| start date | end date | year | title | description | icon | importance | link |
|---|---|---|---|---|---|---|---|
| 1994-03 | month, year | 16 year old British student charged with cyber attacks after breaching the Air Force’s Rome Lab | An intrusion was detected in the Air Force’s Rome Lab that left behind traces of an online “handle.” The young hacker by the handle name “Data Cowboy” was tracked down with the help of Scottland Yard and observed from Rome Lab, hacking into over 150 companies and government sites, defrauding phone companies and even accessing data from the South Korean Atomic Research Institution. What was known in the ’70’s and ’80’s as “phreaking,” a way to make long distances calls by simulating dial tones, had now become the first way to use dial-up internet connections to mask cyber attacks. | square_2.png | 25 | http://www.fas.org/irp/crs/RL30735.pdf | |
| 1996-07 | month, year | President’s Commission on Critical Infrastructure Protection (PCCIP) identified cyber threats at critical | A commission is established that reports to the President the nature and scope of vulnerabilities and threats to the nation’s critical infrastructures. The focus was primarily on cyber threats. The commission is tasked to recommend a comprehensive national policy and implementations strategies. | square_1.png | 25 | http://www.fas.org/irp/offdocs/eo13010.htm | |
| 1997-06 | month, year | Simulated cyber attack named “Eligible Receiver” shows vulnerability in DOD computer networks | The cyberwar game is the first of its kind. It simulated a North Korean attacker targeting the Pacific Command Systems. The U.S. system did poorly in the exercise. | square_2.png | 25 | http://www.globalsecurity.org/military/ops/eligible-receiver.htm | |
| 1997-10 | month, year | PCCIP report released, highlighting government role in monitoring and disseminating latest-threat information to cyber companies | The report becomes known as the “Marsh Report” after commission chairman Robert Marsh, a former Air Force General. The report cites no immediate threat to infrastructure but a need for cybersecurity action due to rapid growth of computer-literate population, inherent vulnerabilities of common protocols in computer networks, easy availability of hacker “tools and same technology being used by general population as hackers. The commission recommended greater cooperation between private and government sectors and highlighted the governments role collecting and disseminating latest threat information to private companies (intrusion techniques, threat analysis, and ways to defend against hackers). | square_1.png | 25 | http://www.fas.org/sgp/library/pccip.pdf | |
| 1998-02 | month, year | Department of Defense (DOD) network attacked, dubbed “Solar Sunrise” | A series of attacks on DOD unclassified networks named Solar Sunrise. The attackers used an exploit in the system to install collection software and went back into the system later to retrieve the information. This attack confirmed the results of “Eligible Receiver. | square_2.png | 25 | http://www.defense.gov/speeches/speech.aspx?speechid=704 | |
| 1998-02 | month, year | National Infrastructure Protection Center (NIPC) is created | The Marsh Report, the Eligible Receiver exercise, and the Solar Sunrise investigation lead the Attorney General Janet Reno and FBI Director Louis Freeh to create the NIPC on February 26, 1998. The NPIC was tasked with protecting the all nationally critical infrastructure network systems for the government and private sector. The NPIC was a multi-agency effort ran and housed out of the FBI. The NPIC was divided into three sections- Computer Investigations and Operations; Training, Administration, and Outreach; and Analysis and Warning. Private industry were encouraged to join private-government partnerships on a voluntary basis to better coordinate protection schemes and disseminate threat information. | square_1.png | 25 | http://ecommerce.hostip.info/pages/770/National-Infrastructure-Protection-Center-NIPC.html | |
| 1998-05 | month, year | Presidential Decision Directive (PPD) No. 63. to implement National Infrastructure Assurance Plan | Groups are setup within the federal government to develop and implement plans to protect government-operated infrastructures. It also calls for a dialogue between government and the private sector to develop a National Infrastructure Assurance Plan to protect the nation’s critical infrastructures by 2003. Each federal agency was made responsible for securing its own critical infrastructure. The National Plan Coordination Staff were organized into the Critical Infrastructure Assurance Office (CIAO) and tasked to develop the plan while the Information Sharing and Analysis Center (ISAC) was setup, modeled after FBI’s National Infrastructure Protection Center, for current threat information sharing. The major focus is on cyber threats and the critical infrastructure sectors were determined to include: Information and Communications, Banking and Finance, Water, Transportation, Emergency Law Enforcement, Emergency Fire Service, Emergency Medicine, Electric Power, Gas, and Oil, Law Enforcement and Internal Security, Intelligence, Foreign Affairs, National Defense. | square_1.png | 25 | http://www.cybercrime.gov/white_pr.htm | |
| 1999-07 | month, year | National Infrastructure Assurance Council, or NIAC, established under Clinton Exec. Order 13130 (order is rescinded by Bush before council can convene) | The Council is tasked with enhancing the partnership between public and private sectors, develop ways to encourage private industry to conduct risk assessments of critical processes, monitor the development of Private Sector Information Sharing and Analysis Centers (PSISACs) and provide recommendations to the National Coordinator and the National Economic Council on how these organizations can best foster improved cooperation among the PSISACs, the National Infrastructure Protection Center (NIPC), and other federal government agencies. | square_1.png | 25 | http://nodis3.gsfc.nasa.gov/displayEO.cfm?id=EO_13130_ | |
