The Perfect Weapon: How the Cyber Arms Race Set the World Afire

by David E. Sanger

From the premiere New York Times Washington correspondent, a stunning and incisive look into how cyberwarfare is influencing elections, threatening national security, and bringing us to the brink of global war.

Behind the Russian cyberattacks that may have thrown the 2016 election; behind the Sony hack; behind mysterious power outages around the world and the disappearance of thousands of personnel records from poorly guarded government servers are the traces of a new and powerful weapon, one that has the potential to remake global conflict like nothing since the invention of the atomic bomb. The Perfect Weapon is the riveting story of how, in less than a decade, cyberwarfare displaced terrorism and nuclear attacks as the greatest threat to American national security.

Cheap to acquire, difficult to defend against, and designed to shield their user's identities so as to complicate retaliation, these weapons are capable of an unprecedented range of offensive tactics; they can take us just short of war, allowing for everything from disruption to theft to the cause of widespread damage of essential infrastructure systems. And the vulnerability of those systems has created a related but equally urgent conflict: American companies like Apple and Cisco must claim allegiance to no government in the name of selling secure products around the globe yet the US intelligence agencies want the help of such companies in defending against future cyberattacks.

Reported and written with unprecedented access by New York Times chief Washington correspondent and bestselling author David Sanger, The Perfect Weapon takes readers inside war rooms and boardrooms, into the secret cyberdens of American and Chinese military, to give the deep-background story of the increasingly pitched battle between nations, their governments, their cyberwarriors, and their corporations.

Genres: Nonfiction, Politics, Technology, History, Science, War, Military Fiction

384 pages, Hardcover

First published June 19, 2018

Reviews

[Clif Hostetler · Rating 3 out of 5]

This book consists largely of the retelling of cyber attack incidents that have previously been in the news over the past ten years. However, the retelling in this book at this time has the advantage of hindsight which provides the enabling perspective regarding background, motive and attribution that were largely uncertain when the stories were first reported. Additionally, encompassing all these stories into one book at this time allows the pondering of their ramifications on privacy, crime, and international relations.

Some of the better known incidents elaborated by this book include (1) Russian interference during the 2016 presidential election, (2) American/Israeli computer worm Stuxnet that blew up Iran’s nuclear centrifuges, (3) Russian cyberattacks on Estonia and Ukraine, (4) the 2014 North Korean cyberattacks on Sony Pictures, and (5) the 2017 worldwide cyberattack by the WannaCry ransomware cryptoworm. Of course part of the story also includes the Edward Snowden and WikiLeaks affairs, and the ripple effects they had on subsequent relations between tech companies and nation states. The author covered these stories as an investigative reporter for the New York Times at the time when they were first in the news. Thus, he is able to retell these stories by frequently switching into first-person voice while recounting interviews with the individuals affected by the incident.

As indicated by the book's title and subtitle, the cyber world provides a new way of exerting power, committing crime, and/or waging war. Cyber arms are a great equalizer. They're low cost and largely asymmetrical. They allow a degree of anonymity and stealth in their use while at the same time holding large swaths of nation-state infrastructure and private-sector infrastructure at risk. Additionally, rogue nations such as North Korea have been able to use cyber tools to make money by illegally hacking into electronic bank transfers (e.g. Bangladesh Bank cyber heist).

Cyber conflict has the additional complication for governments and businesses because of their unwillingness to admit victimhood or participation in such action. Cyber damage not only hurts reputations, going public can reveal techniques and tools that are best kept secret. Another complication is that even though national interests are involved, many of the tools and technologies involved are controlled by private companies who are marketing their products worldwide and thus prefer to appear independent of their home country.

Below are some excerpts from the book involving stories that I found interesting. The first excerpt is an example of how antiquated technology can be advantageous. The second excerpt is an example of the gullibility of Americans.

EXCERPT 1
The following is a description of the findings of an American team sent to the Ukraine to determine if the Russians could shut down the American electrical grid the same way they had done in the Ukraine.

The instructions they carried were simple: go figure out what happened and whether the United States is vulnerable to the same kind of attack. The team came back with a mixed answer. While the Ukrainians did not have defenses as sophisticated as many American utility com-
panies, a quaint oddity in Ukrainian systems ultimately saved them from an even greater disaster. lt turned out that their electric grid, built by the Soviets, was so antiquated that it wasn't entirely dependent on computers.

“They still had the big, old metal switches that ran the power grid back in the pre-computer age,” Ozment explained, as if admiring the simplicity of an original Ford Model A engine. The investigators reported that Ukrainian engineers got into their trucks and went scrambling from one substation to another, looking for switches that they could throw to route around the computers and turn the lights back on.

Score one for a creaking, antiquated system, particularly since it would take months for the Ukrainians to rebuild their damaged computer-based network controls. But Ukraine's resilience was not much comfort to the Americans who read the reports and thought about their own vulnerabilities. Few American systems still had these rusting old switches—they were eliminated long ago. And even if the American utilities had hung on to the old systems, the engineers who knew how they worked had long since retired. (p167)

EXCERPT 2
The following describes some of the early Russian cyber-meddling in American political discourse, and their surprise at their own effectiveness—and American gullibility.

Texas seemed particularly ripe for meddling. Few of the trolls and bot malters had been there, but they had read about it online and seen it in the movies. It didn't take much of a leap of imagination to form a “Heart of Texas” group that appeared to be based in Houston but was actually operating near Red Square. They promoted a rally called “Stop Islamization of Texas,” as if there were much Islamization to worry about. Then, in a masterful stroke, the Russians created an opposing group, “United Muslims of America,” which scheduled a counter-rally, under the banner of “Save Islamic Knowledge." The idea was to motivate actual Americans—who had joined each of the Facebook groups—to face off against each other and prompt a lot of name-calling and, perhaps, some violence.

