[23 May 2021] The first attempt —albeit failed— to use malware in order to extort a victim took place in 1989, with the appearance of the so-called “AIDS Trojan”. In the second half of the 1990s, many hackers continued to experiment with these methods of illicit money-making, and by the end of the first decade of the 2000s, the term “ransomware” was being used in the hacker lexicon.
But these were the good old days. Now there are hacker syndicates that use sophisticated ransomware methods to extort their victims —usually corporations or state-owned enterprises— of millions of dollars. The largest ransom payment ever facilitated for the return of kidnapped data is $10 million. The average target or corporate ransomware attacks pays in excess of $300,000. This is big business.
Colonial Pipeline, the energy distribution company that was attacked earlier this month by a Russian-based hacker syndicate, forked over nearly $4.5 million. By the time it did so, panic among consumers had cause significant gas shortages in the eastern coast of the United States, while petroleum supplies came to a halt for several days.
In an article published last week, Michael Daniel, president and CEO of Cyber Threat Alliance, put it plainly: Ransomware attacks have “moved from being an economic nuisance” and are now “not putting just an economic burden on society, but imposing a real public health and safety threat, and essentially a national security threat”. Earlier this month it was gas supplies. Next time it could be air travel, electric power, water supply, telecommunications networks, or an endless list of essential infrastructure.
What does this mean for intelligence studies? Intelligence studies scholars have traditionally excluded organized crime from the realm of national security. The argument goes, organized crime, which is money-oriented and has no political impetus, does not pose large-scale threats to the security of the state (by the way, Mexico might disagree with that). But in the post-Colonial Pipeline security environment, we can no longer afford to place organized crime in a lesser place in the overall hierarchy of national security threats. Our syllabi should begin to reflect that without delay. [EIA]