| 1999-12 | month, year | Clinton released Version 1.0 of a National Plan for Information Systems Protection | The plan is solely focused on cybersecurity and touts a plan for “A Real Public-Private Partnership…Not Dictated Solutions” and holds educated personnel as the key to success. It lays out 10 programs to achieve the goals laid out in PPD 63 and notes that the government systems should be the model. | square_1.png | 25 | http://clinton4.nara.gov/media/pdf/npisp-execsummary-000105.pdf | |
| 1999-12 | month, year | Private sector actors voluntarily convene Partnership for Critical Infrastructure Security | The goal is to share information and strategies and to identify interdependencies across sectorial lines. It was a private sector initiative, with the CIAO providing administrative support for meetings. Sector liaisons from lead federal agencies were considered ex officio members. | square_1.png | 25 | http://www.energetics.com/resourcecenter/products/communication/samples/Documents/ci-security-factsheet.pdf | |
| 2001-10 | month, year | Bush signs the Patriot Act, which includes definition of critical infrastructure | In the Patriot Act, section 1016 “Critical Infrastructures Protection Act of 2001,” defines “critical infrastructure” as “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters. | square_1.png | 25 | http://epic.org/privacy/terrorism/hr3162.pdf | |
| 2001-10 | month, year | Bush establishes Office of Homeland Security and the Homeland Security Council by Executive Order | Section (3ei) & (3fi) gives the Office the task of “protecting critical infrastructure from the consequences of terrorist attacks” and “coordinate efforts to respond to and promote recovery from terrorist threats or attacks within the United States” to include telecommunication. | square_1.png | 25 | http://www.fas.org/irp/offdocs/eo/eo-13228.htm | |
| 2001-10 | month, year | Bush Re-Creates NIAC with Executive Order 13231- Critical Infrastructure Protection in the Information Age | National Infrastructure Advisory Council (NIAC) is enacted by with the same goals and acronyms the council that was rescinded as President Bush took office. This allowed Bush to appoint twenty-four different advisors. The order is issued “to ensure protection of information systems for critical infrastructure, including emergency preparedness communications, and the physical assets that support such systems, in the information age.” | square_1.png | 25 | http://www.ncs.gov/library/policy_docs/eo_13231.pdf | |
| 2002-07 | month, year | First National Strategy for Homeland Security released | Expands upon the listing of sectors considered to possess critical infrastructure to include public health, the chemical industry and hazardous materials, postal and shipping, the defense industrial base, and agriculture and food. While the main focus is on physical terrorist attack security, “Securing Cyberspace” is one of eight major initiatives identified and is listed under potential terrorist threats. The report also sites the upcoming National Strategy to Secure Cyberspace as what will “describe our initiatives to secure our information systems against deliberate, malicious disruption.” | square_1.png | 25 | http://www.dhs.gov/xlibrary/assets/nat_strat_hls.pdf | |
| 2002-09 | month, year | Bush announces appointments to NIAC | Members selected for NIAC represent major sectors of the economy – banking and finance, transportation, energy, information technology, and manufacturing. The Council also includes representatives from academia, state and local government, and law enforcement. The Council works closely with the President’s National Security and Telecommunications Advisory Committee (NSTAC). Members make recommendations regarding the security of the cyber and information systems relating to national security and economic critical infrastructures. The Committee examines partnerships to enhanced and improve cyber security between the public and private sectors. | square_1.png | 25 | http://georgewbush-whitehouse.archives.gov/news/releases/2002/09/20020918-12.html | |
| 2002-11 | month, year | Congress passes Homeland Security Act establishing a Department of Homeland Security (DHS) | The act consolidated within one department a number of agencies that had, as part of their missions, homeland security-like functions (e.g., Border Patrol, Customs, Transportation Security Administration). The act kept the language of DHS being responsible for “critical infrastructures” to include telecommunications. This left the responsibility overlapping with previous attempts to police cyber crime by the FBI and NSA. | square_1.png | 25 | http://www.dhs.gov/xlibrary/assets/hr_5005_enr.pdf | |
| 2003-02 | month, year | The National Strategy to Secure Cyberspace released | The strategy is an extension of the National Plan for Information Systems Protection created under the Clinton Administration in 1999, now referred to as Version 2.0. This strategy addressed all interested parties in the nation’s information infrastructure, from home users to the international community, and included input from the private sector, the academic community, and state and local governments. It was criticized for lacking regulations which rendered it “toothless.” | square_1.png | 25 | http://news.cnet.com/2100-1001-984697.html | |
