China, Russia spreading lies, digital discord: former US National Security Agency director Mike Rogers

Former US National Security Agency director Mike Rogers says Western nations must work together to neutralise cyber attacks.

Admiral Mike Rogers says disinformation poses a serious threat to democracies.

Chinese and Russian state-based cyber actors are orchestrating industrial-scale malicious attacks and disinformation campaignsto gain global competitive advantage and weaken democratic institutions via “manipulation” and theft of sensitive data.

Amid a surge in cyber attacks targeting Australian governments, critical infrastructure and private sector firms, former US National Security Agency director Mike Rogers has called on Western nations to work together in neutralising active threats.

Admiral Rogers, who also led the US Cyber Command and Central Security Service under presidents Donald Trump and Barack Obama, said establishing cyber deterrence frameworks would help nations manage fast-evolving threats.

“My attitude always was: can you explain to me how Russia, China, North Korea and the Iranians have come to the conclusion that cyber represents low-risk — that they can engage in aggressive activities in cyber and not trigger a significant response … or at least a response that they think outweighs the benefits?” Admiral Rogers told The Australian.

“How is it that we have got two diametrically opposed world models? We have got to change this dynamic, we have to reshape the risk calculus of these cyber actors whether it be nation states or criminal actors.”

Canada, a member of the Five Eyes intelligence alliance alongside Australia, the US, Britain and New Zealand, last week named state-sponsored hackers from China, Russia, Iran and North Korea as the country’s “greatest strategic threat”.

Admiral Rogers, the first appointment to the new CyberCX Global Cyber Security Advisory Board, said disinformation posed a serious threat to democracies including Australia and the US.

Mike Rogers receives an Honorary Officer of the Order of Australia (Military Division) from then governor-general Peter Cosgrove at Government House in Canberra in May last year.

CyberCX, the nation’s leading private-sector cyber security firm, with more than 600 people and 20 offices in Australia and New Zealand, plans to appoint additional representatives from across the Five Eyes nations to join Admiral Rogers.

The cyber security expert, who was NSA director between 2014 and 2018 and maintains links with Australian security chiefs, said integrated cyber and disinformation campaigns were designed to manipulate democratic freedoms, undermine and separate societies.

“The Russians didn’t create these challenges we’re dealing with internally (in the US). But they and other nations through disinformation are pouring gasoline on those issues with the design to weaken our institutions and to weaken us as a society,” he said.

Admiral Rogers said there had been public and legislative pressure in the US for the tech giants, with their size, wealth and technical capabilities, to “step up and assume a level of responsibility”.

Recounting conversations with Facebook five-years-ago, Admiral Rogers said the tech giant would say, “We provide a platform for the hosting of content generated by others. It is not our responsibility nor is it appropriate for us to censor broadly, to control that information”.

“My attitude always was: ‘I understand the theory, guys. But the challenge is you’ve got actors out there who are trying to take advantage of that — that are sowing, through obfuscating identity, through manipulating information, manipulating imagery, outright lies.

“They are sowing discord and they’re dividing us, and that is not in our nation’s, and the broader global community’s, best interests.”

Admiral Rogers said China’s cyber strategy was aimed at generating “global advantage”, focused on securing intellectual property for economic gain and compromising the capabilities of Western nations in the event of a crisis or conflict.

China’s goal is to “have the strongest economy in the world” and gain advantage in the digital economy of the 21st century, similar to the industrial rise of the US last century.

“They are copying a model they have seen work very successfully, and they view cyber as a tool to accelerate that, by stealing the intellectual property they think is going to generate advantage for them.”

He also raised the implications of a cyber actor manipulating the fifth decimal of every geographic location in a country’s database by just two digits.

“How long would it be before we recognise it? And think about what the operational implications would be if geographical locational information was being manipulated and we didn’t recognise it initially or it took some period of time. What would the implications of a total loss of confidence be?”

Admiral Rogers said cyber, for all world powers, remained an important espionage tool to help nation states “gain greater understanding and awareness of what’s going on in the world around us”.

The Morrison government is moving to legislate new powers aimed at beefing-up the cyber defences of critical infrastructure operators and help security agencies target online criminal syndicates, international sexual predators and cyber actors stealing research.

Further cyber security legislation is also being drawn-up as Australia attempts to keep pace with fast-evolving threats. The federal government, which recently released its $1.67bn Cyber Security Strategy, has also put in place foreign interference measures, which have angered Beijing.

In June, Scott Morrison declared the nation was under attack from “sophisticated” state-based cyber actors targeting critical infrastructure, businesses and all levels of government. While the government has not named Beijing, it is understood Chinese cyber actors have been linked to attacks targeting Australian interests.

Admiral Rogers said the rise in cyber and ransomware attacks “are going in the wrong direction”. He warned some nation states had begun outsourcing criminal activity to “cyber mercenaries” and private companies used to penetrate, manipulate, shutdown, degrade and surveil systems.

“It’s getting tougher and it’s broadening. If you look at ransomware, there is little correlation to size and little correlation to sector. You’re seeing ransomware explode across the spectrum of businesses as well as public sector governments.”

CyberCX Chief Strategy Officer Alastair MacGibbon, a former Australian Cyber Security Centre head and special adviser to prime minister Malcolm Turnbull, said legislation was coming down the line that would shake-up Australia’s approach to cyber security across key sectors and the way companies respond.

Mr MacGibbon said the increasing threat posed by ransomware went to the “heart of the integrity and availability” of data and systems.