Dark Territory: The Secret History of Cyber War

Still reading the book but already found some errors that detract from my enjoyment of the material.

You'd think a book about cybersecurity would at least use a proofreader or editor that would know the difference between a silicon "die" and "dye".

They also clearly didn't get a good enough explanation of things like BGP and denial-of-service attacks. I found this disheartening.

Swell overview of the invention of cyber war to capitalize on the fantastic growth of the Internet, actually to monetize spying on Web users by digitally-resuscitated govs, coms and orgs of the near-death national security boastful, wasteful hardware industry gasping last breaths from over-oxygenated National Security confection in 1947 to prolong forever World War 2 rise of the US warfare state.

Kaplan's highly readable, credible account of gov, mil, spy decadence and sloth might be compared to Michael Hayden's laughable, amateurish, offensive defensiveness of his lifetime on the dark money military spy dole, also just published with hearty endorsement of the forever since 1947 greedy mil-spy community energetically whirling through revolving doors to hyper monetize cyber war -- thanks to persuasive self-serving recommendations of venal study panels to solicit and to hire corporations headed and staffed by ex-mil-govs to run the government's darkest monetization operations. As Kaplan skewers them.

Kaplan and Hayden are on speaker and book tours. Admire Kaplan's skewer of Hayden and The Company Cyber Spooks. Remember Edward Snowden admits he is one.

With a catchy title of Dark Territory: The Secret History of Cyber War, this new book by Pulitzer Prize winning author Fred Kaplan looked to be a winner. Not that it’s not a good book; but for anyone who’s been involved with information security and cyberwarfare, most of the stories are already known and have long been covered.

The book gets it title based on an observation by former Defense Secretary Robert Gates. He observed in 2011 that the US had lost sight of the extraordinary story that was going on in the Middle East on the challenges faced by the United States and coalition forces. Gates noted that “we are in dark territory”. Kaplan uses dark territory as a metaphor throughout the book to describe the often clueless approach the US Government has taken to cybersecurity.

Many of the stories that Kaplan details are well known. From the Eligible Receiver red team exercises in 1997, to Stuxnet, the Sony breach and more. What Kaplan has done is interview many of the participants in the events and fill in many of the finer details.

The book does provide a good history of the development of cybersecurity and the threat of cyberwar. Kaplan was able to interview a number of the key players involved and is able to provider an interesting firsthand account of many of the key events in the history of information security.

For readers of Wired, TechCrunch and similar material, much of the material in the book will not be of news to them, nor will they glean much of any secret history. But for those new to the topic, Dark Territory: The Secret History of Cyber War will be an interesting read.

With a catchy title of Dark Territory: The Secret History of Cyber War, this new book by Pulitzer Prize winning author Fred Kaplan looked to be a winner. Not that it’s not a good book; but for anyone who’s been involved with information security and cyberwarfare, most of the stories are already known and have long been covered.

The book gets it title based on an observation by former Defense Secretary Robert Gates. He observed in 2011 that the US had lost sight of the extraordinary story that was going on in the Middle East on the challenges faced by the United States and coalition forces. Gates noted that “we are in dark territory”. Kaplan uses dark territory as a metaphor throughout the book to describe the often clueless approach the US Government has taken to cybersecurity.

Many of the stories that Kaplan details are well known. From the Eligible Receiver red team exercises in 1997, to Stuxnet, the Sony breach and more. What Kaplan has done is interview many of the participants in the events and fill in many of the finer details.

The book does provide a good history of the development of cybersecurity and the threat of cyberwar. Kaplan was able to interview a number of the key players involved and is able to provider an interesting firsthand account of many of the key events in the history of information security.

For readers of Wired, TechCrunch and similar material, much of the material in the book will not be of news to them, nor will they glean much of any secret history. But for those new to the topic, Dark Territory: The Secret History of Cyber War will be an interesting read.

In 2009, Obama's first Secretary of Defense (Robert Gates), created a dedicated Cyber Command. By 2012, its annual budget hit $7 million (plus another $7 billion for cyber activities in the military), and cyber attack team staff rose to 4,000. The U.S. and a few other Western powers were not mounting cyber attacks on other nations' computer networks - as were China, Russia, Iran, Syria, and North Korea.

Previously, intelligence agencies tapped phone lines and retrieved signals. Kaplan provides an interesting overview of what had been accomplished. Now, with the Internet they could also read scads of information, and change its content, corrupt, or erase it. Attackers could now be half a world away, and didn't require large-scale industrial projects, numerous brilliant scientists.