| 2003-12 | month, year | Bush’s Presidential Directive 7 creates the Critical Infrastructure Protection Policy Coordinating Committee | The Directive further defines the relationship between the DHS and other agencies. DHS maintains a cyber security unit and the Director of the Office of Management remains responsible for overseeing government-wide information security programs and operating the federal cyber incident response center within DHS. The Critical Infrastructure Protection Policy Coordinating Committee to advise the Homeland Security Council on interagency policy related to physical and cyber infrastructure security was created. | square_1.png | 25 | http://www.dhs.gov/xabout/laws/gc_1214597989952.shtm | |
| 2005-02 | month, year | Interim National Infrastructure Protection Plan released | A general document that aims to ” provide the framework and sets the direction for implementing this coordinated, national effort.” The plan listed “cyber infrastructures” as high priority as well as coordinating with private industry, across agencies and foreign governments. | square_1.png | 25 | http://net.educause.edu/ir/library/pdf/csd3754.pdf | |
| 2006-03 | month, year | DHS creates Critical Infrastructure Partnership Advisory Council (CIPAC) with private industry | CIPAC is created to support the implementation of the National Infrastructure Protection Plan (NIPP). DHS acts as the Executive Secretariat of meetings. Members include federal, state, local, and tribal government entities that belong to their respective government coordinating councils. Private industries are covered under an array of committees that include ;Chemical Sector Committee Membership; Commercial Facilities Sector Committee Membership; Communications Sector Committee Membership; Critical Manufacturing Sector Committee Membership; Dams Sector Committee Membership; Defense Industrial Base Sector Committee Membership; Emergency Services Sector Committee Membership; Energy Sector Committee Membership; Financial Services Sector Committee Membership; Food and Agriculture Sector Committee Membership; Government Facilities Sector Committee Membership ;Healthcare and Public Health Sector Committee Membership; Information Technology Sector Committee Membership; National Monuments and Icons; Nuclear Sector Committee Membership; Postal and Shipping Sector Committee Membership; State, Local, Tribal and Territorial Government Coordinating Council; Transportation Sector Committee Membership; Water Sector Committee Membership. | square_1.png | 25 | http://www.dhs.gov/xlibrary/assets/cipac/cipac_charter.pdf | |
| 2006-06 | month, year | National Infrastructure Protection Plan (NIPP) | The Plan presents the process by which DHS intends to identify specific assets most critical to the U.S. across all sectors, based on the risk associated with their loss to attack or natural disaster, and then to prioritize activities aimed at maximizing the reduction of those risks for a given investment. The NIPP also calls for implementation plans for these risk reduction activities, with timelines and responsibilities identified, and tied to resources. Each lead agency is to work with its sector to generate Sector Specific Plans, utilizing the processes outlined in the NIPP. The sector-specific plans are to address impacts to physical, human, and cyber assets. | square_1.png | 25 | http://www.naruc.org/Publications/NIPP_Plan4.pdf | |
| 2006-07 | month, year | Veteran’s Affairs loses laptop containing personal data on 26.6 million veterans and their families | The laptop is stolen in a burglary from a Maryland analyst’s home, the analyst later admits he had been working remotely with the adta from home for three years. | square_2.png | 25 | http://epic.org/privacy/vatheft/ | |
| 2006-11 | month, year | Air Force Cyber Command created | The Air Force Cyber Command is created to implement coordinated offensive and defensive electronic warfare. | square_1.png | 25 | http://fcw.com/articles/2006/11/13/air-force-to-create-cyber-command.aspx | |
| 2007-03 | month, year | Idaho National Laboratories hacks and crashes a generator | The Idaho National laboratory demonstrates the ability to physically destroy a power generator through hacking into its control systems. The Laboratories setup a simulated system that mirrored the systems utilized by U.S. energy companies and caused a generator to “shudder, smoke and shut down.” | square_2.png | 25 | http://articles.cnn.com/2007-09-26/us/power.at.risk_1_generator-cyber-attack-electric-infrastructure?_s=PM:US | |
| 2009-02 | month, year | Federal Aviation Administration (FAA) admits breach | Forty-eight files are stolen, including one containing information on 45,000 current and former FAA employees. | square_2.png | 25 | http://fcw.com/articles/2009/02/23/faa-data-breach.aspx | |
| 2009-05 | month, year | Cybersecurity Policy Review completed by NSA and DHS | Obama directs the National Security Agency and Department of Homeland Security Advisors to Conduct Cyber Security policy review for a “clean slate” start on addressing cyber threats. The Policy recommended a cybersecurity advisory position to the president. The appointment of Howard Schmidt, who was Bush’s cybersecurity advisor for a very short time before the position was abolished, reestablished as the cyber security coordinating function within the White House. | square_1.png | 25 | http://www.whitehouse.gov/the_press_office/AdvisorsToConductImmediateCyberSecurityReview | |
| 2010-10 | month, year | Stuxnet Virus wreaks havoc on Iranian nuclear facilities , later reports inplicated U.S. involvement in development. | The Stuxnet virus is reported to have shut down over a thousand centrifuges and possibly destroy over 400 at an Iranian nuclear enrichment facility. | square_2.png | 25 | http://www.wired.com/threatlevel/2010/11/stuxnet-clues/ | |
| 2011-04 | month, year | $11 million lost in cyber bank fraud | The FBI put out an alert noting that $20 million was attempted and $11 million had actually been stolen from small to medium size businesses. The money in each case was wired to a port town in China near the Russian border. | square_2.png | 25 | http://www.ic3.gov/media/2011/ChinaWireTransferFraudAlert.pdf | |
