How U.S. Cyber Command want to control the internet

Squared-jawed, with four stars decorating each shoulder, General Keith Alexander looks like a character straight out of an old American war movie. But his old-fashioned appearance belies the fact that the general has a new job that is so 21st-century it could have been dreamed up by a computer games designer. Alexander is the first boss of USCybercom, the United States Cyber Command, in charge of the Pentagon’s sprawling cyber networks and tasked with battling unknown enemies in a virtual world.

Last year, US Defense Secretary Robert Gates declared cyberspace to be the “fifth domain” of military operations, alongside land, sea, air and­ space. It is the first man-made military domain, requiring an entirely new Pentagon command. That went fully operational a week ago, marking a new chapter in the history of both warfare and the world wide web. In his confirmation hearing, General Alexander sounded the alarm, declaring that the Pentagon’s computer systems “are probed 250,000 times an hour, up to six million per day”, and that among those attempting to break in were “more than 140 foreign spy organisations trying to infiltrate US networks”. Congress was left with a dark prophecy ringing in its ears: “It’s only a small step from disrupting to destroying parts of the network.”

In three short decades, the internet has grown from the realm of geeks and academics into a vast engine that regulates and influences global ­commercial, political, social and now military interaction. Neuroscientists tell us that it is changing the development of our cerebral wiring in childhood and adolescence. Social scientists and civil libertarians warn that our privacy  is being eroded, as ever more of our life is mediated by the web. It should probably come as no surprise that governments believe control of this epoch-making ­technology is far too important to be left in the hands of idiots like you and me.

If states start monitoring the internet, what does it means for the average user? President Obama has stated that his administration’s pursuit of cyber­security “will not include – I repeat, will not include – monitoring private sector networks or internet traffic”. But not everyone is so sanguine. Richard Clarke, adviser to four presidents and the author of Cyber War, supports US plans to beef up its cyber defences but even he is worried about USCybercom. “We created a new military command,” he wrote, “to conduct a new kind of ­high-tech war, without public debate, media discussion, serious congressional oversight, academic analysis or international dialogue.”

Dim lights Embed Embed this video on your site

Very few people understand cybersecurity. It is technologically complex and the network environment in which it operates changes at lightning speed. So governments are granting themselves new powers to intervene in computer networks without anyone, including themselves, fully ­appreciating what their implications are.

The establishment of USCybercom is just one element in an eye-popping expansion of security, which includes beefing up the cyber capacity of the Department of Homeland Security to deal with threats to the US’s domestic cyber networks. These moves will lead to a much deeper apparatus of control and monitoring of internet activity by the US.

Some specialists argue that the gargantuan security systems involved simply will not work, and that bureaucrats and corporations are encouraging a new round of profligacy to line their pockets. Civil liberty advocates worry that General Alexander’s new cyber command could dodge privacy laws to monitor our e-mails and social networking activities. And despite Obama’s reassurances about such an Orwellian scenario, so much of Alexander’s written testimony to Congress has been labelled classified that nobody outside the Pentagon and the White House quite knows what the military cyber strategy involves.

Dim lights Embed Embed this video on your site
Dim lights Embed Embed this video on your site

The US is not alone in trying to muscle in on the web: across the world, states are trying to assert their authority over the communications of ­individuals and private companies.

The United Arab Emirates has been in dispute with Research in Motion, the Canadian manufacturer of the BlackBerry, for the past six months. The government in Abu Dhabi demanded that the company either lift the e-mail encryption on BlackBerries or establish a local server so the authorities could monitor the traffic going into, out of and across the country. Otherwise, Abu Dhabi warned, all BlackBerry communication in the ­country would be stopped. RIM had refused to budge (despite the fact that it had already agreed to allow China, India and Saudi Arabia access to unencrypted messages). The UAE government announced yesterday (Oct 8) that the threat to suspend BlackBerry services had been lifted as the provider now complied with the Gulf state’s regulatory framework.

Some security experts believe that the UAE’s real concern may be more complex than who says what on their BlackBerries. Tony Yustein, an IT security consultant who has advised the FBI, comments: “More important is the knowledge that the data is not 100 per cent secure in Canada, and that the US can access this data. So the US can monitor communications inside the Emirates.”

BlackBerry is just the opening shot. India said last month it intends to ask Google and Skype to set up servers inside its borders so that it can monitor traffic over Gmail and Skype’s internet telephone system. Other countries seem set to follow.

