other ways to parse the threat. One could, for instance, identify a spectrum of thieves running from the proverbial bored teenager in his bedroom through loosely organized groups of hackers to a paramilitary organization under the direct supervision of a hostile peer rival. The marks along this spectrum are probably blurred since "lower" level actors could be proxies for higher level ones. One could also distinguish among various motivations — ranging from the thrill of the adventure (the cyber equivalent of graffiti) to petty greed (shoplifting) to commercial espionage to a focused effort to degrade the power of a political adversary.

However it is parsed, I suspect that when the threat is better understood, we will decide that it does deserve to be treated as a national security concern, one that commands the attention of the top-tier of policymakers. Cyber is probably not at the level posed by the specter of global thermonuclear war during the Cold War, nor perhaps even the specter of nuclear weapons falling into the hands of terrorists today. But the Obama administration is right to take the cyberthreat as seriously as it has and the Pentagon’s cyberstrategy needs to be just the next and not the last step in our response.