Last Friday saw the publication of the full transcript of an interview conducted with the former Director of the CIA, Michael Hayden. The interview gave us insight into US intelligence and strategic thinking which don’t often make it out into the public domain. It’s not so much that everything he said was groundbreaking, rather the importance is in the fact that a person with his professional background said it, and with a degree of frankness and directness not often associated with ex-intelligence chiefs, at least in public.

The interview should be read in its entirety to understand the wide range of topics it covers (beyond further negative publicity for Huawei): US strategic relations in the Asia-Pacific region, the growing intelligence battles that are taking place, especially in the cyber domain, and what the Edward Snowden revelations mean for the US intelligence agencies and their relationships. Most stark are his warnings that we’re entering a new era of cyber threats:

We are moving from a world in which most cyber problems are mainly about stealing your data to a world in which cyber is being used to deliberately create direct kinetic consequences: effects on your information, effects on your networks, and other adverse physical effects on assets that are valuable to you. As surely as night follows day, these cyber security risks are going to expand over time.

There might be some who disagree with this prognosis, but the graveness of the warning is hard to discount. The lion’s share of the interview reflects on China, both its strategic importance and its cyber espionage efforts. In reference to Chinese activity in this area, Hayden makes two key points. Firstly, that the USA is conducting cyber espionage—something that hasn’t been admitted publicly by an ex-Director of a major intelligence agency:

Listen, I fully admit: we steal other country’s secrets. And frankly we’re quite good at it. But the reason we steal these secrets is to keep our citizens free, and to keep them safe. We don’t steal secrets to make our citizens rich. Yet this is exactly what the Chinese do.

The differentiation he makes between espionage as conducted by English-speaking nations as opposed to China provides evidence from an official source that the Anglosphere’s view of what’s ‘fair game’ for espionage isn’t universally agreed, and that the ‘Five Eyes’ view of the scope of espionage is narrower. This might come as comfort to the public as they reel from the constant revelations from Snowden’s catalogue.

There’ve been other intelligence chiefs who’ve spoken out about Chinese activity in cyberspace. In the UK, ex-Director General of MI5, Jonathan Evans, made statements in public about ‘Chinese sources’ being responsible for attacks on the UK, mirroring claims made by intelligence chiefs here in Australia. But Hayden is far more specific in his description of the motivations and types of espionage that the Chinese are conducting:

I understand the Chinese espionage effort against the West. As an intelligence professional, I stand back in awe at the breadth, depth, sophistication and persistence of the Chinese espionage campaign… China does not confine itself to espionage against what you or I would call ‘state secrets’. They have a much broader definition of legitimate espionage to include intellectual property, commercial trade secrets, and the negotiating positions of private entities. In other words, they don’t limit themselves in the way we do in the English-speaking community.

Hayden spoke at length on the Snowden leaks and there’s no doubt that this has been hugely damaging for intelligence agencies across the Five Eyes. Snowden has leaked highly classified details of the agency’s methodologies—something that’s sacred to them. Intelligence agencies are deeply guarded about the methods they use to gather information, because adversaries learn to adapt to and circumvent them. However, as much as terrorists, criminals and other intelligence agencies have learnt about the Five Eyes data collection methods, history suggests that the agencies will eventually develop new ways to access the same data. So in the long-term the damage will be repaired.

There were some really interesting issues raised in Hayden’s interview regarding the private sector and its involvement in ‘active defensive’ to protect networks and data. With cyberspace becoming an ever more dynamic domain, the addition of private sector companies defending themselves by attacking potential malicious actors will create an additional layer of complexity and confusion. With legal confusion, jurisdictional ambiguity and misunderstanding already common, the private sector taking matters into their own hands is worrying. Allowed to develop further, it could turn cyberspace into an even more complicated realm with thousands of participants acting like invisible cyber gunslingers at every turn. The implications of this for the way in which business will be conducted in the future is unclear. Hayden suggests that it could mean that governments will have to take up an increased role in defending the private sector—although as we’ve seen in the US, governments are hesitant to head down that path.

But, as with many aspects of cyber security, events move faster than policy discussions and there’s increasingly a community of consultants and companies advocating ‘offensive defence’. The process of the private sector becoming offensive actors in cyberspace has already begun. Where this leads is uncertain, but it’s hard to imagine it being particularly positive.

Tobias Feakin is a senior analyst at ASPI. Image courtesy of Flickr user Gerald R. Ford School of Public Policy.