My Role in Information Warfare during the Yugoslav Wars

This morning I read a Tweet from @AirForceAssoc reminding me that:

Today in Airpower History, August 30, 1995: NATO and U.S. aircraft began airstrikes on Serbian ground positions in Bosnia-Herzegovina to support the U.N. Operation Deliberate Force. The airstrikes, with a Bosnian-Croatian ground attack, convinced the Serbs to accept peace terms in late 1995.

I'm not particularly fond of commemorating airpower campaigns, but the Tweet did remind me of the small part I played in the Yugoslav Wars of the 1990s. Many Americans remember the 1990s, and especially the Clinton presidency, as a "quiet decade" between the first Gulf War led by President GHW Bush and the so-called "Global War on Terror" led by President GW Bush. Instead of a quiet decade, I remember a an exceptionally busy time for the Air Force, including some of the first "information operations" that combined digital and physical effects.

In fact, fifteen years ago, almost to the week I believe, I volunteered to deploy from San Antonio to Joint Analysis Center (JAC) Molesworth in the UK. They needed intelligence support in the targeting shop, so as an Air Force intel officer I fit the bill. I decided to volunteer to go to the UK over the holidays (through early January) at a time of my "choice," rather than wait for the inevitable call to deploy to the desert, where US forces were still conducting counter-Iraqi operations.

Besides other targeting duties, the most interesting aspect of the shop was a requirement we received concerning a counter-propaganda campaign. Serbian Radio Television (SRT) was broadcasting fairly vile and false information to undermine the peace process. The Stabilization Force (SFOR) commander asked the JAC for options to shut down SRT transmissions, i.e., how to conduct "offensive counterinformation" operations against the Serbs.

We did some technical analysis of the SRT communication infrastructure and determined that if a certain set of transmission towers were "out of commission," that would end the broadcast problem. Part of the shop thought 500 lb bombs would be the best answer. Others thought we should apply a nondestructive approach and simply seize the towers by surrounding them with troops and tanks.

The photo in this post, attributed to the 55th Combat Camera Company, tells you what happened the morning of 1 October, 1997. SFOR seized four towers (Hill 619 in Duga Njiva is depicted), effectively terminating the SRT propaganda campaign. SFOR didn't destroy anything, but it conducted an information warfare operation to achieve the desired objective -- control of adversary mass communication.

If you'd like to read more about the history and theory of this operation, please see Physical Attack Information Operations in Bosnia: Counterinformation in a Peace Enforcement Environment by Major Arthur N. Tulak. I haven't yet read Memory, the media and NATO: information intervention in Bosnia-Hercegovina by Monroe Price, but it also discusses the same operation.

Tweet

Read More

Thoughts on Air-Sea Battle Briefing at Brookings

Last month I attended an event at the Brookings Institute about the Air-Sea Battle concept, which I mentioned in China's High-Tech Military Threat and Air Sea Battle yesterday. A good companion to the briefing is the article Air-Sea Battle: Promoting Stability in an Era of Uncertainty published in February in the journal The American Interest. In that article, General Norton A. Schwartz, USAF (at right in the picture) & Admiral Jonathan W. Greenert, USN write:

When Secretary of Defense Leon Panetta introduced the new strategic guidance for the Department of Defense, he stated that the “smaller and leaner” Joint Force of the future must be prepared, in conjunction with allies and partners, to confront and defeat aggressors anywhere in the world, “including those seeking to deny our power projection.”

The new strategic guidance directs U.S. forces to maintain the “ability to project power in areas in which our access and freedom to operate is challenged” and to be “capable of deterring and defeating aggression by any potential adversary...

With Air-Sea Battle, we are reinvigorating the historic partnership between our two departments to protect the freedom of the commons and ensure operational access for the Joint Force.

Air-Sea Battle provides the concepts, capabilities and investments needed to overcome the challenges posed by emerging threats to access like ballistic and cruise missiles, advanced submarines and fighters, electronic warfare and mines...

Air-Sea Battle relies on highly integrated and tightly coordinated operations across warfighting domains—for example, using cyber methodologies to defeat threats to aircraft, or using aircraft to defeat threats on and under the sea. During the Brookings event, the General and the Admiral were careful not to mention China at all. In fact, I checked the transcript and didn't read either of them saying that word, although reporters asked them about China.

I don't have a problem with that, although I think it's a little disingenuous. The remainder of the American Interest article explains a variety of so-called A2AD scenarios, while also never saying "China." It does mention Iran, however.

Tweet

Read More

China's High-Tech Military Threat and Air Sea Battle

Two months ago Bill Gertz published an excellent article titled China's High-Tech Military Threat. I wanted to share a few excerpts that resonated with me.

[I]n November 2011, the Pentagon conducted an unusual rollout of a new military unit called the Air Sea Battle Office...

The concept calls for the Air Force, Navy, and Marine Corps to integrate forces and other capabilities to defeat what the Pentagon has labeled “anti-access and area denial weapons” — high-technology arms that can prevent or deter the United States military from operating in certain areas...

When pressed on the question of whom the initiative was targeting, one official responded, “The concept isn’t about a specific actor; it’s about countering anti-access, area-denial capabilities...”

[T]he Air Sea Battle Concept is the culmination of a strategy fight that began nearly two decades ago inside the Pentagon and U.S. government at large over how to deal with a single actor: the People’s Republic of China...