| 2011-05 | month, year | Obama- Cybersecurity Legislative Proposal released | The proposal takes into consideration some 50 independent cyber legislative proposals that had been introduced in the previous session of Congress. The proposal received lack luster reviews with some claiming it didn’t have any “teeth,” while others say it didn’t address privacy concerns clearly enough. | square_1.png | 25 | http://www.whitehouse.gov/the-press-office/2011/05/12/fact-sheet-cybersecurity-legislative-proposal | |
| 2011-07 | month, year | DOD releases cyber strategy and admits 24,000 defense contractor files recently stolen through its own systems | Deputy Defense Secretary William J. Lynn reveals in a speech introducing DOD’s cyber strategy that 24,000 files including information on including aircraft, surveillance and satellite communications systems had been stolen from their classified network. | square_2.png | 25 | http://www.defense.gov/news/d20110714cyber.pdf | |
| 2011-09 | month, year | Air Force UAV control stations hacked | Unmanned aerial vehicle systems at Creech Air Force Base in Nevada were infected with a “key logger” malware. Both unclassified and classified systems were infected and took several attempts to remove. The malware did not inhibit or affect the operation of the drones. | square_2.png | 25 | http://www.wired.com/dangerroom/2011/10/virus-hits-drone-fleet/ | |
| 2011-10 | month, year | GAO releases Government wide information security report | The GAO’s report “Weaknesses Continue Amid New Federal Efforts to Implement Requirements” details the escalation of cyber attacks on government systems and saying that attacks have increased “over 650 percent over the past 5 years.” | square_1.png | 25 | http://www.gao.gov/products/GAO-12-137 | |
| 2011-12 | month, year | NSTC releases Cyber Security report | The National Science and Technology Center release a strategic plan that “defines a set of interrelated priorities for the agencies of the U.S. government that conduct or sponsor research and development (R&D;) in cybersecurity.” The plan lays out priorities to fund projects that close current and future cybersecurity threats and expedite the products to market. | square_1.png | 25 | http://www.whitehouse.gov/sites/default/files/microsites/ostp/fed_cybersecurity_rd_strategic_plan_2011.pdf | |
| 2012-02 | month, year | Cybersecurity Act of 2012 bill released | The Cybersecurity Act was a bipartisan bill that had been about three years in the making. Similar to the proposal by the White House in 2011, the bill was criticized by some as a potential liberties threat, applauded by some, with some others believing it’s reliance on voluntary disclosure and compliance and lack of increased cyber crimes penalties made the bill weak. Lead by Sens. John McCain (R-AZ), Republican opposition to a largely bipartisan researched and introduced bill was almost immediate. | square_1.png | 25 | http://www.hsgac.senate.gov/download/the-cybersecurity-act-of-2012-s-2105 | |
| 2012-03 | month, year | NASA admits systems have been hacked | NASA’s Inspector General, Paul K. Martin, in testimony before the Subcommittee on Investigations and Oversight, House Committee on Science, Space, and Technology reported that 13 advanced persistent threat (APT) attacks successfully compromised NASA’s computers in 2011. In one attack, the intruders stole 150 user credentials. Another attack targeted the Joint Propulsion Laboratory from a China-based IP who were able to gain “full functional control over these networks.” | square_2.png | 25 | http://science.house.gov/sites/republicans.science.house.gov/files/documents/hearings/HHRG-112-SY21-WState-B001262_20120229.pdf | |
| 2012-04 | month, year | The Cyber Intelligence Sharing and Protection Act (CISPA) passes the House | The bill faces widespread opposition from online privacy advocates because broad language would likely have given the government access to anyone’s personal information with few privacy protections. It languished in the Senate. | square_1.png | 25 | http://thinkprogress.org/politics/2012/04/27/472990/need-to-know-cispa/ | |
| 2012-10 | month, year | Defense Secretary Leon Panetta warns of “cyber-Pearl Harbor” as White House readies cybersecurity executive order | Secretary Panetta also claims cyberattacks could be “just as destructive as the terrorist attack of 9/11” and noted “[a]n aggressor nation or extremist group could use these kinds of cyber tools to gain control of critical switches… They could derail passenger trains, or even more dangerous, derail passenger trains loaded with lethal chemicals. They could contaminate the water supply in major cities, or shut down the power grid across large parts of the country. | square_1.png | 25 | http://thinkprogress.org/security/2012/11/14/1189311/obama-signed-secret-directive-to-thwart-cyberattacks-in-mid-october/ | |
| 2012-11 | month, year | Revealed President Obama secretly signed Presidential Policy Directive 20, designed to thwart cyberattacks, in mid-October | The directive on cyberattack defense was designed to enable military personal to act more aggressively in thwarting attacks on public and private networks, known as Presidential Policy Directive 20 in mid-October. | square_1.png | 25 | http://thinkprogress.org/security/2012/11/14/1189311/obama-signed-secret-directive-to-thwart-cyberattacks-in-mid-october/ | |
| 2013-01 | month, year | Major U.S. newspapers hacked in apparent Chinese-espionage program | The New York Times, Washington Post and others reveal they were the victims of relentless cyber-assaults, likely part of a coordinate campaign by the Chinese government. | square_2.png | 25 | http://www.nytimes.com/2013/02/02/technology/washington-posts-joins-list-of-media-hacked-by-the-chinese.html | |