It was a testament to how easy it is to mislead some subgroups of American citizens on the web with a few cheap bots and someone imitating a local resident. But no one was more amazed than the young Russians in Saint Petersburg, who, their own emails later showed, could not believe their targets were so gullible.(p202)

[Brandon Forsyth · Rating 5 out of 5]

David Sanger is simply the best writer alive working on issues of global and American security, and his latest book proves how far ahead he is of everyone else in his field. His meticulous reporting and cogent analysis of where cyber warfare is headed makes an urgent argument for international standards (a "digital Geneva Convention" is mentioned) to be discussed and adopted with haste. From the Iranian centrifuge sabotage to Russian hacking of Ukrainian power systems and American election tampering, Sanger exposes how little-understood these new capabilities are, and makes a powerful case that this confusion could lead us to a very dangerous place. THE PERFECT WEAPON is a gripping, insightful read that I can't recommend enough.

[Mehrsa · Rating 5 out of 5]

This is an excellent and terrifying read. The Russians and Chinese and North Koreans are in the house and it seems that this administration is not at all aware of the magnitude of the threat. Sanger has a lot of access and a depth of knowledge on the issues and this history. He's also an excellent writer. I do have some critiques--he seems to think that the olympic games project where the US and Israel hacked into the Iranian computer networks was completely justified (though he worries about its effects). I'm not so sure. Seems a bit sanctimonious to say--when we did it, it was totally responsible and justified. Now that everyone else is doing it, it's not.

[GrandpaBooks · Rating 5 out of 5]

Philip Graham is credited with calling journalism "the first rough draft of history." The author of The Perfect Weapon, David E Sanger, one of the highly respected journalists for the New York Times, called his book "current history." I am going with a 'polished second draft of history.'

As a daily reader of The Times I already had some familiarity with the topics covered in Mr. Sanger's book. However, that reading did not prepare me for what I learned from the depth of research and clarity of writing presented by Mr. Sanger in each chapter. And it's all here: Iran's nuclear centrifuges blowing up; North Korean missiles falling out of the sky; China's remarkable and frightening rise of power in cyberspace; the Russian influence in the 2016 election; and a United States president that is utterly clueless in regard to cybersecurity but still able to spout utter nonsense when asked to discuss our current cyberage.

Mr. Sanger used two words in his subtitle that stand out most to me after finishing his book: War and Fear. Although Mr. Sanger didn't actually state that we're in an ongoing cyberwar, I believe we are and to borrow from the heading of the final chapter, the ongoing cyberwar is 'just left of conventional war.'

The fear (or fears) are first: most Americans, including myself, are blissfully unaware of the ongoing war until we're struck by the "digital equivalent of shrapnel" that inflicts permanent damage on our lives. The second fear: the knowledge that there is a subset of Americans actively and gleefully, consciously and unconsciously, aiding and abetting the same cyberwar enemies that our country is fighting against. This is a must read book in my opinion.

I also recommend checking out: Lights Out-A Cyberattack, A Nation Unprepared, Surviving the Aftermath by Ted Koppel; LikeWar-The Weaponization of Social Media by PW Singer and ET Brooking; and Click Here to Kill Everybody-Security and Survival in a Hyper-Connected World by Bruce Schreiner.

[Walter Ullon · Rating 5 out of 5]

TL/DR: ⭐⭐⭐⭐⭐ Must Read. Very scary. We're screwed. Kill your social media accounts. Abandon technology. Start a homestead. Cynics are on to something.

Full Review:

The threat of Nuclear Weapons and rise of Global Warming have occupied the top spot in the list of humanity's gravest concerns for as long as I can remember, and rightly so. We have arrived at the point in our times where just a few players controlling history's deadliest arsenal can hit the reset button and send us all back to an age when sticks and rocks were considered very high-tech. And it would all happen very fast.

Similarly, the slow decline of our planet's condition due to pollution, over-harvesting of natural resources, and snail-paced adoption of sustainable practices have brought us closer to the teetering edge of a major global crisis.**

Fortunately, the political and social visibility of these issues, respectively, have ensured a healthy if not insufficient amount of discourse. After all, it's easy to see rockets on parade, massive landfills, and melting glaciers. But what about invisible bits of code (yeah, I used "bit" there in the double sense, I'm so cleverr...) freely crawling through cyberspace waiting for the right moment to bring our mighty technological empires all crashing down?

In "The Perfect Weapon", David Sanger makes a very compelling case for the imperative to start a conversation regarding the use of "Cyber Weapons" by nation states. Their full implications are slowly starting to be revealed and it's high time we start treating them with the same import as those previously discussed.

Scariest by far, is our inability to properly gauge the reach of their damage and to understand the full extent to which they are eroding our political and social institutions. Sure, when hackers bring down an exchange or stop you from accessing your bank account we can count the millions in lost revenue, down to the minute. But when the target is a power grid serving millions of households and hundreds of hospitals, the currency we count with is in lives. These weapons are asymmetrical, cheap, easy to deploy, delivered at digital speed, and are not deterred by borders or physical boundaries:

"Cyberweapons are entirely different from nuclear arms, and their effects have so far remained relatively modest. But to assume that will continue to be true is to assume we understand the destructive power of the technology we have unleashed and that we can manage it. History suggests that is a risky bet."

And let's not forget the disruption brought about by those social media platforms that not too long ago were celebrated for their ability to bring democracy and free-speech to remote parts of the world under totalitarian rule. The are now part and parcel of a new breed of attack on the same institutions they once sought to protect. On Russia's capabilities to use these attacks, Sanger writes:

"The Internet Research Agency could actually degrade social media’s organizational power through weaponizing it. The ease with which its “news writers” impersonated real Americans—or real Europeans, or anyone else—meant that over time, people would lose trust in the entire platform. For Putin, who looked at social media’s role in fomenting rebellion in the Middle East and organizing opposition to Russia in Ukraine, the notion of calling into question just who was on the other end of a Tweet or Facebook post—of making revolutionaries think twice before reaching for their smartphones to organize—would be a delightful by-product. It gave him two ways to undermine his adversaries for the price of one."