The reluctance to publicly identify Chinese belligerence as the impetus for the concept is merely a ruse to mollify adherents of a “Benign China” school of foreign policy — the losing side of the long internal policy fight.

The ideological godfather of the benign-China school is Harvard professor and former Clinton administration defense policymaker Joseph S. Nye. In 1995, Nye put forth the notion that if the United States treated China as a threat, it would become a threat.

Nye, who is also one of the progenitors of the soft-power school of policymaking now adopted by Secretary of State Hillary Clinton, has called the notion of a threatening China a self-fulfilling prophecy only warmongers and defense contractors would or could celebrate.

The Gertz article continues by describing the battle for leadership between the "Benign China" and "realist" China schools of thought.

For more information on this issue, please consider reading another Gertz article: Panda War.

Photo credit: ChineseDefence.com

Tweet

Read More

Bejtlich's Thoughts on "Why Our Best Officers Are Leaving"

Twenty-two years ago today I flew to Colorado Springs, CO and reported for Basic Cadet Training with the class of 1994 at the United States Air Force Academy. I took the oath of office pictured at left the following day. I left the service in 2001 because I could no longer fit my military intelligence and computer network defense career interests within the archaic, central planning commission-like personnel system the ruled Air Force assignments.

Today I read an article by Tim Kane, USAFA class of 1990, titled Why Our Best Officers Are Leaving. This article resonated so strongly with me I got a little emotional reading it. The following are some relevant excerpts.

Why are so many of the most talented officers now abandoning military life for the private sector? An exclusive survey of West Point graduates shows that it’s not just money. Increasingly, the military is creating a command structure that rewards conformism and ignores merit. As a result, it’s losing its vaunted ability to cultivate entrepreneurs in uniform...

The military’s problem is a deeply anti-entrepreneurial personnel structure. From officer evaluations to promotions to job assignments, all branches of the military operate more like a government bureaucracy with a unionized workforce than like a cutting-edge meritocracy...

In a recent survey I conducted of 250 West Point graduates (sent to the classes of 1989, 1991, 1995, 2000, 2001, and 2004), an astonishing 93 percent believed that half or more of “the best officers leave the military early rather than serving a full career.”

Why is the military so bad at retaining these people? It’s convenient to believe that top officers simply have more- lucrative opportunities in the private sector, and that their departures are inevitable. But the reason overwhelmingly cited by veterans and active-duty officers alike is that the military personnel system—every aspect of it—is nearly blind to merit. Performance evaluations emphasize a zero-defect mentality, meaning that risk-avoidance trickles down the chain of command.

Promotions can be anticipated almost to the day— regardless of an officer’s competence—so that there is essentially no difference in rank among officers the same age, even after 15 years of service.

Job assignments are managed by a faceless, centralized bureaucracy that keeps everyone guessing where they might be shipped next...

When I asked veterans for the reasons they left the military, the top response was “frustration with military bureaucracy”—cited by 82 percent of respondents (with 50 percent agreeing strongly)...

In a 2007 essay in the Armed Forces Journal, Lieutenant Colonel Paul Yingling offered a compelling explanation for this risk-averse tendency. A veteran of three tours in Iraq, Yingling articulated a common frustration among the troops: that a failure of generalship was losing the war. His critique focused not on failures of strategy but on the failures of the general-officer corps making the strategy, and of the anti-entrepreneurial career ladder that produced them:

“It is unreasonable to expect that an officer who spends 25 years conforming to institutional expectations will emerge as an innovator in his late forties.”

[A]n internal job market might be the key to revolutionizing military personnel. In today’s military, individuals are given “orders” to report to a new assignment every two to four years. When an Army unit in Korea rotates out its executive officer, the commander of that unit is assigned a new executive officer. Even if the commander wants to hire Captain Smart, and Captain Smart wants to work in Korea, the decision is out of their hands—and another captain, who would have preferred a job in Europe, might be assigned there instead.

The Air Force conducts three assignment episodes each year, coordinated entirely by the Air Force Personnel Center at Randolph Air Force Base, in Texas. Across the globe, officers send in their job requests. Units with open slots send their requirements for officers. The hundreds of officers assigned full-time to the personnel center strive to match open requirements with available officers (each within strictly defined career fields, like infantry, intelligence, or personnel itself), balancing individual requests with the needs of the service, while also trying to develop careers and project future trends, all with constantly changing technological tools. It’s an impossible job, but the alternative is chaos.

In fact, a better alternative is chaos. Chaos, to economists, is known as the free market, where the invisible hand matches supply with demand...

Here is how a market alternative would work. Each commander would have sole hiring authority over the people in his unit. Officers would be free to apply for any job opening. If a major applied for an opening above his pay grade, the commander at that unit could hire him (and bear the consequences). Coordination could be done through existing online tools such as monster.com or careerbuilder.com (presumably those companies would be interested in offering rebranded versions for the military). If an officer chose to stay in a job longer than “normal” (“I just want to fly fighter jets, sir”), that would be solely between him and his commander...

I surveyed ex-military officers at Citi, Dell, Amazon, Procter & Gamble, TMobile, Amgen, Intuit, and countless venture-capital firms. At every company, the veterans were shocked to look back at how “archaic and arbitrary” talent management was in the armed forces. Unlike industrial-era firms, and unlike the military, successful companies in the knowledge economy understand that nearly all value is embedded in their human capital.

