Waiting For Cybergeddon

In the United States, the FBI (which is responsible for detecting and investigating Internet based crime) is warning that America is becoming ever more vulnerable to "cybergeddon" (a massive attack via the Internet that would cripple the economy, government and military.)

The FBI admits that it has a hard time getting more money for their Internet security efforts. And reason is because the threat is largely invisible. A picture of a nuclear bomb going off, or of enemy tanks and warships ready to attack, makes a much more effective impression on the politicians who dole out the money.

The FBI also wants to get the Department of Defense Internet defense operations more involved in national level defense against network based attacks. But the four services have a hard time agreeing to coordinate their efforts to defend military use of the Internet when under massive hacker attack. Thus the FBI plea for help sort of falls on distracted ears.

There hasn't been a proper, all-out Cyber War yet. There have been lots of skirmishes, but nothing approaching what an all out battle, via the Internet, would be. What would the first Cyber War be like? Let's be blunt, no one really knows. But based on the cyber weapons that are known to exist, and the ones that are theoretically possible, one can come up with a rough idea.

First, there are three kinds of Cyber War possible. Right now, we have limited stealth operations (LSO), as Chinese, Russian, and others, use Cyber War techniques to support espionage efforts. China is the biggest practitioner, or at least they have been caught most often.

Next comes Cyber War only (CWO). This is open use of a full range of Cyber War weapons. No one has done this yet, but it's potentially less dangerous than firing missiles and unleashing tank divisions. It is believed that Russia indulged in this in 2007, when Estonia infuriated the Russians by moving a World War II statute memorializing the Soviet "liberation" of Estonia (which didn't want to be liberated by the Soviet Union.) Russia denied responsibility for the massive Cyber War assaults on Estonia, which nearly shut down the nations Internet infrastructure. Estonia accused Russia of being responsible, and tried to invoke the NATO mutual-defense pact. NATO Cyber War experts went to Estonia, and shortly thereafter the attacks stopped. Apparently Russia got the message that this sort of thing could escalate in something more conventional, and deadly.

Then we have Cyber War in support of a conventional war. Technically, we have had this sort of thing for decades. It has been called "electronic warfare" and has been around since World War II. But the development of the Internet into a major part of the planets commercial infrastructure, takes "electronic warfare" to a whole other level. Cyber War goes after strategic targets, not just the electronic weapons and communications of the combat forces.

A successful Cyber War depends on two things; means and vulnerability. The "means" are the people, tools and cyberweapons available to the attacker. The vulnerability is the extent to which the enemy economy and military use the Internet and networks in general. We don't know who has what Cyber War capabilities exactly, although China and the U.S. have openly organized Cyber War units, and both nations have lots of skilled Internet experts.

Vulnerability is another matter. The United States is the most exposed to Cyber War attack because, as a nation, we use the Internet more than any other country. That's the bad news. The good news is that if an attacker ever tried to launch a Cyber War by assaulting the U.S., it could backfire. This risk has to be kept in mind when considering what a Cyber War might do. Recall military history. The Pearl Harbor attack in 1941 actually backfired on the Japanese, by enraging Americans and unleashing a bloodthirsty response that left Japan in ruins. The lesson of the original Pearl Harbor is, if you're going to hit someone this way, better make it count. If your opponent is bigger than you, and gets back up, you could be in some serious trouble.

The big problem with Cyber War is that there has not been a lot of experience with it. Without that, no one is really sure what will happen when someone attempts to use it at maximum strength. But unlike nuclear weapons, there is far less inhibition about going all-out with Cyber War weapons. That is the biggest danger. Cyber War is a weapon of growing might, and little restraint by those who wield it. Things are going to get a lot worse.

U.S. Department Of Defense Setting Up Cyber War Section

Once again, the U.S. Department of Defense is trying to build a "Cyber War test range."

Previous efforts have foundered over technical issues. A Cyber War test range would be a collection of computers and networking equipment that would accurately simulate large chunks of the Internet.

This would include a full (and accurate) array of personal, commercial and military computers, but also accurate simulation of what the users are doing. A formidable task, but this time around, the Pentagon thinks it has previous obstacles covered.

Time will tell, and the success of the effort probably won't known until the aftermath of a future Cyber War demonstrates that the Cyber War test range was indeed accurate enough.

The "Cyber War test range" is basically a combination of widely known hardware, and some very special software. The latter element is the hard part.

U.S.A.F. Gen. Lorenz on leadership: At war in cyberspace

Hat Tip to AFPAA off twitter
Commentary by
Gen. Stephen R. Lorenz
Air Education and Training Command commander

12/23/2008 - RANDOLPH AIR FORCE BASE, Texas (AFNS) --

"The stark reality is that the bad guys are winning and our nation is at risk."

