U.S. mulls foreign hackers’ motives

Nicole Perlroth, David E. Sanger and Michael S. Schmidt / New York Times News Service /

Published Mar 4, 2013 at 04:00AM

SAN FRANCISCO — When Telvent, a company that monitors utilities, water treatment plants and more than half the oil and gas pipelines in North America, discovered last September that the Chinese had hacked into its computers, it immediately shut down remote access to its clients’ systems to assure that no outsider could seize control. Company officials and U.S. intelligence agencies then grappled with a fundamental question: Why had the Chinese done it?

Was the People’s Liberation Army trying to plant bugs into the system so they could cut off energy supplies and shut down the power grid if the United States and China ever confronted each other in the Pacific?

Or were the Chinese hackers just trolling for industrial secrets, trying to rip off the technology and passing it along to China’s own energy companies?

“We are still trying to figure it out,” a senior U.S. intelligence official said last week. “They could have been doing both.”

Telvent, which also watches utilities and water treatment plants, ultimately managed to keep the hackers from breaking into its clients’ computers.

At a moment when corporate America is caught between what it sees as two different nightmares — preventing a crippling attack that brings down America’s most critical systems and preventing Congress from mandating that the private sector spend billions of dollars protecting against that risk — the Telvent experience resonates as a study in ambiguity.

To some, it is prime evidence of the threat that President Barack Obama highlighted in his State of the Union address, when he warned that “our enemies are also seeking the ability to sabotage our power grid, our financial institutions, our air traffic control systems,” perhaps causing mass casualties. Obama called anew for legislation to protect critical infrastructure, which was killed last year by a Republican filibuster after intensive lobbying by the Chamber of Commerce and other business groups.

But the security breach of Telvent, which the Chinese government has denied, also raises questions of whether those fears — the subject of weekly research group reports, testimony and congressional studies — may be somewhat overblown, or whether the precise nature of the threat has been misunderstood.

U.S. intelligence officials believe that the greater danger to the nation’s infrastructure may not even be China, but Iran, because of its avowal to retaliate for the Stuxnet virus created by the United States and Israel and unleashed on one of its nuclear sites. But for now, these officials say, that threat is limited by gaps in Iranian technical skills.

There is no doubt that attacks of all kinds are on the rise. The Department of Homeland Security has been responding to intrusions on oil pipelines and electric power organizations at “an alarming rate,” according to an agency report last December. Some 198 attacks on the nation’s critical infrastructure systems were reported to the agency last year, a 52 percent increase from the number of attacks in 2011.

Researchers at McAfee, a security firm, discovered in 2011 that five multinational oil and gas companies had been attacked by Chinese hackers. The researchers suspected that the Chinese hacking campaign, which they called Night Dragon, had affected more than a dozen companies in the energy industry. More recently, the Department of Energy confirmed in January that its network had been infiltrated, though it has said little about what damage, if any, was done.