All points
1758 words
- Tim Hawk spent 33 years in US Air Force intelligence before becoming one of America's most senior intelligence officials. The four-star general led the National Security Agency (NSA), America's largest intelligence agency, and US Cyber Command, responsible for defending the country in cyberspace. This was his first television interview since retirement.
- Hawk says China has penetrated American computer networks on a much wider scale than previously understood. Its targets extend beyond the US military and defence industry to civilian infrastructure and basic services used by ordinary Americans. He described the targeting of essential services as contrary to international law and fundamentally different from how the US military would approach targeting during a conflict.
- China has targeted water systems, electrical power infrastructure and transportation networks. Multiple intrusions into utility systems were discovered in 2023, and Chinese operators had been inside some networks for at least five years. Telecommunications and other critical infrastructure in the United States and abroad are also being targeted.
- Hawk believes the purpose of these intrusions is preparation for a future crisis or military conflict. He argued that compromising basic services offers no obvious economic advantage or conventional foreign intelligence collection value. In his assessment, the principal value is having access available to disrupt American infrastructure when it matters strategically.
- Littleton, Massachusetts, became an example of how far China's cyber operations extend. Its Electric and Water Utility serves approximately 10,000 residents and is neither a major federal government supplier nor a significant military contractor. General manager Nick Lawler said he could identify no reason why China would target his small community.
- The FBI informed Littleton's utility manager in November 2023 that China had gained access to its computer network. Lawler said investigators told him his utility was one of 200 affected entities. He was unable to explain why his relatively insignificant community had attracted Chinese attention.
- Littleton's entire water utility operation is controlled remotely through computer systems. Lawler showed investigators tanks containing dangerous chemicals that must be precisely controlled to produce clean drinking water. Someone with operational control of those systems could potentially poison the town's water supply.
- Chinese operators had not obtained operational control of Littleton's water treatment equipment when they were discovered. With Lawler's permission, federal investigators monitored their activity and observed what they were doing. The incident demonstrated that even a small community without an obvious national security connection could become a target of a foreign adversary.
- Hawk believes targeting small American communities can serve a larger military strategy by diverting national resources. During a confrontation with China in the Indo-Pacific, disrupting services in the American homeland could force Washington to redirect attention and resources away from the overseas crisis. Even shutting down water services in a town like Littleton could attract nationwide attention and complicate military mobilisation.
- Simultaneous infrastructure disruptions could create the appearance of a much larger national emergency. Hawk suggested that three or four attacks occurring together, combined with an information campaign, could magnify public anxiety and the perceived scale of the disruption. Alternatively, China could select strategically important locations where an outage would have greater consequences.
- Other American infrastructure targets reportedly believed to have been compromised include major transportation, energy and communications systems. These include New York City's Metropolitan Transportation Authority, 13 gas pipeline operators, the Port of Houston and major telephone companies. The intrusions are described as having occurred over a period of years.
- Senator Mike Rounds believes China's strategy is intended to deter the United States from intervening in a future confrontation. The Republican senator from South Dakota chairs the Senate Armed Services Cyber Security Subcommittee. He argues that penetrating sensitive American industries gives China the ability to threaten serious domestic disruption if Washington challenges Beijing.
- Financial markets could become a target for disruption without China needing to cause a major technical failure. Rounds explained that even a brief interruption affecting financial transactions by milliseconds could change market behaviour and undermine confidence in the security and reliability of trading systems. He described the possibility of creating chaos on Wall Street as something China would welcome having the ability to threaten.
- China could also use infrastructure access to threaten everyday services as a form of coercion. Rounds identified electricity disruptions and interference with airline reservations as possible examples. The strategic message would be that Beijing knows where American vulnerabilities are and can create serious, prolonged problems if the United States challenges it.
- China exploits weaknesses in ordinary network equipment to gain access to critical systems. In Littleton, investigators identified a vulnerability in the network firewall. Unpatched software and outdated equipment that no longer receives security updates create opportunities for intruders to enter otherwise legitimate systems.
- Chinese operators avoided installing conventional malware after entering Littleton's network. Instead, they stole login credentials and impersonated legitimate employees. This allowed them to access systems without creating the obvious warning signs that malicious software might trigger.
- The apparent strategy is to gain access and remain dormant until the access becomes useful. Hawk explained that Chinese operators were not spending their time collecting intelligence or conducting other visible activities inside Littleton's network. They appeared to be preserving their access for possible future use, making detection and removal particularly difficult.