That's what retired Air Force Lieutenant General Harry Raduege, Jr., writes in an insightful article about cyberspace titled, "Evolving Cybersecurity Faces a New Dawn."

As he describes our many challenges in cyberspace, General Raduege observes that "the list of concerns is growing and endless: rampant cybercrime, increasing identity theft, sophisticated social engineering techniques, relentless intrusions into government networks, and widespread vulnerabilities continuously exploited by a variety of entities ranging from criminal organizations and entrepreneurial hackers to well-resourced espionage actors."

Over the last few weeks, we have focused on the security of our computer networks, and we have found that we have big challenges.

The bottom line is that we are at war in cyberspace...today...all the time.

Our enemies are attacking our network -- the same network you use to send e-mails, share documents and access the internet. They are using stealth and surprise to insert malicious code into our network in order to gain intelligence. What is our enemy's intention? We don't know, but it's not friendly.

Chief Master Sergeant Rob Tappana, our command chief, said something that caught my attention. He observed that if our front gate was under attack, we would do something about it. We would reinforce the guards with our security forces, convene the battle staff, increase patrols and raise awareness levels throughout the base. Chief Tappana then pointed at the computer on a nearby desk and said, "We must realize that that's our front gate too."

He is right. We need to think and act like warriors in cyberspace. That's where leadership is essential.

General Raduege describes four stages in our journey to secure cyberspace. The first stage is ignorance. We don't know what we don't know about cyberspace attacks. We are past that stage now. If you didn't know about our vulnerability in cyberspace, you do now.

The second stage is awareness. We now realize that we are at war in cyberspace, and we are vulnerable. We no longer take access to the network for granted -- we realize that it can be taken away unless we take steps to defend it.

The third stage is actualization. We share a sense of urgency that we need to do something about the attacks on our network. We will learn more and more about cybersecurity. We will all work together to reduce our vulnerability and defend the network from attack.

The final stage is the "cyber mindset," where we think and act as warriors in cyberspace just as we do in air and space. We will train to protect ourselves and our networks from attack. We will all be "on patrol" as we look for new threats. Leaders at all levels will measure our vulnerability and direct defensive actions to counter the enemy.

To get to the fourth stage, we are going to have to work through a paradigm shift about security in cyberspace. Many of us, including me in the past, have taken the network for granted. We can't do that anymore. Every computer connected to the network is part of the battlespace. Every person that has access to the network is operating in a combat environment. Everyone must act responsibly, or it opens a hole in our defense.

As I've written before, I believe you are all leaders, because you all have influence over other people in your workplaces, your families and your communities. It's going to take your leadership to help us make this paradigm shift. How do you lead others through change? You work through the stages of change faster than the people around you.

So, as leaders, I ask that you move from awareness to actualization as quickly as possible. Talk to our experts, beginning with our communication professionals. Set the right example by following the procedures and not taking shortcuts. Learn about and use the tools we have today. I promise that more tools are on the way.

I am working through the stages as fast as I can. We are improving the security of our computers at our headquarters, and I have directed that no one is exempt from security measures, including me. If my computer has to restart while I'm in the middle of something, so be it. We must be willing to accept a moderate amount of mission degradation to secure ourselves against the enemy "at the gate."

General Raduege writes that, despite the challenges facing us in cyberspace, he is optimistic that we are "on the verge of a new dawn for cybersecurity." I am optimistic as well, because we are fortunate to have you to help lead us through this change in our mindset. We are at war in cyberspace and we will all need to apply our warrior skills to prevail. Fight's on!

Nuke and Cyber Pearl Harbor Podcast

Hat tip to Captain David Faggard, U.S. Air Force


Podcast on cyber attack and terrorism

Comments from Brig. Gen. Mark Schissler, director of Air Force Cyber Operations.

Congress warned of Chinese cyber, space threats

China has developed a sophisticated cyber warfare program and stepped up its capacity to penetrate US computer networks to extract sensitive information, a US congressional panel warned.

"China has an active cyber espionage program," the US-China Economic and Security Review Commission said in its annual report to the US Congress. "China is targeting US government and commercial computers."

In its 393-page report, the panel also criticized Beijing for exercising "heavy-handed government control" over its economy and "continuing arms sales and military support to rogue regimes" such as Sudan, Myanmar and Iran.

The commission also issued a warning about China's space program. "China continues to make significant progress in developing space capabilities, many of which easily translate to enhanced military capacity," it said.

"Although some Chinese space programs have no explicit military intent, many space systems -- such as communications, navigation, meteorological, and imagery systems -- are dual use in nature," the commission said.

