Is the NSA's 'Perfect Citizen' the Ultimate Spying Tool?

Could the NSA's new "Perfect Citizen" actually be used for spying on every citizen in the U.S.?

The name sounds like an action movie -- the heroic vigilante chases down the bad guys to aid his country and prevent a nuclear armageddon. It also sounds like the worst possible name for a government program intended to protect citizens, not spy on them.

The NSA's new cyber-security program Perfect Citizen will monitor nuclear power plants, train stations, and the electric power grid to safeguard against cyber-assaults.

And as the Wall Street Journal reported, the new program is intended to monitor cyber-terrorist threats and "would rely on a set of sensors deployed in computer networks for critical infrastructure that would be triggered by unusual activity suggesting an impending cyber attack."...

[Full Article]

Hacking the Electric Grid? You and What Army?

Grid-hacking is back in the news, with the unveiling of “Perfect Citizen,” the National Security Agency’s creepily named effort to protect the networks of electrical companies and nuclear power plants.

People have claimed in the past to be able to turn off the internet, there are reports of foreign penetrations into government systems, “proof” of foreign interest in attacking U.S. critical infrastructure based on studies, and concerns about adversary capabilities based on allegations of successful critical infrastructure attacks. Which begs the question: If it’s so easy to turn off the lights using your laptop, how come it doesn’t happen more often?

The fact of the matter is that it isn’t easy to do any of these things. Your average power grid or drinking-water system isn’t analogous to a PC or even to a corporate network. The complexity of such systems, and the use of proprietary operating systems and applications that are not readily available for study by your average hacker, make the development of exploits for any uncovered vulnerabilities much more difficult than using Metasploit.

To start, these systems are rarely connected directly to the public internet. And that makes gaining access to grid-controlling networks a challenge for all but the most dedicated, motivated and skilled — nation-states, in other words.

Let’s pretend for a moment that hackers were planning to attack the United States. What would they need to do to gather enough information necessary to take out the electrical power in key parts of the country? They don’t want to fiddle at the edges, mind you. They want to have enough data to build the technical capability necessary to shut out the lights in Washington or New York or California at precisely the time and for exactly the duration they want.

For starters, they would need to know things like: Where are the power plants? What kind of plants are they? What sort of fuel do they use? Who built them and when? What sort of materials and technology were used when they were built? Who manufactured the generators, turbines and other key equipment? Whose SCADA software are they running? Who runs the plants? How does fuel, people, supplies get into or out of the plant? What sort of security do they have? And perhaps most importantly: Which plants supply power to which parts of the country?

Where to begin? Even in places like the United States, where there isn’t much you cannot find online, you’re not going to be able to get the depth and detail you need to turn off the lights with a simple network connection. You’re going to have to deploy national-level resources:...

[Full Article]

NSA Denies It Will Spy on Utilities

The NSA is denying a report from the Wall Street Journal that a secret program code-named “Perfect Citizen” will be monitoring civilian networks.

That’s from a rare public statement by the ultra-secret agency responsible for spying on outsiders and defending classified networks. The NSA, as a wing of the military, is largely prohibited from operating within the U.S.

The Journal reported Wednesday that defense contractor Raytheon won a $100 million contract that would involve sensors in the networks of “critical infrastructure” such as utilities and nuclear power plants. The sensors would report anomalies to the NSA via a partnership with Homeland Security, the Journal reported. According to an e-mail cited in the report, a Raytheon employee described it as a “Big Brother” system.

Our take on the original report is here...

[Full Article]

U.S. Plans Cyber Shield for Utilities, Companies

The federal government is launching an expansive program dubbed "Perfect Citizen" to detect cyber assaults on private companies and government agencies running such critical infrastructure as the electricity grid and nuclear-power plants, according to people familiar with the program.

The surveillance by the National Security Agency, the government's chief eavesdropping agency, would rely on a set of sensors deployed in computer networks for critical infrastructure that would be triggered by unusual activity suggesting an impending cyber attack, though it wouldn't persistently monitor the whole system, these people said.

Defense contractor Raytheon Corp. recently won a classified contract for the initial phase of the surveillance effort valued at up to $100 million, said a person familiar with the project.

An NSA spokeswoman said the agency had no information to provide on the program. A Raytheon spokesman declined to comment.

Some industry and government officials familiar with the program see Perfect Citizen as an intrusion by the NSA into domestic affairs, while others say it is an important program to combat an emerging security threat that only the NSA is equipped to provide...

[Full Article]