February 13, 2018 WORLDWIDE THREAT ASSESSMENT of the US INTELLIGENCE COMMUNITY STATEMENT FOR THE RECORD INTRODUCTION Chairman Burr, Vice Chairman Warner, Members of the Committee, thank you for the invitation to offer the United States Intelligence Community’s 2018 assessment of threats to US national security. My statement reflects the collective insights of the Intelligence Community’s extraordinary women and men, whom I am privileged and honored to lead. We in the Intelligence Community are committed every day to providing the nuanced, independent, and unvarnished intelligence that policymakers, warfighters, and domestic law enforcement personnel need to protect American lives and America’s interests anywhere in the world. The order of the topics presented in this statement does not necessarily indicate the relative importance or magnitude of the threat in the view of the Intelligence Community. Information available as of 8 February 2018 was used in the preparation of this assessment. FOREWORD Competition among countries will increase in the coming year as major powers and regional aggressors exploit complex global trends while adjusting to new priorities in US foreign policy. The risk of interstate conflict, including among great powers, is higher than at any time since the end of the Cold War. The most immediate threats of regional interstate conflict in the next year come from North Korea and from Saudi- Iranian use of proxies in their rivalry. At the same time, the threat of state and nonstate use of weapons of mass destruction will continue to grow.  Adversaries and malign actors will use all instruments of national power—including information and cyber means—to shape societies and markets, international rules and institutions, and international hot spots to their advantage.  China and Russia will seek spheres of influence and to check US appeal and influence in their regions. Meanwhile, US allies’ and partners’ uncertainty about the willingness and capability of the United States to maintain its international commitments may drive them to consider reorienting their policies, particularly regarding trade, away from Washington.  Forces for geopolitical order and stability will continue to fray, as will the rules-based international order. New alignments and informal networks—outside traditional power blocs and national governments—will increasingly strain international cooperation. Tension within many countries will rise, and the threat from Sunni violent extremist groups will evolve as they recoup after battlefield losses in the Middle East.  Slow economic growth and technology-induced disruptions in job markets are fueling populism within advanced industrial countries and the very nationalism that contributes to tension among countries.  Developing countries in Latin America and Sub-Saharan Africa face economic challenges, and many states struggle with reforms to tamp down corruption. Terrorists and criminal groups will continue to exploit weak state capacity in Africa, the Middle East, and Asia.  Challenges from urbanization and migration will persist, while the effects of air pollution, inadequate water, and climate change on human health and livelihood will become more noticeable. Domestic policy responses to such issues will become more difficult—especially for democracies—as publics become less trusting of authoritative information sources. CYBER THREATS / GLOBAL THREATS The potential for surprise in the cyber realm will increase in the next year and beyond as billions more digital devices are connected—with relatively little built-in security—and both nation states and malign actors become more emboldened and better equipped in the use of increasingly widespread cyber toolkits. The risk is growing that some adversaries will conduct cyber attacks—such as data deletion or localized and temporary disruptions of critical infrastructure—against the United States in a crisis short of war.  In 2016 and 2017, state-sponsored cyber attacks against Ukraine and Saudi Arabia targeted multiple sectors across critical infrastructure, government, and commercial networks.  Ransomware and malware attacks have spread globally, disrupting global shipping and production lines of US companies. The availability of criminal and commercial malware is creating opportunities for new actors to launch cyber operations.  We assess that concerns about US retaliation and still developing adversary capabilities will mitigate the probability of attacks aimed at causing major disruptions of US critical infrastructure, but we remain concerned by the increasingly damaging effects of cyber operations and the apparent acceptance by adversaries of collateral damage. Adversaries and Malign Actors Poised for Aggression Russia, China, Iran, and North Korea will pose the greatest cyber threats to the United States during the next year. These states are using cyber operations as a low-cost tool of statecraft, and we assess that they will work to use cyber operations to achieve strategic objectives unless they face clear repercussions for their cyber operations. Nonstate actors will continue to use cyber operations for financial crime and to enable propaganda and messaging.  