Quotes from Amy B. Zegart

China is also believed to be behind hacks of Anthem insurance (80 million records), Marriott (400 million records), and Equifax's 146 million credit records covering nearly every adult in America.78

You have to kind of salute the Chinese for what they did," noted Director of National Intelligence James Clapper after the OPM breach.80 From an intelligence perspective, it was a masterstroke.

Russia was almost certainly behind the 2015 and 2016 cyberattacks shutting off Ukrainian power to millions of customers87 and the 2017 NotPetya cyberattack targeting Ukrainian banks, agencies, and companies that spread worldwide, causing more than $10 billion in damage.88

Cyberattacks are defined as "deliberate actions to alter, disrupt, deceive, degrade, or destroy computer systems or networks or the information and/or programs resident in or transiting these systems or networks."32 Put more simply, cyberattacks involve any activity that alters the confidentiality, integrity, or availability of information on digital systems.

Iran's offensive cyber operations have focused on destructive attacks, including a 2012 attack that destroyed thirty thousand Saudi Arabian computers91 and a 2014 attack that wiped hard drives at the Sands Casino in Las Vegas.

Information has always been important in geopolitics, but for most of history physical resources mattered more. Whoever had better farmland, healthier livestock, bigger armies, sturdier fortresses, better weapons, and faster ships prospered. Tangible assets generated trade, transformed societies, and won wars.

Regardless of the outcome, the decisions linger. As one official put it, "Ethical questions will put scars on your soul that you can never get rid of.

Today, by contrast, data has become much more essential for power—whether it's the market power of firms, the domestic political power of governments, or the military power of nations. Nearly two-thirds of today's global economy is based on intangible services,33 not tangible goods, and some experts estimate that up to 40 percent of the world's jobs could be automated in the next fifteen to twenty-five years.

North Korea's bizarre attack on Sony Pictures destroyed thousands of computers and servers and sent the company reeling—all in retaliation for a Seth Rogen comedy called The Interview.

For intelligence officials, 9/11 was personal.

The military's traditional air, land, and sea domains are all natural, not manmade. Nature provides geographic advantages for some and vulnerabilities for others.

Cyberspace, by contrast, is manmade and inherently insecure. The Internet was never designed with security in mind.

Stuxnet, the most sophisticated cyber weapon in the world, with code fifty times larger than typical malware.99 The CIA, the NSA, and Israel's elite cyber Unit 8200 reportedly joined forces.100 Forensics revealed that Stuxnet used four rare and valuable "zero day" vulnerabilities (coding flaws unknown to security researchers or software vendors) to find the precise software operating Iran's centrifuges, spread inside, hide, and destroy without a trace.101

In cyberspace, there are no mountains or oceans to protect people or their assets from others. Good neighborhoods and dangerous ones are unavoidably connected. We are all geographically unlucky.

This has the whiff of August 1945," said former NSA and CIA Director Michael Hayden, referring to the emergence of the atomic bomb. "That's a big deal."105

We even recommended the creation of a recurring IC Analytic Olympics to send home the message that fostering a culture of continuous evaluation and learning should be championed.113

It's hard to imagine now, but as late as 2007, the Intelligence Community's annual threat assessment did not include the word cyber once.42 In 2009, cyber threats still ranked so low on the priority list, they were buried on page 38 of the forty-five-page threat assessment, just below drug trafficking in West Africa.43 Fast forward five years and the world looked very different, with cyber vaulting to the top tier of the 2012 intelligence threat list.

The Defense Department, Carter said, had three core cyber missions: protecting military systems, networks, and information from attack; providing cyber capabilities to support military operations and contingency plans when needed; and defending the United States and its interests against "cyberattacks of significant consequence.

the lack of testing meant that intelligence analysts lacked robust feedback loops

Successful deterrence has three requirements: (1) clear redlines delineating what behavior is unacceptable; (2) a credible capacity and willingness to punish violators (otherwise threats become hollow); and (3) the ability to identify the culprit quickly.55 Notice the word quickly. Identifying an offender eventually isn't good enough.

One expert study called Russia's information warfare approach a "firehose of falsehood."114

Less noticed was Tetlock's other finding: predicting the future wasn't just lucky guessing. Some people did much, much better than average.115 He called them superforecasters.

In 2018, about two billion people, or two-thirds of the online population, had their personal information stolen or compromised.

In geopolitics, the same information is not available to everyone, regardless of how much time they have. Intelligence is in the business of unlocking other people's secrets and protecting our own. Asymmetric information is the name of the game. And in a world of asymmetric information, prediction is much more difficult and miscalculation much more likely.