2018 U.S. Intelligence Community Worldwide Threat Assessment: Coats Testimony: Global Cyber Threats, WMD Nuclear Proliferation, Terrorism, Foreign Denial and Deception, Space and Counterspace

Director of National Intelligence Daniel R. Coats presented the 2018 annual U.S. intelligence community worldwide threat assessment in Congressional testimony on February 13, 2018. In the published report, Coats provides a thorough review of the status of possible threats from a wide variety of nations and terror groups. In addition to the 2018 assessment, this compilation includes the 2017 assessment for comparison and historical reference, plus a report of the Select Committee on Intelligence, United States Senate.

Topics covered in this report include: Global Threats * Cyber Threats * Weapons Of Mass Destruction And Proliferation * Terrorism * Counterintelligence And Foreign Denial And Deception * Emerging And Disruptive Technology * Technology Acquisitions And Strategic Economic Competition * Space And Counterspace * Transnational Organized Crime * Economics And Energy * Human Security * Regional Threats * East Asia * Middle East And North Africa * South Asia * Russia And Eurasia * Europe * Africa * The Western Hemisphere

Russia. We expect that Russia will conduct bolder and more disruptive cyber operations during the next year, most likely using new capabilities against Ukraine. The Russian Government is likely to build on the wide range of operations it is already conducting, including disruption of Ukrainian energy-distribution networks, hack-and-leak influence operations, distributed denial-of-service attacks, and false flag operations. In the next year, Russian intelligence and security services will continue to probe U.S. and allied critical infrastructures, as well as target the United States, NATO, and allies for insights into U.S. policy.

China. China will continue to use cyber espionage and bolster cyber attack capabilities to support national security priorities. The IC and private-sector security experts continue to identify ongoing cyber activity from China, although at volumes significantly lower than before the bilateral U.S.-China cyber commitments of September 2015. Most detected Chinese cyber operations against U.S. private industry are focused on cleared defense contractors or IT and communications firms whose products and services support government and private sector networks worldwide. China since 2015 has been advancing its cyber attack capabilities by integrating its military cyber attack and espionage resources in the Strategic Support Force, which it established in 2015.

Iran. We assess that Iran will continue working to penetrate U.S. and Allied networks for espionage and to position itself for potential future cyber attacks, although its intelligence services primarily focus on Middle Eastern adversaries—especially Saudi Arabia and Israel. Tehran probably views cyberattacks as a versatile tool to respond to perceived provocations, despite Iran's recent restraint from conducting cyber attacks on the United States or Western allies. Iran's cyber attacks against Saudi Arabia in late 2016 and early 2017 involved data deletion on dozens of networks across government and the private sector.

North Korea. We expect the heavily sanctioned North Korea to use cyber operations to raise funds and to gather intelligence or launch attacks on South Korea and the United States. Pyongyang probably has a number of techniques and tools it can use to achieve a range of offensive effects with little or no warning, including distributed denial of service attacks, data deletion, and deployment of ransomware.