| 2013-02 | month, year | Government Accountability Office audit reveals Federal Communications Commission internal networks were breached in August 2011, and efforts to update network security were not properly managed | The $10 million Enhanced Security Network project started by the organization that regulates online communication was mismanaged by the agency and outside contractors, highlighting the shortage of cybersecurity expertise in government. | square_2.png | 25 | http://thinkprogress.org/security/2013/02/11/1569031/fcc-gao-cybersecurit-esn/ | |
| 2013-02 | month, year | White House Cybersecurity Executive Order released | The executive order opens up the voluntary Enhanced Cybersecurity Services program to other sectors participating in critical infrastructure beyond the defense industrial base, creates new information sharing programs under the direction of the Department of Homeland Security, or DHS, to provide threat and attack information to U.S. businesses, and tasks the National Institute of Standards and Technology with designing and implementing a cybersecurity framework to reduce the cyber risks to critical infrastructure. The Presidential Directive, President Obama’s second directive in a row dealing with cybersecurity, outlines three major imperatives for the Department of Homeland Security to pursue to improve the resiliency of the federal government’s critical infrastructure against cyberattack, and clarifies the role of various federal agencies in pursuing those imperatives. | square_1.png | 25 | http://thinkprogress.org/security/2013/02/13/1579731/cybersecurity-executive-order/ |
cyber attack
cybersecurity policy initiative
Timeline: List View
| 1994-03 | 16 year old British student charged with cyber attacks after breaching the Air Force’s Rome Lab | An intrusion was detected in the Air Force’s Rome Lab that left behind traces of an online “handle.” The young hacker by the handle name “Data Cowboy” was tracked down with the help of Scottland Yard and observed from Rome Lab, hacking into over 150 companies and government sites, defrauding phone companies and even accessing data from the South Korean Atomic Research Institution. What was known in the ’70’s and ’80’s as “phreaking,” a way to make long distances calls by simulating dial tones, had now become the first way to use dial-up internet connections to mask cyber attacks. |
| 1996-07 | President’s Commission on Critical Infrastructure Protection (PCCIP) identified cyber threats at critical | A commission is established that reports to the President the nature and scope of vulnerabilities and threats to the nation’s critical infrastructures. The focus was primarily on cyber threats. The commission is tasked to recommend a comprehensive national policy and implementations strategies. |
| 1997-06 | Simulated cyber attack named “Eligible Receiver” shows vulnerability in DOD computer networks | The cyberwar game is the first of its kind. It simulated a North Korean attacker targeting the Pacific Command Systems. The U.S. system did poorly in the exercise. |
| 1997-10 | PCCIP report released, highlighting government role in monitoring and disseminating latest-threat information to cyber companies | The report becomes known as the “Marsh Report” after commission chairman Robert Marsh, a former Air Force General. The report cites no immediate threat to infrastructure but a need for cybersecurity action due to rapid growth of computer-literate population, inherent vulnerabilities of common protocols in computer networks, easy availability of hacker “tools and same technology being used by general population as hackers. The commission recommended greater cooperation between private and government sectors and highlighted the governments role collecting and disseminating latest threat information to private companies (intrusion techniques, threat analysis, and ways to defend against hackers). |
| 1998-02 | Department of Defense (DOD) network attacked, dubbed “Solar Sunrise” | A series of attacks on DOD unclassified networks named Solar Sunrise. The attackers used an exploit in the system to install collection software and went back into the system later to retrieve the information. This attack confirmed the results of “Eligible Receiver. |
| 1998-02 | National Infrastructure Protection Center (NIPC) is created | The Marsh Report, the Eligible Receiver exercise, and the Solar Sunrise investigation lead the Attorney General Janet Reno and FBI Director Louis Freeh to create the NIPC on February 26, 1998. The NPIC was tasked with protecting the all nationally critical infrastructure network systems for the government and private sector. The NPIC was a multi-agency effort ran and housed out of the FBI. The NPIC was divided into three sections- Computer Investigations and Operations; Training, Administration, and Outreach; and Analysis and Warning. Private industry were encouraged to join private-government partnerships on a voluntary basis to better coordinate protection schemes and disseminate threat information. |
| 1998-05 | Presidential Decision Directive (PPD) No. 63. to implement National Infrastructure Assurance Plan | Groups are setup within the federal government to develop and implement plans to protect government-operated infrastructures. It also calls for a dialogue between government and the private sector to develop a National Infrastructure Assurance Plan to protect the nation’s critical infrastructures by 2003. Each federal agency was made responsible for securing its own critical infrastructure. The National Plan Coordination Staff were organized into the Critical Infrastructure Assurance Office (CIAO) and tasked to develop the plan while the Information Sharing and Analysis Center (ISAC) was setup, modeled after FBI’s National Infrastructure Protection Center, for current threat information sharing. The major focus is on cyber threats and the critical infrastructure sectors were determined to include: Information and Communications, Banking and Finance, Water, Transportation, Emergency Law Enforcement, Emergency Fire Service, Emergency Medicine, Electric Power, Gas, and Oil, Law Enforcement and Internal Security, Intelligence, Foreign Affairs, National Defense. |