Iran appears to be in two minds about whether to embrace or stymie technological progress. On the one hand, Twitter accounts helped the opposition mobilise demonstrations in the wake of last year’s contested presidential election and so the authorities blocked the service sporadically. On the other hand, by monitoring Twitter traffic, Tehran was able to identify who was organising the protests.

Taken together, these incidents demonstrate how states are building walls around the internet to regulate what information circulates in their country. The internet is being separated into a series of national intranets that reflect cultural, political and security concerns. “As cyber security and national security become ever more entwined, an increasing number of countries may impose censorship,” says Rex Hughes, a Cambridge academic who heads Chatham House’s project on Britain’s cyber defences. “A number of countries have already gone down this route.”

Try accessing YouTube in Turkey, for example, and you get a message saying that it is banned. In China, the BBC website is often offline – especially when there is a big Chinese story in the news. Nor is the US immune to censorship, having forced the removal of .com websites advertising travel to Cuba from Europe.

Russia has a slightly different approach. It has built up a monumental Big Brother appartus that goes under the acronym SORM-2. A copy of every little byte that goes in, out or across Russia is copied to a central storage computer in Moscow under the control of the FSB, the KGB’s successor. Should the organisation ever need the co-operation of a fellow citizen, then the information stored on the FSB’s computers can provide useful leverage to overcome any reluctance.

It is easy to understand why the paranoid elites of Iran, Burma and Belarus might be monitoring the internet as closely as they do. But why are the military and security services in the west starting to divert so much of their resources into what is known soothingly as “information assurance”?

Dim lights Embed Embed this video on your site

Cyber Command Defines Its Mission

After several delays, U.S. Cyber Command was established in May at Ft. Meade, Md., under the umbrella of the U.S. Strategic Command. At the helm is Air Force Gen. Keith B. Alexander, who is also director of the National Security Agency and head of the Central Security Service. Congress made him responsible for “directing the operations and defense of the Defense Department’s information networks, the systemic and adaptive planning, integration and synchronization of cyber-activities and . . . for conducting full-spectrum military cyberspace operations to ensure U.S. and allied freedom of action in cyberspace.”

But how will the command fulfill this mission? Part of the answer lies in how the command prepares for a mission that requires the integration of IT offices from all five services, all combatant commands, the nation’s intelligence services and by necessity the private sector, including public utilities and industry, and local law enforcement. Factor in as well foreign governments and non-state actors who are involved in cyber-espionage or suspected of attacking the Defense Department’s networks. All of this must be taken into account as Cyber Command identifies, connects and strengthens the latticework of 15,000 different Pentagon networks, 4,000 military installations and more than seven million Defense Department computer and telecommunication tools. The scope of the problem, considering the amount of hardware and software that needs to be cataloged, ordered and protected, is staggering.

Since the command has been set up to tackle a new and emerging kind of warfare—one which hasn’t been fully defined—it is critical that Cyber Command breaks out of the rigid historical and structural box that conventional U.S. combatant commands operate in, say several industry experts interviewed by DTI.

Michael Tanji, a security consultant who previously worked with the Defense Intelligence Agency, National Security Agency and National Reconnaissance Office, says the command should strive to “operate in a matrix fashion” and bring in the right staffers regardless of where they sit on the civilian/military divide, or even which service or office they report to, for any given problem. “A pyramid-shaped organization chart, made up of smaller pyramid-shaped organization charts, is not going to work,” he says. “Cyber Command has to deal with offense and defense, and the best way to do that is to have [everyone] work together to understand the adversary mindset and techniques. You’re a much better defender if you know how bad guys exploit software; you’re a much better attacker if you know what defenders can do to stop you from succeeding.”

Dim lights Embed Embed this video on your site

The notion that this command needs to find a new way of operating is shared by another analyst, Richard Stiennon, who says “it’s not like setting up the Air Force or bringing in John Paul Jones to set up the Navy, where you take some people at the beginning of an industry and have them do it. We’re 10-15 years behind the times and playing catch-up.” Stiennon, chief research analyst at IT-Harvest and an IT security adviser who has worked for the Pentagon and private industry, adds, “Imagine if the Navy decided to get into aircraft carriers today, from scratch,” without having the benefit of decades of developing aircraft and carrier technologies, tactics and procedures in tandem. That, he says, captures the scope of the task ahead. Stiennon says the first priority of the command should be simple: start with the basics. “On Day 1, if [General] Alexander were to pound the table with his fist, it should be to discover and know every network connection and make sure it’s protected. That’s a huge task. It would be expensive, but it’s got to be done.”

