On the day that they entered the headquarters of a renowned technology company, the security unit was nondescript—quiet as a mouse. It had to be that way, naturally. For months prior, the tech behemoth’s upper management had suspected that something nefarious was going on inside their organization: files were disappearing; millions of dollars’ worth of intellectual property was being copied, they believed; personal and private information, too. Worse, the executives in the corporate suite were mystified about their culprit. But they recognized the veracity of an adage in the tech industry: there are two kinds of companies—those that have been hacked, and the ones that haven’t been hacked yet.
As the tech company’s workers endeavored on their quotidian tasks that day, perusing their computers, carrying on with their familiar series of tasks, the security sleuths surreptitiously flipped open their laptops, connected to the network, and subtly began their forensics investigation. The team ran software to search for viruses and malware, which turned up nothing. They checked the servers for illicit software, which similarly turned up an absence of leads. Eventually, the operatives from the security company set up network-monitoring tools to detect where traffic might be leaving the building. Soon enough, their screens were filled with charts and numbers—reds, yellows, greens—that zigzagged up and down like an E.K.G. or digital seismograph. One of those spikes indicated that a massive amount of data was flowing out of a single computer elsewhere in the company’s offices.
But this evidence suggested another troublesome challenge. The company had always had a B.Y.O.D., or bring your own device, policy. Anyone who worked in the office could come in, connect their individual device to the network, and commence their day independent of company machinery. The computer that was funneling information, therefore, didn’t register on the roster of machines controlled and owned by the I.T. department. This left the security team with one definitively old-school option: they literally followed the wire that ran from the server to the rogue computer. One by one, they plucked up the tiles in the server room, followed the Cat-5 cable as it swam alongside hundreds of other cables, inside the walls, past yellow and white power wires, and through the labyrinthine office, until they found themselves at the end of the cord, which terminated inside a small closet. There, seated behind a laptop, was a young Chinese woman.
The security specialists searched her personal computer and immediately discovered more than 30 pieces of malware that were funneling information out of the servers and back to dozens of computers in China. The woman wasn’t an employee of the tech company. Instead, she had been hired as a student intern after e-mailing the company out of the blue, asking if she could assist in the office.
For the tech company, the problems didn’t end there. Silicon Valley may imagine itself as a larger-than-life cauldron of drama. But large companies don’t operate like John McTiernan movies or John le Carré thrillers. And even if this tech company was convinced that this intern had bilked it for critical secrets, it couldn’t prove that she was a spy or had committed espionage, or if she had been nefariously targeted herself. (For what it’s worth, a security expert on the team told me they suspected the former.) Furthermore, the company didn’t want to alert authorities, perhaps fearful that the press would find out, and the company’s valuation would be affected. Instead, it quietly parted ways with the intern and changed the company’s tech policies.
Spies and corporate espionage are a fixture of Silicon Valley. Employees at companies from Twitter to SpaceX have privately told me they suspect spooks work within their walls, stealing corporate secrets, plans for new technologies, or entire servers full of code to replicate back home. Some have suspected that these alleged agents were trying to figure out how their company’s network worked. The C.E.O. of one of the big tech companies in Silicon Valley once confided in me that not only was there “no question” that Russian and Chinese agents worked at the company, but that it was impossible to know who they were or prove that they were indeed foreign agents.
The people who run these tech companies protect their I.P., or trade secrets, with astounding security. After the recent shooting at YouTube’s headquarters, a former Google executive told me that the reason the shooter wasn’t able to get inside the building was because security measures were put in place not to protect people, but rather the data. Evident at the recent congressional hearings with Mark Zuckerberg was the reality that companies like Facebook and Google likely have more data on citizens around the globe than any national security agency, even possibly the N.S.A.
Now, in the wake of the cyber-hacking that undergirded Brexit and the 2016 U.S. election, some in Silicon Valley are wondering if protecting their servers from outside intruders could have driven spies to get in the old-fashioned way: by working inside big tech companies for more nefarious purposes than stock options. Why would the Chinese or Russian governments finance billions of dollars in R&D when they could just persuade an operative to plug a computer into an unprotected network and siphon sensitive data out for the cost of an airline flight? What better way to understand how to get around the defenses put in place by Facebook, Twitter, or YouTube than to have a mole inside the company, snooping through the code, attending meetings, or even designing the very systems they are taking advantage of?
The attempt to usurp confidential information from the furnace of American economic innovation is a story as old as Silicon Valley itself. In the 70s and 80s, spies from other countries were constantly trying to steal (often successfully) the plans for computer chips and infrastructure systems. In the 90s, it was mostly aerospace technology. In the late 80s, the C.I.A. issued a report detailing how Soviet and Chinese intelligence agents were constantly trying to recruit Valley engineers to turn over files about micro-electronics or software that was being used by the military. John Markoff, the veteran New York Times technology reporter, didn’t mince words about what’s been going on in the tech sector for decades. “This has all been part and parcel of Silicon Valley since I’ve been covering in the 1970s,” he said.