| 1999-07 | National Infrastructure Assurance Council, or NIAC, established under Clinton Exec. Order 13130 (order is rescinded by Bush before council can convene) | The Council is tasked with enhancing the partnership between public and private sectors, develop ways to encourage private industry to conduct risk assessments of critical processes, monitor the development of Private Sector Information Sharing and Analysis Centers (PSISACs) and provide recommendations to the National Coordinator and the National Economic Council on how these organizations can best foster improved cooperation among the PSISACs, the National Infrastructure Protection Center (NIPC), and other federal government agencies. |
| 1999-12 | Clinton released Version 1.0 of a National Plan for Information Systems Protection | The plan is solely focused on cybersecurity and touts a plan for “A Real Public-Private Partnership…Not Dictated Solutions” and holds educated personnel as the key to success. It lays out 10 programs to achieve the goals laid out in PPD 63 and notes that the government systems should be the model. |
| 1999-12 | Private sector actors voluntarily convene Partnership for Critical Infrastructure Security | The goal is to share information and strategies and to identify interdependencies across sectorial lines. It was a private sector initiative, with the CIAO providing administrative support for meetings. Sector liaisons from lead federal agencies were considered ex officio members. |
| 2001-10 | Bush signs the Patriot Act, which includes definition of critical infrastructure | In the Patriot Act, section 1016 “Critical Infrastructures Protection Act of 2001,” defines “critical infrastructure” as “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters. |
| 2001-10 | Bush establishes Office of Homeland Security and the Homeland Security Council by Executive Order | Section (3ei) & (3fi) gives the Office the task of “protecting critical infrastructure from the consequences of terrorist attacks” and “coordinate efforts to respond to and promote recovery from terrorist threats or attacks within the United States” to include telecommunication. |
| 2001-10 | Bush Re-Creates NIAC with Executive Order 13231- Critical Infrastructure Protection in the Information Age | National Infrastructure Advisory Council (NIAC) is enacted by with the same goals and acronyms the council that was rescinded as President Bush took office. This allowed Bush to appoint twenty-four different advisors. The order is issued “to ensure protection of information systems for critical infrastructure, including emergency preparedness communications, and the physical assets that support such systems, in the information age.” |
| 2002-07 | First National Strategy for Homeland Security released | Expands upon the listing of sectors considered to possess critical infrastructure to include public health, the chemical industry and hazardous materials, postal and shipping, the defense industrial base, and agriculture and food. While the main focus is on physical terrorist attack security, “Securing Cyberspace” is one of eight major initiatives identified and is listed under potential terrorist threats. The report also sites the upcoming National Strategy to Secure Cyberspace as what will “describe our initiatives to secure our information systems against deliberate, malicious disruption.” |
| 2002-09 | Bush announces appointments to NIAC | Members selected for NIAC represent major sectors of the economy – banking and finance, transportation, energy, information technology, and manufacturing. The Council also includes representatives from academia, state and local government, and law enforcement. The Council works closely with the President’s National Security and Telecommunications Advisory Committee (NSTAC). Members make recommendations regarding the security of the cyber and information systems relating to national security and economic critical infrastructures. The Committee examines partnerships to enhanced and improve cyber security between the public and private sectors. |
| 2002-11 | Congress passes Homeland Security Act establishing a Department of Homeland Security (DHS) | The act consolidated within one department a number of agencies that had, as part of their missions, homeland security-like functions (e.g., Border Patrol, Customs, Transportation Security Administration). The act kept the language of DHS being responsible for “critical infrastructures” to include telecommunications. This left the responsibility overlapping with previous attempts to police cyber crime by the FBI and NSA. |
| 2003-02 | The National Strategy to Secure Cyberspace released | The strategy is an extension of the National Plan for Information Systems Protection created under the Clinton Administration in 1999, now referred to as Version 2.0. This strategy addressed all interested parties in the nation’s information infrastructure, from home users to the international community, and included input from the private sector, the academic community, and state and local governments. It was criticized for lacking regulations which rendered it “toothless.” |
| 2003-12 | Bush’s Presidential Directive 7 creates the Critical Infrastructure Protection Policy Coordinating Committee | The Directive further defines the relationship between the DHS and other agencies. DHS maintains a cyber security unit and the Director of the Office of Management remains responsible for overseeing government-wide information security programs and operating the federal cyber incident response center within DHS. The Critical Infrastructure Protection Policy Coordinating Committee to advise the Homeland Security Council on interagency policy related to physical and cyber infrastructure security was created. |
