Richard Clarke: “First Major Cyber War Between Two Powers”

CHRISTIANE AMANPOUR: Next, how will Putin respond to sanctions? Will it make him escalate or look for a diplomatic solution? Former counterterrorism official and novelist, Richard Clarke, served three presidents on the National Security Council. And he joins Walter Isaacson to discuss the alarming threat of cyber war.

(BEGIN VIDEO CLIP)

WALTER ISAACSON, HOST: Thank you, Christian. And Richard Clarke, welcome to the show.

RICHARD CLARKE, FORMER NATIONAL COORDINATOR FOR SECURITY AND COUNTER TERRORISM: Good to be with you, Walter.

WATSON: There are different levels of cyber-attack, which Biden has warned us about that could one along because of what’s happening in Ukraine. The first is Russians using cyber warfare against the Ukrainians. To what extent has that happened and what are we doing to help the Ukrainians?

CLARKE: There’s been a massive Russian cyber-attack for a month now going on against Ukraine, against their military communications systems and against their civilian infrastructure. The United States has been helping behind the scenes as have other European governments, and as have private sector companies, cybersecurity companies, helping Ukraine to restore services. But there is still an active war going on between Russia and Ukraine in cyber space.

ISAACSON: Give me an example what’s happening.

CLARKE: Russian cyber-attacks have knocked out most of the government’s services. So, you can’t, as citizen of Ukraine, go online and communicate with your government. Learn from your government. You can’t access news very easily. You can’t call 911. You can’t call a hospital. And on the military side, there’s been a degradation of communications, command and control in the Ukrainian military. Now, they’ve overcome a lot of that, because it’s been going on for over a month, but it’s the most significant Russian cyber-attack on the country we’ve ever seen.

ISAACSON: Now, a lot of these attacks are done through vigilantes or cutouts in both ways. Sometimes vigilantes like Anonymous, as it’s going after the Russians sort of on behalf of the Ukrainians, and there are volunteers probably in the United States trying to do denial of service attacks. I assume that’s happening on the Russian side, too? So, tell me about this sort of unofficial proxy war?

CLARKE: Well, the difference is that in Russia, the unofficial hackers are known very well by the government and do what the government wants them to do. It’s kind of a reserve army that the Russians have. In Europe, in the United States, we have no control over the hackers, white hat or gray hat even black hat hackers. And there’s a lot of activity, and we don’t get to see the full dimension of that in media reporting, but it’s happening. A lot of people in the United States and Europe are attacking Russian websites, primarily to get news to the Russian people. But there are also, as you say, denial service attacks that are preventing the Russians from getting to essential services. This is a dangerous thing because it’s not our government that’s doing it. The Russians may or may not know that, but the Russians may mirror image and think that the United States government, the Europeans, and their governments are trying to get the hackers do this.

ISAACSON: So, in other words, the hackers doing it on behalf of Ukrainians, sort of white hat American hackers doing this, could get on a slippery slope or a way that this just spins out of control, and should we stop them from doing it or is there some add strong having them do it?

CLARKE: I would ask them not to do it. It’s better if the government controls the level of attacks that we do on other countries. We don’t want to give the Russians an excuse or a reason for attacking our cyber space. So far, they haven’t done that, but they could. And we don’t want to make it easier for them to justify that. We don’t want to provoke it.

ISAACSON: You just said that they haven’t attacked our cyber space. We have not yet had an official Russian attack on cyber space in the United States. Biden has issued warnings that it’s going to happen. It’s going to happen. Tell me where you think it might happen and why is Biden issues these warnings?

CLARKE: Well, Biden says he has evolving intelligence that the Russians are planning to do that. Our intelligence agencies, particularly NSA, probably have a capability of watching the Russians set up for attacks, some of them at least. And therefore, might be able to block them. But not all of them. The attacks could come in two kinds. They could be targeted after specific infrastructures like, for example, what if they went after the colonial pipeline again, as they did — as Russian hackers did earlier. And instead of $5 a gallon, our gas was $10 a gallon. What if they went after the refineries? So, they could do these targeted attacks. They could also do indiscriminate attacks, like what’s called the software supply chain attack. They once went after — Russian military intelligence, once went after a company called Solar Winds, which supplied software to 14,000 companies. And in the software supplied, the Russians inserted malware that allow the Russians to get into those companies, as sort of back door, a very sophisticated back door. So, they could do that. In which case they wouldn’t know — probably, all the companies that would be hit, they wouldn’t know all of the effects that would happen.

