Not surprising at all. What's surprising is that it's taken this long to appear in the news.<p>While in the shipyards for maintenance I would stand watch and was responsible for letting people on/off a large ship. Most were contractors. The only requirement was that they had a contractor badge. How did we tell this was a valid badge? Good question. You'd think there would be some sort of master list of people with badges we could check and verify.<p>Not quite. Every contractor had their own style of badge and we had no way of knowing if any particular badge was real or not. Want a "valid" badge? Buy a badge printer. You're in.<p>We had people we didn't even know just show up to install systems on board that nobody was able to verify were supposed to be there or not. It was a little better with the classified systems, but you can imagine that any verification of contractor IT systems was non-existent.
A non-trivial bit of the problem is the highly fashionable attitude of refusing to do work that helps the Department of Defense. The fact that skilled labor is a limited resource for both nations, which means refusing to help is at least similar to aiding foreign powers, which are statistically dictatorships of one kind or another, seems to not factor into the set of moral ethoses that such folks espouse.<p>Remember, it's not just China. It's North Korea, Russia, Iran, Isreal; any country facing significant military threats is interested in US weapons technology.<p>You live in a constitutional democracy on a planet where the mean, median, and mode country is a dictatorship? And don't want to defend that government? Really?
Hackers breaching US Navy contractors tells us one important thing: That the US Navy is not doing adequate due diligence on the firms it allow to be contractors.<p>This story is part of the campaign to present China as an unethical, capable adversary and threat. In reality, China wants to trade peacefully with the US and the aggression is nearly 100% on the US side and is meant to garner all the benefits of threat-oriented chest pounding for US politicians.<p>The #1 rule of being a citizen should be "don't let them tell you who to fear or who to hate". Sadly, the NYT, Bloomberg, and the WSJ are all telling us to hate and fear China, when it's obvious that the US has domestic political motives in mind.<p>In the US, leaders need an enemy or the conversation might turn to things like "why do we have poisonous drinking water?" or "Why has there been a trend of downward mobility?" or "Why didn't anyone get punished for Snowden's revelations or for the lies that led to the Iraq war?"
> The victims have included large contractors as well as small ones, some of which are seen as lacking the resources to invest in securing their networks.<p>That does not compute. If they want to become a defense contractor, it stands to reason not spending resources on securing their network (and educating their employees against phishing attacks) is a non-starter.
Do procurement contracts have clauses that discount the purchase price when proprietary information is lost to reflect the diminished value of the product?
At what point will the gov actually do something meaningful here? I know security is hard, but so is putting a man on the moon. This is insane the amount of hacks without consequences.
A slightly different headline would be "Navy has lousy security practices especially regarding contractors"<p>I'm pretty sure the CIA and NSA do their utmost to spy as much as they can on the Chinese and Russian Navy.