Hackers create opportunity for military firms

tags: cyberwar, procurement

• For U.S. military firms, the latest revelations of highly sophisticated hacker attacks on Google Inc. are highlighting a new reality, and a potentially lucrative business: The battlefield is shifting to cyberspace.
• The military industry, having already done extensive work protecting federal government computers, may be in a good position in the emerging market that could exceed $100 billion in revenue within the next decade, analysts said.

  It may have little choice. Pentagon spending on weapons is expected to slow, leaving military firms scrambling for new business.

• The federal government is expected to set aside $8.3 billion this year for protecting its computers from hackers, up 60% from just four years ago.
• federal spending on cyber-security is expected to grow 8.1% annually over the next four years, according to Input, a Reston, Va., government contracting research firm.

  “That’s significant growth, given the budget pressure that the government is under,” said John Slye, principal analyst at Input.

• And in December, Northrop created a cyber-security research consortium with Carnegie Mellon University, the Massachusetts Institute of Technology and Purdue University as a way to tap new technologies and recruit emerging talent.
• Defense rival Lockheed Martin Corp. took a different route assembling a cyber-security alliance with tech companies, including Microsoft Corp, Cisco Systems Inc. and Dell Inc., to collaborate on developing measures against hackers.

  In November, the nation’s largest military contractor finished a 5,000-square-foot facility in Gaithersburg, Md., that’s dedicated to cyber-security research. Lockheed has also recruited Lee Holcomb, former chief technology officer for the Department of Homeland Security, to head the company’s cyber-security initiatives.

• “Nobody is building aircraft carriers anymore,” said James Mulvenon, director of the Center for Intelligence Research and Analysis at Defense Group Inc., a national-security firm. “It looks like, from now on, the big money is in cyber space.”

Public Diplomacy 2.0: Where the U.S. Government Meets “New Media”

tags: public diplomacy, social_media, perception management

Posted from Diigo. The rest of my favorite links are here.

South Africa poised to become cybercrime hub

tags: cyberwar

• Analysis published by Symantec claims to show that South Africa is set to become a cybercrime hub during the coming year, largely due to the introduction of new broadband internet capacity.

Posted from Diigo. The rest of my favorite links are here.

Pentagon computer-network defense command delayed by congressional concerns – Annotated

tags: cyberwar

• The Pentagon’s plan to set up a command to defend its global network of computer systems has been slowed by congressional questions about its mission and possible privacy concerns, according to officials familiar with the plan.
• Key questions include: When do offensive activities in cyberspace become acts of war? How far can the Pentagon go to defend its own networks? And what kind of relationship will the command have to the National Security Agency?
• “I don’t think there’s any dispute about the need for Cyber Command,” said Paul B. Kurtz, a cybersecurity expert who served in the George W. Bush and Clinton administrations. “We need to do better defending DOD networks and more clearly think through what we’re going to do offensively in cyberspace. But the question is how does that all mesh with existing organizations and authorities? The devil really is in the details.”
  • – post by TransTracker

• One senior defense official said officials are trying to figure out, for instance, to what extent it is legal and desirable to remove malware outside the gateways as it heads to military networks.

  “What can you do at the perimeter?” he said. “What can you do outside the perimeter? We haven’t had resolution on that.”

  Privacy advocates are sensitive to government monitoring of communications networks at or just outside the gateways, particularly if the effort involves private Internet carriers, out of concern that purely private, non-government communications could be monitored. But defense officials said they are not contemplating the involvement of private firms.

• NSA Deputy Director Chris Inglis said in a recent interview that “90 percent” of the command’s focus will be on defensive measures because “that’s where we are way behind.”

  “If we led with attack, people would say, ‘That’s just nuts. That’s completely irrational,’ ” he said. “You’ve got to be about the defense.”

• Beyond a cyber command, the Pentagon is grappling with a dizzying array of policy and doctrinal questions involving cyber warfare.

  Who should authorize a cyber attack on an adversary that might be capable of undermining the United States’ financial system or energy infrastructure? What degree of certainty is needed about an alleged attacker before authorizing a response? When does an effort to defend a U.S. military network cross the line into an offensive action?