If Sanger is correct, and it's hard to argue against his point, we have all become part of the weapon system, and what is worse, we are just cluelessly strolling around this new battlefield, too. Posts, shares, tweets, and likes could prove just as noxious to society as ignorance, prejudice, apathy, and complacency.

Taking pride in participating in the democratic process every election cycle is no longer sufficient, it seems. We must make an effort to become savvier in the ways in which what we choose to use, share, and engage with, is used to distabilize an ever increasing technological dependent, interconnected world. We could all be more responsible in this respect; awareness leads to discussion.

After reading Sanger's excellently written and thorough examination of the role of Cyber Weapons in the 21st century, I'm convinced they pose the most immediate threat to our times and way of life.

Please do yourself a favor and at least skim its pages and see for yourself. Start there.


**If you have read "Factfulness" by Hans Rosling you'd be inclined to dispute this point, but my biggest issue with the book is that it took the long term effects of this prosperity far too lightly. See my review: https://www.goodreads.com/review/show...

[Radiantflux · Rating 4 out of 5]

66th book for 2018.

Nice summary of current situation around cyberwar from an American perspective. This is a scary world where large state players (China and Russia, but also North Korea and Iran) are increasingly intruding (attacking?) US targets. The US is largely unprotected from a cyberattack, which could take down power, water etc. relatively easily. Having read this it's really unclear how secure US voting systems are from an attack during 2018 election cycle.

Well worth a read. A nice complement to Russian Roulette which covers some of the same material as it relates to Russia's hacking of the 2016 US Elections.

4-stars.

[Krutika · Rating 5 out of 5]

• r e v i e w •
.

“As we put autonomous cars on the road, connect Alexas to our homes, put ill-protected Internet-connected videos cameras, and conduct our financial lives over our cell phones, our vulnerabilities expand exponentially.” - David E. Sanger
.

The Perfect Weapon is an absolutely terrifying piece of literature which delves deeply into the rise of cyber warfare and how it has altered the lines of geopolitics, world economy, and even the everyday lives of civilians. Sanger largely focusses on the “Seven Sisters” of cyber conflict: The United States, Russia, China, Britain, Iran, Israel, and North Korea - how cyber conflict has expanded since the revelation of the American/Israeli attacks on Iran’s nuclear program. He explores how great and small powers alike have moved into a new era of constant sabotage, misinformation, and fear, in which everyone is a target. The message is alarming. "Rarely in human history has a new weapon been adapted with such speed, customised to fit so many different tasks, and exploited by so many nations to reshape their influence on global affairs," Sanger writes. He goes on that cyber weapons have the capability to "fry power grids, stop trains, silence cell phones, and overwhelm the internet".
.

If these doomsday scenarios are the future, the future is now. It is well-known that the US and Israel planted a computer virus, known by the code name "Stuxnet", into Iran's nuclear facilities, causing centrifuges to spin out of control, and setting back its nuclear program for years. Russia resorted to cyber war in Ukraine, as part of its conventional invasion. And, of course, Russia used cyber weapons to influence the 2016 US Presidential elections, as well as the Brexit vote. And this is just the tip of the iceberg covered by David Sanger. North Korea’s attack on Sony Pictures just to prove its point, or her swindling of nearly a billion dollars from Bangladesh – it felt like I was reading more of a sci-fi thriller. The fact that privacy is a myth and no-one is exonerated from the clutches of cyber war is far more than chilling. Whilst the book mostly covers about the clashes between the US and other governments, the reality that the lives of civilians are at stake as collateral is shocking and scary. The technological advancement in cyber warfare has improved so much that missiles can be disabled even before they can be fired. The personal e-mails, chats and files exchanged which are supposedly “encrypted” and “secure” are not as secure as it is claimed.
.

We are aware of the kind of traditional warfare where countries go to war at the borders with their guns blazing. Civilians are seldom directly involved. Quite recently, when the Chinese soldiers intruded across Indian borders which later led to a bloodbath, we were quite comfortably watching the news of Amitabh Bachchan being tested positive for COVID19. This safe haven doesn’t exist in the realm of cyber warfare. It is the scenario where our most intimate secrets that are safely locked and hidden in our mobile phones, laptops or hard disks et al can be easily erased or worse – stolen. The power supply to our homes be cut or our bank accounts can be emptied. It would take months to just figure out who the perpetrator was and almost impossible to undo the damages. In this new and expanding form of warfare, the civilians are the inevitable collateral damage. The book was well paced and the language used was crisp reflecting that Sanger has worked for three decades at The New York Times. “In the 21st century we have seen a toward blurring the lines between the states of war and peace. Wars are no longer declared and, having begun, proceed according to an unfamiliar template”, says David E. Sanger.
.

Is this book relevant to all? After reading, I have covered the camera of my laptop with a tape, strengthened my passwords and thoroughly assessed the permissions granted to various apps in my phone. That’s what The Perfect Weapon made me: cynical, cautious and importantly, aware about the dark reality of the digital world. The book is easily one of most thrilling and terrifying non-fiction books I have ever come across.
.

Rating : 4.7 / 5

[RC1140 · Rating 3 out of 5]

This was a great review of the political and cyber landscape over the past decade or so. Not much new information if you have been following along , but really well condensed into a single source which gives things broader context.

[Mal Warwick · Rating 5 out of 5]

Russia and China have penetrated so deeply into the electronic systems that sustain the American economy that either country might be able to set us back two or three decades using cyber weapons. North Korea and Iran appear to be not far behind. What seems to be stopping them all is the equal or greater ability of the United States to do the same or worse to them—not to mention the chance we might reduce their countries to cinders with nuclear weapons. That's the message at the heart of David E. Sanger's chilling new book, The Perfect Weapon. "Great power competition—not terrorism—is now the primary focus on US national security," he writes. And that competition is increasingly playing out online.