An event in Washington in July, sponsored by the Armed Forces Communications and Electronics Association, brought together the major players from industry, cyber-office heads from the individual services and Cyber Command leaders to figure out how some of these problems might be addressed. Bruce Held, director of intelligence and counterintelligence for the Energy Department, warned that “a static cyber-defense can never win against an agile cyber-offense. No matter how many attacks the U.S. repels in the coming years, there will always be more on the way. “You beat me 99 times, I will come after you 100 times. Beat me 999 times, I will come after you 1,000 times,” and eventually, “I will beat you.”

Army Brig. Gen. John Davis, director of current operations at U.S. Cyber Command, said it is imperative that the offensive capabilities of the military are linked with other government agencies and the civilian world, so the government can build “the frameworks to plan across the spectrum of conflict.”

Another panelist, Ed Mueller, chairman of the President’s National Security Telecommunications Advisory Committee, added that “we’ve made a big push over the last several years to become more tactical” when it comes to thwarting cyber-attacks. To continue innovating, “a bridge between private [industry] and public [government] is absolutely essential.”

Given the pervasive nature of the threat from hackers and even disgruntled service members leaking information that each service has to confront—the recent leak of 90,000 pages of tactical reports from Afghanistan to the activist website WikiLeaks shows how pervasive the threat is—one wonders how all of these different cyber commands are going to coalesce into one effective organization under U.S. Cyber Command. The new command’s director of plans and policy, USAF Maj. Gen. Suzanne Vautrinot, moderated a panel of cyber commanders from the services, saying that “nobody here has one job,” since those tasked with leading their services’ cyber-operations are “dual-hatted” to Cyber Command.

USAF Brig. Gen. Gregory Brundidge added that the services have to “harmonize” their efforts, and quickly. He mentioned that when he was deployed to Iraq, the services “were fighting to get information because everyone was reporting through their own services. If there is one lesson we’ve learned over the years, it’s that anything that brings our efforts closer together and harmonizes things is going to get us much farther along in our journey . . . what we’re all grappling with today is how . . . we bring all these things together that we have created in our own cocoons.”

In comments this summer to a group at the Center for Strategic and International Studies, Alexander outlined some of the difficulties that Cyber Command faces under different scenarios. For example: When the U.S. is at war with another state; a state uses an intermediary to “bounce” an attack (i.e., conceal its involvement) against U.S. networks; or the U.S. is under attack by stateless entities. “Each one of those is going to have different standing rules of engagement,” Alexander said. “What we don’t have now is precision in those standing rules of engagement, [which] we need. And we’re working through those with U.S. defense policy and up through the deputies’ committees for the administration.”

While the command might not yet have methods to work through these problems, Stiennon says, the danger lies in the fact that “you can’t do this slowly, the adversaries already know about the networks—they might know more about the network than the owners of the network. You’ve got to slam the door in their face, and you’ve got to do it now.”

Tanji sees the success of Cyber Command resting on the issue of whether the leadership can think, organize and behave as an information-age enterprise. “If their model is that of every other military command, then they will fail,” he says. “They will spend their time fighting internal and external battles. The only way they will succeed in a military command structure is if their authorities trump other command and service level [structures]. To overcome that you need to be thinking about how to offer solutions or capabilities that multiply the power of operational commands within that construct.”

Dim lights Embed Embed this video on your site

Four Critical Priorities for USCYBERCOM

Cyberspace and its associated technologies offer unprecedented opportunities to the United States and are vital to our Nation's security and, by extension, to all aspects of military operations. Yet our increasing dependency on cyberspace, alongside a growing array of cyber threats and vulnerabilities, adds a new element of risk to our national security.

1) Secure Buy-In for USCYBERCOM

Creating buy-in throughout government agencies has for decades been the single biggest threat to our nation's security. This is why, before USCYBERCOM can establish themselves and their initiatives, it must establish intra-government support to ensure various government agencies are working together, not against one another. This support is a critical factor in getting USCYBERCOM up and running, and will be necessary for the success of the cyber SWAT team (#4 on the list).

Ken Pappas, the Vice President of Marketing and Security Strategist for Top Layer Security, has spoken with many government groups about this challenge and believes that the most difficult objective for USCYBERCOM is not implementing security measures, but rather gaining support and trust of all agencies that will be affected by this. This is why Pappas proposes USCYBERCOM's first objective should be to win the support of all agencies and have them become stakeholders in the plan, as well as the execution, monitoring and success of the new command.

Securing buy-in for USCYBERCOM is certainly already underway through meetings with DHS, NSA, intelligence agencies, the military branches and more. Together, these groups will establish a "state of the cyber union", helping to determine what is already happening, where different parts fit and what elements are the most important. Working together now towards buy-in leads to a clear picture of what is needed and helps define the mission for USCYBERCOM.