The use of cyber attacks as a foreign policy tool outside of military conflict has been mostly limited to sporadic lower-level attacks. Russia, Iran, and North Korea, however, are testing more aggressive cyber attacks that pose growing threats to the United States and US partners. Russia. We expect that Russia will conduct bolder and more disruptive cyber operations during the next year, most likely using new capabilities against Ukraine. The Russian Government is likely to build on the wide range of operations it is already conducting, including disruption of Ukrainian energy- distribution networks, hack-and-leak influence operations, distributed denial-of-service attacks, and false flag operations. In the next year, Russian intelligence and security services will continue to probe US and allied critical infrastructures, as well as target the United States, NATO, and allies for insights into US policy. China. China will continue to use cyber espionage and bolster cyber attack capabilities to support national security priorities. The IC and private-sector security experts continue to identify ongoing cyber activity from China, although at volumes significantly lower than before the bilateral US-China cyber commitments of September 2015. Most detected Chinese cyber operations against US private industry are focused on cleared defense contractors or IT and communications firms whose products and services support government and private sector networks worldwide. China since 2015 has been advancing its cyber attack capabilities by integrating its military cyber attack and espionage resources in the Strategic Support Force, which it established in 2015. Iran. Iran will continue working to penetrate US and Allied networks for espionage and to position itself for potential future cyber attacks, although its intelligence services primarily focus on Middle Eastern adversaries—especially Saudi Arabia and Israel. Tehran probably views cyberattacks as a versatile tool to respond to perceived provocations, despite Iran’s recent restraint from conducting cyber attacks on the United States or Western allies. Iran’s cyber attacks against Saudi Arabia in late 2016 and early 2017 involved data deletion on dozens of networks across government and the private sector. North Korea. We expect the heavily sanctioned North Korea to use cyber operations to raise funds and to gather intelligence or launch attacks on South Korea and the United States. Pyongyang probably has a number of techniques and tools it can use to achieve a range of offensive effects with little or no warning, including distributed denial of service attacks, data deletion, and deployment of ransomware. North Korean actors developed and launched the WannaCry ransomware in May 2017, judging from technical links to previously identified North Korean cyber tools, tradecraft, and operational infrastructure. We also assess that these actors conducted the cyber theft of $81 million from the Bank of Bangladesh in 2016. Terrorists and Criminals. Terrorist groups will continue to use the Internet to organize, recruit, spread propaganda, raise funds, collect intelligence, inspire action by followers, and coordinate operations. Given their current capabilities, cyber operations by terrorist groups mostly likely would result in personally identifiable information (PII) disclosures, website defacements, and denial-of-service attacks against poorly protected networks. Transnational criminals will continue to conduct for-profit cyber- enabled crimes, such as theft and extortion against US networks. We expect the line between criminal and nation-state activity to become increasingly blurred as states view cyber criminal tools as a relatively inexpensive and deniable means to enable their operations. COUNTERINTELLIGENCE AND FOREIGN DENIAL AND DECEPTION The United States will face a complex global foreign intelligence threat environment in 2018. We assess that the leading state intelligence threats to US interests will continue to be Russia and China, based on their services’ capabilities, intent, and broad operational scope. Other states in the Near East, South Asia, East Asia, and Latin America will pose local and regional intelligence threats to US interests. For example, Iranian and Cuban intelligence and security services continue to view the United States as a primary threat. Penetrating the US national decisionmaking apparatus and the Intelligence Community will remain primary objectives for numerous foreign intelligence entities. Additionally, the targeting of national security information and proprietary information from US companies and research institutions involved with defense, energy, finance, dual-use technology, and other areas will remain a persistent threat to US interests. Nonstate entities, including international terrorists and transnational organized crime groups, are likely to continue to employ and improve their intelligence capabilities, including human, technical, and cyber means. As with state intelligence services, these nonstate entities recruit sources and perform physical and technical surveillance to facilitate their illicit activities and to avoid detection and capture. Trusted insiders who disclose sensitive or classified US Government information without authorization will remain a significant threat in 2018 and beyond. The sophistication and availability of information technology that increases the scope and impact of unauthorized disclosures exacerbate this threat. Russia and Influence Campaigns Influence operations, especially through cyber means, will remain a significant threat to US interests as they are low-cost, relatively low-risk, and deniable ways to retaliate against adversaries, to shape foreign perceptions, and to influence populations. Russia probably will be the most capable and aggressive source of this threat in 2018, although many countries and some nonstate actors are exploring ways to use influence operations, both domestically and abroad. We assess that the Russian intelligence services will continue their efforts to disseminate false information via Russian state-controlled media and covert online personas about US activities to encourage anti-US political views. Moscow seeks to create wedges that reduce trust and confidence in democratic processes, degrade democratization efforts, weaken US partnerships with European allies, undermine Western sanctions, encourage