The US government has been slow on the uptake to acknowledge this threat. In 2007, the intelligence community's annual worldwide threat assessment delivered to Congress did not even include cyber weapons on the list. At that point, both Russia and China had been building their cyber capabilities for years. Now, of course, attitudes have changed. The United States Cyber Command, created in 2009, was upgraded only in 2018 into a Unified Combatant Command, one of ten in the US armed forces. Cyber Command is headquartered at Fort Meade, along with the National Security Agency, and is commanded by the agency's director. Together, NSA and Cyber Command house both our country's offensive and defensive cyber operations. Sanger explains that the two organizations work together uneasily. Their priorities are sometimes at cross-purposes.

Excessive caution about the threat of cyber weapons

David Sanger is extraordinarily well-connected in Washington. He has been writing on foreign policy, globalization, nuclear proliferation, and the presidency for more than thirty years for the New York Times. He has been the paper's Chief Washington Correspondent since 2006. Throughout The Perfect Weapon, he cites one-on-one conversations with nearly all the major players in the drama he describes. And drama it is. This book details the bureaucratic turf wars, foot-dragging, incompetence, and excessive caution that has so often characterized America's inadequate response to the threat posed by cyber weapons.

The dilemma Sanger describes is worrisome. "America's offensive cyber prowess has so outpaced our defense that officials hesitate to strike back," he writes. Although American companies and government are penetrated online thousands of times every day, the government has rarely spoken out to denounce those responsible. Partly, this is because it may take days, weeks, or even months to assemble definitive proof about who launched a given attack. But it's also because officials in the CIA, NSA, Pentagon, and White House are unwilling for our adversaries to gain any insight into how we obtained the information. Even when we know perfectly well who's responsible, they decline to speak out. Simply citing specific evidence could reveal the existence of American or Allied "implants" in their computer systems. Like many of the top former officials he interviewed, Sanger regards that reluctance to show our cards as an error.

"The US has only rarely activated cyber weapons"

Unless the government can accuse an adversary in public, it's hampered from retaliating. The upshot is that the US has only rarely activated cyber weapons, so far as we know. (The most notable exceptions were the Stuxnet attack on Iran's nuclear production facilities in 2010, carried out jointly with Israel, and the attack on North Korea's launch systems that caused its missiles to explode or fall into the sea.) However, Russia has not hesitated to attack weaker nations, chiefly Ukraine and Estonia, as well as both the United States and Western Europe.

As Sanger points out, there are ways, however inadequate, that the United States might combat a nuclear attack. There is always a warning, even if it's measured only in minutes. With cyber weapons, however, there is no warning. And "In almost every classified Pentagon scenario for how a future confrontation with Russia and China, even Iran and North Korea, might play out, the adversary's first strike against the United States would include a cyber barrage aimed at civilians." And the threat isn't limited to those four hostile countries. "A decade ago," Sanger notes, "there were three or four nations with effective cyber forces; now there are more than thirty." Now we face the proliferation of cyber weapons, not just nuclear devices.

About the author

David E. Sanger has written two books on American foreign policy as well as The Perfect Weapon, his most recent work. He is the Chief Washington Correspondent for the New York Times.

[Nicole · Rating 3 out of 5]

A decent read pulling all the various strands of the cyber story together in one place, but likely to feel like review if you’ve been reading the news for the last ten years.

[Mac · Rating 5 out of 5]

Buy.

An excellent and honestly, a bit horrifying read. This book is an easy and accessible way for most people to get quickly updated on the growing role that cyber space plays in our lives, and the ways it already has. Every chapter expands on the stories I had read in the news over the years -the chapter on North Korean missiles was particularly revealing for me.

While told from the American perspective, I would strongly recommend this book for military historians or those in geopolitics looking to expand their knowledge on the fifth domain. This is also a great companion for those working in cyber, specifically from or with a government angle.

I would be greatly interested in a book that expands on the history of cyber and tells the story from more than just the American angle. I will be watching closely for Sanger's next book.

[Roman Trukhin · Rating 4 out of 5]

Протягом останнього десят��ліття у Таймс було опубліковано багато матеріалів-розслідувань, що стосувались використання неконвекційної зброї в кіберпросторі. Книга є фактично літературно-опрацьованим збірником цих статей, що описують збройні конфлікти радше з політично-філософської, а не технічної точки зору.

Якщо хочеться зануритися в тему, але відлякує надмірна деталізація технічних моментів, то це видання - саме те, що потрібне для розігріву. Правда є нюанс: книзі уже 3 роки і хоча на перший погляд це ніби небагато, для галузі кібербезпеки - це прірва часу, протягом, якої стались і соларвінд, логфошел, які навіть окремо можуть стати окремими книгами.

[Joseph Stieb · Rating 4 out of 5]

An outstanding introduction to cyber warfare and the U.S. defense establishment's struggle to adapt to it. Covers Russia, China, Ukraine, North Korea, and lots of corporate spying and stealing. Not every chapter fully enthralled me, but overall this book is excellent for getting at the thorny questions of cyber warfare: Is it really warfare? How can we come to agreements on these weapons if most sides won't say what they can do? Is an attack on a multinational company an attack on a sovereign nation in which it is based?

[Oleh Bilinkevych · Rating 3 out of 5]

Багато води та самоповторень. Багато фокусу на США і дуже туманне формулювання впливу КНР на так званий кіберпростір.

Почасти, складалось враження, наче автор брав матеріал із загальнодоступних новинних джерел, а не особистих, про які він часто згадує.

Ще одна книга, яка чудово показує всю нікчемність колективного Заходу у протидії сучасним загрозам. Просрали все що можна.

[Grady Henexson · Rating 4 out of 5]

4⭐️ Although a bit outdated, this is a great book covering the new age of cyber warfare. A solid read for anyone who wants to learn more about cyberwar and refreshing insights for computer nerds like me.