2) Establish USCYBERCOM's Mission and Priorities

Avi Deitcher, the founder of Atomic Inc., recognizes the importance of establishing a clear vision, because without it USCYBERCOM will fail, "In the words of Frederick the Great, he who defends everything, defends nothing." It is imperative that USCYBERCOM properly defines their mission and within that mission outline the priorities of the command.

The challenge, of course, is that a main priority to DHS might not be priority number one for DoD. Certainly some of this will be resolved through the buy-in phase, but there will be issues no matter how coordinated different agencies become. A critical part of establishing the mission will be the people who are chosen to lead USCYBERCOM in the trenches. In fact Pappas argues that people are the key to the success of the mission, "First selecting the right people to undertake this task should come before anything else. Then comes the vision, then strategy on how to execute, then funding."

People are going to be a key element for USCYBERCOM but without a clear mission these people will be set up to fail and the set goals will not be achieved. Pappas continued, "What is the goal? I don't think anyone has figured this out yet. Hence a vision needs to be made and bought in. What are we protecting and from who?". With the vision, mission, and people in place it will be time to identify exactly what needs protecting.

3) Identify Network Vulnerabilities and Set Security Standards

During the buy-in phase there will be knowledge gathered to identify network vulnerabilities, but that will merely scratch the surface. Creating a clear picture of all network vulnerabilities will help USCYBERCOM set priorities. Fortunately, this is an area where the government can use technology. Resiliency testing provides a first step in identifying the weak spots within a network by hitting devices with realistic application traffic, up-to-date security attacks and line-rate throughput. Testing in this manner reveals the flaws of network equipment, even taking into consideration DDoS attacks, botnets, application fuzzing and more.

Once you perform this level of testing, priorities will become readily apparent. Additionally, resiliency testing of new equipment to be deployed sets a "cyber security standard". There are so many different networks and disparate security initiatives to protect these networks that the "cracks" may be quite large, any testing standard introduced helps create a safety net under those cracks in the system.

Mixing in a standard, within an overlapping set of cyber security initiatives, is smart strategy, for net-centric defense and beyond. Mr. Pappas notes, "If this [seperate agency cyber security initiatives] is how it is starting out, then each agency is going to have its own mini cyber command and disparate systems once more. This is common within US Government agencies. One of the good things that comes out of this however is that the hackers cannot use the same tactics to gain access to ALL agencies. So following a 'standard' for all agencies might not be a bad strategy."

Having each government network uphold to a baseline set of standards will be important in order to act across these networks during an attack. If each have met a set of security standards USCYBERCOM will have an easier time responding to and preventing attacks. Knowing that each piece of equipment has been resiliency tested, under approved standards, will immediately tell USCYBERCOM, or any cyber security initiative, where the potential holes live, how to route services so they come back up faster and allow them to respond quickly enough to avoid permanent damage to any net-centric infrastructure. As the government takes the lead in setting standards to improve the resiliency of network equipment, private enterprise will benefit by having access to far more resilient, high performance equipment.

4) Create a Cyber SWAT Team

Once buy-in, vision, priorities and standards have been established, it is now important to act quickly in establishing a team of first responders in the event of a massive cyber attack. Mr. Deitcher was clear what he would advise, a crisis center, "Put in place a team that coordinates a response to all attacks and breaches. It is acceptable, and may even be preferable, that each department and/or area has its own team with its own priorities. However, when an attack does come in, it is crucial that a central "SWAT" team be apprised of it."

This becomes increasingly important, as Deitcher points out, when an attack occurs on a government agency that might not have the necessary cyber security expertise but needs to stop the attack and prevent it from hitting other agencies. USCYBERCOM, if built correctly, can certainly be a center point for this cyber SWAT team, helping to monitor for attacks and taking actions, across departments, when an attack occurs. Additionally if resiliency testing standards have been applied USCYBERCOM can more quickly respond and end any attack.

Conclusion

USCYBERCOM has an enormous challenge ahead of them and here we have only provided four of the most important recommendations. However, at the end of the day, this still all comes back to people, as most things do when you are talking about network security. This fact struck home while talking with Mr. Deitcher, who succinctly stated that the most pertinent cyber threat to the United States today is incompetence.

USCYBERCOM can help eliminate and shore up this threat of incompetence by establishing buy-in throughout the government, establishing a clear vision, identifying vulnerabilities through resiliency testing and creating a cyber SWAT team. It will be interesting to see what is presented to Secretary Gates in just eight weeks.