The commission, which was established by Congress in 2000 to analyze the economic and national security relationship between the two nations, said China was investing heavily in cyber warfare.

"Since China's current cyber operations capability is so advanced, it can engage in forms of cyber warfare so sophisticated that the United States may be unable to counteract or even detect the efforts," the commission said.

It said Chinese hacker groups may be operating with government support.
"By some estimates, there are 250 hacker groups in China that are tolerated and may even be encouraged by the government to enter and disrupt computer networks," the commission said.

It quoted Colonel Gary McAlum, chief of staff for the US Strategic Command's Joint Task Force for Global Network Operations, as saying China has recognized the importance of cyber operations as a tool of warfare and "has the intent and capability to conduct cyber operations anywhere in the world at any time."

"China is aggressively pursuing cyber warfare capabilities that may provide it with an asymmetric advantage against the United States," the commission said. "In a conflict situation, this advantage would reduce current US conventional military dominance."

The commission recalled that unclassified US military, government and government contractor websites and computer systems were the victims of cyber intrusions in 2002 codenamed "Titan Rain" and attributed to China.

And earlier this month The Financial Times, citing an unnamed senior US official, reported that Chinese hackers -- possibly with backing by the Beijing government -- had penetrated the White House computer network and obtained emails between government officials.

The commission made 45 recommendations to Congress including possible "additional funding for military, intelligence and homeland security programs that monitor and protect critical American computer networks."

On the economic front, the commission said "China relies on heavy-handed government control over its economy to maintain an export advantage over other countries."

"The result: China has amassed nearly two trillion dollars in foreign exchange and has increasingly used its hoard to manipulate currency trading and diplomatic relations with other nations," it said.

"Rather than use this money for the benefit of its citizens -- by funding pensions and erecting hospitals and schools, for example -- China has been using the funds to seek political and economic influence over other nations," said Larry Wortzel, chairman of the commission.

Beijing's "continuing arms sales and military support to rogue regimes, namely Sudan, Burma, and Iran, threaten the stability of fragile regions and hinder US and international efforts to address international crises, such as the genocide in Darfur," the commission added.

It criticized China's use of prison labor to produce goods for export and an "information control regime" that it said regulates the print and broadcast media, Internet, entertainment and education.

The Unreported War - Cyber War

Cyber Wars are underway, but the practitioners are doing it covertly, lest there is a conventional counterattack.

Nuclear weapons have kept the major nations from going to war with each other for the past half century. That will probably continue.

But Cyber War provides an opportunity to fight an anonymous war against another nation, without leading to physical violence on a large scale. But only if your don't make the target nation really, really mad. This is a delicate balancing act.

This has been done in the past, largely by quietly supporting opposition or terrorist groups in enemy nations. The key here is hiding your tracks. The earliest signs of this was the highly damaging Code Red virus of 2001, which apparently came from China. The origin of the virus was traced back to China, but China denied any responsibility and got away with it.

China, unlike other nations hostile to America (North Korea, Cuba, Iran), has a large and growing Internet presence. China has thousands of skilled Internet programmers, and has admitted it is putting together military units for developing and using cyberweapons.

So the next time there are tensions between the United States and China, there will be an outbreak of nasty, and hard to trace, Cyber War attacks on the United States. The only problem China faces with this approach is that if its weapons hit other nations as well, and China were found out, the diplomatic backlash would be damaging. Even if attacks only made against United States and were not traced back to China, China would still be the chief suspect. It would be a case of China being the only nation with the motive and means.

Of course, China could always slip Iran or North Korea some choice cyber weapons and wait for those nations to take a shot at America.

And the Chinese are no doubt aware that America could launch its own anonymous cyber attack on China. You wouldn't be able to hide the effects of such a covert war, nor the scrambling of diplomats to bring the undeclared war to an end. Meanwhile, China is content to use Cyber War tools mainly for espionage. So do many other nations.

These undeclared, and unofficial, Cyber Wars have been going on for over a decade now. And the tools available to the attackers are becoming more powerful. What's behind this are several dozen gangs that undertake large scale criminal operations on the Internet. Most people see the results in the form of spam email (over 70 percent of all email is spam) and operations that secretly take over personal and business PCs, so these computers can secretly transmit spam, or huge quantities of bogus messages that shut down targeted web sites (DDOS, or distributed denial or service attacks).

The gangs also specialize on finding all manner of secret, or sensitive, information, and selling it. Intelligence agencies are often eager buyers.

It appears that China and Russia, or at least their security services, have made deals with some of the gangs. It works like this. If the secret police want some Internet based spying done, or a DDOS attack unleashed on someone, the gangs will do it, or help government Cyber War organizations do so.