[Russell Atkinson · Rating 4 out of 5]

Sanger has done an excellent job of reporting, and now accumulating, accounts of cyberwarfare for many years now. History has shown that generals and presidents or rulers the world over have always prepared for the previous war, not the one that confronts them. Today's war is being fought remotely through networks. Sanger does a good job of explaining how devastating an all-out attack could be. The United States is more vulnerable than any other nation because we are more connected than any other. Just consider what life would be like permanently without electricity or your local water system. Gas stations will have no gas or no way to pump what they have, so even generators won't work long. The book is not written with an alarmist aim, but it is sobering. It can seem repetitive, but it is informative and readable.

[Shiloh Liu · Rating 4 out of 5]

must read to understand how cyber blurs the lines between war and peace, public and private, etc.

[Book Shark · Rating 4 out of 5]

The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age by David E. Sanger

“The Perfect Weapon” is an interesting look at the political implications of cyberwarfare. National security correspondent for the New York Times, David E. Sanger takes the public on a historical ride into the world of cyberweapons and how it has transformed geopolitics. This enlightening 354-page book includes the following twelve chapters: 1. Original Sins, 2. Pandora’s Inbox, 3. The Hundred-Dollar Takedown, 4. Man in the Middle, 5. The China Rules, 6. The Kims Strikes Back, 7. Putin’s Petri Dish, 8. The Fumble, 9. Warning from the Cotswolds, 10. The Slow Awakening, 11. Three Crises in the Valley, and 12. Left of Launch.

Positives:
1. A clearly written and researched book.
2. An interesting topic, the history and implications of cyberwarfare.
3. Sanger has great command of the topic and is very fair and strident with his criticism.
4. An excellent Preface that sets the tone for the book. “Cyberweapons are so cheap to develop and so easy to hide that they have proven irresistible. And American officials are discovering that in a world in which almost everything is connected—phones, cars, electrical grids, and satellites—everything can be disrupted, if not destroyed.”
5. Provides the key difficulty in dealing with cyberwarfare. “After a decade of hearings in Congress, there is still little agreement on whether and when cyberstrikes constitute an act of war, an act of terrorism, mere espionage, or cyber-enabled vandalism.” “But figuring out a proportionate yet effective response has now stymied three American presidents. The problem is made harder by the fact that America’s offensive cyber prowess has so outpaced our defense that officials hesitate to strike back.”
6. The book is full of detailed examples of cyber intrusions committed by our biggest rivals. “Investigators raced to figure out how the Russians had gotten inside. The answer was pretty shocking: The Russians had left USB drives littered around the parking and public areas of a US base in the Middle East. Someone picked one up, and when they put the drive in a laptop connected to SIPRNet, the Russians were inside. By the time Plunkett and her team made their discovery, the bug had spread to all of US Central Command and beyond and begun scooping up data, copying it, and sending it back to the Russians.”
7. Describes interesting military cyber operations. “Cyber Command’s piece of the puzzle was to contribute to an operation named Nitro Zeus. It was a plan—using cyber and other methods—to shut down the entire country, preferably without firing a shot. If Olympic Games was the cyber equivalent of a targeted drone strike on Iran, Nitro Zeus was a full-scale attack.”
8. Cyber espionage by China. “China does more in terms of cyber espionage than all other countries put together,” the expert James Lewis noted to me in the midst of the investigation into Shotgiant. “The question is no longer which industries China is hacking into. It’s which industries they aren’t hacking into.””
9. Discusses the Snowden affair. “The Snowden affair kicked off a remarkable era in which American firms, for the first time in post–World War II history, broadly refused to cooperate with the American government.”
10. A fascinating look at balancing security and privacy. “But Cook had a bigger and better argument, one that the government could not so easily parry: if Apple created a back door into its code, that vulnerability would become the target of every hacker on Earth. The FBI was naïve to think that if the tech companies created a lock and gave the FBI a key, no one else would figure out how to pick it.”
11. Excellent chapter on North Korea. “The North Korean military began training computer “warriors” in earnest in 1996, he recalled, and two years later opened Bureau 121, now the primary cyberattack unit. Members were dispatched for two years of training in China and Russia. Jang Sae-yul, a former North Korean army programmer who defected in 2007, said these prototypical hackers were envied, in part because of their freedom to travel.” “In short, cyberweapons were tailor-made for North Korea’s situation in the world: so isolated it had little to lose, so short of fuel it had no other way to sustain a conflict with greater powers, and so backward that its infrastructure was largely invulnerable to crippling counterattacks.” “Today the North may be the first state to use cybercrime to finance its state operations.”
12. Obama’s view on cybersecurity. “In short, until the Sony attack Obama believed corporate America should take responsibility for defending its own networks, just as they take responsibility for locking their office doors at night. That approach made sense most of the time: Washington could not go to DEFCON 4 every time someone—even a state—went after part of the private sector.”
13. What would a book about cyber intrusions be without Putin. “Putin’s goals in Ukraine were as much psychological as physical. He wanted to declare to Ukrainians that their country exists only because Russia allows it to exist. Putin’s message to the Ukrainians was simple: We own you.” “What happened in Ukraine confirmed the corollary to the Gerasimov doctrine: As long as cyber-induced paralysis was hard to see, and left little blood, it was difficult for any country to muster a robust response.”
14. US elections meddling. “In late 2014, the agency dug into its social media campaign to commence its disruption of the US elections. The group deployed hundreds of fake accounts on Facebook and thousands on Twitter to target populations already divided by issues like immigration, gun control, and minority rights.”
15. The impact of social media. ““I didn’t realize at the time that two-thirds of American adults get their news through social media,” said Haines, who was among the most thoughtful members of Obama’s team about the impact of social movements on democratic processes.”
16. A look at the Shadow Brokers. “Inside the NSA, this breach was regarded as a far greater debacle than the Snowden affair. For all the publicity and media attention around Snowden, a dark if compelling character who could still command headlines from his exile in Russia, the Shadow Brokers were inflicting far more damage.”
17. The use of cyberwarfare to disrupt our enemies. “The goal of the new campaign, I was told in a series of briefings, was to disrupt the Islamic State’s ability to spread its message, attract new adherents, circulate orders from commanders, and carry out day-to-day functions, including paying its fighters.” ““Operation Glowing Symphony,” as it was code-named, would be the largest cyber effort against ISIS and one of the last big cyber operations that Obama approved in the Situation Room.”
18. An expose of Facebook. “From the start, Facebook made its money not by selling connectivity, but by acting as the world’s seemingly friendly surveillance machine, then selling what it learned about users, individually and collectively.” “In September 2017, ten months after the election, the company finally began to concede the obvious. It said those who had manipulated Facebook “likely operated out of Russia,” and it turned over 3,000 of these ads to Congress.”
19. Interesting tidbits throughout the book. “A government that still gave lip service to communism had figured out venture capitalism—and concluded it was the shortest path to get the technologies the country needed.”
20. The legal difficulties in dealing with cyber issues. “There is no issue on which government lawyers have spent more time, to less productive effect, than on the question of how the laws of war apply to cyber.”