| 2005-02 | Interim National Infrastructure Protection Plan released | A general document that aims to ” provide the framework and sets the direction for implementing this coordinated, national effort.” The plan listed “cyber infrastructures” as high priority as well as coordinating with private industry, across agencies and foreign governments. |
| 2006-03 | DHS creates Critical Infrastructure Partnership Advisory Council (CIPAC) with private industry | CIPAC is created to support the implementation of the National Infrastructure Protection Plan (NIPP). DHS acts as the Executive Secretariat of meetings. Members include federal, state, local, and tribal government entities that belong to their respective government coordinating councils. Private industries are covered under an array of committees that include ;Chemical Sector Committee Membership; Commercial Facilities Sector Committee Membership; Communications Sector Committee Membership; Critical Manufacturing Sector Committee Membership; Dams Sector Committee Membership; Defense Industrial Base Sector Committee Membership; Emergency Services Sector Committee Membership; Energy Sector Committee Membership; Financial Services Sector Committee Membership; Food and Agriculture Sector Committee Membership; Government Facilities Sector Committee Membership ;Healthcare and Public Health Sector Committee Membership; Information Technology Sector Committee Membership; National Monuments and Icons; Nuclear Sector Committee Membership; Postal and Shipping Sector Committee Membership; State, Local, Tribal and Territorial Government Coordinating Council; Transportation Sector Committee Membership; Water Sector Committee Membership. |
| 2006-06 | National Infrastructure Protection Plan (NIPP) | The Plan presents the process by which DHS intends to identify specific assets most critical to the U.S. across all sectors, based on the risk associated with their loss to attack or natural disaster, and then to prioritize activities aimed at maximizing the reduction of those risks for a given investment. The NIPP also calls for implementation plans for these risk reduction activities, with timelines and responsibilities identified, and tied to resources. Each lead agency is to work with its sector to generate Sector Specific Plans, utilizing the processes outlined in the NIPP. The sector-specific plans are to address impacts to physical, human, and cyber assets. |
| 2006-07 | Veteran’s Affairs loses laptop containing personal data on 26.6 million veterans and their families | The laptop is stolen in a burglary from a Maryland analyst’s home, the analyst later admits he had been working remotely with the adta from home for three years. |
| 2006-11 | Air Force Cyber Command created | The Air Force Cyber Command is created to implement coordinated offensive and defensive electronic warfare. |
| 2007-03 | Idaho National Laboratories hacks and crashes a generator | The Idaho National laboratory demonstrates the ability to physically destroy a power generator through hacking into its control systems. The Laboratories setup a simulated system that mirrored the systems utilized by U.S. energy companies and caused a generator to “shudder, smoke and shut down.” |
| 2009-02 | Federal Aviation Administration (FAA) admits breach | Forty-eight files are stolen, including one containing information on 45,000 current and former FAA employees. |
| 2009-05 | Cybersecurity Policy Review completed by NSA and DHS | Obama directs the National Security Agency and Department of Homeland Security Advisors to Conduct Cyber Security policy review for a “clean slate” start on addressing cyber threats. The Policy recommended a cybersecurity advisory position to the president. The appointment of Howard Schmidt, who was Bush’s cybersecurity advisor for a very short time before the position was abolished, reestablished as the cyber security coordinating function within the White House. |
| 2010-10 | Stuxnet Virus wreaks havoc on Iranian nuclear facilities , later reports inplicated U.S. involvement in development. | The Stuxnet virus is reported to have shut down over a thousand centrifuges and possibly destroy over 400 at an Iranian nuclear enrichment facility. |
| 2011-04 | $11 million lost in cyber bank fraud | The FBI put out an alert noting that $20 million was attempted and $11 million had actually been stolen from small to medium size businesses. The money in each case was wired to a port town in China near the Russian border. |
| 2011-05 | Obama- Cybersecurity Legislative Proposal released | The proposal takes into consideration some 50 independent cyber legislative proposals that had been introduced in the previous session of Congress. The proposal received lack luster reviews with some claiming it didn’t have any “teeth,” while others say it didn’t address privacy concerns clearly enough. |
| 2011-07 | DOD releases cyber strategy and admits 24,000 defense contractor files recently stolen through its own systems | Deputy Defense Secretary William J. Lynn reveals in a speech introducing DOD’s cyber strategy that 24,000 files including information on including aircraft, surveillance and satellite communications systems had been stolen from their classified network. |
| 2011-09 | Air Force UAV control stations hacked | Unmanned aerial vehicle systems at Creech Air Force Base in Nevada were infected with a “key logger” malware. Both unclassified and classified systems were infected and took several attempts to remove. The malware did not inhibit or affect the operation of the drones. |
