U.S. Deputy Attorney General Rod Rosenstein announces that nine Iranians have been charged with conducting vast cybertheft campaigns on behalf of the Islamic Revolutionary Guard Corps.Win McNamee, Getty Images
By the numbers, the Iranian attack against American research universities sounds startling: a computer hack of more than 140 institutions, 3,700 professors, and $3 billion in data.
Perhaps even more surprising, though, is the number of the universities that seem worried: zero.
Or subscribe now to read with unlimited access for less than $10/month.
Don’t have an account? Sign up now.
A free account provides you access to a limited number of free articles each month, plus newsletters, job postings, salary data, and exclusive store discounts.
If you need assistance, please contact us at 202-466-1032 or help@chronicle.com.
U.S. Deputy Attorney General Rod Rosenstein announces that nine Iranians have been charged with conducting vast cybertheft campaigns on behalf of the Islamic Revolutionary Guard Corps.Win McNamee, Getty Images
By the numbers, the Iranian attack against American research universities sounds startling: a computer hack of more than 140 institutions, 3,700 professors, and $3 billion in data.
Perhaps even more surprising, though, is the number of the universities that seem worried: zero.
The case involves nine Iranians accused on Friday by federal prosecutors of stealing more than 31 terabytes of academic data and intellectual property from more than 8,000 professors at more than 300 institutions worldwide.
Yet organizations representing the American institutions, including the Association of American Universities, said they’d been unable to find any members expressing concern. Individual institutional leaders and cybersecurity experts also described themselves as puzzled by the charges.
ADVERTISEMENT
That most likely reflects an indictment that was more about pursuing international politics than about blunting any dire threat to American universities, according to experts with foreign-policy experience.
Circumstances including the lack of any publicly identified victims, said Josephine Wolff, an assistant professor of public policy at the Rochester Institute of Technology, “sort of suggests that maybe the intellectual-property theft piece of this may be a little less dramatic or urgent than the indictment makes it out to be.”
“It’s best to see this,” said James A. Lewis, a researcher at the Center for Strategic and International Studies and a career federal adviser on military and cybersecurity issues, “as a signal to the Iranians rather than excitement over a particular crime.”
That wasn’t the message delivered on Friday by federal prosecutors. During a half-hour news conference led by top Justice Department officials, the deputy U.S. attorney general, Rod J. Rosenstein, repeatedly emphasized the seriousness of the matter. He said the nine indicted Iranians, working on behalf of Iran’s government, now face U.S. financial sanctions and the fear of arrest if they visited any of 100-plus countries that cooperate with U.S. authorities.
ADVERTISEMENT
The Iranian hacking, which also infiltrated some American companies and government agencies, “does not just cause economic harm; it also threatens America’s national security,” Rosenstein said. “Universities can thrive as marketplaces of ideas and engines of research and development only if their work is protected from theft.”
The case represents “one of the largest state-sponsored hacking campaigns ever prosecuted by the Department of Justice,” said Geoffrey S. Berman, U.S. attorney for the Southern District of New York.
The prosecutors did not name any affected institutions. The only clue to their location came from the text of the indictment, which said that two of the affected universities were located in Berman’s New York City-area jurisdiction. Officials at New York City’s biggest research university, Columbia, did not respond to requests for comment. Paul M. Horn, senior vice provost for research at New York University, the second-largest, said federal officials had notified NYU of threats against it in the past but did not appear to have done so in this case.
The indictment came as the Trump administration has stepped up its rhetorical attacks on Iran, threatening to withdraw the United States from a 2015 global treaty in which Iran accepted limits on its nuclear-energy program in return for nations’ lifting economic sanctions.
In such a complex legal matter, it doesn’t seem likely that treaty politics somehow affected the timing of the Justice Department action, said one policy expert, Michael Eisenstadt, director of the Military and Security Studies Program at the Washington Institute for Near East Policy. Instead, he said, the case probably reflects a variety of realities, including a genuine Iranian belief that American universities might possess valuable clues about U.S. government intentions.
ADVERTISEMENT
Either way, the uncertainties in the American academic community about the meaning of the Iranian indictment occurred as federal officials were already lamenting challenges in convincing university leaders of the seriousness of the threat posed by foreign adversaries seeking intellectual property.
Just last month, in an appearance before the U.S. Senate Intelligence Committee, the FBI director, Christopher A. Wray, suggested “naïveté on the part of the academic sector” concerning Chinese spying. China and other foreign adversaries have long been taking advantage of the openness and freedom on American campuses, the FBI said in a 2011 report.
One factor that may drive doubt about the significance and meaningful extent of the Iranian hacking, Lewis said, is the apparent adoption by U.S. prosecutors of a tactic of indicting foreign actors, who most likely will never be brought into a U.S. courtroom, primarily as a signal of political intent. A key example, he said, is the May 2014 indictment of five Chinese military officers, largely as “a way to kind of draw lines about what’s unacceptable behavior in cyberspace.”
Computer hacking of American targets seems a relatively low-risk, potentially high-reward pursuit, and the U.S. government needs some way to push back, Lewis said. But the Justice Department’s talk of Iranians’ violating thousands of professors and billions of dollars in academic data appears to be largely “an indictment art form,” he said. “The indictment always reads like you’re responsible for everything from the explosion of the Hindenburg on down.”
Paul Basken covers university research and its intersection with government policy. He can be found on Twitter @pbasken, or reached by email at paul.basken@chronicle.com.
Paul Basken was a government policy and science reporter with The Chronicle of Higher Education, where he won an annual National Press Club award for exclusives.