TaoSecurity Blog

In June 2011 I wrote a blog post with the ever polite title  China's View Is More Important Than Yours . I was frustrated with the Western-centric, inward-focused view of many commentators, which put themselves at the center of debates over digital conflict, neglecting the possibility that other parties could perceive the situation differently. I remain concerned that while Western thinkers debate war using Western, especially Clausewitzian, models, Eastern adversaries, including hybrid Eastern-Western cultures, perceive war in their own terms. I wrote in June 2011: The Chinese military sees Western culture, particularly American culture, as an assault on China , saying "the West uses a system of values (democracy, freedom, human rights, etc.) in a long-term attack on socialist countries ... Marxist theory opposes peaceful evolution, which... is the basic Western tactic for subverting socialist countries" (pp 102-3). They believe the US is conducting psychologic...

I received the latest issue of my alumni magazine, Checkpoints , today. It's graduation season, so the content included statistics about the latest graduating class as shown at right. This relates to a recent post, Whither United States Air Force Academy? , where I said the skill most needed to help grow the nation is digital defense. The statistics the Checkpoints editors chose to print, however, reminded me of the Academy's current focus. Notice that between the demographic information and the "fun facts" we see details on so-called "rated officers," reprinted below: 529 total rated graduates 490 pilots 8 combat systems operators 2 air battle managers 29 unmanned aerial system pilots To me, these statistics reflect the idea that "what gets measured, matters." Clearly the bias at USAFA continues to be towards flying. I get the "Fly, Fight, Win" message. I repeat it often at inappropriate times thanks to effective brainwas...

I enjoyed reading Stuxnet Poses Interesting International Cyber Law Issues by Rick Aldrich in IAnewsletter Vol 14 No 2 (pdf). I've known the author since my days in the USAF and he's very clued-in as a CS grad from USAFA and a lawyer who worked for AFOSI. I'd like to share a few excerpts. Please try to avoid fixation on Stuxnet if that topic bothers you. Stuxnet is not the core of Alrich's argument. Article 51 of the United Nations (UN) charter states in pertinent part, “Nothing in the present Charter shall impair the inherent right of individual or collective self-defense if an armed attack occurs against a Member of the United Nations.” [8] So can a cyber attack , such as that evidenced by Stuxnet, constitute an “armed attack?” Clearly at the time Article 51 was written, in August of 1945, such an attack was never envisioned. Traditionally the term “armed attack” has connoted a kinetic attack – missiles, bombs, bullets and the like – but it has never been definit...

Why won't the US or China (or even Russia) admit we're engaged in cyberwar? I have a theory based on historical precedent, involving all three countries: the Korean War. Since my time in the Air Force I knew that US pilots had directly engaged Russian pilots in the skies over Korea in the 1950s. This was an "open secret." Recently I watched the NOVA episode Missing in MiG Alley , which confirmed this fact: NARRATOR: For 40 years, Russia's role in Korea remained a secret. Now, one of the Soviets' top aces, Sergei Kramarenko, can finally talk about his exploits in MiG Alley. SERGEI KRAMARENKO: (Russian dialogue) INTERPRETER: It was a secret mission, neither before nor after the war were we allowed to reveal that we were going to fly for the North Koreans...against the Americans. It was top secret. SERGEI KRAMARENKO: (Russian dialogue) INTERPRETER: We were told that in case we were shot down beyond the front line we had to kill ourselves. Not to surrender wa...

I found these excerpts from yesterdays DEBKAfile story An alarmed Iran asks for outside help to stop rampaging Stuxnet malworm to be interesting: Tehran this week secretly appealed to a number of computer security experts in West and East Europe with offers of handsome fees for consultations on ways to exorcize the Stuxnet worm spreading havoc through the computer networks and administrative software of its most important industrial complexes and military command centers... The impression debkafile sources gained Wednesday, Sept. 29 from talking to European computer experts approached for aid was that the Iranians are getting desperate. Not only have their own attempts to defeat the invading worm failed, but they made matters worse: The malworm became more aggressive and returned to the attack on parts of the systems damaged in the initial attack. One expert said: "The Iranians have been forced to realize that they would be better off not 'irritating' the invader because...

Thanks to the Team Cymru news feed for pointing me to Emerging Cyberthreats and Russian Views on Information Warfare and Information Operations by Roland Heickerö of the Swedish Defence Research Agency . I found this content in pages 23-24, "Differences and similarities between Russian, US and Chinese views on IW," to be really interesting: In order to understand the Russian view in a wider context, a comparison has been made with Russia’s most important competitors – the USA and China – and their approach to information operations... All three countries agree on the important role information has in today’s conflicts. Over time its importance will grow. The USA has influenced the mindsets of the others, especially regarding ideas about information superiority and information dominance, as well as command and control warfare. Information adds a new dimension to warfare and IW weapons could be used offensively and defensively to protect a country’s own information resources ...