I completely agree with this article, especially the concepts of an "internal market" for hiring and retaining talent. I hope someone with the power to implement change reads Mr Kane's article and fights the bureaucracy to improve all the military services by nurturing their most important resource: people.

Tweet

Read More

What Gets Measured, Matters

I received the latest issue of my alumni magazine, Checkpoints, today. It's graduation season, so the content included statistics about the latest graduating class as shown at right.

This relates to a recent post, Whither United States Air Force Academy?, where I said the skill most needed to help grow the nation is digital defense.

The statistics the Checkpoints editors chose to print, however, reminded me of the Academy's current focus. Notice that between the demographic information and the "fun facts" we see details on so-called "rated officers," reprinted below:

• 529 total rated graduates
• 490 pilots
• 8 combat systems operators
• 2 air battle managers
• 29 unmanned aerial system pilots

To me, these statistics reflect the idea that "what gets measured, matters." Clearly the bias at USAFA continues to be towards flying. I get the "Fly, Fight, Win" message. I repeat it often at inappropriate times thanks to effective brainwashing techniques.

Imagine what the list might look like if a different paradigm operated:

• 529 total cyber operators
• 107 computer network defenders (generic category)
• 102 incident responders
• 101 developers (secure coding focus)
• 98 reverse engineers
• 84 forensic investigators
• 37 offensive specialists

...or something like that. Don't dwell on the categories or counts: focus on the message. Could you imagine a military academy producing young people with skills like that? Imagine the impact they could have inside and outside the military. Think of the growth in civil aviation after World War II thanks to the influx of former military pilots.

Seeing statistics like I created will be a signal that we have a chance of winning the ongoing cyberwar.

Tweet

Read More

Whither United States Air Force Academy?

From TaoSecurity

Thomas Ricks' post Does the Air Force Academy have ‘the least educated faculty’ in the country? inspired me to write this post. Mr. Ricks cited a story by Jeff Dyche, a former USAFA professor who cited a litany of concerns with the USAFA experience. I graduated from the Air Force Academy in 1994, ranked third in my class of 1024 cadets, and proceeded to complete a master's degree at Harvard in 1996. In my experience, at least in the early 1990s, USAFA faculty were as good, or better, than Harvard faculty. I considered the nature and volume of my graduate courses to be simple compared to my USAFA classes. When several fellow graduate students broke into tears after learning what the Harvard faculty expected of them, I couldn't believe how much easier the classes were going to be!

Rather than address points made by Ricks and Dyche, I prefer to focus on a theme that appears every few years: "why does the nation need service academies?" To provide one answer to this question, I'm going to draw on some lessons from a biography I'm reading called Grant by Jean Edward Smith. As you probably know, US Grant was a West Point graduate. According to Smith, during Grant's time as a cadet, West Point was one of only two schools in the nation that trained graduates as civil engineers. According to West Point in the Making of America,"

Following the example of the famous French engineering and artillery schools that the army had sent him to study, [Superintendent] Thayer made West Point America's national engineering school. West Point combined officer training with a highly technical undergraduate education...

Engineering itself became the army’s elite branch of service, the first choice by those who ranked highest in a graduating class. Lower-ranking cadets went to the cavalry, infantry, and other branches. West Point also became the nation's major source of civil engineers and of engineering educators. In the three decades before the Civil War, West Pointers as teachers, writers, and practitioners fostered science and engineering at Cornell, Harvard, Yale, and other colleges.

So, beyond just producing professional military officers, West Point met the country's exploding demand for civil engineers. As Smith says:

[A]s the nation moved westward, the demand for engineers grew steadily. For that reason, few of the young men who went to West Point did so with the intention of making the Army a career. It was no disgrace to resign from the service to take a better civilian position, and of the 1058 cadets who graduated from the academy between its inception in 1802 and 1839, only 395 remained on active duty.

I believe West Point's experience in the early 1800's could serve as an example for USAFA in this century. Few would advocate closing USAFA if it produced graduates with skills seldom found elsewhere, meeting another exploding demand. It seems to me that the skill most needed to help grow the nation is digital defense. This requirement takes many forms, including secure coding, infrastructure design/construction/operation, incident detection and response, forensics, threat intelligence and adversary characterization, malware analysis and reverse engineering, counter-threat operations, and related fields. With the proper leadership, faculty, and determination, USAFA could differentiate itself as the nation's premiere "cyber school," with an integrated curriculum focusing on securing cyberspace -- both in the military and government or private sectors.

This change doesn't require shifting all Academy resources to the cyber mission, but I would admit far greater numbers of cyber-affiliated candidates and radically beef up the Academy's cyber program. There is a precedent: in 1990 when I was admitted, I was one of the approximately 150 freshmen (out of about 1,500 total freshmen) who lacked 20/20 vision. 90% of my class was "pilot qualified" because the demand for pilot training was projected to be high by 1994.

If USAFA became known as "the" school for cyber, accepting that not all graduates intend to serve a twenty year Air Force career, I doubt the school would suffer so many questions of relevance and cost.

Tweet

Read More

APT Drives Up Bomber Cost

Bill Sweetman wrote a good article on the new Air Force bomber program titled USAF Bomber Gets Tight Numbers. I found the following paragraph interesting:

One factor will drive up the cost of the bomber’s R&D: its status as a SAP [Special Access Program]. SAP status — whether the program is an acknowledged SAP, as the bomber is likely to be, or completely black — incurs large costs. All personnel have to be vetted before they are read into the program. Information within the program is compartmentalized, reducing efficiency. SAP status has been estimated to add 20% to a program’s cost.