  Many of these questions will be answered down the road, after the command is launched, and perhaps some won’t be answered for years, defense officials said.

Posted from Diigo. The rest of my favorite links are here.

In Shift, U.S. Talks to Russia on Internet Security

tags: cyberwar

Posted from Diigo. The rest of my favorite links are here.

Spy vs. spy on Facebook

tags: social_networking, social_media, information sharing, intelligence

Posted from Diigo. The rest of my favorite links are here.

Cyber Fear Echo Chamber

tags: cyberwar

Cyberattacks: Civilization’s High Stakes Cyber-Struggle: Q&A With Gen. Wesley Clark (ret.)

tags: cyberwar

• As wrenching as traditional warfare is, there is a new kind of threat brewing that ultimately could cause even greater harm to the planet, retired general Wesley Clark told TechNewsWorld. “We’re in a cyber-struggle today,” he said. “We don’t know who the adversaries are in many cases, but we know what the stakes are: continued economic vitality and, ultimately, global civilization.”
• The conflicts in the Middle East and Afghanistan, to name the most prominent, are taking their toll on human life and limb. However, the escalating
  cyberconflict among nations is far more dangerous, argues retired general Wesley Clark
• That cyberconflict will take a far greater toll on the world, contends Clark

• TechNewsWorld: While it’s generally agreed that the next war may be a cyberwar, much of our infrastructure is either hooked up to the Internet or in the process of being hooked up to the Internet. Electricity companies, for example, are agitating for the use of smart meters. That being the case, and with hackers increasing the frequency and sophistication of their attacks, does the increasing pace of hooking everything up to the Internet pose a real security threat?

  Clark: We’re going into completely digitized medical records, which could lead to a huge invasion of privacy. It could also lead to things like blackmail and is physically dangerous because people can tamper with records of vital signs, or can alter prescriptions. There’s no telling just what could be done.

  Companies could lose their supply chain management, lose their accounting records, lose their customer lists. Trying to rebuild this on paper when we’ve all been interconnected on the Internet will cause years of economic decline. We are, as a civilization, quite vulnerable to disruption, and this security problem doesn’t just affect one nation but the whole global economic infrastructure.

  You can’t conceive of the threats from the point of view of a traditional war. Cyber-efforts are ongoing today; we’re in a cyber-struggle today. We don’t know who the adversaries are in many cases, but we know what the stakes are: continued economic vitality and, ultimately, global civilization.

• Some countries’ police forces don’t understand what a bot is or understand cloud computing. This is not surprising; technology is usually ahead of the law, and we need people who can work both realms and can bring the law up to speed.
• There needs to be a multidimensional, multilayered and multi-azimuth defense. That is, defense has to look in all directions. When you’re talking about cybersecurity, you’re talking about being able to protect your points. It’s not directed against a country, but to secure your points of access or specific end points or network access. It’s not as though you’re arming yourself against a specific threat — you’re simply undertaking all aspects of protection.

Posted from Diigo. The rest of my favorite links are here.

What happens when Al Shabaab and the Somalian Pirates get EASSy? at IntelFusion

tags: cyberwar

EFF sues feds for info on social-network surveillance

tags: social media surveillance, privacy, crowd mining

Posted from Diigo. The rest of my favorite links are here.

New IDF unit to fight enemies on Facebook, Twitter

tags: perception management, social_media

Posted from Diigo. The rest of my favorite links are here.

USCC 2009 Annual Report Page

tags: cyberwar

U.S. – CHINA COMMISSION CITES CHINESE INDUSTRIAL POLICY, ROLE IN GLOBAL FINANCIAL CRISIS, ESPIONAGE, CYBER ATTACKS, AND INFORMATION CONTROLS AS CLOUDING U.S.-CHINA RELATIONSHIP

tags: cyberwar

China Cyber Espionage Threatens U.S., Report Says

tags: cyberwar

China’s Capacity for Cyberwarfare with the U.S.

tags: cyberwar

Posted from Diigo. The rest of my favorite links are here.

