In 2001, Eric O’Neill arrested fellow FBI agent Robert Hanssen for spying on the U.S. on behalf of the Soviet Union and Russian Federation.
It was one of the most sensational espionage cases in FBI history and led to Hanssen’s conviction. He’s now serving a life sentence in prison.
The case was the subject of the 2007 Hollywood thriller “Breach,” which brought O’Neill a degree of fame.
He hasn’t disappeared from the public eye. O’Neill left the FBI and became a national strategist for the security company Carbon Black. As part of his job, he frequently gives talks about the state of cyber security. He did just that on Thursday, Oct. 27, at the Cyberfest 2016 conference in La Jolla.
O’Neill also spent time talking to the Union-Tribune about Russia’s hacking of the Democratic National Committee and the Clinton campaign, and China’s theft of millions of records from the U.S. Office of Personnel Management. He has deep concerns about incidents and what it means for democracy.
Here is a portion of the interview, which was edited for clarity and continuity.
Q: The American public largely ignores data breaches against retailers and financial institutions. And the public is not pounding on tables about the Russian hacks on the DNC. Why are’t more people concerned or outraged?
A: It boggles my mind that they haven't cared about these breaches. John Q. Public doesn't seem to care unless it affects them personally. Even identity theft. (People say), ‘Yeah, so my credit card was hacked or stolen in the Target scam. But what happened? Maybe I spotted something I didn't charge and I just reported it to fraud and it wasn't my problem. Target had to deal with it.’
(But) people are starting to care now (due to the hacks against the DNC). If you can steal my vote, if you can corrupt my vote, if you can rig an election, well, as an American, that is a problem.
Is that likely to happen? Absolutely not. It's almost impossible. Each voting system is run by the states. If you wanted to (interfere) you would literally have to find a way to break into polling places and install malware on each polling station. They are generally not networked. You would have to attack each system one by one all over the country. It's not likely to happen.
But people are afraid that this could happen — especially this year. (They) get so zealously behind their candidate that it's almost personal when a candidate gets attacked.
Q: How are they going to sort through what's true?
A: They're not. That's the problem. This fear that the election could be rigged by Russia is an unfounded fear. But it is one that many people share. Carbon Black did a study that found that 15 million people might not vote.
Q: Fifteen million?
A: Yeah. That's like one in five people.
Q: What does that say about what Russia did -- or did not -- achieve in any of this?
A: Well I think they achieved what they wanted to achieve. Spies don't just steal information to provide a benefit for their particular state or country. Spies also sabotage, they disrupt. They’re the most effective part of any kind of war machine. Wars are won by espionage. If we're in a battle with them for -- maybe in Russia's mind, world supremacy -- then using these tactics can really throw the US into chaos. And we are in chaos right now. Just the stuff that's coming out of the campaigns is chaotic.
Q: You spoke about China's attack on the Office of Personnel Management. Is this a case where there is a lot of impact occurring that's just not highly visible in a community like San Diego where so many people have (government security) clearances?
A: Yes. You have hit the nail right on the head. The impact is occurring now, but we won't see it until we starting catching these (spies).
There's the old way of recruiting (spies) -- ideology, black mail or greed. (The idea that) I've learned all about you because I've stolen all of your information from OPM. I've got your entire background. I know your vulnerabilities. I know where I can black mail you. I know whether you're greedy, whether you really need money.
I've taken what I've stolen and compared it to everything you've put on social media and (in) the public records searches you can do here in the U.S. and I've learned you've got a couple of mortgages on your home, and I've learned that you're getting into fights with your wife, and you're really stretched for money. And what do you have? (Security) clearance, access. What do I have? Unlimited money. And now I can recruit you. Maybe its a little bit of greed. A little bit of greed always turns to black mail.
Q: Russia, China, North Korean, Iran -- these countries are hacking us. What are we to make of it? Is it just what goes on all of the time?
A: We go after other governments all of the time to take information -- to find out what defense departments are going to do, to find out what militaries are going to do, what their political strategies are on the world stage. They do it to us. We do it to them. The great game of espionage.
The other side of it is that the attacks can be disruptive. I’m worried about an attack on critical infrastructure. We have a very weak power grid, we have a weak and poorly defended and poorly designed system of controls for our power structure. If you want to compare what ours actually looks like take a look at Ukraine's (power grid) and everything that happened when Russia shut them down (in 2015).
They could do the same thing to us. We're bigger; they probably couldn’t get the whole country. But if there was an orchestrated attack, they could probably shut down the West Coast.
Q: Is this the kind of thing that could escalate into cyber war and kinetic war between countries?
A: Cyber espionage isn't the sort of thing that's going to escalate into warfare. It's seems to be more of a Cold War. (The US doesn’t) seem to be willing to attack back. At least that hasn't happened yet, with the exception of possibly what maybe we, maybe Israel, maybe the two of us together did to Iran in setting back their nuclear industry with Stuxnet (a computer worm).
I kind of wish that we would do a little bit more of that. But we don't. I think part of that is that we don't want to escalate things.
Q: How does anyone in American society know what it is doing in this space?
A: If you're doing all this correctly, you don't want people to know.
The best espionage happens in the shadows without anyone realizing that it has happened. Years later, someone retires and writes a book and it gets uncovered.
Q: OK, but the Obama administration came back said that we're going to do a proportional retaliation for what Russia did to the DNC --
A: They said a covert retaliation. Why announce that if you're going to do it?
Q: The government is asking the public to trust them on this. But there is a lot of mistrust of the government by the American people. So does this just go in one ear and out the other?
A: I think it goes in one ear and out the other. I don't think our government is very trusted right now. The future looks grim for any change to that. But it is important. When a population feels threatened (they need) to be able to trust their government to be able to handle it.
©2016 The San Diego Union-Tribune Distributed by Tribune Content Agency, LLC.