You Are Here

Cyber defenders map intrusions in nine stages. America is at stage eight — with the intruder already deleting the logs.

Photo by Maro Donato on Unsplash

In my profession, practitioners are paid to betray their employers on a schedule.

The service is called a red-team engagement: a company hires a group of specialists to attack it in earnest, to think as its enemies think, to find unlocked doors and unexamined assumptions, and then, having broken in, to explain precisely how it was done. The arrangement sounds perverse until you grasp its premise, which is that no institution knows itself. An organization’s brochures describe its intentions; only an intruder can describe the institution as it actually stands. The report that concludes such an engagement makes strange reading for the executives who commissioned it — a burglar’s diary of their own house — and it is, in my experience, the only document they ever fully believe. Mere vulnerability assessments rarely carry similar gravitas.

For some years now the United States has been undergoing the involuntary version of this exercise, and so, in varying stages, have the other liberal democracies. The campaign against independent agencies, prosecutorial independence, the civil service, the separation of powers, and the plain text of constitutional provisions such as the Emoluments Clause has been reported, correctly, as a catastrophe. What the current coverage rarely considers is the professional’s second thought: that an attack is also an audit, conducted in bad faith but rigorous beyond anything the defenders would ever have commissioned for themselves. The findings of a hostile assessment are not less true for the hostility. They are only more expensive.

The Framers, it should be said, were not naive about any of this. Madison was arguably the first American threat modeler. “If men were angels,” he wrote in Federalist No. 51, “no government would be necessary”; the entire scheme of checks and balances is a design against the malicious insider, ambition arranged to counteract ambition.

The trouble, we now discover, lies not in the theory, but in the wiring.

♦

The Emoluments Clause forbids a president to profit from foreign powers, and then names no enforcer, prescribes no penalty, and establishes no process — a “No Trespassing” sign posted over an open field. The independence of the Justice Department, which most Americans assume to be structural, appears nowhere in the Constitution and scarcely anywhere in statute; it is a post-Watergate courtesy that endured exactly as long as every president consented to observe it. Inspectors general, the government’s internal auditors, may be dismissed upon little more than a notice to Congress. The emergency-powers statutes permit a president to assume extraordinary authorities more or less alone, while reclaiming them requires majorities proof against his veto. Congressional subpoenas proceed at the pace of litigation, which converts obstruction into a form of participation. And Hamilton confessed the deepest dependency in 1788: the judiciary, he wrote in Federalist No. 78, has “neither FORCE nor WILL, but merely judgment,” and must rely upon the executive arm even for the efficacy of its rulings. This was less a warning than a description of the system’s final assumption — that the man commanding the executive arm would consider himself bound.

The litigation record of the present administration has tested that assumption with a thoroughness no political scientist could have arranged. The lower courts performed almost exactly as designed. Federal district judges ruled against the administration at rates approaching 96 percent in certain months, and the pattern held across the bench: by one Stanford analysis, Republican appointees ruled against it nearly as often as Democratic ones. Those rulings then ascended. By one prominent court watcher’s count, thirty-nine administration matters reached the Supreme Court in the first year, every one a case the government had already lost below, and the justices sided with the government in thirty-six, chiefly by way of the emergency docket, in interim orders sometimes a paragraph in length, frequently unexplained, issued without full briefing or argument. In my trade we would say that judicial review carries a single point of failure at its apex, and that the shadow docket operates as an undocumented administrative interface: the override that leaves no log. The metaphor is a bit ugly, but it holds. Perfect detection in the lower tiers of a system means very little if one privileged hand can silence the alarm.

♦

Gather the findings and the executive summary runs to a single line: the republic ran on the honor system. A norm, after all, is an expectation of shame, and it binds only those vulnerable to shame and its effects. For two and a half centuries, we mistook etiquette for architecture. We confused the fact that no president had done a thing for the existence of some mechanism preventing it. In my field, ‘no one would ever do that’ is the core assumption that every insider-threat incident report exists to refute; the belief held right up until the moment someone trusted did. Constitutional history is no different.

Nor is the discovery an American possession. Hungary submitted to the same procedure years ago: courts captured, civil service hollowed, press delegitimized, opposition prosecuted, and elections re-engineered so that the ruling party could not lose them. Poland endured a variant, and Turkey now hosts the mature strain. Were this malware, we would call it one codebase with regional forks.