Security for SAP isn't cheap! Sweetman elaborates:

The most likely reason for this measure is the sensitivity of ELO [extreme low-observable] technology, combined with the fact that the U.S. is the target of what may be the most extensive and successful espionage program in history — China’s Advanced Persistent Threat.

How much is the new bomber supposed to cost?

The magic numbers for the bomber are a fleet size of 80-100 and a flyaway cost of $500 million.

So, that's $50 billion, assuming 100 aircraft at $500 million each? Let's assume that cost includes SAP fees. If SAP protection adds 20%, that means without SAP the cost would be roughly $42 billion.

That means, for this program alone, the APT costs the US taxpayer $8 billion.

I find this sort of article really interesting because it demonstrates a real-world cost due to ongoing computer intrusions perpetrated by the APT.

Tweet

Read More

Ten Years After Leaving the Air Force

Ten years ago today was my last official day as an active duty officer in the United States Air Force.

I left the Individual Ready Reserve in June 2002, but I don't count that extra time since I worked as a civilian full-time.

I find it ironic that the "Officer In Charge" (OIC) of "Career Enhancements" signed my Honorable Discharge! Leaving the service can be quite a "career enhancement" when you want to continue defending Air Force data assets but the service feels its time to "career broaden." :)

To this day I am grateful for the colleagues, training, experiences, missions, and responsibilities of my time in the Air Force. At the same time, I remain amazed that I spent almost 11 years of my life wearing the uniform. It seems so long ago now, but I am always pleased to run across people in the security and intelligence worlds who remember working with "Captain Bejtlich."

I've greatly enjoyed the last ten years out of uniform and I look forward to more good ones, God willing!
Tweet

Read More

Historical Video on AFCERT circa 2000

I just uploaded a video that some readers might find entertaining. This video shows the United States Air Force Computer Emergency Response Team (AFCERT) in 2000. Kelly AFB, Security Hill, and Air Intelligence Agency appear. The colonel who leads the camera crew into room 215 is James Massaro, then commander of the Air Force Information Warfare Center. The old Web-based interface to the Automated Security Incident Measurement (ASIM) sensor is shown, along with a demo of the "TCP reset" capability to terminate TCP-based sessions.

We have a classic quote about a "digital Pearl Harbor" from Winn Schwartau, "the nation's top information security analyst." Hilarious, although Winn nails the attribution and national leadership problems; note also the references to terrorists in this pre-9/11 video. "Stop the technology madness!" Incidentally, if the programs shown were "highly classified," they wouldn't be in this video!

I was traveling for the AFCERT when this video was shot, so luckily I am not seen anywhere...

Read More

Review of Martin Libicki's Cyberdeterrence and Cyberwar

Amazon.com just posted my three star review of Martin Libicki's Cyberdeterrence and Cyberwar. I've reproduced the review in its entirety here because I believe it is important to spread the word to any policy maker who might read this blog or be directed here. I've emphasized a few points for readability.

As background, I am a former Air Force captain who led the intrusion detection operation in the AFCERT before applying those same skills to private industry, the government, and other sectors. I am currently responsible for detection and response at a Fortune 5 company and I train others with hands-on labs as a Black Hat instructor. I also earned a master's degree in public policy from Harvard after graduating from the Air Force Academy.

Martin Libicki's Cyberdeterrence and Cyberwar (CAC) is a weighty discussion of the policy considerations of digital defense and attack. He is clearly conversant in non-cyber national security history and policy, and that knowledge is likely to benefit readers unfamiliar with Cold War era concepts. Unfortunately, Libicki's lack of operational security experience undermines his argument and conclusions. The danger for Air Force leaders and those interested in policy is that they will not recognize that, in many cases, Libicki does not understand what he is discussing. I will apply lessons from direct experience with digital security to argue that Libicki's framing of the "cyberdeterrence" problem is misguided at best and dangerous at worst.

Libicki's argument suffers five key flaws. First, in the Summary Libicki states "cyberattacks are possible only because systems have flaws" (p xiii). He continues with "there is, in the end, no forced entry in cyberspace... It is only a modest exaggeration to say that organizations are vulnerable to cyberattack only to the extent they want to be. In no other domain of warfare can such a statement be made" (p. xiv). I suppose, then, that there is "no forced entry" when a soldier destroys a door with a rocket, because the owners of the building are vulnerable "to the extent they want to be"? Are aircraft carriers similarly vulnerable to hypersonic cruise missiles because "they want to be"? How about the human body vs bullets?

Second, Libicki's fatal understanding of digital vulnerability is compounded by his ignorance of the role of vendors and service providers in the security equation. Asset owners can do everything in their power to defend their resources, but if an application or implementation has a flaw it's likely only the vendor or service provider who can fix it. Libicki frequently refers to sys admins as if they have mystical powers to completely understand and protect their environments. In reality, sys admins are generally concerned about availability alone, since they are often outsourced to the lowest bidder and contract-focused, or understaffed to do anything more than keep the lights on.