Everyone's been talking about cyberwar this week, thanks in part to the Economist coverage. Many of the comments on my posts and elsewhere discuss the need for definitions. I thought it might be useful to refer to an authoritative source on war for the United States: DoD Joint Publication 1: Doctrine for the Armed Forces of the United States ( .pdf ), known as JP 1. Incidentally, back in 1997 as an Air Force 1Lt straight from intelligence school, I worked on doctrine publications like this for Air Intelligence Agency, specifically the early doctrine on information warfare, like the August 1998 publication of Air Force Doctrine Document 2-5: Information Operations ( .pdf ). What does JP 1 say about war? War is socially sanctioned violence to achieve a political purpose . In its essence, war is a violent clash of wills. War is a complex, human undertaking that does not respond to deterministic rules. Clausewitz described it as “the continuation of politics by other means” [Boo...

Does anyone remember this story from April 2009? Computer Spies Breach Fighter-Jet Project Computer spies have broken into the Pentagon's $300 billion Joint Strike Fighter project -- the Defense Department's costliest weapons program ever -- according to current and former government officials familiar with the attacks... In the case of the fighter-jet program, the intruders were able to copy and siphon off several terabytes of data related to design and electronics systems, officials say, potentially making it easier to defend against the craft... "There's never been anything like it," this person said, adding that other military and civilian agencies as well as private companies are affected. "It's everything that keeps this country going..." Former U.S. officials say the attacks appear to have originated in China... Six current and former officials familiar with the matter confirmed that the fighter program had been repeatedly broken into... A w...

A number of people, inside and outside the security world, think that any discussion of real threats is a manufactured justification for intrusive government action. Their argument is simple. The government wants to control the people, or obtain a resource, or pursue some objective that could not be reasonably achieved if transparently presented to the citizenry. The government "propaganda machine," sometimes in coordination with "the media" and "big business," "manufactures" a "crisis" whose only solution is increased government power. The people acquiesce in order to preserve their safety, and the government achieves its objective. As a result, those who see the world in this manner treat any discussion of real threats as step 2 in this process towards decreased liberty via increased government power. Those who seek to inform the citizenry of real threats are dismissed as sowing "FUD." This is a tragedy, because it means ...

The new National Security Strategy (.pdf) says the following about "cyberspace": Secure Cyberspace Cybersecurity threats represent one of the most serious national security, public safety, and economic challenges we face as a nation. The very technologies that empower us to lead and create also empower those who would disrupt and destroy. They enable our military superiority, but our unclassified government networks are constantly probed by intruders. Our daily lives and public safety depend on power and electric grids, but potential adversaries could use cyber vulnerabilities to disrupt them on a massive scale. The Internet and e-commerce are keys to our economic competitiveness, but cyber criminals have cost companies and consumers hundreds of millions of dollars and valuable intellectual property. The threats we face range from individual criminal hackers to organized criminal groups, from terrorist networks to advanced nation states. Defending against these threats to ou...

Amazon.com just posted my three star review of Martin Libicki's Cyberdeterrence and Cyberwar . I've reproduced the review in its entirety here because I believe it is important to spread the word to any policy maker who might read this blog or be directed here. I've emphasized a few points for readability. As background, I am a former Air Force captain who led the intrusion detection operation in the AFCERT before applying those same skills to private industry, the government, and other sectors. I am currently responsible for detection and response at a Fortune 5 company and I train others with hands-on labs as a Black Hat instructor. I also earned a master's degree in public policy from Harvard after graduating from the Air Force Academy. Martin Libicki's Cyberdeterrence and Cyberwar (CAC) is a weighty discussion of the policy considerations of digital defense and attack. He is clearly conversant in non-cyber national security history and policy, and that knowl...

In response to my TaoSecurity Blog post titled Buck Surdu and Greg Conti Ask "Is It Time for a Cyberwarfare Branch?" , I decided to create the Association of Former Information Warriors. I set up a LinkedIn Group with the following description: The Association of Former Information Warriors is a professional networking group for those who once served as military members in information operations (IO) or warfare (IW) units. The mission of the AOFIW is to propose, promote, and debate policies and strategies to preserve, protect, and defend digital national security interests. Candidate members must be referred by current members. Those no longer in military service are candidates for full membership; those currently serving in uniform are candidates for associate membership. In other words, to join AOFIW you need to know an existing member. This weekend I am going to try kickstarting the membership process by inviting those I personally know and trust to meet these criteria...

The latest issue of the Information Assurance Technology Analysis Center's IANewsletter features "Army, Navy, Air Force, and Cyber -- Is It Time for a Cyberwarfare Branch of [the] Military?" by COL John "Buck" Surdu and LTC Gregory Conti. I found these excerpts enlightening. The Army, Navy, and Air Force all maintain cyberwarfare components, but these organizations exist as ill-fitting appendages that attempt to operate in inhospitable cultures where technical expertise is not recognized, cultivated, or completely understood. The services have developed effective systems to build traditional leadership and management skills. They are quite good at creating the best infantrymen, pilots, ship captains, tank commanders, and artillerymen, but they do little to recognize and develop technical expertise. As a result, the Army, Navy, and Air Force hemorrhage technical talent, leaving the Nation’s military forces and our country under-prepared for both the ongoing cy...

