NSA Targeting Domestic Computer Systems
The National Security Agencyâ€™s Perfect Citizen program hunts for vulnerabilities in â€ślarge-scaleâ€ť utilities, including power grid and gas pipeline controllers, new documents from EPIC show.
Newly released files show a secret National Security Agency program is targeting the computerized systems that control utilities to discover security vulnerabilities, which can be used to defend the United States or disrupt the infrastructure of other nations.
The NSAâ€™s so-called Perfect Citizen program conducts â€śvulnerability exploration and researchâ€ť against the computerized controllers that control â€ślarge-scaleâ€ť utilities including power grids and natural gas pipelines, the documents show. The program is scheduled to continue through at least September 2014.
The Perfect Citizen files obtained by the Electronic Privacy Information Center and provided to CNET shed more light on how the agency aims to defend â€” and attack â€” embedded controllers. The NSA is reported to have developed Stuxnet, which President Obama secretly ordered to be used against Iranâ€™s nuclear program, with the help of Israel.
U.S. officials have warned for years, privately and publicly, about the vulnerability of the electrical grid to cyberattacks. Gen. Martin Dempsey, the chairman of the Joint Chiefs of Staff, told a congressional committee in February: â€śI know what we [the U.S.] can do and therefore I am extraordinarily concerned about the cyber capabilities of other nations.â€ť If a nation gave such software to a fringe group, Dempsey said, â€śthe next thing you know could be into our electrical grid.â€ť
Discussions about offensive weapons in the U.S. governmentâ€™s electronic arsenal have gradually become more public. One NSA employment postingÂ for a Control System Network Vulnerability Analyst says the job involves â€śbuilding proof-of concept exploits,â€ť and an Air Force announcement in August called for papers discussing â€śCyberspace Warfare Attackâ€ť capabilities. The Washington Post reportedÂ last month that Obama secretly signed a directive in October outlining the rules for offensive â€ścyber-operations.â€ť
â€śSabotage or disruption of these industries can have wide-ranging negative effects including loss of life, economic damage, property destruction, or environmental pollution,â€ť the NSA concluded in a public report (PDF) discussing industrial control systems and their vulnerabilities.
The 190 pages of the NSAâ€™s Perfect Citizen files, which EPIC obtained through the Freedom of Information Act last week, are heavily redacted. At least 98 pages were completely deleted for a number of reasons, including that portions are â€śclassified top secret,â€ť and could â€ścause exceptionally grave damage to the national securityâ€ť if released, according to an accompanying letter from Pamela Phillips, chief of the NSAâ€™s FOIA office.
But the portions that were released show that Raytheon received a contract worth up to $91 million to establish Perfect Citizen, which â€śenables the government to protect the systems,â€ť especially â€ślarge-scale distributed utilities,â€ť operated by the private sector.
The focus is â€śsensitive control systems,â€ť or SCS, which â€śprovide automation of infrastructure processes.â€ť Raytheon is allowed to hire up to 28 hardware and software engineers who are supposed to â€śinvestigate and document the results of vulnerability exploration and research against specific SCS and devices.â€ť
One job description, for a senior penetration tester, says the position will â€śidentify and demonstrate vulnerabilities,â€ť and requires experience using security-related utilities such as Nmap, Tenableâ€™s Nessus, Libnet, and Netcat. Raytheon is required not to disclose that this work is being done for the NSA.
The Wall Street Journal disclosed the existence of Perfect Citizen in a 2010 article, which reported the NSAâ€™s â€śsurveillanceâ€ť of such systems relies â€śon a set of sensors deployed in computer networks for critical infrastructure that would be triggered by unusual activity suggesting an impending cyber attack.â€ť
An NSA spokeswomanÂ responded to CNET at the time by saying that Perfect Citizen is â€śpurely a vulnerabilities assessment and capabilities development contractâ€ť that â€śdoes not involve the monitoring of communications or the placement of sensors on utility company systems.â€ť
Marc Rotenberg, EPICâ€™s executive director, said that the newly declassified documents â€śmay help disproveâ€ť the NSAâ€™s argument that Perfect Citizen doesnâ€™t involve monitoring private networks.
The FOIAâ€™d documents say that because the U.S. government relies on commercial utilities for electricity, telecommunications, and other infrastructure requirements, â€śunderstanding the technologies utilized in the infrastructure nodes to interoperate on the commercial backbone enables the government to protect the systems.â€ť
Neither the NSA nor Raytheon immediately responded to requests to comment from CNET this morning. Weâ€™ll update this story if we receive a response.