A few weeks ago McAfee released its third annual Virtual Criminology Report, in which we consulted with leading security experts around the world to gauge their opinions on where cyber crime is today—and where it’s headed. The experts represent top institutions such as NATO, the FBI and the London School of Economics.

While the report covers several elements of cyber crime, by far what has generated the most discussion is that of state-sponsored cyber espionage. Most notably the assertion that some 120 countries are developing ways to spy on other countries or businesses and potentially use the Internet to attack targets such as financial markets, government computer systems, air traffic control and utilities, among others.

According to the report, attackers using systems in China are believed responsible for four out of five major cyber attacks on government targets in 2007. The report specifically claims that in 2007 the Chinese hacked the U.S., Indian and Australian governments and “probed” U.K. computer networks to uncover weak spots in the nation’s IT infrastructure.

Are these assertions true? Is state-sponsored cyber espionage real? Yes.

In response to the report, China has categorically denied any engagement in cyber spying. Curiously, however, its foreign ministry spokesman said Chinese networks too have been targeted “China has also been attacked by hackers of some countries, so the Chinese government attaches great importance to and participates in the international law enforcement cooperation in this area,” Liu Jianchao said. When asked which countries were targeting China, he declined comment.

Not everyone believes China’s denials. A few days after the report was released, the Times reported that the director-general of MI5, the U.K’s counter-intelligence and security agency, sent a confidential letter to 300 chief executives and security chiefs at banks, accounting firms and legal firms warning them that they were under attack from Chinese state organizations. The letter claimed the Chinese army is targeting British companies doing business in China in an effort to steal confidential commercial information. The Times also reported that one of Europe’s largest engineering companies and a large oil company had recently been compromised by Chinese attacks.

How vulnerable are national networks?
Shifting from the hackers to the hacked, the Virtual Criminology Report details how a well-orchestrated cyber attack can cripple an unprepared national infrastructure. The current poster nation for this is Estonia, which in April 2007 suffered a massive denial-of-service attack that shut down its government, education, banking and other networks for weeks. Who was responsible for the attack? Estonia blames Russia, which has denied all involvement.

Estonia is hardly the only nation susceptible to cyber attack. NATO has said that all 26 of its member countries have been targeted by some form of cyber attack, and that more than 10 of its own agencies are working to protect against further incidents.

In the United States, in fiscal 2007 alone there were 37,000 attempted breaches of government and private programs and 80,000 attacks on military networks. Two days before the Virtual Criminology Report was released, a senior advisor to the Pentagon confirmed that the U.S. government has efforts underway to prevent attacks on military, government and private computer networks. Using the Air Force’s recent move to create a new military command specifically to prepare for cyberwar (with a staff of 40,000) as an example, the advisor cited budget estimates of up to $35 billion over the next five years to guard against cyber attacks.

Claiming that U.S. military officials have publicly conceded that cyber attacks have succeeded in reducing military operational capability, the advisor reported that the Pentagon has reduced the number of gateways to its military network to 13, but the overall U.S. government still has more than 1,300 potentially vulnerable connections. The advisor said he was not speaking for the Pentagon.

Cross-border collaboration
The FBI's ongoing “Bot Roast” operation, launched earlier this year to combat botnet-related crimes, has uncovered more than a million infected computers around the world and $26 million in economic losses. More than eight arrests have been made so far, the most recent being that of a New Zealand teenager just a few weeks ago. While Bot Roast has yet to uncover definitive links to state-sponsored cybercrime, it shows how seriously the FBI is taking the threat in general. It also demonstrates how the FBI is working in conjunction with other governments and agencies to fight cybercrime on a global level, which will be a critical component in tackling state-sponsored attacks in the future.

What is next?
The experts cited in the Virtual Criminology Report agree, and they are clearly not alone in their opinion. The global verdict is in, and it is undisputable. State-sponsored cyber espionage and cyber attacks are real, and what we’ve seen so far is only the beginning. Attacks will become more sophisticated, and businesses and governments everywhere need to take more steps than ever before to protect themselves.

To date nearly 500 articles about the Virtual Criminology Report have appeared in newspapers and web sites around the globe. At McAfee we hope the publicity will raise awareness at all levels of business and government about the importance of addressing this critical issue. Cybercrime is no longer just a threat to industry, but increasingly to national security. With so much at stake, putting protective technology in place is absolutely essential.

I encourage you to download a copy of the report.