- American intelligence officials do not have a complete picture of China's access to US computer networks. Hawk acknowledged that the government lacks perfect knowledge of how extensively Chinese operators have penetrated American systems. He estimated that automated scanning activity could involve millions of devices every day, although he did not provide a verified count of successful attacks.
- China denies conducting the hacking operations. The White House told the programme that the administration was working to assess the extent of American exposure and mitigate the damage.
- Littleton was forced to rebuild its entire computer network after the intrusion, spending more than $50,000. The financial cost was compounded by the difficulty of removing an intruder who had already established legitimate-looking access. Hawk argued that preventing access in the first place is considerably easier than identifying and removing an established intruder.
- Hawk says basic cybersecurity measures are essential to protecting American infrastructure. Critical infrastructure operators and the smaller networks supporting them need to maintain fundamental security practices, including properly updated equipment and protection against known vulnerabilities. Otherwise, the government and infrastructure operators must expend substantially more resources removing intruders after a compromise.
- Hawk remains confident in American cyber capabilities but considers the scale of the challenge a major problem. When asked whether the United States was good at defending itself, he answered affirmatively, but qualified that confidence by pointing to the extraordinary scale of Chinese activity.
- Hawk's leadership of the NSA lasted only a little over a year. During the first Trump administration, he had progressed through the ranks from two-star to three-star and eventually four-star general. He assumed leadership of the NSA and US Cyber Command in 2024, as the extent of China's infrastructure intrusions was becoming increasingly apparent.
- Hawk was removed as NSA director in April following political accusations of disloyalty. He said a senior Department of Defense official telephoned him to communicate that the president had decided to remove him. The programme reported that far-right activist Laura Loomer had met with President Trump and argued that Hawk was disloyal and should be fired.
- The public evidence Loomer cited against Hawk was his appointment by President Joe Biden. She characterised his dismissal as a blessing for the American people. The transcript provides no additional evidence of misconduct or disloyalty, and the White House declined to answer the programme's questions about his removal.
- Hawk said the accusations were personally damaging but maintained that he had remained committed to national security throughout his career. He said he had worked every day to make America safer and had continued meeting the expectations of the president until his final day of service. Asked directly whether he had been disloyal, he answered unequivocally that he had not.
- Hawk subsequently retired from the Air Force after leaving the NSA. He expressed disappointment at losing experienced national security leaders without strong justification, arguing that America does not have enough people with the expertise required for these responsibilities.
- The NSA appointed a new acting director following Hawk's departure. Senator Mike Rounds described Hawk's removal as a loss for the country but potentially a major gain for whichever public or private organisation subsequently employed him. He wished Hawk well and acknowledged the value of his leadership and expertise.
- Rounds also publicly reassured observers that America's cyber mission forces remained operationally prepared. In comments made the week after Hawk's removal, he said America's adversaries watching the proceedings should understand that US Cyber Command and the NSA remained ready regardless of the scenario.
- Hawk said his departure did not change the importance of the organisations he had led. Once he was no longer in charge, his attention shifted to the continued missions of the NSA and US Cyber Command, while his family considered how they could continue serving the country in different ways.
- Hawk now teaches at Yale University and consults for private industry. Although he has left government service, he remains involved in cybersecurity through academic and commercial work while China continues expanding its hacking, espionage and intellectual property theft activities.
- Other departures have further reduced America's experienced cyber-defence leadership. The programme reported additional resignations and firings involving people responsible for American cyber defence. Hawk believes the country's overall capacity is shrinking even as China's capabilities continue to grow.
- Hawk says the United States still possesses substantial government cybersecurity capabilities, but leadership must use them effectively. He identified stronger partnerships between government and private industry as essential to countering the growing threat. The responsibility now rests with the administration to mobilise existing expertise and rebuild effective cooperation.
- Failure to maintain American dominance in cyberspace could produce three major strategic consequences. China could continue stealing American intellectual property and damaging the US economy, expand intelligence collection that benefits it during peacetime and conflict, and maintain hidden access inside critical American and allied networks for use during a future crisis.
- Hawk considers Chinese pre-positioning inside American and allied infrastructure particularly dangerous. Access established before a crisis could give Beijing an operational advantage when a confrontation begins, allowing it to threaten essential systems without first having to penetrate them during the conflict itself. He said the United States must prevent that advantage from developing.