My industry long ago learned what to do when the same tooling appears across victims: publish the indicators of compromise, warn the sector, and let the defenders at the next target harden their systems before contact. The banks manage this without embarrassment. The democracies, oddly, still treat each backsliding as a private shame, even as the authoritarian playbook circulates openly between capitals. There is no reason the defense should travel more slowly than the exploit. As for Hungary, hold that thought. Its story turned this spring, and I will come back to it.

♦

My old firm kept a diagram for this. Every firm in my industry keeps one. They can be labeled kill chains, attack matrices, or lifecycles; the dialects differ, but the grammar doesn't. The version I learned came from Mandiant (acquired by Google), which built its name on incident response. My own work there ran to strategy and detection, the question of how to notice an intruder no one expected and how to reliably keep them out, but the diagram was the lingua franca whatever your specialty. It taught us to read every intrusion as a lifecycle: reconnaissance, compromise, foothold, escalation, lateral movement, persistence, mission. Its discipline was that nothing an attacker did was ever senseless; each act was a stage, and each stage prepared the next.

Mandiant’s Targeted attack life cycle via Google Cloud

Lay the template over the past decade and the fit is disquieting.

The reconnaissance was conducted in the open: a nine-hundred-page inventory of the government’s soft points, published under the name Project 2025, with the first term having served as reconnaissance in force. The initial compromise required no breach of the perimeter at all. In my trade’s taxonomy, it was an insider event. The intruder came through the front door holding valid credentials, as the defenses of 1787 were drawn against usurpers, and the election was the phish that worked.

The foothold went in during the first days: the executive orders, the inspectors general dismissed at a single stroke, the acting officials seated where the Senate had confirmed no one. Privileges escalated by emergency declaration and by a theory of the unitary executive that the shadow docket ratified one emergency stay at a time; and it was here that the young engineer-saboteurs of the Department of Government Efficiency entered the record and were handed administrator access to the Treasury’s payment rails and the government’s personnel files, a grant of privilege that a hired red team spends weeks negotiating and rarely receives in full.

Internal reconnaissance followed, as it always does — loyalty reviews and the lists of agents and prosecutors who had touched disfavored cases — and the lateral movement continues as I write: outward from the executive core into the independent agencies, the universities, the law firms, the broadcasters, the states, each new position put immediately to work against the next.

Persistence, the art of remaining, arrived on schedule: judicial appointments, the conversion of the civil service, acting leadership with no intention of acting briefly. The final stage the analysts call completing the mission; the reader has already met its Hungarian translation.

♦

There is one stage more, and the country has reached it.

The older kill-chain charts, the ones Lockheed Martin drew when the vocabulary was young, list a step the newer diagrams fold silently into the others: covering tracks. Every competent intruder clears the logs at some point during the intrusion because evidence is the key substance that can convert a breach into a legal case. Consider, in that light, what has been happening to the government’s evidence.

The statistical agencies have been hollowed and their inconvenient numbers disputed or discontinued; public datasets have been purged from the record; confidential files have been seized and commingled by the same efficiency engineers who held the keys to the payment system. And this August the Treasury went further, announcing that it would not merely cease maintaining the registry of shell-company ownership that Congress obliged it by statute to keep, a ledger built so that investigators could follow money through the nesting dolls of anonymous corporations — but would also destroy the data already gathered so that no later administration could consult it. One of the law’s congressional champions compared the act to deleting the FBI’s fingerprint files. My trade calls this anti-forensics and a prosecutor would call it spoliation of evidence. Either way, the intruder is deleting the logs on their own behalf and that of every intruder still to come.

Here is where the analogy gives out. A contracted red team operates under consent and scope; it stops on command, documents everything, and might even make itself available to sit with you afterward through the repair. Yet no one consented to this engagement, and the damage is not being absorbed by an abstraction called the constitutional order. It is being absorbed by people.

