RUTHFULLY YOURS

Every day in the United States, professional cyber-spies are stealing tremendous amounts of information. Mainly from Russia and China, these spies target computer networks and increasingly seek entryways through mobile phones. Modern mobile phones — Smartphones — are powerful, networked computers, but they lack the firewalls and safeguards typically installed on PCs. What protection is commercially available is weak and unsatisfactory.

America’s cyber-systems are under attack because what they hold is extremely valuable. Everything from the design of a stealth fighter-bomber to the investment portfolio of a powerful entrepreneur is open to professional cyber-spies and, thus, to the governments that sponsor them.

For political reasons, the United States has done very little finger-pointing at the culprits. While there has been talk about getting tough with cyber-spies, so far, at least, there is little evidence of strong action against the governments that train and send them. That leaves the advantage with the intruder.

But who are the intruders? Examples from the past can help us form a picture of the people recruited and how they work.

The Russians developed an elaborate technology-spying operation starting in the 1960s. Directorate T was created from the former Department 10 in 1963 to intensify the acquisition of Western strategic, military, and industrial technology. By 1972, Directorate T had a headquarters staff of several hundred officers subdivided into four departments, in addition to specialists stationed at major Soviet embassies around the world. The Directorate’s operations were coordinated with the scientific and technical collection activities of other KGB elements, and with the State Scientific and Technical Committee (GNTK).

The job of Directorate T was to collect technical information needed to support the Soviet Union’s infrastructure. Much of the focus was on computers and microelectronic technology and know-how. By the early 1980s, the Soviets found themselves in head-to-head military competition with the United States, needing to make up deficits in critical areas — primarily in microelectronics. This meant an active program to get access to the technology, smuggle examples back to the Soviet Union, and collect information from U.S. government sources. Parallel to Directorate T was Soviet military intelligence, which worked to obtain Western weapons and weapons designs.

In all, it was a very large bureaucracy made up of well-trained professionals. Many were multilingual; each was directed to his or her target by an elaborate acquisition plan. Promotions and rewards were based on successful operations against targets in the plan.

Directorate T was an elite outfit, and it had the attention of top Soviet leaders, as it did their Western counterparts. One of the most remarkable successes of French intelligence in the 1970s and 1980s was recruiting a senior Directorate T agent, given the codename Farewell. Farewell supplied the French, and ultimately the United States, with an inside view of Soviet technology collection efforts. Farewell’s real name was Vladimir Vetrov, and he worked for Line X, the operational arm of Directorate T. Eventually Vetrov was arrested, according to the official story, for murdering his mistress and an off-duty police officer who happened on the scene. In jail, Vetrov’s boasting alerted Soviet counterintelligence officials to a bigger story, namely spying for the West. Sometime in 1985 he was tried as a traitor and spy and executed.

As a model, Vetrov was a very talented, highly trained person who spoke excellent French and some English. He had a mathematics and engineering background, and he was well-paid, was allowed to travel, and enjoyed many of the perks afforded the Soviet nomenklatura.

Today’s cyber-spies, whether Russian or Chinese, would need to be trained like Vetrov. That is to say, they would have a strong technical background and be capable of handling English (reading and comprehension, since mobile phone intrusions require language skills). This means that these are highly professional people who would need to have good government salaries and perks, and who would constantly be evaluated on the value of the acquisitions they brought in.

Probably, like Vetrov, they would be recruited while still in university. In many cases, the best of them would be sent abroad, especially to the United States, for graduate education and to improve their knowledge of the target country. The number of Chinese undergraduates on U.S. campuses in 2010 increased 43 percent from the previous year, according to the annual Institute of International Education Open Doors. Chinese students form the largest number of foreign students in the U.S., with 157,558 enrolled in 2010. The nearest rival was India with 103,895.

Not all Chinese students go home to be spies, of course, but for China there is a double-benefit — there are the spies they send to enlarge their American vocabulary and scientific background, and there are students who can be recruited in future.

No one knows how many Chinese cyber-spies there are, but estimates in the tens of thousands are probably close to right.

The Russian situation is different. China is trying to suck up most of America’s technology and know-how and wants to control key individuals in decision-making positions. The Chinese need to know with day-to-day precision what is going on, accounting for the large number in the U.S. on an ongoing basis.

The number of Russians studying in the U.S. is quite small, because Russia is in cyber-spying mostly for the money, targeting mainly financial institutions, banks, trading companies, and probably some government agencies and organizations. Russian military intelligence, of course, still targets America’s weapons systems and command-and-control networks. While we don’t know for sure, a large part of Russian spying is probably done with human agents instead of electronically.

The modern cyber-spy — sponsored by his government; well-trained; proficient in English; capable of understanding, assessing, and managing his target — represents a formidable national security challenge for the United States. In the 1980s, thanks to Farewell and a remarkable relationship between President Ronald Reagan and French President Francois Mitterrand (Farewell was their agent), the United States and its allies launched a major program to shut down Soviet techno-spies. The project ultimately was successful.

Today we need a major program led from the top, with our allies and friends on board, to confront the growing vulnerability of all Western systems and the entire security umbrella. The basic elements would be:

�-� Enhance counter-intelligence. The FBI needs to figure out who is being trained in the U.S. and, wherever possible, boot out Chinese agents. If we put pressure on their “rising stars,” the Chinese will quickly figure out we are on to their game.

�-� Start recruiting their guys. Farewell is the perfect example of how and what to do. A strongly proactive recruiting program, starting with Chinese studying here, would send a message — one that the Russians understood, and one that China won’t miss.

�-� Reduce access to American industry and scientific institutions. This was done to the Russians, and it paid off. It would be a big warning to Chinese scientists and engineers who prize their access to our scientific and engineering communities.

�-� Put our allies and friends to work hitting Chinese scientific and industrial targets, especially state-owned targets. A “hit-back” policy is important to establish some “ground rules” for how the game is played. If there is a Chinese attack on one of our Air Force computer systems, or on a top Army leader through his Smartphone, then hit-back attacks on similar targets are not only legitimate, but politically necessary.

These are “starter” suggestions, and to make them work, we need leaders to step forward now as they did in the past.

Stephen Bryen was the founder and first director of the Defense Technology Security Administration. He is now CEO of SDB Partners LLC in Washington, D.C.