The Silence of a Successful Cyberattack
Given the existence of systemic vulnerabilities and a party with the capability and intent to exploit them, it is important to consider the motivations of such a party. In particular, it is important to ask why a hostile party with the capability to exploit a vulnerability would not do so.
Consider first an analogous situation in the intelligence community. Say that sensitive and important information about Nation A is gathered by (adversary) Nation B from a well-placed but covert source. Under what circumstances might Nation B refrain from using that information against Nation A? The answer depends on the value that Nation B places on protecting the source of the information versus the value it places on using the information at that time. “Protecting sources and methods” is a task of paramount importance in the intelligence community, because many sources and methods of collecting intelligence would be difficult to replace if their existence became known—and thus, certain types of information are not used simply because their use would inevitably disclose the source.
Similarly, in the shadowy world of cyberthreat and cybersecurity, a hostile party with the capability to exploit a vulnerability might be well advised to wait until the time is right for it to launch an attack. In fact, one might well imagine that such a party would conduct exercises to probe weaknesses and lay the groundwork for an attack, without actually taking overly hostile action. For example, such a party might use a virus that simply replicated itself but did not carry a payload that did any damage at all in order to prove to itself that such an attack is possible in principle.
The cybersecurity community knows of incidents (such as rapidly propagating viruses without destructive payloads and the active compromise of many network-connected computers that can be used to launch a variety of distributed attacks) that are consistent with the likely tactics of intelligent hostile parties. And it knows of intelligent parties whose intentions toward the United States are hostile. These factors do not constitute a logical proof of a high-end cyberthreat, but they do underlie the committee’s judgment that the vulnerabilities with which it is concerned are not merely theoretical.
and seriously hostile. For example, a high-end cyberattacker may use IT in an attack as a means to an end and not as an end itself for a high-impact attack, much as the terrorists on September 11, 2001 (9/11), commandeered four airplanes to use as weapons. That is, for a high-end adversary, a cyberattack may be most effective as an amplifier of a physical attack.37
Fifth, as a military strategy (a point relevant mostly to nation-states),