The inspectors general dismissed en masse in the administration’s first days were not weaknesses in a diagram; they were public servants with staffs, mortgages, and unfinished investigations. Prosecutors purged for having done their jobs, scientists whose work stopped mid-grant, career civil servants dismissed by form email after decades of service, and men flown to a foreign prison without so much as a hearing — none of them will be made whole by the quality of the lessons the rest of us manage to draw. A breach report is written about servers, and servers do not grieve. So let the vocabulary of incident response be used with care: we are not reading a report, the intruder is still on the network, and the casualties are not figures of speech.

♦

Responders carry an important certainty rarely granted to spectators: incidents end. After sixteen years, Hungary’s may have just ended. This April, in the largest turnout in the country’s democratic history, Hungarians voted out the man who had engineered elections he could not lose and handed the opposition the two-thirds supermajority he once used to rewrite the constitution. The architect of his own ostensibly unlosable election was forced by the will of the citizenry to concede on a Sunday night.

Recovery there is only beginning. The machine’s builders have not left town. But the fact stands, and it is the most hopeful fact in this essay: stage nine is a design goal, not a law of nature. What distinguishes the institutions that emerge hardened from those breached again by similar exploits is the least glamorous rite of the profession, the lessons-learned review. The defense, it happens, keeps a lifecycle chart of its own (detect, respond, recover, and a modest box the flowcharts label improvement) and the country has been moving through it without benefit of the vocabulary: the district courts as detection, the lawsuits and the protests and the ballots as response, recovery pending, and everything this essay argues for crowded into that last box.

A vulnerability disclosed and patched justifies the pain of its disclosure. A vulnerability disclosed and ignored is worse than one never found at all: the flaw is public, the fix is waiting, and attackers read disclosure lists the way burglars once read obituaries, looking for the houses everyone knows are empty. The case for a silver lining rests there. The price of these findings has already been paid by We the People; the only question that remains open is whether the country collects what our losses bought. And it is worth recalling what these lifecycle charts were drawn for: admiring the kill was never among their uses. The chain is charted so that a defender who can name its stages can find the cheapest place to break it. A chain broken at any link fails at every link downstream; interdiction is the entire doctrine.

♦

The assessment phase has concluded; no one may any longer plead ignorance of the attack surface. We hold a defect list for the constitutional order itemized the way my industry itemizes software flaws: affected component, attack vector, and patch status. The remediation queue arrives pre-sorted by severity. Norms must be promoted to statute. Clauses that name no enforcer must be given one, together with someone possessed of standing to invoke it. The institutions must be compartmented, so that the capture of one cannot proceed by trust into the rest — what Madison called ambition counteracting ambition, my colleagues and I call segmentation; the insight is identical. Transparency and the keeping of records must be understood as a government’s logging: the tedium that makes the eventual reckoning legible and the first thing an intruder deletes. And the reckoning itself belongs to recovery rather than to revenge: contain the intruders, restore the service, rotate the credentials, and close the hole by which they entered.

What Budapest actually did this spring deserves a paragraph of its own, because the method travels. Orbán's machinery rested on one structural assumption: that of a fragmented opposition, since the rules were drawn to convert division into supermajorities for the ruling party. Péter Magyar's answer was to deny the exploit its precondition. He collapsed the opposition into a single disciplined vehicle rather than a quarreling coalition, and then ran a campaign that the old playbook of smears and captured media could not manage to subvert. The margin did the rest; an election turnout too large for any manipulated skew of the districts to absorb. A rigged system, it turns out, has a rated load.

Analysts will savor the final detail: Magyar was a defector from the regime itself, a man who knew the machine from the inside. The recovery, like the intrusion, was an insider event. Hungarians did not wait for fair rules before contesting them. They beat the ruler under rules he wrote, and the prize is the instrument that built the machine: a supermajority that can amend the constitution at will. My trade calls that level of control root or ring 0, and its meaning is simple enough: whoever holds it can rewrite the system itself. For a decade and a half the intruder held it. Now the defenders do.

♦

Franklin’s famous dare, “a republic, if you can keep it,” has generally been read as a warning, but it is better read as a work order. The apple cart lies on its side, and it did not tip itself; but anyone who has rebuilt a network after a total compromise will confess the guilty consolation of wreckage, which is that one finally gets to build the thing as the diagrams always pretended it was built. The beauty can be in the arrangement, once we gather together to right it — provided that, this time, we patch as we go.

The Hungarians, this spring, showed us how.

♦