Cyber warfare: The corporate community

tags: cyberwar

Cyber warfare: The intelligence community

tags: cyberwar

Cyber warfare: The military community

tags: cyberwar

Posted from Diigo. The rest of my favorite links are here.

U.S. is Striking Back in the Global Cyberwar – Annotated

tags: cyberwar

• Offensive cyberwar itself can encompass espionage, intercepting communications, and disabling computers and other infrastructure. The United States has those capacities, but the scope of the arsenal receives far less ink than the status of the country’s defense. The Obama administration issued a report on that aspect in May and announced the creation of a cybersecurity czar to organize defense. But the sections of the report that address the country’s offense remain highly classified, according to officials familiar with its contents. That’s frustrating to many people in the national security field. “The only way that deterrence works is if the other side knows that you have weapons and the willingness to use them,” says Charles Dodd, an expert in cyberwar at the security firm Nicor Global, who advises the House Armed Services Committee on cyberthreats sponsored by foreign nations.
• Despite the secrecy, brief glimpses of several cyberwar incursions have surfaced recently. The New York Times reported this year, for example, that some of the best information the intelligence community has collected on the Iranian nuclear program came from a hack into that country’s computer networks.
• NSA’s Tailored Access Operation Group
• focused on monitoring communications
• In 2004, Thomas Reed, a retired senior national security official, revealed the extraordinary story of how the CIA tricked the Soviet Union into stealing doctored software that later destabilized the trans-Siberian gas pipeline. That fancy bit of hacking caused a massive explosion in a wilderness section of the pipeline in 1982 that was visible from space and equivalent in size to that of a 3-kiloton nuclear weapon
• in 2001 a special committee of the European Union’s Parliament accused the United States of using its Echelon global spy network to steal secrets that enabled U.S. companies to beat the European consortium, Airbus, to aircraft contracts in the mid 1990s.
• “The U.S. doesn’t define what constitutes an act of cyberwar, so countries like China—while publicly denying it—are going full speed ahead to take advantage of us,” says Nicor Global’s Dodd. “It would be good to see the government putting some money behind offensive capabilities to fight back.”
  • – post by TransTracker

Tech sabotage during the Cold War

Provides an interesting historical perspective on an incident that might be considered “cyebrwar” today. The U.S. used faulty software to cause physical damage to a pipeline in the USSR. Was this an actof war? What was the legality of such an act? Does this prove that the ongoing cyberwar debate is not so much about the U.S. responding to threats from others as it is about justifying practices that the U.S. itself has engaged in or would like to engage in?

tags: cyberwar

Posted from Diigo. The rest of my favorite links are here.

The Cyberwar Plan

tags: cyberwar

• At the request of his national intelligence director, Bush ordered an NSA cyberattack on the cellular phones and computers that insurgents in Iraq were using to plan roadside bombings. The devices allowed the fighters to coordinate their strikes and, later, post videos of the attacks on the Internet to recruit followers. According to a former senior administration official who was present at an Oval Office meeting when the president authorized the attack, the operation helped U.S. forces to commandeer the Iraqi fighters’

  communications system. With this capability, the Americans could deceive their adversaries with false information, including messages to lead unwitting insurgents into the fire of waiting U.S. soldiers.

  Former officials with knowledge of the computer network attack, all of whom requested anonymity when discussing intelligence techniques, said that the operation helped turn the tide of the war. Even more than the thousands of additional ground troops that Bush ordered to Iraq as part of the 2007 “surge,” they credit the cyberattacks with allowing military planners to track and kill some of the most influential insurgents.

• Some journalists have obliquely described the effectiveness of computerized warfare against the insurgents. In The War Within, investigative reporter Bob Woodward reports that the United States employed “a series of top-secret operations that enable [military and intelligence agencies] to locate, target, and kill key individuals in extremist groups such as Al Qaeda, the Sunni insurgency, and renegade Shia militias. … ” The former senior administration official said that the actions taken after Bush’s May 2007 order were the same ones to which Woodward referred. (At the request of military and White House officials, Woodward withheld “details or the code word names associated with these groundbreaking programs.”)