In response to my post Black Hat DC 2009 Wrap Up, Day 1 , a commenter shared a link to a Fairfax Chamber of Commerce briefing by Boeing on the Comprehensive National Cybersecurity Initiative (CNCI) that I last mentioned in FCW on Comprehensive National Cybersecurity Initiative . I've extracted a few slides below to highlight several points. The first slide I share shows abbreviated definitions for Computer Network Defense, Computer Network Exploitation, and Computer Network Attack. These mirror what I cited in China Cyberwar, or Not? in late 2007. The second slide supports what I said in my Predicitons for 2008 post: Expect greater military involvement in defending private sector networks . Notice DNI and DoJ are said to be "authorized to conduct domestic intrusion detection," and DNI and DoD are allowed "involvement with domestic networks." The three phased approach is displayed next. Note mentions of deployment of sensors, counter-intrusion plans, and d...

I've been a subscriber of the Economist magazine since 1997. Although I have not been working to achieve this goal, I am happy to report that a personal ambition of mine has been reached today: I was cited in the 6 Dec 08 edition, in an article titled Cyberwarfare: Marching off to cyberwar . One way for governments to do this [to become resilient to cyber attack], says Richard Bejtlich, a former digital-security officer with the United States Air Force who now works at GE, an American conglomerate, might be to make greater use of open-source software, the underlying source code of which is available to anyone to inspect and improve. To those outside the field of computer security, and particularly to government types, the idea that such software can be more secure than code that is kept under lock and key can be difficult to accept. But from web-browsers to operating systems to encryption algorithms, the more people can scrutinise a piece of code, the more likely it is that it...

Many readers have been asking me to comment on Marcus Ranum 's keynote titled Cyberwar is Bullshit at Hack In The Box Security Conference 2008 - Malaysia . (What a great conference; I think we are seeing the Asia-Pacific area really grow its digital security community. You can access the conference materials here . I'd like to point out my friend CS Lee spoke about NSM at the event.) The article Don’t waste funds preparing for cyberwars summarized Marcus' talk as follows: The billions of dollars spent on researching cyberwarfare can be put to better use because cyberwar is never going to be as effective as conventional war, said an IT ­security expert. Marcus Ranum, chief security officer of Tenable Network Security said cyberattacks aren’t a good force multiplier in an actual war. Many people, he said, talk about cyberspace as if it can be a new form of battlefield but this is not possible because you can’t occupy and hold cyberspace as you would a piece of enemy te...

Thanks to several of you for asking for my opinion of the article Carpet bombing in cyberspace: Why America needs a military botnet by Col. Charles W. Williamson III. I'd like to cite a few excerpts and comment directly. The world has abandoned a fortress mentality in the real world, and we need to move beyond it in cyberspace. America needs a network that can project power by building an af.mil robot network (botnet) that can direct such massive amounts of traffic to target computers that they can no longer communicate and become no more useful to our adversaries than hunks of metal and plastic. America needs the ability to carpet bomb in cyberspace to create the deterrent we lack... This is interesting. Why do we need to project force in cyberspace to deter our enemies? Cyberwar is usually cited as a means of conducting asymmetric warfare, meaning one side is much weaker than other in conventional means. Cyberwar is expected to be conducted against US assets (critical infras...

Kudos to Marty Graham of Wired for writing Welcome to Cyberwar Country, USA . This is original reporting on the Air Force Cyber Command , focusing on the question of where to formally house the command. I personally hope it is located near Washington, DC. Given that the JTF-GNO and NSA are nearby, it would make sense for the Air Force to be physically close to coordinate work and draw on local talent.

This week I attended Victory in Cyberspace , an event held at the National Press Club . It centered on the release of a report written by http://www.irisresearch.com/grant.html">Dr. Rebecca Grant for the Air Force Association 's Eaker Institute . The report is titled Victory in Cyberspace (.pdf). The panel (pictured at left) included Lt. Gen. Robert J. Elder , Lt Gen. (ret) John R. Baker , and Gen. (ret) John P. Jumper . Dr. Grant is seated at the far right. As far as the event went, I found it interesting. If you are exceptionally motivated you can download the entire 90 min briefing in .wmv format here . I'd like to share a few thoughts. First, I was impressed by all the speakers. Lt. Gen. Baker led AIA when I was a Captain there. At the same time Gen. Jumper led Air Combat Command, before becoming Chief of Staff. I learned Lt. Gen. Elder has a PhD in engineering. Lt. Gen. Elder commented that cyberspace is a domain similar to the ocean, and he specifically...

I've been writing about the Chinese threat for a while. I was glad to see Professor Spafford chime in with Who is Hacking Whom? : It remains to be seen why so many stories are popping up now. It’s possible that there has been a recent surge in activity, or perhaps some recent change has made it more visible to various parties involved. However, that kind of behavior is normally kept under wraps. That several stories are leaking out, with similar elements, suggests that there may be some kind of political positioning also going on — the stories are being released to create leverage in some other situation. Cynically, we can conclude that once some deal is concluded everyone will go back to quietly spying on each other and the stories will disappear for a while, only to surface again at some later time when it serves anoher political purpose. And once again, people will act surprised. If government and industry were really concerned, we’d see a huge surge in spending on defenses and...