ISAACSON: Do you think some of that malware is still in corporate service?

CLARKE: Absolutely.

ISAACSON: And how would a corporation figure out Russians have put malware in?

CLARKE: They probably couldn’t. We were very lucky in the case of SolarWinds that a company called FireEye (INAUDIBLE) discovered it almost by chance, because they were one of the people who got the software. And they noticed — one of their people noticed a slight anomaly. And it had been going on for months, and no one had noticed. And frankly, I do not believe SolarWinds was the only company that they did that too. So, I think they are probably already have backdoors into thousands of American companies.

ISAACSON: Do you think we have backdoors into their companies?

CLARKE: Oh, most certainly. Most certainly. And into their infrastructure. Things like their power grid and whatnot. But if we are attacked by them, let’s say, and they knock off the power grid in the Central Atlantic region, for example, I’m not sure if I lose power here in Virginia, it’s going to make me feel any better to know that people in (INAUDIBLE) don’t have power either. And there’s an asymmetry. We are much more dependent as an economy on our technical infrastructure, on the Cloud, on the Internet, than the Russian economy is.

ISAACSON: So, should it be our doctrine and is it or doctrine that if they attack our infrastructure, such as our electricity grids, using cyber, we can attack back, not just using cyber, but using kinetic real physical attacks?

CLARKE: Well, that is our doctrine. That’s been the Pentagon’s doctrine for over 10 years, that we will judge the nature of the attack by the effect, the magnitude of the effect, not the method. And therefore, we reserve the right as a government to respond to a major cyber-attack in any way. Now, that’s why it’s a slippery slope. We talked earlier about the slippery slope of vigilantes. There’s also this more significant one, which is people think cyber war is antiseptic, it’s clean, there are no body bags. But it could very quickly lead to a kinetic war if the damage get significant, and the damage can get significant. Just because we haven’t seen that happen, because there hasn’t yet been a major cyber war between two powers, that doesn’t mean it won’t happen. It doesn’t mean it won’t be very significant if it happens. So, cyber war is not a safe no body bag kind of approach. It’s, in fact, an escalation.

ISAACSON: We have rules. We have doctrines, and so do the Russians, that we have all known, that we’ve negotiated over 50 years, whether it will be conventional forces in Europe or tactical nuclear weapons. Do we have doctrines? And do we have rules of the road? Do we have Geneva Conventions about the use of cyber weapons? And if not, should we?

CLARKE: We don’t. Lawyers will tell you that the Geneva Convention applies to any weapon. And therefore, perhaps to cyber weapons. But no — the answer is, no. We have never worked out rules of cyber war, because we don’t want to the reveal what we could do and neither do the Russians or anybody else. If we get into a cyber war with them, this will be the first major cyber war between two powers. It is terror incognito. We don’t know what the rules are. We don’t know what would happen.

ISAACSON: Are those rules that are sort of vague covered by NATO and specifically, Article 5, which says any attack on a NATO country is an attack on all of us NATO countries? For example, if there were some cyber interferences in Poland, do you think this would trigger a NATO response and that would help escalate this war?

CLARKE: The NATO secretary-general, Mr. Stoltenberg, has addressed that issue and he said, yes. That cyber war is covered by the NATO mutual defense arrangement. The so-called Article 5. So, that if there were a major cyber-attack on Poland, NATO would consider that an attack on all NATO’s 30 nations.

ISAACSON: Do you think we should have methods to respond to a cyber-attack short of using real physical force that would be an effective response? In other words, the major cyber-attack on them that would be more than commensurate?

CLARKE: Biden has said publicly that we would respond in kind, at least initially. He didn’t say, at least initially. He said, we could respond in kind. And I have reason to believe that we have packages already designed. Somewhat like the list, the menu of nuclear options. We have a menu of cyber options that the president could choose from.

ISAACSON: Give me a couple examples of that so we know what you’re talking about.