The 1980s were a particularly intense time for spying in the tech industry. Back then, it was called “cloak-and-data” espionage, and it was rampant. Reports by the C.I.A. at the time estimated that there were more than a thousand spies or engineers who had been turned, working with or for countries like China, Taiwan, Israel, Poland, Korea, and, most of all, Russia. One of the biggest and most shocking cases at the time involved James Durward Harper Jr., who was given a life sentence for conspiring to sell secrets for missile technology to Polish intelligence. Espionage in the Silicon Valley, a book published in 1984, tells the story of chip designs stolen by agents from Tokyo to Moscow, and of old-school Soviet-bloc espionage amid the Cold War.
But as the Cold War cooled off, and 9/11 turned the nation’s attention toward a new and unprecedented sort of globally matrixed foe, spying appeared to be a thing of the past. Military technology moved from missiles to encompass RTs, MTs, Likes, #FFs, GIFs, and B3s. And while it made perfect sense to try to get spies into a missile defense company, it didn’t seem plausible that any foreign government would care what people were blabbing about on Twitter. It turns out now, post-2016, that that was wrong. The social-media companies might be more powerful than the missile makers. Meanwhile, the connection between our government and our largest companies has ossified. Now, as the Department of Defense works with companies like Google and Amazon on cloud-computing technologies, or hires tech giants to help build artificial-intelligence tools that could be used in war, it would be perfectly logical that contemporary foreign spies would want access to these files, too. Vladimir Putin has been alarmingly transparent about what’s at stake in the arms race for artificial intelligence, and China’s president, Xi Jinping, is also pouring billions into A.I. development, fully aware that whoever rules the computers will run the world. North Korea has been pursuing A.I. for decades through its state-run tech research agencies. The only way to get ahead in this competition, given that the cutting edge of this work is taking place in Silicon Valley, is to snatch what’s already been done, or what is about to be built.
In the nascent days of Sputnik and building ham radios in Silicon Valley, it appears that there were two ways to get information on a company. The first was to slip a spy into America, which was not, and likely still isn’t, an easy task. The second involved turning someone who already lived and worked here. One former federal agent recently delineated, in general terms, how foreign agents infiltrate companies today. The Chinese, the former agent said, prey upon the nationalism of expats who might view stealing data as a form of devout intellectual patriotism. With Russian spies, the agent told me, it’s much more sinister. “Sometimes, Russians can try and turn someone to make them work for them, but when that doesn’t work, they switch to physical threats, even offering ultimatums to family members still living back in Russia,” the agent told me. And the web of loyalty gets even more tangled from there. As Markoff noted, it isn’t just foreign agents who likely work inside tech companies. “There are, without a doubt, people who are technical employees in Silicon Valley, but who also report to the C.I.A. and F.B.I.,” he said.
The C.I.A., N.S.A., F.B.I., and H.S.I. can all benefit from knowing the inner workings of a company like Twitter, Apple, Google, Facebook, Microsoft, or Amazon. In the late 90s, the C.I.A. funded its own venture firm in Menlo Park called In-Q-Tel, with the hope that investing in tech companies could help the agency gain access to cutting-edge technologies that might be useful for national intelligence. (The “Q” was a reference to the fictional James Bond “Q Branch,” which was a fictive research-and-development division of the British Secret Service.) But after the dot-com bust and 9/11, the division changed course—at least as far as we know. These days, company agendas and politics have made collaboration fraught. After information was released in the Edward Snowden reports, Apple refused to help the F.B.I. break into the iPhone’s encryption software. The N.S.A. has been unable to gain access to private information about the browsing or social-media habits of certain Americans or foreign nationals. What better way to solve these problems than having an agent walk in through the front door and just take them?
It’s beyond obvious, as the fog of the 2016 election clears, that Russia used tools built in Silicon Valley against the country that built them. Were spies working within those social networks? Are they still? All we know is that it’s probably going to get worse. In the future, spies from Russia, China, Korea, and elsewhere may show up at companies like Facebook and Apple, Amazon and Microsoft, and pose as engineers; similarly, engineers currently working there may be turned by foreign agents. They’ll presumably pursue artificial intelligence that will be able to shut down power grids, destroy entire computer systems, sway the financial markets, and gather vast amounts of information on American citizens. Or, maybe—as has been proven so effective already—to create fake news and fake videos that can be used to tear our country in two. As I’ve noted before, we’re only in the first inning of the disinformation wars. Imagine the day when our adversaries learn how to perfectly imitate a New York Times article, or CNN broadcast, for their own purposes.
There is also a silver lining, of sorts. Owing to the Trump administration’s lax attitude toward pursuing new thresholds in artificial intelligence, several people have noted to me recently that Chinese delegations that used to visit Silicon Valley on a regular basis are now staying home. One expert on U.S.-China relations told me that President Xi understands the future of A.I., and its role in both defense and economic growth, and is subsequently investing billions in resources to pursue that future. In contrast, Trump is more concerned with coal. This juxtaposition will have a considerable impact moving forward. The world we will inhabit in five years will be remarkably different from the one we live in now. Artificial intelligence, and the technologies it spawns, will lead to quantum computing—computers that are so powerful that they will jettison us into a new era of humanity, connectivity, and intelligence. Computers that will operate millions of times faster than current machines, and in turn, easily decrypt even the most advanced cryptography we use today. Computers that will work so quickly that the speed of disruption in any industry could happen not in decades, years, or even months, but rather, in an instant. And that while it may be Silicon Valley that creates these technologies, it might be an adversary who ends up using them.