Negatives:
1. Doesn’t do a good job of distinguishing the different categories within cyberwarfare.
2. Lack of supplementary visual material. No charts, no photos, few diagrams to compliment the otherwise excellent narrative.
3. Limited links to notes.
4. If you are an avid news junkie and follow cyberwarfare a lot of what’s in the book will seem like well old news.

In summary, I really enjoyed this book. Sanger does a wonderful job of describing the difficulties of dealing with cyberwarfare and its implications. He clearly is well connected and takes advantage of such access to provide the public with some keen insights. The book is full of detailed examples of cyber intrusion by well-known actors like Russia, China, North Korea and Iran. A few shortcomings but overall a worthy read on an important hot topic, I recommend it!

Further suggestions: “Dark Territory: The Secret History of Cyber War” by Fred Kaplan, “Like War: The Weaponization of Social Media” and “Cybersecurity and Cyberwar” by P.W. Singer, “Dawn of the Code War” by John P. Carlin, “Cyber War” by Richard A. Clarke, “Facts and Fears: Hard Truths from a Life in Intelligence” by James R. Clapper and Trey Brown, “A Higher Loyalty” by James Comey, and “The Assault on Intelligence” by Michael V. Hayden.

[Lord Temujin · Rating 5 out of 5]

A very insightful book about a new 21st Century realm of warfare: Cyber.

[Scribe Publications]

In a chilling new book, The Perfect Weapon, David Sanger details how more than 30 nations have developed effective cyber forces.
Financial Times

[Sanger] writes with persuasiveness and authority.
The Telegraph

[Sanger is] a shrewd and insightful strategic thinker.
New York Times

An encyclopedic account of policy-relevant happenings in the cyberworld … the most comprehensive, readable source of information and insight about the policy quandaries that modern information technology and its destructive potential have spawned.
New York Times Book Review

Sanger, The New York Times’ security correspondent, has catalogued the recent history of how cyber warfare has developed, how it needs to be confronted, and the intensely complex policy issues that arise.
Courier Mail

In his new book, The Perfect Weapon, Sanger offers a panoramic view of the rapidly evolving world of cyber-conflict. He covers incidents from the covert U.S. cyber-campaign to sabotage Iran’s nuclear program (a story we know about largely because of Sanger’s diligent reporting) to Edward Snowden’s epic heist of National Security Agency data. And yes, there’s also plenty of background on Russia’s active measures during the 2016 campaign. But there’s also a wealth of gripping material on stories that have probably been missed by the broader public … It all adds up to a persuasive argument for the truth of the book’s title.
Christian Caryl, The Washington Post

[The Perfect Weapon is] an important – and deeply sobering – new book about cyberwarfare.
Nicholas Kristof, New York Times

Anyone who doubts cyber’s unintended consequences should read David Sanger’s new book The Perfect Weapon. Sanger, a reporter for The New York Times, has been a dogged and diligent observer of cybersecurity issues for years. His book is a readable account of what went wrong.
Robert Samuelson, The Washington Post

This encyclopedic account by a Times correspondent traces the rapid rise of cyberwarfare capabilities and warns that ideas about how to control them are only beginning to emerge.
The New York Times Book Review (Editor’s Choice)

Sanger, The New York Times’ security correspondent, has catalogued the recent history of cyber warfare, how it needs to be confronted and the intensely complex policy issues that arise. This is the last word in the modern world of cyber warfare – until artificial intelligence takes over.
Mercury

The Perfect Weapon may be one of the most important, if chilling, books you’ll read this year.
The Saturday Age

The greatest virtue of Sanger’s writing is that it is clear-headed and morally grounded, not in any way breathless or apocalyptic.
Paul Monk, Weekend Australian

For the rest of the lay public, this very accessible book by New York Times journalist David Sanger is an outstanding volume to fill in the gaps.
Anthony Smith, NZ International Review

[Rick Presley · Rating 5 out of 5]

If any book deserves the sobriquet, "If you're not outraged, then you're not paying attention," this one does. It is the compilation of fairly recent news items on the subject of cyber warfare. What was reported at the time it happened as nearly random, but intentional acts of computer sabotage have proven to be part of a grand strategy on the world stage of state actors to engage in warfare that puts everyone at risk. In essence, there is little if anything in this book that is new, but by structuring it the way he does, it paints a far bleaker picture than when the events were taking place.

Locally, at the time of this writing, my neighbors who are using CenturyLink for their internet access are experiencing a series of annoying outages that their carrier cannot seem to resolve. It is so bad that the company is reported to be under investigation. After reading this book, I suspect this is another attack and no one has had the courage or the resources to definitely state that's what it is.

This book is a must read for anyone who wants to be truly informed about the major attacks, where they came from, how they were promulgated and what the response to them has been. You will not leave with any assurance that the Powers That Be have any way of dealing competently with the threats, so this will scare you spitless, but other than that, it is a must read.