In return, the gangs have a safe haven. The gangs have to refrain from major operations against the country they are in, but most of the targets are in the West (that's where most of the money is). Of course, no one will admit to this sort of thing. But criminal gangs working for the secret police is an ancient practice in these two countries, something that goes back centuries.

Secure in their safe havens, some of these gangs are now going after the commercial services that try and control spam, DDOS attacks and all manner of computer crime. The gangs obviously have an interest in trying to interfere with these security companies, and are apparently feeling secure enough from retribution, and prosecution, to do so.

The U.S. is the main target for the Internet based espionage, and has not yet come up with a way to get the foreign hackers to stop. U.S. officials don't want this stuff in the media either, because the losses are embarrassing, as is the lack of an effective plan to halt the plundering.

Occasionally, some details leak out, like the military asking Congress for permission to use more aggressive methods in going after the cyber spies. This quiet war could have enormous implications for any future conventional conflict. The Chinese are going after military technology, and it's not always obvious what they've got, and what they haven't. This increases the probability of some nasty, and painful, surprises when the shooting starts.

Cyber-Battlespace: Navy vs Air Force

Battlespace
By Bob Brewin

The Navy, according to an internal document that came my way thanks to an Air Force reader, plans to rebrand its Naval Network Warfare Command as the Naval Cyber Forces Command, reflecting the fact that "cyberspace is increasingly important and inseparable from our national defense interests," the internal document stated.

That document, The Naval Network Warfare Command, Command Renaming Communications Plan, said, "Cyberspace has become the global battlespace. According to Adm. Gary Roughhead, the chief of naval operations, the next battle is the information domain and the first shots have already been fired."

The Navy seems to have taken a page from the original Air Force Cyber Command playbook by viewing cyberspace as "a domain like land, sea, air and space and it must be defended," according to the brief.

Just like the Air Force, the Navy views the best defense is a good offense, with offensive cyberspace operations as part of the Cyber Forces Command's portfolio. "The effects we can produce in and through cyberspace range from simple deterrence to destruction and defeat of any adversary -- the full range of operational effects," the brief said.

Cyber Forces Command and Fleet Intelligence

The Cyber Forces Command will be built around the existing Naval Network Warfare Command, which was formed in 2002 from 23 organizations, including the former Naval Space Command, the Naval Computer and Telecommunications Command, the Fleet Information Warfare Center, and the Navy Component Task Force-Computer Network Defense. In 2005, the Naval Network Warfare Command absorbed the Naval Security Group, which handled signals intelligence and cryptography.

These organizations already provide the Naval Network Warfare Command with building blocks for a cyber command, including network operations, but the Navy also plans to add fleet intelligence to the Cyber Forces Command mix, along with surveillance and reconnaissance.
These additional missions will give the Cyber Forces Command a lot more clout than the Air Force ever imagined for its Cyber Command.

The fleet intelligence part of the Cyber Forces Command will do just what its name implies: focus on providing intelligence to commanders at the operational fleet or aircraft squadron level. The Office of Naval Intelligence, which deals with global maritime intelligence, will not come under the Cyber Forces Command, according to the internal paper.

The internal paper said this change needed to be made because "the current fleet organizational structure process for gathering intelligence and intelligence, surveillance and reconnaissance is less than optimal and lacks coherence across all naval warfare areas." The current, somewhat disjointed structure for fleet intelligence and ISR "lacks coherence" and impedes the Navy's ability to deal with increasingly complex threat environments in the future, the paper added.

A Navy source told me that the intel folks appear less than pleased with this realignment and "may have to be dragged kicking and screaming" into the Cyber Forces Command future.

Three-Star Clout

When the Air Force kicked off its grand Cyber Command plan, it was a three-star job, but now that it will come under the Air Force Space Command, as I reported last week, it most likely will be a two-star job.

But the Cyber Forces Command will have three-star clout, with the head of the Naval Network Warfare Command, Vice Adm. H. Denby Starling II, tapped to run the new command.

Rear Adm. Sam Cox, who currently serves as fleet intelligence director and director for plans and policy for the Naval Network Warfare Command, will take on the same jobs in the Cyber Forces Command.

You Can Keep Your Rating

While the Air Force will continue to rebrand its computer and communications technicians with a new cyber moniker, the Navy has no similar plans to merge computer, communications or electronic technicians into one career field, according to the internal paper. The Navy does not plan to merge its intelligence or information and warfare communities either, the paper said.

The Cyber Forces Command will not result in any reduction in the number of personnel in the Navy intelligence community or in officer or enlisted ranks in the network, gadget or gizmo fields.

