BALTIMORE (AP) — The computer networks that control power plants and financial systems will never be secure enough and a new, highly secure alternative Internet should be considered for development, a top FBI official said Thursday.
Shawn Henry, the FBI's executive assistant director, said critical systems are under increasing threat from terror groups looking to buy or lease the computer skills and malware needed to launch a cyber attack.
In an Associated Press interview Thursday, Henry said jihadist militants looking to harm the U.S. can tap organized crime groups who are willing to sell their services and abilities to attack computer systems. He would not say which terror group or whether any insurgent networks have actually been able to acquire the high-tech capabilities.
But he said one way to protect critical utility and financial systems would be to set up a separate, highly secure Internet.
Henry sketched out the Internet idea to a crowd at a conference of the International Systems Security Association, saying that cyberthreats will always continue to evolve and outpace efforts to defend networks against them.
"We can't tech our way out of the cyberthreat," Henry said. "The challenge with the Internet is you don't know who's launching the attack." A key step, he said, would be to develop networks where anonymity is not an option and only known and trusted employees have access.
The vulnerabilities of critical systems such as power plants, the electric grid or Wall Street were a prime topic during the conference, reflecting growing concerns by U.S. officials.
Government security officials say cyber attackers are using the Internet to steal money, ferret out classified secrets and technology and disturb or destroy important infrastructure, from the electrical grid and telecommunications networks to nuclear power plants and transportation systems.
And while Henry described a system for the future, the head of the Pentagon's Cyber Command warned that the attacks against critical systems are increasingly carrying destructive viruses or malware.
Gen. Keith Alexander, who also is director of the National Security Agency, said the Pentagon and intelligence agencies must do more to protect their computer systems and coordinate with private companies to safeguard public networks.
And when a computer network is infected, someone should be able to disconnect it, he said.
"Is it the FBI? Is it the NSA? Is it the military or is it the ISPs — the Internet service providers? But somebody can turn that device off," Alexander said during a conference of the International Systems Security Association.
Alexander added that the Defense Department is finalizing policies that will determine what the military can do in the event of a cyber attack.
The Defense Department has set up a trial program to share cyberthreat data with some large military contractors in order to prevent intrusions. The Homeland Security Department is looking at that model to protect power plants, financial networks or other key systems.
Alexander said that effort may need government action but that Homeland Security must lead it, with reviews to ensure the protections of civil liberties and privacy.
He said it's no longer good enough to try to monitor all networks at the Pentagon or across the government and then block the intrusions as they are detected. Cybersecurity experts note that it can sometimes take months to detect that someone has gotten in.
Instead, Alexander said the Defense Department is planning a drastic reduction in the number of routes into the network, so they can be better monitored and intrusions can be blocked in real time.
He also said defense and intelligence agencies will move to cloud computing, which would use highly secure, encrypted banks of remote computers to store data — much like people store photos or email in popular online programs.
Doing that, said Alexander, will allow officials to better see and block any threats trying to get into government systems. He also noted that commanders used cloud computing in Iraq, which allowed the military in intelligence officials to more quickly share and disseminate information to troops on the front lines who needed it.
In related action Thursday, the DHS announced that a former executive at the North American Electric Reliability Corp., or NERC, has been named the new deputy undersecretary for cybersecurity.
Mark Weatherford was the vice president and chief security officer at NERC and before that was the chief information security officer for the state of California. He is a former naval cryptologic officer.