CLARKE: You know, would you like to turn out the electric power grid? Would you like to turn that out in Moscow? Would you like to turn that out in Siberia? Would you like to blow up their pipelines? Would you like derail trains? Would you like to bring down their air traffic control system then make it impossible for them to fly? Would you like to bring down telephone system? Their stock market? There’s a whole series of things that we could do with cyber weapons and we probably have plans and capability to do that.

ISAACSON: What should we be worrying about for our election coming up? The Russians have already shown a propensity to meddle with our elections?

CLARKE: So, the Russian have this concept of hybrid warfare, which is warfare short of conventional attack. And two key elements of hybrid warfare are what we’ve been talking about, cyber war, and the other one is disinformation and creation of a so-called fifth column. People inside the country to whip up dissent. Frequently, those people don’t know that they’re being used by foreign powers. But I think it’s pretty clear that Russia has, through its disinformation arm, been feeding talking points, been feeding information to Americans that sometimes show up — in fact, frequently show up on some mainstream media. And that perhaps some of the people involved in the January 6th insurrection were unwilling dupes of disinformation. We can expect to see more of that kind of thing as the tensions between the United States and Russia get higher.

ISAACSON: Are you saying that some of the people we’ve seen on TV spouting, talking points, supporting Russia, or denigrating Ukraine are either unwilling or even willing dupes of Russia or been supplied misinformation by Russia?

CLARKE: Certainly, they’re at least unwilling or unknowing. Some of them might know. But you can track talking points that originate on Russian sites migrate to the extreme right-wing sites in the United States, and then, migrate from the extreme right-wing sites into certain congressmen and senators, and from there, onto certain television networks.

ISAACSON: Can you be a little more specific on that? And then, give me an example.

CLARKE: You can see stories, for example, that Russians have been trying to put out, a story that the United States was helping Ukraine develop biological weapons, which is pure nonsense. That begins on Russian sites. And it — we’ve now been able to monitor that moving into certain right- wing sites in the United States. And certain commentators have begun discussing, well, you know, was that — is there any truth to that? These ideas permeate and they flow from Moscow’s disinformation program, which is extensive and elaborate and very well established and old, into countries all around the world. They don’t just do this to us.

ISAACSON: There’s a big controversy now, especially in Israel, and in all the papers about Zelenskyy — President Zelenskyy of Ukraine, asking for Pegasus, which is a system that allows a country to hack into cell phones which the Israelis have, and Israelis saying, no, we’re not going to sell it to you. To what extent is that a real problem and what type of software like that should those of — those countries rooting for Ukraine be willing to sell to Ukraine?

CLARKE: Well, Israel has very surprisingly and very disappointingly pretended to be Switzerland in this conflict. Even the Swiss’s haven’t pretended to be Switzerland. But Israel has maintained neutrality and say they’re not selling arms and that they say they’re selling cyber weapons. Pegasus is a system that would allow Ukrainian’s intelligence to get into specific cell phones. And we know that the Russian commanders are using cell phones to communicate, because somebody, and I assume it’s Ukraine, has interfered with their regular communications, their encrypted communication system. I don’t think it will make a big difference that they don’t have Pegasus. They’re already apparently following the location of Russian generals by intercepting their cell phone signals.

ISAACSON: I know you were very close to — and certainly, we all miss Secretary Madeleine Albright. I remember seeing you all together at times. I was just wondering now, as we all mourn her passing, if you have any particular memory of her you’d like to share?

CLARKE: Oh, so many. I absolutely loved that woman. She had such grit, such determination, such courage. And she was such an American patriot, even though she was born and spent the first 10 years can of her life in what was then Czechoslovakia. I could go on all night. But one moment, sticks in my mind. We were sitting in her office at the U.N., when she was U.N. ambassador, and we were complaining about Secretary-General Boutros-Ghali, and how ineffective he was how — and frankly, anti-American he was. And somebody said — I think may have been Jamie Ruben who said, well, you know, he has to be re-elected this year for a second term. And Madeleine looked at me and I looked at her, and, you know, there was a twinkle in her eye. And she said, are you thinking what I’m thinking? And I said, it’s going to be hard to deliver to the president, it’s going to be hard to deliver to Washington, to — we may be the only one that opposes him. And she looked at me and said, but we have the veto.

ISAACSON: All right. Thank you so much, Richard Clarke, for joining us this evening.

CLARKE: Thank you, Walter.