Just one example should suffice. We know that Facebook was targeted by Russian actors as a means of promulgating false news. Two major things about this infuriated me and continue to leave me without much hope that our elected officials and business leaders can be trusted to manage the vulnerability. Neither the Trump nor the Obama administrations demonstrate any competence in these matters (and that doesn't even get into the inept Democratic National Congress). Meanwhile, this is what irritates me the most:

1. Zuckerberg's Congressional hearing convinced me that our legislators at the federal level are hopelessly incompetent, uninformed, backward, idiotic, and generally clueless when it comes to any sort of technology. I am no geek, but there are teenagers that know more about computers, software, and the internet that the entire composition of the congressional investigating committee. It was apparent from their questions, their speeches, and most importantly, their findings that they do not have the first idea of what all this is about. We need competent help sitting in Congress.

2. Frontline's investigative reporting of Facebook showed that even though they may be smart at FB and Google when it comes to software and computer capability, they are absolute children when it comes to managing companies and assuming responsibility for their actions. The interviews with Sandberg and Zuckerberg had me despairing that we have given infants the ability to launch the cyber equivalent of ICBMs without any oversight.

I can only hope that the grownups show up soon and know enough about computers to handle themselves competently. If Sanger is anywhere close to prescient (and I'm deathly afraid that he is), we are going to see things get a lot, lot worse before they even begin to improve.

[William Schram · Rating 4 out of 5]

In The Perfect Weapon, author David E Sanger does an excellent job of terrifying me. With America’s Allies and Enemies having Cyber weapons and attack capabilities, you would think that the leadership of America would have some kind of plan or something. Apparently, they do not have anything of the kind. Our weapons of mass destruction are aging at a steady rate, the launch computers are apparently using Floppy Disc Drives, and the people in charge of reacting to the threats are sitting on their laurels. It is really quite ridiculous to think that some old person who knows nothing of computers and what they are capable of is in charge of making laws and things, but that is the case in America. Then you have to combine that with the fact that our own laws and bureaucratic tendencies make us slow to react and you have a giant recipe for disaster.

Now I suppose it is not all bad, there is this book that was allowed to print I suppose. However, keeping our own capabilities a secret is like shooting ourselves in the foot. Not to mention that the people with legit access to our secrets are idiots. Do you know how the Russians accessed some really important line in the Chain of Command that stems directly from the President? Some idiot found a USB drive lying on the ground somewhere and plugged it into a computer station with access. That is ridiculous.

The book is named the way it is because, when used properly, Cyber weapons are difficult to trace and pin on any single aggressor. They are silent, and in many cases cause annoyance rather than straight up death.

The author gives some advice, but a lot of it will fall on deaf ears. Thus, this book sickens me. It wasn’t really enjoyable, but it was quite informative.

[John · Rating 5 out of 5]

How to the laws of war apply to cyber? That is the question. Why not just manipulate North Korea's missile launches software prior to launch and thereby plunging them into the sea shortly after takeoff? Well, that would amount to preemptive war in violation of international law. So when Sanger seeks information about those failures at the Pentagon, he's met with stony silence. Yet cyber manipulation has happened before, namely when the U.S. and Israel caused Iran's nuclear centrifuges to whirl off into destructive spins. Indeed cyber is indeed a part of any future war --one country's ability to plunge another into utter darkness so fast that retaliation is impossible. In many ways the U.S. has been asleep to realities of cyber intrusions and hacks. Bureaucratic infighting. Chinese stealing our intellectual property silly. And what about Russian intrusions in into our election processes? Clear, straightforward news reporting narrative. Overall message: Wake Up!

[Ietrio · Rating 1 out of 5]

This book reeks of old white journalist who has a hard time keeping his high standard of living. Sanger has a good self image, which makes the context even more pompous than it is. The guy has a problem grasping the computers, but who cares as he is well steeped into the Red Scare. The chapter titles are cute, and the lame puns are the best part: Pandora's Inbox, The Kims Strike Back. I get a feeling from his shallow understanding of the Russian society that he is not fluent in Russian.

So this is just another scare story from another fear monger in dire need of money.

[Ahmed · Rating 4 out of 5]

This book is a healthy dose of reality documenting the cyber war that is currently being waged by Russian, Chinese, and North Korean state sponsored hackers on us. Russian disruption of power in the Ukraine, the North Korean hack of Sony, Russian fake ads on Facebook, the US cyber attack of Iranian nuclear facilities, and the Wannacry virus are all well documented.

This book goes to show where the future of battle is going. Cyber will be an important realm of any kind of conflict.

[Steven Yenzer · Rating 3 out of 5]

This reads more like a series of news articles than a cohesive book. The stories are well-reported and interesting, but didn’t seem to come together into a big picture.

[Evin Ashley · Rating 5 out of 5]

Outstanding research, pacing of content, and articulate analyses - Sanger's book should be widely read by every American, and I emphasize American, as we grapple with our identity in the context of a global society.

I 100% agree with the NYT (to which Sanger is a contributing journalist), which stated The Perfect Weapon is "the product of extraordinarily diligent reporting...devastatingly effective."

My blood pressure rose reading about the Russian interference in the 2016 US Presidential Election, particularly in "purple states", of which "Texas seemed particularly ripe for meddling" (p.202): states that have ample potential for fostering a moderate political climate. In these states, Russian hackers actively sowed fake news which divided the electorate at a crucial time - and the attackers' impact reverberates today, like a sickening echo chamber.

Our own government has been reticent to admit the incredibly embarrassing and devastating penetration of our physical and cyber infrastructure, which started as soon as the USSR fell in the 90s. In order to avoid public paranoia and demoralization, our government generally refused to acknowledge the scope or source of these cyberattacks, not only from our worst enemy in this domain - Russia - but from China, Iran, North Korea and other less influential actors which simply have the will to impair our systems, values and standing in the world. That is all it takes, because cyberattacks are cheap and the great leveler - our open and advanced society is much more vulnerable than theirs.