Desert Storm was the largest armored offensive since WWII, and also the first campaign of 'counter command-control warfare.' Months before the first shot U.S. analysts discovered Saddam had fiber-optic cable from Baghdad to Basra and on into Kuwait City. Upon contacting the Western firms that had installed the cable, the locations of the switching systems were identified. Those switches were among the first targets hit, forcing Iraqis to use a backup network using microwave signals. Anticipating this move, NSA had positioned a new satellite over Iraq to scoop up the signals. Thus, at every step the NSA and American commanders knew exactly what Saddam and his generals were saying - providing them a huge edge. NSA 'spooks' also figured out how to disrupt Iraq's Russian-provided command-control systems and air-defense radar. Saddam then switched to communicating via motorcycle - but that was too slow.

Then came an interim phase while NSA etc. leaders slowly realized that digital and fiber-optic, not analog and microwave, were the future, then came widespread encryption, and realization that hooking everything up to the Internet presented serious risks. Next - the recognition of how vulnerable facilities were to terrorism and hacking.

Early vulnerability studies found many defense computers unprotected by a password, others by lame ones - '12345' or 'ABCDE.' Dumpster diving also worked, as well as basic 'phishing.' The entire Defense Department network was broken into, and those that realized there was a problem had no idea what to do.

Then it's numerous (too many) accounts of various personal encounters and small steps. Finally, its 2007, and General Petraeus is in command of U.S. forces in Iraq wanting to use NSA resources to help revive counterinsurgency techniques. Roadside bombs were the biggest threat to American soldiers - but intelligence on bombers and their locations took 16 hours to flow to the Pentagon, then to Fort Meade for analysis by tech teams, back to Baghdad, and finally to soldiers in the field. Petraeus and Alexander decided to put NSA equipment and analysts inside Iraq - moving some 6,000 analysts etc. to Bagdad. About 22 were killed out with soldiers on patrol - many by those same roadside bombs. But, the lag time between collecting and acting on intelligence went from 16 hours to 1 minute.

Then, in September that same year, four Israeli F-15 jets flew over an unfinished nuclear reactor in eastern Syria that was being built with help from North Korean scientists. They demolished it. The Syrians had no warning - the Israelis had used a U.S.A.F. program to cut the link between Syrian radars and operator radar screens.

Also in 2007, back in March, a 2.25 MW power generator at Idaho National Laboratory was destroyed after a destabilizing signal was received from D.C.

Then lots more anecdotal details of this and that before getting to the U.S. hacking into Iran's controls that regulated the centrifuges. It took 8 months for the NSA to devise a plan and design the work to carry it out. The plan included leaping across the air gap that surrounded the computers used to manage their centrifuges. Normal speed ranged from about 800 to 1,200 cycles/second - the worm gradually sped them up to 1,410 cycles, at which several centrifuges flew apart. Alternatively, the centrifuges slowed down to 2 cps, causing a different type of destruction. In either case, the worm fed false data to those monitoring performance. By the start of 2010, about 2,000 out of 8,700 of Iran's centrifuges were damaged beyond repair. Weeks later, another 1,000 were taken out of commission. But then the worm somehow 'escaped' and was discovered - both by the Iranians and virus-protection programs worldwide. However, America had launched the first attack on another nation's critical infrastructure.

We weren't alone for long. By July, in Obama's first year as President, North Korea launched a massive denial-of-service attack, shutting down websites at DHS, Treasury, the FTC, the NYSE, NASDAQ, etc. Then in 2012, NSA wiped out nearly every hard drive at Iran's oil ministry and the Iranian National Oil Ministry. Four months later, Iran used its Shamoon virus, wiping out 30,000 hard drives at Saudi Aramco, the joint U.S.-Saudi Arabian oil company, and planning on each monitor the image of a burning American flag. While unclear what the new definition of war would be, the Rubicon had clearly been crossed - several times. But it didn't create the same certainty as eg. tracking the arc of a ballistic missile's trajectory. Regardless, we began looking for more cyber targets - to be attacked in the future.

Side Notes: Bob Gates, Secretary of Defense in 2006, was stunned by the volume of attempted intrusions into American military networks - sometimes hundreds/day. How Stuxnet crossed the 'air gap' wasn't explained in a useful, understandable manner. Fortunately, WIRED (12/2014) provides more information.

