Defense Contractors Don’t Want to Say When They’ve Been Hacked

Shhh—defense companies aren’t too excited about a new rule that would make them reveal their security breaches.

<a href="">MultiplyLeadership</a>/Flickr

Let our journalists help you make sense of the noise: Subscribe to the Mother Jones Daily newsletter and get a recap of news that matters.

In 2009, it came to light that hackers had successfully broken into the most expensive Pentagon weapons program of all time, the F-35 fighter jet, by gaining access to computers allegedly belonging to the defense contractor BAE Systems (the contractor part came out later). There had “never been anything like it,” one unnamed official told the Wall Street Journal. The intruders were later confirmed to be Chinese spies, and lo and behold, in 2012 China rolled out a stealth fighter that looked suspiciously like the F-35. Was it a coincidence?

It took several years for all of the details of the F-35 breach to be unearthed. (The first hack took place in 2007, wasn’t publicly reported until 2009, and BAE Systems’ alleged role didn’t come out until 2012.) But a new amendment to the defense budget, introduced by Sen. Carl Levin (D-Mich.), would prevent contractors from not disclosing when they’ve been hacked. The amendment would require defense contractors to report to the Pentagon when spies and hackers successfully scale their firewalls. And the contractors don’t appear to be happy about it.

Some of the contractors’ grievances were aired in Politico on Monday. Trey Hodgkins, a senior vice president at TechAmerica, a trade association, said that contractors are already participating in a voluntary information-sharing program, and they “are likely to fight the change.”

Mother Jones contacted four major defense contractors: KBR, Lockheed Martin, BAE Systems, and L-3 Communications. Only Jennifer Allen, a spokesperson for Lockheed Martin, responded—with a non-comment comment. “We are reviewing the cybersecurity amendment in the recently passed Senate version of the defense authorization bill, and will watch it closely,” she said.

Lawyers who work in contracting law are already spelling out arguments against the amendment, making the point that it doesn’t specify whether it applies to classified or unclassified information that has been breached. Kate Molony, an associate at Crowell & Moring, writes that it “raises significant questions for those that it seeks to regulate.” Elizabeth Ferrell, a lawyer at McKenna Long & Aldridge, calls it an “ambiguous legislative reporting requirement.”

But in fact, contractors already have to report some of this information. The Pentagon’s Defense Security Service releases regular reports on technology hacking in the defense industry. According to Mark Jaycox, a policy analyst at the Electronic Frontier Foundation, even though reporting is voluntary, DSS can get this information in part because recently “DOD has been adamant about inserting a clause in contracts that mandates reporting of security breaches.” He adds that the new amendment would create a uniform standard for everyone, and “the government can use this information to defend against threats.”

Richard Bejtlich, who used to work for General Electric and is now the chief security officer at the cybersecurity firm Mandiant, says there are already well-defined reporting requirements for contractors who work with classified information. He adds that extending those requirements to companies that work with unclassified information could be a good thing for taxpayers. “In the private sector, if you’re doing work for another company, you have to tell them if there’s a breach that involves their data,” he says. “It’s just good customer service.”


Headshot of Editor in Chief of Mother Jones, Clara Jeffery

It sure feels that way to me, and here at Mother Jones, we’ve been thinking a lot about what journalism needs to do differently, and how we can have the biggest impact.

We kept coming back to one word: corruption. Democracy and the rule of law being undermined by those with wealth and power for their own gain. So we're launching an ambitious Mother Jones Corruption Project to do deep, time-intensive reporting on systemic corruption, and asking the MoJo community to help crowdfund it.

We aim to hire, build a team, and give them the time and space needed to understand how we got here and how we might get out. We want to dig into the forces and decisions that have allowed massive conflicts of interest, influence peddling, and win-at-all-costs politics to flourish.

It's unlike anything we've done, and we have seed funding to get started, but we're looking to raise $500,000 from readers by July when we'll be making key budgeting decisions—and the more resources we have by then, the deeper we can dig. If our plan sounds good to you, please help kickstart it with a tax-deductible donation today.

Thanks for reading—whether or not you can pitch in today, or ever, I'm glad you're with us.

Signed by Clara Jeffery

Clara Jeffery, Editor-in-Chief

payment methods

We Recommend