As Sanger noted:

"It was (...) the beginning of a series of fumbles across the board that undercut America's ability to react at a crucial point in time when it could have made a difference." (p.192)

"Babies had been conceived and born in the time it took the DNC, and the US government, to wake up." (p.205)

"We are living in a gray zone, one of constant digital conflict". (p.308)

I support an even stronger cyber strategy than Sanger suggests: We should not simply agree to international norms of moderation; to mutually refrain from certain devastating attacks - we should send a clear message to those that have attacked us with intent to continue doing so that it is in their interest to cease and desist.

There is a new dimension of moral geopolitical obligations to consider: The Obama administration refrained from retaliating against a Russian cyberattack because it would have shut down a gas pipeline to Europe, which would have meant our allies had a cold winter. To refrain from retaliation was a mistake. Europe would have temporarily suffered for the greater good: If our allies run the risk of becoming collateral damage, they would have been incentivized to a more concerted effort to combat cyberattacks from our aggressors.

I am an idealist who believes in world peace and war being the very last option on the table, but it is clear we are already in one. The values America stands for are also shared globally, and there is a real struggle for their sustainability:

"The challenge is to think about how to defend a civilian infrastructure that the United States government does not control, and private networks where companies and American citizens often don't want their government lurking - even for the purpose of defending them." (xxii, preface)

"Were they an American company first, or a global one?" (p.87)

As cyberattacks inevitably increase, our greatest vulnerability as "Western" society is the independence between our institutions. Russia, China and other "Eastern" states with heavy government control of their civil society and private sector can respond faster and more aggressively in certain contexts. In order to compete with them, we have to create an incredibly effective framework for collaboration between our institutions, being careful to preserve the beating heart of creativity: Independence, freedom of expression, exchange of ideas.

This will ensure that our form of governance and way of life, which are taking hits in the short term, triumph in the long term.

[Brahm · Rating 2 out of 5]

A couple things I liked about this book: getting a better understanding of where cybersecurity/defence/offence fits into the world of geopolitics, understanding how cyber fits into the "stack" of modern warfare, how fast the cyber arms race is moving, and how particularly vulnerable (North) America is as we focus on innovation and leave security as an afterthought.

The geopolitics are so complicated: if a nation-state cyber-attacks you, are you justified in a physical retaliation? What is off limits for cyber attacks - hospitals, nuclear silos, or nothing? Does a nation-state have an obligation to protect private companies against cyber attacks, or hit back on their behalf?

Good depth into the Stuxnet story (Iranian nuclear enrichment sabotage), WannaCry (turns out the North Koreans did it), the Sony Pictures hack (North Koreans again), NotPetya (Russians), and more.

But, there were a couple things I didn't like.

First, this is more of a US politics book than I expected (shame on me, the reader), which makes sense because there was plenty of cyber-drama to write about in Election 2016 (DNC, Hillary server, Russians, etc). Two thoughts: I don't have any stamina left for this story, and I think it's a little too early to be writing the history books.

The other was some minor perceived inconsistencies that took away from the story. While recounting the DNC email saga, Sanger says the Russians "activated Wikileaks". Maybe this is shorthand for the sake of moving the story along. But my impression, after kinda-sorta keeping tabs on Wikileaks since it hit the scene in 2006, is that it is, or was, a fiercely independent organization. Then again - what the hell do I know, right?!

Last thing, working in automation - this book was stressful!

Final rating is tough. I liked parts of it, others not so much. Since my ratings usually reflect my overall emotional enjoyment, I'm gonna say it was "OK" (2 stars). But still came away with lots of useful information for understanding the cybersecurity landscape that will help me talk to IT and controls people at work.

[Peter · Rating 2 out of 5]

This is a well-written book on a very specific topic from a one-sided point of view with an unfortunate audiobook narrator.

That summary above is the response I'd give if anyone asked me what I think of the book. The two-star rating might seem a bit harsh, but I couldn't really justify anything higher from my perspective since I already knew the broad strokes of all the events the book covered. The details of those events were somewhat interesting, but I really didn't need 400 pages to satisfy my curiosity. However, that's very much a biased opinion coming from someone who works in IT and follows international news. For people only vaguely aware of the current cyber environment and political landscape, this is a very informative book covering the last decade or so on the topic of cyber threats.

I should note that this is told from a very biased perspective, one of a journalist working in the USA, seemingly for an American audience and from the viewpoint that America is the world's only bastion of freedom, fighting a lonely war against the rest of the world's evil powers. That's not to say it pulls any punches though since the author was very critical of most of the decisions the country's national security agencies have made up to this point.

This is far from a bad book and like I said earlier, the two stars are primarily because I found it quite boring due to my prior knowledge of the events. I still learned a few things and would definitely recommend this to people curious about the topics. However, I would warn that there's a lot the general public probably still doesn't know and as much as this book tried to 'expose' a lot of 'secret' details, you can be quite sure that those are already out of date and only scratching the surface of what's really going on behind closed doors.

[Ayushman · Rating 3 out of 5]

As a historical record of cyber attacks in the last fifteen years, excellent book.

But the book falls short when Sanger attempts to conduct any sort of analysis of these events. The book is rife with contradictions- he prescribes deterrence by denial as a strategy to avert a cyber arms race. But this is in an impossible strategy to execute at a scale of the entire US economy, something Sanger himself observes happened with Stuxnet.

Sanger's obtuse writing style - suited for the New York Times - is turgid in a book. For example, he spends paragraphs theorizing who in the US government could have authorized Stuxnet while noting that only the president had the authority to order covert action.

The book also muddles along on the challenge of attribution of cyber attacks. Cyber attacks are not impossible to attribute. Much of the impossibility of attribution that surrounded my time in Ottawa was the Obama administration unwillingness to name names because then it might be expected to actually do something. A similar thing happens in the physical world with the 2014 seizure of Crimea - the little green men were obviously Russian troops, nobody person could have been confused about their origin and purpose. The Obama administration and the Europeans played along the charade because they didn't want to have to do anything about it.