Third, this "blame the victim" mentality is compounded by the completely misguided notions that defense is easy and recovery from intrusion is simple. On p 144 he says "much of what militaries can do to minimize damage from a cyberattack can be done in days or weeks and with few resources." On p 134 he says that, following cyberattack, "systems can be set straight painlessly." Libicki has clearly never worked in a security or IT shop at any level. He also doesn't appreciate how much the military relies on civilian infrastructure from everything to logistics to basic needs like electricity. For example, on p 160 he says "Militaries generally do not have customers; thus, their systems have little need to be connected to the public to accomplish core functions (even if external connections are important in ways not always appreciated)." That is plainly wrong when one realizes that "the public" includes contractors who design, build, and run key military capabilities.

Fourth, he makes a false distinction between "core" and "peripheral" systems, with the former controlled by users and the later by sys admins. He says "it is hard to compromise the core in the same precise way twice, but the periphery is always at risk" (p 20). Libicki is apparently unaware that one core Internet resource, BGP, is basically at constant risk of complete disruption. Other core resources, DNS and SSL, have been incredibly abused during the last few years. All of these are known problems that are repeatedly exploited, despite knowledge of their weaknesses. Furthermore, Libicki doesn't realize that so-called critical systems are often more fragile that user systems. In the real world, critical systems often lack change management windows, or are heavily regulated, or are simply old and not well maintained. What's easier to reconfigure, patch, or replace, a "core" system that absolutely cannot be disrupted "for business needs," or a "peripheral" system that belongs to a desk worker?

Fifth, in addition to not understanding defense, Libicki doesn't understand offense. He has no idea how intruders think or the skills they bring to the arena. On pp 35-6 he says "If sufficient expenditures are made and pains are taken to secure critical networks (e.g., making it impossible to alter operating parameters of electric distribution networks from the outside), not even the most clever hacker could break into such a system. Such a development is not impossible." Yes, it is impossible. Thirty years of computer security history have shown it to be impossible. One reason why he doesn't understand intruders appears on p 47 where he says "private hackers are more likely to use techniques that have been circulating throughout the hacker community. While it is not impossible that they have managed to generate a novel exploit to take advantage of a hitherto unknown vulnerability, they are unlikely to have more than one." This baffling statement shows Libicki doesn't appreciate the skill set of the underground.

Libicki concludes on pp xiv and xix-xx "Operational cyberwar has an important niche role, but only that... The United States and, by extension, the U.S. Air Force, should not make strategic cyberwar a priority investment area... cyberdefense remains the Air Force's most important activity within cyberspace." He also claims it is not possible to "disarm" cyberwarriors, e.g., on p 119 "one objective that cyberwar cannot have is to disarm, much less destroy, the enemy. In the absence of physical combat, cyberwar cannot lead to the occupation of territory." This focus on defense and avoiding offense is dangerous. It may not be possible to disable a country's potential for cyberwar, but an adversary can certainly target, disrupt, and even destroy cyberwarriors. Elite cyberwarriors could be likened to nuclear scientists in this respect; take out the scientists and the whole program suffers.

Furthermore, by avoiding offense, Libicki makes a critical mistake: if cyberwar has only a "niche role," how is a state supposed to protect itself from cyberwar? In Libicki's world, defense is cheap and easy. In the real world, the best defense is 1) informed by offense, and 2) coordinated with offensive actions to target and disrupt adversary offensive activity. Libicki also focuses far too much on cyberwar in isolation, while real-world cyberwar has historically accompanied kinetic actions.

Of course, like any good consultant, Libicki leaves himself an out on p 177 by stating "cyberweapons come relatively cheap. Because a devastating cyberattack may facilitate or amplify physical operations and because an operational cyberwar capability is relatively inexpensive (especially if the Air Force can leverage investments in CNE), an offensive cyberwar capability is worth developing." The danger of this misguided tract is that policy makers will be swayed by Libicki's misinformed assumptions, arguments, and conclusions, and believe that defense alone is a sufficient focus for 21st century digital security. In reality, a kinetically weaker opponent can leverage a cyber attack to weaken a kinetically superior yet net-centric adversary. History shows, in all theatres, that defense does not win wars, and that the best defense is a good offense.

Read More

Air Force Cyberspace Report

This week I attended Victory in Cyberspace, an event held at the National Press Club. It centered on the release of a report written by Dr. Rebecca Grant for the Air Force Association's Eaker Institute. The report is titled Victory in Cyberspace (.pdf). The panel (pictured at left) included Lt. Gen. Robert J. Elder, Lt Gen. (ret) John R. Baker, and Gen. (ret) John P. Jumper. Dr. Grant is seated at the far right.

As far as the event went, I found it interesting. If you are exceptionally motivated you can download the entire 90 min briefing in .wmv format here. I'd like to share a few thoughts.

First, I was impressed by all the speakers. Lt. Gen. Baker led AIA when I was a Captain there. At the same time Gen. Jumper led Air Combat Command, before becoming Chief of Staff. I learned Lt. Gen. Elder has a PhD in engineering.

Lt. Gen. Elder commented that cyberspace is a domain similar to the ocean, and he specifically drew parallels with the Navy. (This made me wonder why the Navy isn't taking the lead on defending cyberspace.) In order to use the ocean for commercial purposes, the domain must be controlled so ships are protected from harm. Cyberspace is similar, except that in addition to requiring control of the domain in order to use it, the domain must first be created. (No one needs to create an ocean.)

