Legal Aspects of Cybersecurity Artur Appazov

5.4
 
Cyberespionage – the Advanced Persistent Threat 
Cyberespionage refers to state-sponsored theft of industrial and defense secrets and/or 
intellectual property.
111
The state sponsored cyberespionage poses a serious threat to the 
economic and national security. Military secrets and valuable corporate intellectual 
property undermine the long-term competitiveness of the targeted countries.
112
Some prominent examples of cyberespionage include: Moonlight Maze (1998); Byzantine 
Hades (2002); Operation Titan Rain (2003); Operation Buckshot Yankee (2008); Operation 
Night Dragon (2008-2011); Operation Aurora (2009); penetration of Lockheed Martin, BAE 
Systems and Northrop Grumman (2009); Operation Shady RAT (2006); GhostNet (2009); 
108
M
EHAN
, Cyberwar, Cyberterror, Cybercrime: A Guide to the Role of Standards in an Environment of Change 
and Danger 28. 2008. 
109
See Jewkes & Yar, Handbook of Internet Crime. 2010. 
110
Teplinsky, A
MERICAN 
U
NIVERSITY 
B
USINESS 
L
AW 
R
EVIEW
, 268-269 (2013). 
111
Id. at, 252. 
112
Contreras, et al., A
MERICAN 
U
NIVERSITY 
L
AW 
R
EVIEW
, 1114-1115 (2013). 

---

34 
the RSA Breach (2011); and twenty-three natural gas pipeline operators (December 2011-
June 2012).
113
By some reports, cyberespionage is estimated to cost the United States alone (in terms of 
lost jobs, innovation, and national security) and its corporations (in terms of lost 
intellectual property, remediation, and reduced consumer confidence) up toillion annually, 
but reliably quantifying the potentially staggering costs of cyberespionage has been an 
elusive goal. Obstacles include the fact that many companies do not know that they have 
been victimized and even those that do know are often reluctant to disclose out of concern 
for their reputation.
114
One particularly insidious form of cyberespionage is known as an advanced persistent 
threat (APT). APTs are highly targeted malware-based attacks with several distinguishing 
features. First, as their name suggests, APTs are often advanced. In many cases, they utilize 
the full spectrum of computer intrusion technologies and techniques and combine multiple 
attack methodologies and tools in order to reach and compromise their target. Second, 
APTs are persistent. APT operators seek long-term access to their targets, with attack 
objectives generally extending beyond immediate financial gain. In order to maintain long-
term access to targets, APTs generally operate stealthily for as long as possible. Finally, 
APTs rely on skilled, motivated, organized and well-funded operators to coordinate and 
execute attacks. The substantial resources required to operate APTs generally makes them 
a tool of nation-states. At their essence, APTs are computer intrusions staged by threat 
actors that aggressively pursue and compromise specific targets, often leveraging social 
engineering or the ‘art of manipulation,’ in order to maintain a persistent presence within 
the victim’s network so that they can move laterally and extract sensitive information.
115