No Blaze of Publicity

The Navy has worked quietly on the formation of the Cyber Forces Command for about a year, an approach that stands in stark contrast to the Air Force, which ran TV and Web advertisements for the Cyber Command.

Maybe that's why the Cyber Forces Command will emerge unscathed from bureaucratic battles over the cyber domain thing inside the Pentagon.

The Gordon England Decision

The Navy planned to announce the stand-up of the Cyber Forces Command at the start of October, but now awaits a decision from Deputy Secretary of Defense Gordon England on how the cyber mission will be sliced and diced among the three service branches, a source told me.

That Navy source added that the Omaha, Neb.-based U.S. Strategic Command will have overall responsibility for the cyber units, with an announcement planned for the end of this month.

Air Force pursues Cyber Command again

Top Air Force leadership has decided to pursue forming Cyber Command to defend Defense Department networks and to launch cyberattacks against foes after putting the project on hold in August.

The service's leadership, including Air Force Secretary Michael Donley and Chief of Staff Gen. Norton Schwartz, made the decision last week at the Corona senior leadership conference in Colorado Springs, Colo., to continue its effort to stand up the command, said Capt. Michael Andrews, an Air Force spokesman.

The service put Cyber Command on hold in August, saying it wanted to delay the program until new senior Air Force leaders, including Schwartz, had time to make a final decision on the scope and mission of the command. Last month, sources said the Pentagon decided that the U.S. Strategic Command in Omaha, Neb., should create and run a joint Cyber Command, a move that seemingly dashed any hopes the Air Force had to own Defense's cyber responsibilities.

In May, Deputy Secretary of Defense Gordon England wrote in a memo, "Because all the combatant commands, military departments and other defense components need the ability to work unhindered in cyberspace, the domain does not fall within the purview of any particular department or component."

The service originally had decided to establish the Cyber Command as a separate unit within Air Force Space Command, and during the Corona conference, leadership "discussed how the Air Force will continue to develop capabilities in this new domain and train personnel to execute this new mission." "The conduct of cyber operations is a complex issue, as [Defense] and other interagency partners have substantial equity in the cyber arena," Donley said. "We will continue to do our part to increase Air Force cyber capabilities and institutionalize our cyber mission."

Andrews said the Air Force will provide more details on the Cyber Command later in October after discussions with Pentagon and congressional leadership.

Implications of Russian Cyber Battles

Implications of
Russian Cyber Battles
By Colin Clark

When the history of the Russian invasion of Georgia is written, one of the most revealing discussions may center on the role of cyber warfare.

Some questions that will need answering: Just when did Russian hackers begin their attacks on the Georgian websites. Just what role did NATO — especially Estonian and American — cyber warriors have in guiding the Georgian response. Was the enormous three-week attack on Estonia last April from Russia a practice run for the Georgian attack?

When the Russians crippled Estonia’s cyber infrastructure, NATO dispatched top cyber war experts to investigate and to improve the Estonians’ electronic defenses.

It seems reasonable that, in the event of a true combined operation against the Georgians, NATO dispatched cyber experts to help though I haven’t confirmed that yet. There are numerous reports that Estonia has sent cyber warriors to help the Georgians combat both countries historic nemesis.

Official and unofficial Pentagon spokesmen refused to comment on whether the US might or might not be assisting the Georgians in their efforts to protect their Internet infrastructure.

However, one source said that if any US agency would be helping the Georgians it would be the Department of Homeland Security. The reason: if the Russians were to learn the Pentagon was assisting the Georgians they could claim the US was waging cyber war against them.

And US policy is that attacks on our computer systems can be considered an act of war, a logic the Russians would be sure to follow. If DHS is assisting the Georgians then we can make it very clear that US efforts are purely defensive. Also, DHS is home to the Computer Emergency Response Team.

All this raises questions about the US approach to cyber warfare — not defensive and security measures, but the willingness to use the web to attack an enemy to blunt or cripple their offensive capabilities.

As one of my wittier sources put it earlier today: Are the Georgians really more afraid of a cyber attack than of all those missiles raining down on their heads. The global World Wide Web may be incredibly resilient, but local web connections can be seriously disrupted by those old timey capabilities known as kinetics. Destroy phone or cable connections –easily done with artillery or bombs — and you’ve made it a lot harder to rebuild and reconnect than would a denial of service attack. On top of the destruction, an enemy can send a much clearer and simpler signal than can be done through cyber attacks. On the other hand, it is the very ambiguity of a cyber attack that can make it such a powerful tool in the times before a conflict erupts. Ask the Russians and the Estonians.