Review of Buchanan, Ben. The Hacker and the State: Cyber Attacks and the New Normal of Geopolitics (Cambridge, Harvard University Press, 2020)
Juniper Networks, a Silicon Valley company that makes networking products, made headlines in early June. Sixteen members of Congress sent a letter to the company’s CEO wanting to know why some of the company’s firewalls included National Security Agency (NSA)-designed encryption algorithms—likely with a backdoor the agency could exploit. The lawmakers also asked what the company discovered in its 2015 investigation after Juniper learned that the code had been altered. “Juniper’s experiences can provide a valuable case study about the dangers of backdoors, as well as the apparent ease with which government backdoors can be covertly subverted by a sophisticated actor,” the lawmakers wrote, as Congress debated new legislation on encryption in the EARN IT Act.[1]
In his new book, The Hacker and the State, Georgetown professor Ben Buchanan, draws on documents leaked by Edward Snowden to describe what appears to have happened. The NSA, Buchanan writes, manipulated elements of a number-generation technique used in encryption. That code ended up in Juniper’s networking products sold globally; sales included foreign governments.[2]
But there’s a twist. In 2012, subtle changes appeared in the products’ source code, probably the work of Chinese state hackers, according to Buchanan’s private-sector sources.[3] The change locked out the original prying eyes and allowed whoever made the edit to decrypt data collected from Juniper’s customers. A more brazen change in 2014 that allowed for active hacking.[4] Concerns about such backdoors, and the potential to lose control of them, factor into contemporary debates on encryption. But it’s worth scrutinizing what is technically possible and what’s been done in the past.
High-tech surveillance isn’t new. In February, The Washington Post reported that the Swiss company Crypto AG was secretly owned by the Central Intelligence Agency (CIA) and West German intelligence for much of the Cold War. Internal documents leaked to The Washington Post call it “the intelligence coup of the century,” and reveal that the company sold rigged encryption devices to governments, both US allies and foes, around the world.[5]
Today’s government-sponsored hackers also find ways to listen in on sensitive conversations and shape world affairs with an array of digital tools at their disposal, as Buchanan recounts. These new forms of collection and confrontation have far-reaching implications for diplomacy and larger international relations.
The centrality of the United States to online communications presents a unique set of opportunities. Countries that make up the Five Eyes—an intelligence consortium of the United States, Canada, the United Kingdom, Australia, and New Zealand—currently control much of “the central nervous system,” or the switching stations and cables carrying Internet traffic around the world, Buchanan writes, making these countries well positioned for intelligence collection.[6]
The United States also has “transit authority” for information that passes through its borders.[7] This transit authority for information is much like American jurisdiction for transactions that pass-through US banks, even momentarily, allowing the US to impose unilateral sanctions on terrorists, rogue regimes, and the banks that service them anywhere in the world. Many major Internet companies are headquartered in the United States; they are not only bound by US law but at times work with the government willingly.[8] Fear of losing such control helps explain why some in Washington advocate bans foreign apps on American phones, and Secretary of State Mike Pompeo introduced his Clean Network initiative, which calls for a sweeping break of digital ties between the United States and China.
Early in the book, Buchanan reveals how the NSA uses what it calls its “home-field advantage” to move the needle on American diplomacy.[9] In 2010, UN Ambassador Susan Rice wanted to know the positions of several UN Security Council members ahead of negotiations on Iran sanctions. According to documents leaked by Snowden, the NSA was able to get Foreign Intelligence Surveillance Act (FISA) approval—details about the permitted categories for collection are not public—to spy on Bosnia, Uganda, Gabon, and Nigeria for this purpose. Ambassador Rice used the intercepts to improve her negotiating strategy and secured approval for the sanctions package.[10]
Buchanan frames his book by exploring the international relations concepts of signaling and shaping. He argues that cyber tools are “ill-suited for signaling” because it’s too hard to discern intent.[11] The necessary secrecy means that cyber tools cannot be used for power-projection.[12] They are more effective at shaping a particular environment: gathering information, promoting preferred narratives, or gently destabilizing a situation. While conducting a freedom of navigation operation in distant seas is a clear signal projecting power, showing you can cut off a country’s electrical grid would likely render that capability useless.
Much like Johns Hopkins University SAIS professor and Buchanan’s former thesis advisor, Thomas Rid, Buchanan explores how emerging technologies affect international relations. States continuously “define the contours of acceptability,”[13] and small but dedicated states can have disproportionate impact through hacks and cyberattacks. There are many open questions, including recent debates over weakening encryption, whose hardware should be allowed in telecommunications networks, and when it is appropriate to spy on allies. Buchanan’s meticulous research lays the historical and technical foundation to start discussing the way forward.
[1] Senator Ron Wyden et al, Congress of the United States, to Rami Rahim, June 10, 2020. https://www.wyden.senate.gov/imo/media/doc/061020%20Wyden%20Led%20Bicameral%20Juniper%20Letter.pdf
[2] Ben Buchanan, The Hacker and the State: Cyber Attacks and the New Normal of Geopolitics (Cambridge, Massachusetts: Harvard University Press, 2020), 71-72.
[3] Buchanan, 76-77.
[4] Buchanan, 79.
[5] Greg Miller, “The Intelligence Coup of the Century,” The Washington Post, February 11, 2020. https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/
[6] Buchanan, 19.
[7] Buchanan, 22.
[8] Buchanan, 26.
[9] Buchanan, 15.
[10] Buchanan, 26.
[11] Buchanan, 4.
[12] Buchanan, 308
[13] Buchanan, 317.