anti-US political views, and counter efforts to bring Ukraine and other former Soviet states into European institutions. Foreign elections are critical inflection points that offer opportunities for Russia to advance its interests both overtly and covertly. The 2018 US mid-term elections are a potential target for Russian influence operations. At a minimum, we expect Russia to continue using propaganda, social media, false-flag personas, sympathetic spokespeople, and other means of influence to try to exacerbate social and political fissures in the United States. SPACE AND COUNTERSPACE Continued global space industry expansion will further extend space-enabled capabilities and space situational awareness to nation-state, nonstate, and commercial space actors in the coming years, enabled by the increased availability of technology, private-sector investment, and growing international partnerships for shared production and operation. All actors will increasingly have access to space-derived information services, such as imagery, weather, communications, and positioning, navigation, and timing for intelligence, military, scientific, or business purposes. Foreign countries—particularly China and Russia—will continue to expand their space-based reconnaissance, communications, and navigation systems in terms of the numbers of satellites, the breadth of their capability, and the applications for use. Both Russia and China continue to pursue antisatellite (ASAT) weapons as a means to reduce US and allied military effectiveness. Russia and China aim to have nondestructive and destructive counterspace weapons available for use during a potential future conflict. We assess that, if a future conflict were to occur involving Russia or China, either country would justify attacks against US and allied satellites as necessary to offset any perceived US military advantage derived from military, civil, or commercial space systems. Military reforms in both countries in the past few years indicate an increased focus on establishing operational forces designed to integrate attacks against space systems and services with military operations in other domains. Russian and Chinese destructive ASAT weapons probably will reach initial operational capability in the next few years. China’s PLA has formed military units and begun initial operational training with counterspace capabilities that it has been developing, such as ground-launched ASAT missiles. Russia probably has a similar class of system in development. Both countries are also advancing directed-energy weapons technologies for the purpose of fielding ASAT weapons that could blind or damage sensitive space-based optical sensors, such as those used for remote sensing or missile defense. Of particular concern, Russia and China continue to launch “experimental” satellites that conduct sophisticated on-orbit activities, at least some of which are intended to advance counterspace capabilities. Some technologies with peaceful applications—such as satellite inspection, refueling, and repair—can also be used against adversary spacecraft. Russia and China continue to publicly and diplomatically promote international agreements on the nonweaponization of space and “no first placement” of weapons in space. However, many classes of weapons would not be addressed by such proposals, allowing them to continue their pursuit of space warfare capabilities while publicly maintaining that space must be a peaceful domain. TRANSNATIONAL ORGANIZED CRIME Transnational organized criminal groups and networks will pose serious and growing threats to the security and health of US citizens, as well as to global human rights, ecological integrity, government revenues, and efforts to deal with adversaries and terrorists. In the most severe cases abroad, criminal enterprises will contribute to increased social violence, erode governments’ authorities, undermine the integrity of international financial systems, and harm critical infrastructure. Drug Trafficking Transnational organized criminal groups supply the dominant share of illicit drugs consumed in the United States, fueling high mortality rates among US citizens. Americans in 2016 died in record numbers from drug overdoses, 21 percent more than in 2015.  Worldwide production of cocaine, heroin, and methamphetamine is at record levels. US mortality from potent synthetic opioids doubled in 2016, and synthetic opioids have become a key cause of US drug deaths.  Mexican criminal groups will continue to supply much of the heroin, methamphetamine, cocaine, and marijuana that cross the US-Mexico border, while China-based suppliers ship fentanyls and fentanyl precursors to Mexico-, Canada-, and US- based distributors or sell directly to consumers via the Internet. Broader Threats From Transnational Crime Transnational organized criminal groups, in addition to engaging in violence, will continue to traffic in human beings, deplete natural resources, and siphon money from governments and the global economy.  Human trafficking will continue in virtually every country. International organizations estimate that about 25 million people are victims.  The FBI assesses that US losses from cybercrime in 2016 exceeded $1.3 billion, and some industry experts predict such losses could cost the global economy $6 trillion by 2021.  Criminal wildlife poaching, illegal fishing, illicit mining, and drug-crop production will continue to threaten economies, biodiversity, food supply security, and human health. For example, academic studies show that illicit mining alone adds some 650 to 1,000 tons of toxic mercury to the ecosystem each year.  Transnational organized criminal groups probably will generate more revenue from illicit activity in the coming year, which the UN last estimated at $1.6-$2.2 trillion for 2014.