Outside contractors responsible for programming Iran's centrifuge control systems were infected first, then became unwitting malware carriers when they brought their laptops into the plan and transferred data to the air-gapped systems with a flash drive. NSA's hardware implant called Cottonmouth-I comes with a tiny embedded transceiver allows it to extract data from targeted systems via RF signals and transmit it to a briefcase-sized NSA relay station up to 8 miles away. Its February 2017 issue provides new information - using a drone to steal data by watching a computer's blinking LED - after first planting malware on the computer of interest. Researchers found they could move data as fast as 4,000 bits/second - close to a megabyte every half hour. A typical smartphone camera can receive about 60 bps, a GoPro camera up to 120 bps. Another method involves varying a computer's fan speed.

In 2013, Edward Snowden, in an interview with Hong Kong's top newspaper, revealed that the NSA had launched more than 61,000 cyber operations, including attacks on hundreds of computers in Hong Kong and mainland China. Earlier he'd also revealed hat NSA was collecting phone records of millions of American citizens. These revelations pulled the rug out from under President Obama when he tried to meet with China's President Xi and complain about their intrusions. One leak was the 50-page catalog of tools and techniques used by NSA. Snowden also released documentation of U.S. monitoring foreign leaders' cell phone calls.

February 10, 2014, a cyber attack against the Las Vegas Sands Corporation destroyed the hard drives in thousands of servers, PCs, and laptops - after first stealing thousands of customers' credit-card and employee information. experts traced the attack to Iran. Wiping out the data stored required only 150 lines of code. Two weeks earlier, North Korea had hacked into Sony - destroying 3,000 computers and 800 servers - after taking more than 100 TB of data. A prior attack in 2011 shut down its PlayStation network for 23 days - and cost about $170 million.

In 2014 there were almost 80,000 security breaches in the U.S.. On average, hackers stayed inside the networks they'd broken into nearly 7 months before being detected. Corporate resistance to mandatory security standards overcame efforts to establish them. Most private companies refused to share information, not only because they lacked incentives but also because they feared lawsuits. Nations most likely to attack the U.S. via cyber weren't plugged into the Internet nearly as much as the U.S. - and would suffer far less damage in a potential counterattack.

Dark Territory is the second work by the author that I read and while in my opinion it was not the same quality as his previous work titled The Insurgents I think it is important to realize that this is not because I thought Dark Territory was bad but because The Insurgents was on a league of its own. In Dark Territory the author Fred Kaplan turn to the subject of cyber warfare.
I appreciated the research the author put into the book. The research is all the more incredible considering the fact that the time period Kaplan covered for his research spanned several decades beginning with Ronald Regan’s concern to the war on terror up to the present. Sometimes what Kaplan found is pretty funny as stories. For instance I thought it was quite funny to read of what began as a question by Ronald Regan to his national security team after watching a movie on hacking led to the first written government document concerning the threat of cyber warfare. Yet at the same time there’s many sobering moments in the book where the author recounts hackers gathering information or attacking US government/private corporation’s websites and database.
Overall this book recounts the up and down effort of the US government to protect US interests from online attack. There’s time where certain government officials get the threat but then at the same time some within the leadership of the US government don’t see the dire threat and only want to go back to the status quo. For instance Kaplan talks about how generals and admirals in the military found discussions about cyberwarfare as a distraction to their traditional concerns of fighters, ships and ground units.
I also appreciated the author’s honest look at personalities and situations even when they weren’t necessarily flattering. For instance the book discusses quite a bit about Richard Clarke the former National Coordinator for Security, Infrastructure Protection and Counter-terrorism for the United States under the Clinton and Bush administration. Some might remember in the 2000s of how Clarke authored a book and went on a public campaign to attack the Bush’s administration mishandling of matters that eventually led to 9/11. But this book went beyond the spot light and self-promotion of Clarke and reveal how Clarke wasn’t particularly liked in Washington due to his bullying, overstepping his authority and bossy matters. Credit must be given where credit is due however and Clarke did see the importance of protecting private US businesses from cyberattacks although the means he propose for that to happen wasn’t favored by any US presidents nor something private industries would have wanted.
A recurring theme throughout the book was also the tension of offense versus defense when it comes to cyber warfare. Kaplan noted that when weaknesses and backdoors for software are discovered, agencies like the National Security Agency would want to keep it a secret as a way of exploiting this weakness to hack others. Yet at the same time the threat will also bring risks to American businesses and corporations. But if one “patches up” the problem then that removes a means for the NSA to hack their targets. This observation of the inter-relationship of offense/defense is important to understand the larger problem within government institutions and their clashing roles and purposes. I also thought the author did a good job showing how everything the US can do as an offensive capability will also eventually be used by the enemy. A good case in point is how the US went after the Iranian nuclear weapons program only to find that the Iranians can also go on the offense in attacking in American interests with their own cyber warfare also. There’s much food for thought the book provides and the question the book pose is relevant for all of us as well such as the rights to privacy, security and counter-terrorism and what constitute a serious enough cyber-attack to have crossed the line to be an act of war. There’s no easy answer but Kaplan is right in raising these questions for readers today to ask and discuss.

