Columns

VALLEY OF THE SPIES

Foreign agents have been stealing tech secrets since the 70s. But in the wake of Facebook's recent crisis, the biggest companies in the world are facing the challenge at unprecedented levels

Summer 2018 Nick Bilton
Columns
VALLEY OF THE SPIES

Foreign agents have been stealing tech secrets since the 70s. But in the wake of Facebook's recent crisis, the biggest companies in the world are facing the challenge at unprecedented levels

Summer 2018 Nick Bilton

On the day that they entered the headquarters of a renowned technology company, members of the security unit were nondescript—quiet as a mouse. It had to be that way, naturally. For months prior, the tech behemoth's upper management had suspected that something nefarious was going on inside their organization: files were disappearing; millions of dollars' worth of intellectual property was being copied, they believed—personal and private information, too. Worse, the executives in the corporate suite were mystified about the culprit. But they recognized the veracity of an adage in the tech industry: There are two kinds of companies—the ones that have been hacked, and the ones that haven't been hacked yet.

As the tech company's staff went about their usual quotidian tasks, working at their computers and carrying on with their familiar assignments, the security sleuths surreptitiously flipped open their laptops, connected to the network, and subtly began thenforensic investigation. The team ran software to search for viruses and malware, but found nothing. They checked the servers for illicit software, but again came up with an absence of leads. Eventually, the operatives set up network-monitoring tools to detect where traffic might be leaving the building. Soon enough, their screens were filled with charts and numbers— reds, yellows, greens—that zigzagged up and down like a digital seismograph. One of those spikes indicated that a massive amount of data was flowing out of a single computer elsewhere in the company's offices.

But this evidence suggested another challenge. The company had always had a B.Y.O.D., or "bring your own device," policy. Anyone who worked in the office could come in, connect his or her individual device to the network, and commence the workday independent of company machinery. The computer that was tunneling information, therefore, didn't register on the roster of machines controlled and owned by the I.T. department. This left the security team with one definitively old-school option: to literally follow the wire that ran from the server to the rogue computer. One by one, they plucked up the floor tiles in the server room, followed the Cat 5 cable as it swam helix-like alongside hundreds of other cables, inside the walls, past yellow and white power wires, and through the labyrinthine office, until they found themselves at the end of the cord, inside a small closet. There, seated behind a laptop, was a young Chinese woman.

THEY FOLLOWED THE CORD INSIDE WALLS, ALL THE WAY TO A CLOSET-AND TO A WOMAN BEHIND A LAPTOP.

The security specialists searched her personal computer and immediately discovered more than 30 pieces of malware that were drawing information out of the servers and sending it to dozens of computers in China. The woman wasn't an employee of the tech company. Instead, she had been hired as a student intern after e-mailing the company out of the blue, asking if she could assist in the office.

For the tech company, the problems didn't end there. Silicon Valley may imagine itself as a larger-than-life cauldron of drama, but large companies don't operate as if in John le Carre thrillers. And even if this one was convinced that this intern had bilked it for critical secrets, it couldn't prove that she was a spy or had committed espionage, or even whether she had been targeted herself. (For what it's worth, a security expert on the team told me they suspected the former.) Furthermore, the company didn't want to alert authorities, perhaps fearful that the press would find out and the company's valuation would be negatively affected. Instead, it quietly parted ways with the intern and changed its tech policies.

Spies and corporate espionage are a fixture of Silicon Valley. Employees at companies from Twitter to SpaceX have privately told me they suspect that spooks work within their walls, stealing corporate secrets, plans for new technologies, or entire servers full of code to replicate back home. Some have suspected that these alleged agents were trying

to figure out how their company's network operated. The C.E.O. of one of the biggest tech companies in Silicon Valley once confided to me not only that there was "no question" Russian and Chinese agents worked at the company, but also that it was impossible to know who they were or to prove they were indeed foreign agents.

The people who run these tech companies protect their I.P., or trade secrets, with astounding security. After the recent shooting at YouTube's headquarters in San Bruno, California, a former Google executive told me that the reason the shooter wasn't able to get inside the building was that security measures had been put in place—not to protect people but, rather, to protect the data. Evident at Mark Zuckerberg's recent congressional hearings was the reality that companies such as Facebook and Google likely have more data on citizens around the globe than any national-security agency, including possibly the N.S.A.

Now, in the wake of the cyber-hacking that beset Brexit and the 2016 U.S. presidential election, some in Silicon Valley are wondering if protecting their servers from outside intruders could have driven spies to get in the old-fashioned way: by working inside big tech companies for more nefarious purposes than stock options. Why would the Chinese or Russian governments finance billions of dollars in R&D when they could just persuade an operative to plug a computer into an unprotected network and siphon sensitive data out for the cost of an airline flight? What better way to understand how to get around the defenses put in place by Facebook, Twitter, or YouTube than to have a mole inside the company, snooping through the code, attending meetings, or even designing the very systems to be taken advantage of?

The attempt to usurp confidential information from the furnace of American economic innovation is a story as old as Silicon Valley itself. In the 70s and 80s, spies from other countries were constantly trying to steal (often successfully) the plans for computer chips and infrastructure systems. In the 90s, it was mostly aerospace technology. In the late 80s, the C.I.A. issued a report detailing how Soviet and Chinese intelligence agents were regularly trying to recruit Valley engineers to turn over files about microelectronics or software that was being used by the military. John Markoff, the veteran New York Times technology reporter, didn't mince words about what's been going on in the tech sector for decades. "This has all been part and parcel of Silicon Valley since I've been covering it in the 1970s," he said.