• Cyber-defenders know what to prepare themselves for because the United States has used the kinds of weapons that now target the Pentagon, federal agencies, and American corporations. They are designed to steal information, disrupt communications, and commandeer computer systems. The U.S. is forming a cyberwar plan based largely on the experience of intelligence agencies and military operations. It is still in nascent stages, but it is likely to support the conduct of conventional war for generations to come. Some believe it may even become the dominant force.

• Over the past few years, however, the cyber-cohort has gained influence among the ranks of military strategists, thanks in large part to the ascendancy of Gen. Petraeus. The man widely credited with rescuing the U.S. mission in Iraq is also a devotee of “information operations,” a broad military doctrine that calls for defeating an enemy through deception and intimidation, or by impairing its ability to make decisions and understand the battlefield. In past conflicts, the military has jammed enemy communication systems with electromagnetic waves or dropped ominous leaflets from planes warning enemy forces of imminent destruction. Today, cyber-warriors use the global telecommunications network to commandeer an adversary’s phones or shut down its Web servers. This activity is a natural evolution of the information war doctrine, and Petraeus has elevated its esteem.

• Military officers describe cyberspace as the fifth domain of war, after land, sea, air, and space. But cyberspace is unique in one important respect — it’s the only battlefield created by humans.

  “We have invented this, and it cuts across those other four,” said retired Air Force Lt. Gen. Harry Raduege, who ran the Defense Information Systems Agency from 2000 to 2005.

• “You can’t win the cyberwar if you don’t win the war for talent,” said Max Stier, the president of the Partnership for Public Service, an advocacy group that helped write the study. The co-author was Booz Allen Hamilton, the government contracting firm where former intelligence Director McConnell now runs the cyber-security business.
• The Defense Department graduates only about 80 students per year from schools devoted to teaching cyber-warfare. Defense Secretary Robert Gates has said that the military is “desperately short” of cyber-warriors and that the Pentagon wants four times as many graduates to move through its teaching programs over the next two years.
• On May 5 of this year, lawmakers on the House Armed Services Subcommittee on Terrorism and Unconventional Threats and Capabilities asked the NSA’s Alexander whether the attacks on Estonia and Georgia met the definition of cyberwar. “On those, you’re starting to get closer to what would be [considered war],” he said. “The problem you have there is who — the attribution.”

• The U.S. conducted its first focused experiments with cyberattacks during the 1999 bombing of Yugoslavia, when it intervened to stop the slaughter of ethnic Albanians in Kosovo. An information operations cell was set up as part of the bombing campaign. The cell’s mission was to penetrate the Serbian national air defense system, published accounts and knowledgeable officials said, and to make fake signals representing aircraft show up on Serbian screens. The false signals would have confused the Serbian response to the invasion and perhaps destroyed commanders’ confidence in their own defenses.

  According to a high-level military briefing that Federal Computer Week obtained in 1999, the cyber-operation “could have halved the length of the [air] campaign.” Although “all the tools were in place … only a few were used.” The briefing concluded that the cyber-cell had “great people,” but they were from the “wrong communities” and “too junior” to have much effect on the overall campaign. The cyber-soldiers were young outsiders, fighting a new kind of warfare that, even the briefing acknowledged, was “not yet understood.”

• Only four years after the war in Yugoslavia, planners again held off on releasing a potentially virulent weapon against Iraq. In the plan to disable the Iraqi banking network in advance of the U.S. invasion, the Pentagon determined that it might also bring down French banks and that the contagion could spread to the United States.

  “It turns out that their computer systems extend well outside Iraq,” a senior Air Force official told Aviation Week & Space Technology in March 2003. “We’re also finding out that Iraq didn’t do a good job of partitioning between the military and civilian networks. Their telephone and Internet operations are all intertwined. Planners thought it would be easy to get into the military through the telephone system, but it’s all mixed in with the civilian [traffic]. It’s a mess.” This official said that to penetrate the military systems, the United States would risk what planners began calling “collateral computer network attack damage.”

