This Is How They Tell Me the World Ends: The Cyberweapons Arms Race

In 2016, a mysterious group calling themselves the Shadow Brokers hacked into the NSA’s cache of zero-days and published a portion of them online. These were some of the USA’s most sophisticated cyberweapons—powerful weapons of mass digital destruction that in many cases were ready to use. The Shadow Brokers offered to sell off the remaining exploits, first in an auction and then a la carte. They did not receive much in the way of payment, likely because potential buyers were aware that engaging would make them a target for espionage agencies all over the world. Out of spite, the angered hackers posted the NSA’s top 20 exploits online for free so that anyone could use them to wreak havoc. This list included a hack known as EternalBlue, which chained together several vulnerabilities in Windows software into a “point and click” weapon that could grant access to private systems all over the world. Technically, EternalBlue had no zero-days, since the NSA had informed Microsoft of the vulnerabilities and a software patch had been released. However, this patch relied on users to update their software, so millions of computers were still left vulnerable. In the weeks after the Shadow Brokers leaks, hundreds of thousands of computers in 150 countries were infected.

Jake Williams, who worked as a TAO (Tailored Access Operations ) exploitation specialist for the NSA between 2008 and 2013, worked for a company that helped to clear up the aftermath of cyber-attacks. He wrote a blog post on the Shadow Brokers leaks, claiming that state-sponsored Russian hackers with the goal of discrediting the US government were the likely culprits. The Shadow Brokers responded directly to his post, doxxing him as a former NSA agent. Williams was horrified and felt abandoned by the agency upon their lack of support; he even cancelled any plans to travel abroad, for fear that he would be targeted.

In 2017, hackers from North Korea’s Lazarus Unit released a ransomware attack that spread around the world with unprecedented speed. One target that was hugely disrupted was the British National Health Service (NHS). This attack was called “WannaCry” and used the EternalBlue hack to infiltrate systems and corrupt important files. The attack caused massive disruption but earned the North Koreans very little money because they failed to include any means of returning the uncorrupted data, making it pointless to pay the ransom. A young British hacker also figured out a trick to divert victims of the attack from North Korean servers, very quickly neutralizing the attacks. The FBI was criticized for arresting this young man for his heroism soon after he came to their attention, and Microsoft was indignant to be stuck with the task of cleaning up the NSA’s mess.

Russian hackers learnt from the mistakes made by WannaCry hackers and did not repeat them in the “NotPetya” attacks that occurred soon afterwards. This attack used NSA zero-days and EternalBlue to destroy computers in Kyiv, Ukraine, causing at least $10 billion in damage. Dymtro Shymkiv, the presidential deputy in charge of cybersecurity and a former Microsoft employee, was in New York when he was informed of the attack. He posted that the presidential office was still online so as to control the narrative and avoid panic, and he spent the next few months cleaning up the aftermath. This attack prompted Brad Smith to speak at the UN and promote a digital Geneva Convention to restrict the use of cyberweapons on civilian targets. Instead of following such suggestions, the NSA began planting bugs with the potential to cause catastrophic damage in Russian digital infrastructure.

Perlroth judges that due to mismanagement of foreign policy and cybersecurity policy, the 2016-2020 Trump administration caused unprecedented damage to American cybersecurity. Trump got rid of the position of Head of Cybersecurity and undermined his own government agencies by denying their findings in regard to foreign cyberthreats. He refused to admit that Russia interfered with the 2016 election, and as a result, the Russian government faced no consequences for the hacks. Trump also refused to acknowledge that Saudi leaders had murdered the Washington Post’s Jamal Khashoggi, then used hacking to try and silence those who were reporting on the crime. 

Additionally, the ententes with China and Iran that Obama negotiated were overturned, causing a massive upswing in the number of Iranian and Chinese hacks of American systems. China began targeting its own citizens with digital surveillance even more thoroughly than previously, making it illegal for Chinese hackers to report zero-days to anyone but the government. In the months preceding the 2020 election, Russian hacks caused chaos by targeting hospitals and holding the digital infrastructure of entire towns hostage. Their propaganda teams also sowed chaos and dissent in online American forums, just as they did prior to the 2016 election. Instead of condemning this interference, Trump supported a blatantly false conspiracy theory that blamed the hacks and disruption on Ukraine. Despite this obfuscation, Trump was ousted from office on election day.