Control, however, does not mean "ownership." Elder specifically stated the Air Force does not plan to "own cyberspace;" cyberspace is more of a "strategic commons" like the ocean. Cyberspace is also not confined only to the Internet. A presentation by Dr. Lani Kass titled Cyberspace: A Warfighting Domain cites the classified National Military Strategy for Cyberspace Operations to define cyberspace as:

a domain characterized by the use of electronics and the electromagnetic spectrum store, modify and exchange data via networked systems and associated physical infrastructures.

(Speaking of the NMSCO, I read a Joint document is en route, according to Joint Staff readies cyber operations plan.)

Elder's presentation featured plenty of military jargon, like the great "OODA loop" (observe, orient, decide, act) and a new "effects chain" (find, fix, target, engage). (That sounds like the OODA loop, doesn't it?)

One of Elder's major points, reflected in the report, is the Air Force's recognition that cyberspace (broadly meaning communications, I believe) is the foundation for all Air Force operations. I would argue that all of the services are equally dependent on cyberspace. That reminds me of the role of United States Transportation Command. It makes sense to me that cyberspace activities are currently part of United States Strategic Command.

USSTRATCOM accomplishes its cyber mission through the Joint Task Force - Global Network Operations (JTF-GNO, led by the commander of Defense Information Systems Agency), Joint Functional Component Command - Network Warfare (JFCC-NW, led by the director of National Security Agency), and Joint Information Operations Warfare Command (JIOWC, led by the commander of Air Force Intelligence, Surveillance, and Reconnaissance Agency).

If cyberspace is truly a warfighting domain (alongside land, sea, aerospace), I don't see who can argue against an independent Cyber Force. (I don't argue for a separate Space Force because I think the Air Force will eventually be the Aerospace Force.) Elder rejects the idea of an individual Cyber Force in Dr. Grant's report, but the Army had the same feeling about the Air Corps before 1947. We can separate the world into physical and virtual, or as the military likes to say, "kinetic" and "non-kinetic." I find it hard to believe that a cyber operator who reads and manipulates hex is going to find much in common with someone who kills people by exploding ordnance.

Elder mentioned some of the tasks the Air Force expects to perform to better secure its networks. These included a "cyber standardization and evaluation team," application assurance testing, software tamper detection via signatures and hashes, clusters of systems voting on proper outcomes, "cyber sidearms" in the form of tools on individual laptops, and a specific cyber Air Force Specialty Code (AFSC). If this had happened 10 years ago my career would have been very different and probably much longer!

Elder finished his talk describing how the US Code affects Air Force activities. For example, Title 10 (Armed Forces) restricts the work of the active duty military. Similar restrictions affect the intelligence community through Title 50 (War and Defense). However, because the Air National Guard operates under Title 32 (National Guard), it has more room to help the commercial sector and local governments with network defense. Elder said he would like to see Guard cyber units in every state, from the size of a squadron up to a wing. I thought this was a fairly exciting concept, since the Guard is likely to contain people with industry experience.

Lt. Gen. Baker and Gen. Jumper only spoke for a few minutes each. Jumper really hammered the acquisition community for providing the "block 40 upgrade to the block 30 capability" and thinking that helps the warfighter. He recommended writing Concepts of Operations before deciding what to buy. (Wow, sounds just like the commercial world; don't let vendors drive your security program!) Jumper said we need a "PhD-quality Weapons School," aggressor forces, and policy and doctrine modeled on offensive and defensive counter-air operations.

In the question phase, when asked why the bad guys are "so much better" than the good guys, Jumper replied "Bad guys don't have policy constraints." I believe Baker stated that the biggest problem he sees in industry is the feeling that "we don't think it [breaches] can happen to us,", he said, "but it's happening every day."

As far as the report itself, I realized the author did not have any experience in the topic of computer network defense, exploitation, or warfare. Having just watched two shows on Army and Marine snipers, it made me think how it must sound to a sniper for a non-sniper to write a report on sniper craft. Disappointingly, the Estonia "cyberwar" was presented as the galvanizing action that should stir everyone's pot. In describing the event, the report author wrote:

The attackers also used illicitly linked computers around the globe to mount an enhanced onslaught. These attacks were conducted by networks of "bots" -- a bot being an automated program that accesses web sites and traverses the site by following links on its pages.

So, it appears we should pin the blame on Web crawlers. Sigh.

I also read about "Windows 1.0" being released in August 1995 and "Windows 2.0" in November 1995.

Apparently no one did a technical edit of this report. It's clear it took a lot of work to write this report, however. There's plenty of history, references and interviews. I would not have wanted to undertake this task, since I would have required a few years to get the history right.

I found this one item immensely interesting, so I'll close with it:

[One] difficulty is estimating the scope of the mission. "We are well past the $5 billion per year mark, and I don't know where the top end is," commented one STRATCOM official. "The $5 billion is mostly on defense. We buy huge amounts of software and people to run that, but it's totally ineffective against Tier III" cyber [advanced persistent] threats, this official noted. (emphasis added)

Read More

Air Force Cyber Command Provisionally at Barksdale

What a busy night. I just read Wynne taps Barksdale to host Cyber Command:

The Air Force Cyber Command will be headquartered, at least on an interim basis, at Barksdale Air Force Base, La., Secretary of the Air Force Michael Wynne announced Wednesday while visiting Barksdale and the base’s surrounding communities.

Wynne is expected to offer more details about Cyber Command on Tuesday as the part of the Air Force’s Pentagon celebration of its 60th anniversary.