• Because of the widespread damage that cyber-weapons can cause, military and intelligence leaders seek presidential authorization to use them. “They’re treated like nuclear weapons, so of course it takes presidential approval,” the former military officer said. McConnell, the ex-intelligence director, has compared the era of cyberwar to “the atomic age” and said that a coordinated attack on a power grid or transportation or banking systems “could create damage as potentially great as a nuclear weapon over time.”
• The Obama administration’s former White House chief of cyber-security, Melissa Hathaway, has called for international cyberspace agreements. In a number of speeches in 2008 while still with the Bush administration, Hathaway proposed a Law of the Sea Treaty for the Internet, which, she said, is the backbone of global commerce and communications, just as the oceans were centuries ago.
• The odds for a broad international framework aren’t good, however.
• In September, a panel of national security law experts convened by the American Bar Association and the National Strategy Forum, a Chicago-based research institute, concluded that the prospects for any multinational agreement are bleak. “The advantages of having a cyber-warfare capacity are simply too great for many international actors to abjure its benefits,” the panel stated.

• In this historical analogy, experts have embraced a Cold War deterrent to prevent the cyber-Armageddon that military and intelligence officials have been warning about — mutually assured destruction.

  Presumably, China has no interest in crippling Wall Street, because it owns much of it. Russia should be reluctant to launch a cyberattack on the United States because, unlike Estonia or Georgia, the U.S. could fashion a response involving massive conventional force. The United States has already learned that it makes no sense to knock out an enemy’s infrastructure if it disables an ally’s, and possibly America’s own. If nations begin attacking one another’s power grids and banks, they will quickly exchange bombs and bullets. Presumably, U.S. war planners know that. And it may be the most compelling reason to keep their cyber-weapons sharp but use them sparingly.

Posted from Diigo. The rest of my favorite links are here.

Cyber warfare: Communities

tags: cyberwar

• In many cases of the modern world “cyber” refers to the computers that command and control networks and weapons systems. However, it is also apparent that it gets stretched far beyond command and control.

  The metaphors of cyber warfare are partially to blame. In trying to force cyber warfare into a metaphor it is denigrated and castigated as much as it is heralded with miraculous powers. The better case is that metaphors and analogies are rife with systemic bias of the community positing the miraculous conceptual allegory. Over the next few days we’ll look at the metaphorical and allegorical analysis along with the biases of the different communities. This is all in part the written notes of a book chapter I’m preparing for the Cyber Conflict Studies Association.

Metaphors at War in Cyberspace

tags: cyberwar

Sabotaging The System – 60 Minutes – CBS News

tags: cyberwar

Posted from Diigo. The rest of my favorite links are here.

Cyber threat calls for flexibility in command model, general says – Annotated

tags: cyber command, cyberwar, air_force

• Technology’s dark side has created a new battlefield in cyberspace, and that brings new considerations to the way military commands should be structured, according to Lt. Gen. William Lord, chief of warfighting integration and chief information officer of the Office of the Secretary of the Air Force.
  • A nice little bit of tech determinism there. – post by TransTracker
• To be successful in such a domain, the U.S. Cyber Command and any other military force that deals with the cyber threat must develop a command structure that can be flexible, Lord said. Although the structure should be based on a traditional command model, it needs to incorporate some non-traditional elements, he said. Ã¢â‚¬Å“We need to operate without heavy restrictions. There are enormous restrictions in the offensive domain. The biggest problem isn’t the enemy, the biggest problem is us.”
  • Sounds like a “don’t ask, don’t tell” policy on offense in cyberspace. Cyberwar is so dangerous and so fast, that there’s no time for oversight. Just let us do our thing; we promise we’ll be good. No thanks. – post by TransTracker
• He called for a strong, centralized approach to network management.
  • Centralization is not typically seen as aiding flexibility and speed of action. – post by TransTracker

TSA needs privacy IT tools, IG says — Federal Computer Week

tags: privacy