Major U.S. banks have turned to the National Security Agency for help protecting their computer systems after a barrage of assaults that have disrupted their Web sites, according to industry officials.
The attacks on the sites, which started about a year ago but intensified in September, have grown increasingly sophisticated, officials said. The NSA has been asked to provide technical assistance to help banks further assess their systems and to better understand the attackersâ€™ tactics.
The cooperation between the NSA and banks, industry officials say, underscores the governmentâ€™s fears about the unprecedented assault against the financial sector and is part of a broader effort by the government to work with U.S. firms on cybersecurity. Nonetheless, the assistance is likely to dismay privacy advocates, who say that the worldâ€™s largest electronic spying agency has no business peering inside private companiesâ€™ systems, even if for the strict purpose of improving computer security.
U.S. intelligence officials said last year they believe the attacks against the banks and other companies have been carried out by Iran, although some experts have cautioned that it is difficult to accurately determine who is behind them.
â€œIf you look at their actions, theyâ€™re taking this very seriously. The government is stepping up to the plate,â€ said one bank official, who like most interviewed for this article declined to be named because he was not authorized to speak for the record.
The NSA declined to comment for this article beyond a statement saying that the agency provides assistance â€œin full compliance with all applicable laws and regulations.â€
The cyber assaults against the banks are known as distributed denial-of-service, or DDoS, attacks, in which Web servers are overwhelmed with traffic, thus slowing their responsiveness or crashing them altogether. The disruptions â€” which typically last up to an hour or two at most â€” do not involve the theft of data, but they have interrupted online banking services and diverted security teams at a large number of financial institutions.
The banks whose Web sites have been disrupted include Bank of America, PNC Bank, Wells Fargo, Citigroup, HSBC and SunTrust. In recent weeks, attackers have targeted up to seven banks a day, but only on Tuesdays, Wednesdays and Thursdays.
For security experts at banks â€” already considered to be among the best at cybersecurity in the private sector â€” the attacks have been far more challenging than most DDoS incidents because the assailants have commandeered vastly more traffic to carry out the attacks.
The governmentâ€™s willingness to engage â€œis emblematic of how these cyber-related risks are evolving,â€ the bank official said. â€œAgencies like the NSA have tremendous expertise for very sophisticated types of information-security programs.â€
Although the NSA is known mostly for its collection of intelligence, its mission includes â€œinformation assuranceâ€ to secure both the militaryâ€™s computer networks and other â€œnational security systems.â€ The NSA for more than 20 years has helped companies that provide software to the Defense Department improve their security.
In general, it can provide assistance to private sector companies when their systems are seen as critical to national security, said Richard George, a former computer security official at the NSA. The request must come from a government agency, such as Treasury or the Department of Homeland Security, that has authority to work with the company.
â€œWe can certainly help them analyze the situation,â€ said George, who is now at Johns Hopkins Universityâ€™s Applied Physics Laboratory. â€œOne thing we can do is â€˜red teamâ€™ their solution. If their tech guys say, â€˜This is what we plan to do,â€™ we can look at that and say, â€˜Is it effective?â€™ â€
Google obtained NSA help in 2010 after the tech giant found its computer networks compromised by hackers believed to be based in China. The request, made through DHS, was justified on the grounds that Googleâ€™s search engine is widely used on Defense Department computers, a former defense official said.
George said the agencyâ€™s assistance usually entails a small team â€” say, six people â€” inspecting a companyâ€™s system to help the firm understand how an intrusion happened, what if anything was stolen, and whether similar events have happened at other firms.
The team can advise a company on how to repair its system and strengthen and test its defenses to prevent repeat occurrences. Some company data may be shared to help derive a â€œsignatureâ€ of the attack, former officials said.
The access to information is among the issues that concern critics.
â€œThe dual mission of the NSA, to promote security and to pursue surveillance, creates an intractable privacy problem,â€ said Marc Rotenberg, executive director of the Electronic Privacy Information Center.
Former NSA officials say privacy concerns are overblown and note that requests for NSA assistance are denied when there is no national security interest at stake. George said that, over the past decade, the agency has aided about 10 companies a year after their networks were compromised.
â€œIf NSA is involved [with the banks], itâ€™s because they would love to see whatâ€™s happening on the victimâ€™s side,â€ a second former defense official said. â€œThereâ€™s probably more for the government to learn than to give.â€
A silver lining
For the government, the recent DDoS incidents, while disturbing, have had a silver lining: They have given impetus to further collaboration with the private sector.
The Obama administration has sought to improve such cooperation, in the hopes of improving the nationâ€™s cybersecurity. Last fall, the White House was calling Internet providers and asking them, â€œWhat are you seeing?â€ one Internet company official said. â€œGradually, that evolved to â€˜How can we help?â€™ â€
The NSA is far from the only agency working to improve cybersecurity in the private sector.
The FBI has a joint cyber task force in Northern Virginia and a 24/7 hotline for industry to call for help, and the Treasury Department has a cyber unit closely monitoring threats. The Homeland Security Department, which runs a round-the-clock cybersecurity watch center in Arlington, is sharing alerts with industry and has banking and Internet company representatives on the premises. The Justice Department has set up a nationwide network of national security cyber specialists, which officials said would do more outreach to industry and serve as a forum to exchange information.
The FBI is concerned about recent cyber events, said Richard McFeely, the bureauâ€™s executive assistant director of the Criminal, Cyber, Response and Services Branch. â€œWe need to make sure that weâ€™re responsive around the clock on it.â€
In the case of banks, the government has begun providing officials with advance warning of a DDoS attack sometimes five or 10 minutes ahead of time.
The ability to share information between the FBI and the banks has been eased by the granting of more than 250 classified-level security clearances to bank officials in the past five years, industry officials said.
â€œWhat weâ€™ve seen is a much more refined ability to receive information from the NSA and other agencies,â€ the bank official said.- The Washington Post