The command will likely be led by a two-star general, officials said. While four-star generals traditionally head Air Force major commands, commands with fewer members, such as Air Force Special Operations Command, have two- or three-star generals in charge.

Like the other major commands, Cyber Command will answer directly to the secretary and the chief of staff.

There had been some consideration that Cyber Command would come under Air Combat Command’s 8th Air Force, headquartered at Barksdale. The 8th oversees much of the service’s computer network defense and information warfare capabilities. The commander of the 8th, Lt. Gen. Robert Elder, has been the service’s point man for mapping out Cyber Command’s structure and requirements for training members and acquiring equipment.

Barksdale won on an interim basis because the Air Force Network Operations Center is there, although this AFNOC Fact Sheet mentions that the AFNOC Network Security Division is at Lackland Air Force Base, Texas and the AFNOC Network Operations Division is at Gunter Annex, Alabama.

I think Air Force Cyber Command will be permanently based in San Antonio (to leverage AFISR Agency) or potentially a base near DC, to facilitate coordination with Ft Meade.

I am really looking forward to attending Victory in Cyberspace, hosted by the Air Force Association:

The Eaker Institute will release a report “Victory in Cyberspace” and host a panel discussion about the Cyberspace domain at 1 p.m., Tuesday, Oct. 9, at the National Press Club...

This Eaker Institute Panel will discuss how cyberspace should become equal with air and space in the Air Force’s mission set and how that affects the airman’s profession and the nation’s security priorities. Participants include Lt. Gen. Elder, who commands the Air Force headquarters for cyberspace, global strike and network operations, including establishing a new Cyber Command; Gen. Jumper (ret.), former Chief of Staff of the Air Force; and Lt. Gen. Baker (ret.), former Vice Commander, Air Mobility Command [and one of my AIA commanders].

I expect to hear more about Air Force Cyber Command on the Air Force 60th Birthday on 18 September.

Read More

Goodbye AIA

A friend from my AFCERT days left a comment indicating that the 33 IOS split into two different squadrons, the 33 NWS (the old AFCERT) and the 91 NWS. This prompted me to look at the organizational structure of my old Air Force units.

I realized that last month what used to be Air Intelligence Agency is now Air Force Intelligence, Surveillance and Reconnaissance Agency, according to this story. AFISR now works as a field operating agency for AF/A2, the Deputy Chief of Staff for Intelligence, Surveillance and Reconnaissance, Lt. Gen. David A. Deptula. AIA was part of 8th Air Force, but that experiment has been reversed.

It looks like AFISR has lost information operations duties since it's now an "ISR" agency. According to Air Force ISR Agency, the AF/A2 says:

"Air Intelligence Agency was traditionally focused on a particular intelligence discipline, signals intelligence," said General Koziol. "Now we are expanding our capabilities into geo-spatial-intelligence, imagery, human intelligence, and measurement and signature intelligence disciplines. As an integral member of our nation's combat forces, we are focused on integrating the information derived by those capabilities and delivering critical information to combatant commanders and national level decision makers."

That's news to me. I think AIA was doing those missions previously, but Deptula wants a single agency responsible for all of it. He gets that with AFISR. Information operations are now part of Air Force Cyber Command, which apparently will become active this fall.

I have mixed feelings about AIA's fate. Lt. Gen. Deptula is a three-star, which outranks previous top intel generals (who were two-stars). Putting a three-star with ISR responsibilities at HQ AF will probably give ISR greater attention. However, the word "intel" appears three times in Deptula's bio -- all in relation to his existing job. He's a career F-15 driver, so once again we have a pilot as the Air Force's "top intel guy." This is sad. Are there no good Air Force intel generals available? Hopefully the new AFISR commander, Maj. Gen. John C. Koziol, will be able to step up when Deptula moves on.

The only saving grace in this situation is that the king of all intel officers continues to be Gen. Michael Hayden, Director of the Central Intelligence Agency.

Read More

Hope for Air Force Cyberoperators

Last November I wrote about the Air Force Cyberspace Command. I said:

I'd like to see the new Cyberspace Command sponsor a new Air Force Specialty Code (AFSC) for information warriors. The current Intel or Comm paradigm isn't suitable.

Today I read Air Force moves to populate Cyberspace Command:

The Air Force is developing plans for a dedicated force to populate the ranks of the service’s new Cyberspace Command, its commanding general said today.

Lt. Gen. Robert Elder, commander of the 8th Air Force and chief of the new command, said the service will finish deliberations on a force structure for the command within a year and then start filling those positions.

Once service officials have laid out career paths and training guidelines for the jobs, Elder said, recruits will be able to join what he called the Air Force’s cyberforce just as they could opt to become fighter pilots or navigators.

I hope this "cyberforce" is an AFSC for "cyberoperators." These "cyber" terms make me cringe, but whatever they are called it's important to create a new AFSC for these people. I left the USAF in 2001 because I was the only company-grade intelligence officer in the Air Force with hands-on computer network defense skills. Because I wasn't a comm officer or engineer, the personnel weenies at Air Force Personnel Command had no career path for me. That's why I pulled the ejection handles and joined the civilian workforce, where I could control my own career path.

I'd still like to see an independent Cyber Force to centralize information warfare capabilities alongside the Army, Navy, Air Force, and Marines.

