Titan Rain intrusions against US defence, aerospace and NASA networks (2003-2005)
What happened
Titan Rain is the FBI codename for a series of intrusions into US government, defence and contractor networks that came to public attention through TIME's August 2005 account of Shawn Carpenter, a Sandia National Laboratories analyst who traced the activity outside official channels. TIME reports intrusions at Lockheed Martin in September 2003 and at Sandia several months later, and describes compromises of networks ranging from the Redstone Arsenal to NASA to the World Bank. The intrusions are described as fast and disciplined, ten to thirty minutes each, with the actor taking over a hidden section of a hard drive, compressing as many files as possible and transmitting them through way stations in South Korea, Hong Kong or Taiwan before the data reached mainland China; the traffic is traced to three routers in Guangdong. Among the material TIME reports taken are an Army helicopter mission-planning system and the Falconview flight-planning software, and, of direct relevance to this corpus, aerospace documents containing hundreds of detailed schematics of propulsion systems, solar panelling and fuel tanks for the Mars Reconnaissance Orbiter.
This is the oldest record in the corpus and its sourcing reflects that. Everything rests on one magazine article built on one investigator's account of work he performed outside his employer's authority, and which cost him his job and his clearance. No government report confirms the specific document sets, and the attribution to Chinese state actors was never made officially in these terms. What makes the record worth holding is that its one load-bearing claim is unusually specific for this batch: named subsystems of a named spacecraft. Of the two techniques SPARTA's bibliography cites, EX-0010 is mapped, recovered under decision 67 when the segment restriction that was the only ground for rejecting it was retired, and IMP-0006 is rejected on the distinction SPARTA itself keeps between a mission's product and a spacecraft's design. Three techniques are mapped here, and the two strongest, REC-0001 and EXF-0008, are outside SPARTA's set.
Attack vector
Not established. TIME describes the actor's behaviour once inside (compressing files into a hidden disk region and relaying them through third-country way stations) but not how access was obtained.
Operational impact
None reported. No source describes an effect on the Mars Reconnaissance Orbiter or on any mission; the spacecraft launched in August 2005 and operated normally.
Data compromised
As reported by TIME: aerospace documents with hundreds of detailed schematics of Mars Reconnaissance Orbiter propulsion systems, solar panelling and fuel tanks, plus an Army helicopter mission-planning system and the Falconview flight-planning software.
Affected segments
supply_chain, ground
Disclosed
2005-08-29
SPARTA techniques evidenced
Each row is a technique this record evidences, with the reasoning and the source that attests to it.
What relationship, confidence, and evidence mean on the rows below
- Relationship
What kind of link this is between the technique and the target.
Mitigates: the target actively prevents, detects, or recovers from the technique.
Addresses: the target governs the technique or is relevant to it, without interdicting it. Most governance and policy obligations sit here.
Triggers obligation: the technique occurring is what triggers the duty the target imposes.
Relates to: related to the technique, but the target neither interdicts nor governs it. Used sparingly.
- Confidence
How strongly the source supports this mapping, not how severe the technique is.
High: the source supports the mapping squarely.
Moderate: supported, with a qualification such as a cross-tactic reading that stays operationally sound.
Low: the source reaches the technique only in part.
- Evidence
How close to the source text the mapping was made.
Direct: a verbatim excerpt of the cited source was read against the technique, and the rationale argues from that excerpt.
Derived: the mapping follows from the source's scope or structure, with no on-point excerpt addressing the technique.
Inferred: reached by composition through another framework, or by domain reasoning the source does not support on its face.
TIME describes intrusions of ten to thirty minutes in which the actor took over a hidden section of a hard drive, compressed as many files as possible and transmitted them onward through way stations in South Korea, Hong Kong or Taiwan: automated adversary tooling executing on victim hosts. Derived and low because the account names no malware, offers no sample, and describes the activity through one investigator's reconstruction. Recovered per decision 67: previously rejected only because SPARTA writes EX-0010 on the vehicle. The IMP-0006 rejection on this record is not recovered; it turns on SPARTA keeping a mission's product and a spacecraft's design apart, which is an object distinction rather than a segment one.
EXF-0008 covers breaching development or integration environments at the mission owner, a contractor or a partner to obtain documentation and configuration data more complete than flight archives, before launch. TIME reports intrusions at both NASA and defence contractors and the removal of detailed design documentation for a spacecraft that had not yet launched, which is that pathway. The edge is derived because TIME does not say which network held the Mars Reconnaissance Orbiter documents, so the mission owner and the contractor are both candidates and neither is confirmed.
TIME reports the theft of aerospace documents containing hundreds of detailed schematics of propulsion systems, solar panelling and fuel tanks for the Mars Reconnaissance Orbiter. REC-0001's subject is the coherent design picture of a spacecraft, explicitly including propulsion and power, assembled from artefacts such as block diagrams and design documentation. A named spacecraft, named subsystems and a stated document type make this the one edge in this batch where the source describes the technique's object rather than permitting it to be inferred.
Considered and not mapped
These techniques were considered for this record because a source, a related record or SPARTA's own catalogue pointed at them. Each was read against what the sources say and not mapped. The reason is given in full.
SPARTA's own citation, and the intuitive one, since documents were stolen. Rejected on the technique's plain text: IMP-0006 is theft of the data the spacecraft gathers, processes and sends, whose loss puts the mission's purpose in jeopardy. MRO design schematics are ground-held engineering documentation about a spacecraft that had not yet flown. Mapping it would collapse the distinction between stealing a mission's product and stealing its blueprints, which SPARTA keeps separate: the blueprints are
REC-0001.Considered because Falconview and an Army mission-planning system were taken. Rejected: both are ground-side aviation software, not flight software, and neither is a spacecraft's.
Sources
The published accounts this record rests on. The tier is SafeMode Space's own assessment of the source, and the reason for it is given beside it. What the tiers mean and how they are assigned: the source tiers.
A source is listed when a mapped technique rests on it, or when it disputes the account. One the curators read but neither cited nor recorded as disputing the record is not listed, so an absence here means neither is true rather than that nobody looked.
- The Invasion of the Chinese CyberspiesTrade press
Tier 3: General-interest news magazine, but the only public account of this material and the source SPARTA's bibliography cites. It rests on one named investigator's account of work he did outside official channels, and no government report confirms the specific document sets it describes.
Every source SafeMode Space reproduces, and on what terms: sources and attribution.