| 2011-10 | GAO releases Government wide information security report | The GAO’s report “Weaknesses Continue Amid New Federal Efforts to Implement Requirements” details the escalation of cyber attacks on government systems and saying that attacks have increased “over 650 percent over the past 5 years.” |
| 2011-12 | NSTC releases Cyber Security report | The National Science and Technology Center release a strategic plan that “defines a set of interrelated priorities for the agencies of the U.S. government that conduct or sponsor research and development (R&D;) in cybersecurity.” The plan lays out priorities to fund projects that close current and future cybersecurity threats and expedite the products to market. |
| 2012-02 | Cybersecurity Act of 2012 bill released | The Cybersecurity Act was a bipartisan bill that had been about three years in the making. Similar to the proposal by the White House in 2011, the bill was criticized by some as a potential liberties threat, applauded by some, with some others believing it’s reliance on voluntary disclosure and compliance and lack of increased cyber crimes penalties made the bill weak. Lead by Sens. John McCain (R-AZ), Republican opposition to a largely bipartisan researched and introduced bill was almost immediate. |
| 2012-03 | NASA admits systems have been hacked | NASA’s Inspector General, Paul K. Martin, in testimony before the Subcommittee on Investigations and Oversight, House Committee on Science, Space, and Technology reported that 13 advanced persistent threat (APT) attacks successfully compromised NASA’s computers in 2011. In one attack, the intruders stole 150 user credentials. Another attack targeted the Joint Propulsion Laboratory from a China-based IP who were able to gain “full functional control over these networks.” |
| 2012-04 | The Cyber Intelligence Sharing and Protection Act (CISPA) passes the House | The bill faces widespread opposition from online privacy advocates because broad language would likely have given the government access to anyone’s personal information with few privacy protections. It languished in the Senate. |
| 2012-10 | Defense Secretary Leon Panetta warns of “cyber-Pearl Harbor” as White House readies cybersecurity executive order | Secretary Panetta also claims cyberattacks could be “just as destructive as the terrorist attack of 9/11” and noted “[a]n aggressor nation or extremist group could use these kinds of cyber tools to gain control of critical switches… They could derail passenger trains, or even more dangerous, derail passenger trains loaded with lethal chemicals. They could contaminate the water supply in major cities, or shut down the power grid across large parts of the country. |
| 2012-11 | Revealed President Obama secretly signed Presidential Policy Directive 20, designed to thwart cyberattacks, in mid-October | The directive on cyberattack defense was designed to enable military personal to act more aggressively in thwarting attacks on public and private networks, known as Presidential Policy Directive 20 in mid-October. |
| 2013-01 | Major U.S. newspapers hacked in apparent Chinese-espionage program | The New York Times, Washington Post and others reveal they were the victims of relentless cyber-assaults, likely part of a coordinate campaign by the Chinese government. |
| 2013-02 | Government Accountability Office audit reveals Federal Communications Commission internal networks were breached in August 2011, and efforts to update network security were not properly managed | The $10 million Enhanced Security Network project started by the organization that regulates online communication was mismanaged by the agency and outside contractors, highlighting the shortage of cybersecurity expertise in government. |
| 2013-02 | White House Cybersecurity Executive Order released | The executive order opens up the voluntary Enhanced Cybersecurity Services program to other sectors participating in critical infrastructure beyond the defense industrial base, creates new information sharing programs under the direction of the Department of Homeland Security, or DHS, to provide threat and attack information to U.S. businesses, and tasks the National Institute of Standards and Technology with designing and implementing a cybersecurity framework to reduce the cyber risks to critical infrastructure. The Presidential Directive, President Obama’s second directive in a row dealing with cybersecurity, outlines three major imperatives for the Department of Homeland Security to pursue to improve the resiliency of the federal government’s critical infrastructure against cyberattack, and clarifies the role of various federal agencies in pursuing those imperatives. |
This timeline was published by the Center for American Progress
” As the world is increasingly interconnected, everyone shares the responsibility of securing cyberspace. “
Newton Lee
4 responses to “Major cyber incidents”
Hey! This post couldn’t be written any better! Reading through this post reminds me of my previous room mate! He always kept talking about this. I will forward this article to him. Pretty sure he will have a good read. Thank you for sharing!
Do you mind if I quote a couple of your posts as long as I provide credit and sources back to your weblog? My website is in the exact same area of interest as yours and my visitors would certainly benefit from a lot of the information you present here. Please let me know if this ok with you. Appreciate it!
I am extremely inspired together with your writing skills and also with the structure for your weblog. Is that this a paid theme or did you customize it your self? Anyway keep up the nice high quality writing, it抯 uncommon to see a great weblog like this one today..
Pretty great post. I just stumbled upon your blog and wished to say that I have really loved browsing your weblog posts. In any case I抣l be subscribing for your feed and I am hoping you write again very soon!