The 1980s were a particularly intense time for spying in the tech industry. Back then, it was called "cloak and data" espionage, and it was rampant. Reports by the C.I.A. at the time estimated that there were more than a thousand spies and engineers who had been turned, working with or for countries such as China, Taiwan, Israel, Poland, North Korea, and, most of all, Russia. One of the biggest and most shocking cases involved James Durward Harper Jr., who was eventually given a life sentence for conspiring to sell secrets for missile technology to Polish intelligence. The book Espionage in the Silicon Valley', published in 1984, tells the story of chip designs stolen by agents from Moscow to Tokyo, and of old-school Soviet-bloc espionage.

But as the Cold War cooled off, and 9/11 turned the nation's attention toward a new and unprecedented sort of globally matrixed foe, spying appeared to be a thing of the past. Military technology moved from missiles to encompass RTs, MTs, Likes, #FFs, GIFS, and B3s. And while it made perfect sense to try to get spies into a missile-defense company, it didn't seem plausible that any foreign government would care what people were blabbing about on Twitter. In the wake of the 2016 election, however, it turns out that was wrong: social-media companies might be more powerful than the missile-makers. Meanwhile, the connections between our government and our largest companies have only ossified. Now, as the Department of Defense works with companies like Google and Amazon on cloud-computing technologies, or hires tech giants to help design artificial-intelligence tools with military applications, it would be perfectly logical that contemporary spies would want access to these files, too. Vladimir Putin has been alarmingly transparent about what's at stake in the arms race for artificial intelligence, and China's president, Xi Jinping, is also pouring billions into A.I. development, fully aware that whoever rules the computers will run the world. North Korea has been pursuing A. I. for decades through its state-run tech-research agencies. The only way to get ahead in this competition, given that the cutting edge of this work is taking place in Silicon Valley, is to snatch what's already been done, or what is about to be built.

During Silicon Valley's nascent days, around the time of Sputnik and ham radios, there were essentially two ways to get information on a company. The first was to slip a spy into America, which was not, and likely still isn't, an easy task. The second involved turning someone who already lived and worked here. One former federal agent recently delineated, in general terms, how foreign agents infiltrate companies today. The Chinese, the former agent said, prey upon the nationalism of expats who might view stealing data as a form of devout intellectual patriotism. With Russian spies, the agent told me, it's much more sinister: "Sometimes, Russians can try and turn someone to make them work for them, but when that doesn't work, they switch to physical threats, even offering ultimatums to family members still living back in Russia." And the web of loyalty gets even more tangled from there. As Markoff noted, it isn't just foreign agents who likely work inside tech companies. "There are, without a doubt, people who are technical employees in Silicon Valley but who also report to the C.I.A. and F.B.I.," he said.

C.I.A., N.S.A., F.B.I., and Department of Homeland Security investigations could all benefit from knowing the inner workings of companies such as Twitter, Apple, Google, Facebook, Microsoft, and Amazon. In the late 90s, the C.I.A. funded its own venture firm in Menlo Park called In-Q-Tel, with the hope that investing in tech companies could help the agency gain access to cutting-edge technologies that might be useful for national intelligence. (The "Q" was a reference to the "Q Branch," which was a Active research- and-development division of the British Secret Intelligence Service in Ian Fleming's James Bond novels.) But after the dot-com bust and 9/11, the venture firm changed course—at least as far as we know. These days, company agendas and politics have made collaboration fraught. After information was released in the Edward Snowden reports, Apple refused to help the F.B.I. break into the iPhone's encryption software. The N.S.A. has been unable to gain access to private information about the browsing or social-media habits of certain Americans and foreign nationals. What better way to solve this problem than by having an agent simply walk in through the front door and take the data?

It's beyond obvious, as the fog of the 2016 election clears, that Russia used tools built in Silicon Valley against the country that built them. Were spies working within those social networks? Are they still? All we know is that it's probably going to get worse. In the future, spies from Russia, China, North Korea, and elsewhere may show up at companies like Facebook and Apple, Amazon and Microsoft, and pose as engineers; similarly, engineers currently working at these companies may be turned by foreign agents. They'll presumably pursue artificial intelligence with the capability to shut down power grids, destroy entire computer systems, sway the financial markets, and gather vast amounts of information on American citizens. Or maybe—as has been proven so effective already—to create fake news and fake videos that can be used to tear our country in two. As I've noted before, we're only in the first inning of the disinformation wars.

Imagine the day when our adversaries learn how to perfectly imitate a New York Times article or CNN broadcast for their own purposes. Owing to the Trump administration's lax attitude toward pursuing new thresholds in artificial intelligence, several people noted to me recently, Chinese delegations that used to visit Silicon Valley on a regular basis are now staying home. One expert on U.S.China relations told me that President Xi understands the future of A.I. and its role in both defense and economic growth, and is investing billions in resources to pursue that future. In contrast, Trump is more concerned with coal.

The world we will inhabit in five years will be remarkably different from the one we live in now. Artificial intelligence, and the technologies it spawns, will lead to quantum computing—with computers so powerful that they will jet us into a new era of humanity, connectivity, and intelligence. Computers that will operate millions of times faster than current machines and, in turn, easily decrypt even the most advanced cryptography we use today. Computers that will work so quickly that the disruption in any industry could happen not over decades, years, or months but, rather, in an instant. And while it may be Silicon Valley that creates these technologies, it might be an adversary who ends up using them.