FBI suspects two teens in DOD systems attack
Connecting state and local government leaders
The FBI is investigating whether two California youths are the culprits behind a hack attack that breached 11 Defense Department systems last month, an FBI official said. "We did two searches on [Feb. 25], and we seized hardware, software, printers and other peripherals," said George Grotz, an FBI spokesman in the agency's San Francisco office.
The FBI is investigating whether two California youths are the culprits behind a hack
attack that breached 11 Defense Department systems last month, an FBI official said.
"We did two searches on [Feb. 25], and we seized hardware, software, printers and
other peripherals," said George Grotz, an FBI spokesman in the agency's San Francisco
office.
The two minors allegedly used computer applications to enter unclassified DOD systems
in the United States and Okinawa, Japan. The military uses the systems to maintain pay and
personnel records.
No one has been arrested, but the FBI's computer crime squad raided the youths' homes
in Cloverdale, Calif., about 80 miles north of San Francisco.
Grotz would not confirm that the raids on the homes were driven by the attack on the
DOD systems. But the FBI is investigating the two teen-agers as part of a computer
intrusion case, he said.
The FBI has not said what led officials to the juveniles. But The Washington Post
reported Feb. 28 that Netdex Internet Services Inc. of Santa Rosa, Calif., first alerted
FBI agents to the hackers after they used the Internet service provider's system as a
launching pad for attacks on other systems.
The four Navy and seven Air Force systems that were breached handle unclassified
information, but senior DOD officials said they are concerned about how the attack might
affect military operations.
"It was the most organized and systematic attack the Pentagon has seen to
date," deputy Defense secretary John Hamre said. "I think this was--more than
anything--a serious wake-up call."
Hamre would give no details of the incidents because DOD is also investigating them.
But he said the hackers failed to penetrate any classified systems.
DOD is now installing firewalls around its unclassified systems, Hamre said.
He said DOD will install other devices, such as attack warning systems and computer
forensics tools, to detect the source and time of attacks.
DOD officials said they believe the youths may have been part of an elaborate and
widespread hacking game that has been directed in part against Defense systems.
According to John C. Davis, National Security Agency commissioner to the President's
Commission on Critical Infrastructure Protection, about 95 percent of DOD's communications
run over public networks, which makes them particularly vulnerable to electronic attack.
"The United States accounts for about 60 percent of the Internet activities
worldwide. That makes us very vulnerable to people who want to attack our networks,"
Davis said.
President Clinton in July 1996 established the commission to identify threats and to
develop policy for protecting the nation's eight critical infrastructures, including
telecommunications, electric power, water, banking and finance, transportation, oil and
gas, and emergency and government services.
"It doesn't take much capability to attack these infrastructures. It takes a
computer or a few computers and some good hackers. All they need is a malicious intent and
a few thousand dollars in equipment," Davis said.
The rapid proliferation of hacking tools over the Internet makes it easier for
less-sophisticated hackers to penetrate the government's networks, Davis said. The new
weapons of mass disruption are logic bombs, viruses and e-mail attacks, he said.
A computer system at Langley Air Force Base, Va., was brought to a standstill recently
when it was flooded with e-mail.
A more sophisticated attack was recently launched from the United Kingdom, where
hackers broke into the Air Force's Rome Laboratory in Rome, N.Y., and used that system as
a springboard to break into DOD computers around the country.
Attorney General Janet Reno, who is a member of the commission's steering committee,
late last month announced the establishment of a new National Information Protection
Center at FBI headquarters in Washington to detect hacking attempts as soon as they occur.
Likewise, DOD is no longer satisfied with detecting break-ins after the fact, said
Jacques Gansler, undersecretary of Defense for acquisition and technology, at a House
hearing last month.
Gansler said DOD will spend $2.8 billion over the next five years on its Defense
Information Assurance Program (DIAP) to provide continuous, multilayered protection for
DOD's networks.
DIAP funding includes money for NSA's Multilevel Information Systems Security
Initiative products. MISSI is an NSA program that provides affordable, interoperable
information security for the Defense Message System.