Author Fred Kaplan has assembled a solid, detailed, and thoughtful book about the roughly 35 year history of computer use, misuse, espionage, and intentional harm by government and non-governmental players. Its main focus is on the U.S. government and its struggles to come to terms with the massive problem of hacking, theft, and severe damage that is now within reach of nations, terrorists, and even precocious teen-agers. It also covers in detail our own history of spying and espionage of other governments and non-governmental players.
The book is packed with somewhat dry detail (inevitable, I think). But its importance to the average thoughtful citizen should be readily apparent. Our property, freedoms, and even our safety is imperiled by these relatively new and powerful dangers. "The Genie" is out of the bottle, and its extremely powerful, far-reaching, and unpredictable. We need to be aware of this threat, particularly in light of the cyber activities that lead up to and influenced the recent national elections. Are we still in control of our own destiny? Were we ever? I recommend this book.

4.5 stars. Riveting history of cyber warfare from the respected journalist, Fred Kaplan. Kaplan's research and sourcing are excellent and his delivery is to the point. Kaplan balances explanations of the relevant technology (including its weaknesses, how it can be marshaled for offensive and defensive operations) with recent history. He interweaves the growing prevalence and importance of the cyber realm with the lagging understanding of government and military to its potential and pratfalls. A concise history, replete with quotes from and about the major players, and a nice primer for where things currently stand. Recommended.

Boring, and needlessly political.

I could actually feel the paperwork for this book being filled out in triplicate, sent to his superiors, sent back to him for revisions, put on hold until a committee could be formed that would be used to determine if the book was worth completing, revised, the formation of a Subcommittee for Oversight of the Book Committee, an Advisory Bureau to the Oversight Subcommittee on the Book Committee, and on, and on, and on...

It was a pretty thorough history of U.S. Cyber Warfare, insofar as information that is actually available to the public. I am sure there was quite a bit left out for the purposes of National Security because I doubt they would give someone like Fred Kaplan clearance to most of that information. Roughly 15% of the book was genuinely interesting. This small percentage dealt with actual attacks by small organizations or individuals attacking government organizations or private companies.

The remaining 85% was a drudging trek through completely opposing viewpoints and tedious narratives. The irony of all of this is completely lost on Kaplan. The author describes two ideas that do not jive. In Kaplan's view, the government is full of bureaucratic foot-dragging and ineffectuality, while at the same time he is clearly a left-leaning, big government, NSA apologist. If only the conservatives would get out of the way of "progress!" This guy couldn't help but not-so-subtly chastise conservative Presidencies while jerking off liberal administrations. Bill Clinton asked poignant and insightful questions, Obama really understood the importance of Cyber War funding, while Reagan was a bumbling idiot, and Bush was the classic hick, mirrored by every other liberal bobble-head in for the past six decades.

Too many and never ending details, names, dates, ranks, positions, document code names etc. I bought audible version. Would imagine print version to look like an event log or a guest entry register in an office reception. Very boring and very poor story telling by the author. Am getting more and more skeptical about the store editorial reviews these days. I do not think I remembering 10 worth of of details out of 9 and half hours audio. Unless you are serious academic or something, do not waste your money on this book.

Kaplan reviews in detail and depth the history of governmental heavy breathing with regards to the security of America's cyberspace since the dawn of the Internet. Kaplan's forceful message is that in spite of all of the bureaucratic breast beating and intimidating organizational names, everyday and in every way the Federal government is further and further behind the bad guys. The 2015 hack of the Office of Personnel Management (OPM) during which raw security clearance files of 22 million individuals were exfiltrated is a sad and troubling case-in-point of the book's findings.

Disappointing book. Based on a review I read I was expecting the bulk of the book to be on the "five guys" who wrote the report on the NSA monitoring of all telecommunications. Instead the first 220 pages were on what had happened in the 1960's, 70's, and 80's.

While I appreciate the research required to develop this information it was repetitive and fumbled the chronological order.

When you finally get to the "five guys" report it's a whole 10 pages in the book.

Not recommended.