Read More

Air Force Cyberspace Command

According to Air Force Link, 8th Air Force will become the new Air Force Cyberspace Command. This appears to be the next step following the creation of a Air Force Network Operations Command structure in August. That came on the heels of the Air Force Information Warfare Center being redesignated as the Air Force Information Operations Center. That was a result of the Air Force Tactical Fighter Weapons Center being redesignated as the Air Force Warfare Center. In a related move, the former 67th Information Operations Wing is now the 67th Network Warfare Wing. Follow all that?

It also appears the Air Force is centralizing control of network operations and security centers, according to this article:

All Air Force network operations security centers, which were previously decentralized among the major commands, will consolidate under the 67th with the stand-up of two integrated network operations and security centers, or I-NOSCs, located at Langley AFB, Va., and at Peterson AFB, Colo.

Apparently the former AFCERT, now the Air Force Network Operations and Security Center Network Security Division (AFNOSC NSD) in San Antonio, TX, is adding 191 MacAulay-Brown contractors.

For some higher level insights into these changes, the latest version of AFI 33-115v1: Network Operations (.pdf) might be interesting.

Returning to the creation of the new Cyberspace Command -- remember the Air Force was once part of the United States Army. I see no reason why the United States should maintain independent services that fight on land, sea, air, and space, but have cyber forces scattered throughout the other services. (You might make the counter-argument that each service maintains its own "air forces," but these support their parent service.)

I think within my lifetime we will see an independent Cyber Force to centralize information warfare capabilities alongside the Army, Navy, Air Force, and Marines. If it happens within the next 10 years, I think Col Greg Rattray might be in charge. (Yes, I'm assuming he continues to be promoted!) Before that happens, I'd like to see the new Cyberspace Command sponsor a new Air Force Specialty Code (AFSC) for information warriors. The current Intel or Comm paradigm isn't suitable.

Read More

Thoughts on Military Service

I recently received an email which contained the following request:

I would be greatly appreciative of any response from you regarding how your experience with the military has enhanced your knowledge and careers in information security and any advice you may have to offer.

I was a cadet at the Air Force Academy from 1990-1994, and an active duty officer from 1994 to early 2001. I received my first formal training in security during military intelligence training in 1996. I started my first hands-on security work in 1998 at the Air Force CERT, using our ASIM sensors to detect and respond to intrusions. I met Sguil developer Bamm Visscher there. I left the Air Force when the personnel system decided it was time for me to "career broaden" out of the technical world and into another field. No thanks!

From my perspective, the Air Force is a good way to gain responsibility at a young age. It was quite an experience to be 27 and in charge of detecting intrusions across the whole Air Force. I liked the sense that what we did "mattered." Management supported our mission. In fact, current CIA Director General Michael Hayden commanded Air Intelligence Agency while I was assigned there, and he invented our information gain - exploit - defend - attack (GEDA) framework.

While in the Air Force I had a chance to deal with high-end intruders who were financed, trained, and determined. Failure was measured in lost sensitive information and potentially lives. When taken seriously, that reality drove adopting what worked and eliminating what didn't. I developed my thoughts on network security monitoring based on my Air Force experiences. I was also proud to serve with some of the most motivated and talented people I've ever met.

Read More

Thoughts on New Air Force Mission

Slashdot alerted me to the new US Air Force mission statement, which reads:

"The mission of the United States Air Force is to deliver sovereign options for the defense of the United States of America and its global interests -- to fly and fight in Air, Space, and Cyberspace. "

The mission used to be "to defend the United States and protect its interests through air and space power."

When I served we made the "transition" from an air force to a so-called aerospace force. It was an important step to recognize that space would be another arena for combat. Now the new mission statement has added cyberspace to the list of arenas in which the Air Force will fight.

The Air Force has been fighting in cyberspace for decades. The battle became especially interesting in the early 1990s when we decided to deploy ASIM sensors to monitor networks. ASIM, or Automated Security Incident Measurement, was a network-based IDS built on Todd Heberlein's Network Security Monitor (NSM). NSM was the first network-based IDS. Prior to NSM, intrusion detection was done by watching activity on hosts.

I am gratified to see the Air Force step up to the plate and declare that it will have a formal operational cyberspace responsibility. This recognition might help units tasked with performing this mission receive the resources they need to win in cyberspace.

"Nothing can stop the US Air Force!" :)

Read More

Air Force Personnel Database Owned

According to this Air Force Times story, personnel data for "about 33,300 officers and 19 airmen" was remotely accessed. The records include "Social Security numbers... marital status, number of dependents, date of birth, race/ethnic origin (if declared), civilian educational degrees and major areas of study, school and year of graduation, and duty information for overseas assignments or for routinely sensitive units."

The story quotes an Air Force spokesman:

"'Basically, we had an unauthorized user gain access to a single user account by stealing a password,' said Lt. Col. John Clarke, chief of the Systems Operations Division at the Air Force Personnel Center. 'Then they went in and accessed member information on roughly 33,000 military members.'"

I would like to know how a "single user account" was able to query records on 33,000 people. If this account belonged to a normal user (i.e., an Air Force member), some serious problem allowed that single account to look at other members' records. Alternatively, the user account could have belonged to someone with privileges to review records.

It sounds like my old unit helped with the response:

"Personnel officials went to the 8th Air Force network operations center for help and called in the network security experts at the Air Intelligence Agency. They also brought in the Air Force Office of Special Investigations and legal specialists."

Read More