Slashdot Mirror
Ask the Air Force Cyber Command General About War in Cyberspace
We ran an article about the new Air Force Cyber Command and its recruiting efforts on February 13, 2008. Now Major General William Lord, who is in charge of this effort, has agreed to answer Slashdot users' questions. If you're thinking about joining up -- or just curious -- this is a golden opportunity to learn how our military is changing its command structure and recruiting efforts to deal with "cyberspace as a warfighting domain." Usual Slashdot interview rules apply.
Have you heard enough Skynet jokes/references/analogies to make you want to kill the next guy that mentions it that thinks he's the King of Comedy?
General Lord, I am currently a member of the VT Air National Guard, and I have a bachelor's degree in computer science and work in IT for my civilian job - is there a good way that someone like me can be put to use in this effort without having to go onto active duty and relocate? Thanks - Ben
Do you have telecommuting opportunities? Terrorists and criminals don't work out of a giant call center or office building, so I would hope that those fighting against them might not have to either.
Does it ever wear you down that you have to look at anything and everything in the world as a potential tool or locale for warfare?
I like to place meaningful quotes in my sig, so people will know that I know what meaningful quotes are.
So, what's up with that war on blogs we read about recently? You know, the one "so utterly stupid, it makes me want to scream." Not quite your area of responsibility directly, I believe, but certainly of interest to the crowd here.
ProofReading Markup Language - and yes, I find typos.
Why has the DoD not simply disconnected from the Internet in light of all the threats and (apparently somewhat successful) attacks from abroad?
It appears that the military is increasingly involved in areas who's jurisdiction was once considered to be wholly in the civil domain. Use of jargon like "cyberspace" seems only to obfuscate and distract from the core issue. This appears an effort to recruit public opinion and defuse the deeper questions that strike at the heart of a free and civil society. I think that if we had a statement that "The private mails are a warfighting domain" would generate a fair amount of debate on the role of the military as opposed to the police, the function of constitutional protection of liberties, and the question of what actually constitutes a state of war.
What are the limits on this jurisdiction? Who enforces these limits, and how is the public informed of that status? How are efforts to extend being safeguarded from creating mission creep that threatens all civil discourse in the United States and abroad form targeting, suppression, propaganda and extra-legal surbeillance?
"Flyin' in just a sweet place,
Never been known to fail..."
Dear Major General Lord, I'm an academic who has been theorizing and writing about military doctrine in in cyberspace. One problem that I have encountered is in theorizing about what conflict in cyberspace looks like, though Libicki does a fine job. How does your command develop war fighting doctrine in the absence of actual conflict for cyberspace?
There have been several recent news reports that China has and is engaging in a nationally funded effort to hack into and attack US government computer systems. The German government recently announced that they traced recent aggressive cyber-attacks back to the Chinese government. What, if anything, is being done against this type of cyber-terrorism against us and our allies? Why do we still confer most-favored nation trading status onto a Nation who is actively engaged in efforts to spy on and attack our government and corporate computer systems?
Major, it seems to me (and others at /.) that the cultures that most geeks espouse run counter to the perceptions of the military. This being, for example, showing up at a consistent designated hour, opposition to wearing a standard uniform, having an overly strict form of discipline, etc.
How do you propose to reconcile those conflicts and establish your organization with any semblance of 'geek cred' to get the real talent you sound interested in attracting? What sorts of 'carrots' will you wave to attract people?
We're all hypocrites. We all have hidden parts, it's the contrast between them that make us more a hypocrite than others
Is it possible that rules would be relaxed to allow the types of people that can do the job already but may not be "fit" or a "good fit" for/in military service, or is the plan to take airmen and train them to do what you want them to be able to do? Would a civilian with the proper skillset be able to act as a contractor without enlisting, etc?
Don't blame me, I voted for Kodos
It seems that in the military traditionally it was always looking for people fresh out of highschool for EMs and if you wanted to get anywhere in the military you had to be either college educated or, to really have a high end military career, start really young in something like the Valley Forge Military Academy and work from there.
In a traditional branch of the army/navy/airforce that is probably as it should be.
But in this area people have to be trained for years, still not know as much as the older hands in the private industry, and before they really know enough their enlistment would be over. Also, it would be unacceptable for an older IT person to join but take a pay cut to a Private's level or perhaps even a Lieutenant's -- so I imagine this branch would have to be somewhat different.
Is the military going to do to reach out toward the older folks who have extensive experience and knowledge outside the military?
A great portion of the minds you would need in order to facilitate this are not of what is traditionally classified as "fit for service." Would those requirements be altered in order to cast a larger net for a talent pool?
Karma Whoring for Fun and Profit.
War is never clean.
In conventional warfare, certain actions such as hiding among civilian populations are forbidden. These actions are considered war crimes because of the collateral damage they are likely to cause. What actions in cyberspace do you think should be outlawed? How about intentionally bringing down hospital IT systems, or destroying undersea cables without regard to the effects on civilian populations?
Don't mess with The Phone Company. Piss them off and you'll be using two tin cans and a piece of string.
If shutting down access to blogs isn't enough to create resentment, the Air Force is "developing data mining technology meant to root out disaffected insiders based on their e-mail activity--or lack thereof." With "Probabilistic Latent Semantic Indexing" a graph is constructed of social network interactions from an organization's e-mail traffic "If a worker suddenly stops socializing online, abruptly shifts alliances within the organization, or starts developing an unhealthy interest in "sensitive topics," the system detects it and alerts investigators."
"Flyin' in just a sweet place,
Never been known to fail..."
- Space Rogue
When the US military is run by people who are representative of their population, and understand the composition of their country, they may be successful in persuading the best and brightest minds to work for them. As an observer here in canada (and we're not THAT much better for this), the american system tends to use the stick, not the carrot, in order to persuade its citizens to do the right thing - which discourages experimentation! The US military is percieved as being much worse.
General Lord, I am currently a Computer Science student attending a U.S. university, and I am curious as to what skills you would like to see in potential recruits for the USAF Cyber Command. What areas of expertise are preferred over others?
Security professionals thrive in an environment where authority is questioned, basic assumptions are always challenged and diversity of thought is critical. Even the idea of uniforms is going to drive away the professionals you need to set up this type of institution. Do you believe that setting up this type of institution within the military is even a good idea? Do you think that perhaps there's a more appropriate environment for it? Are you entirely aware of what kinds of challenges you face in recruiting top-notch people for this type of thing? Would you even know a top-notch security professional if you saw one? They're not easy to identity unless you're another security professional. Are you? Do you really have what it takes to try and lead this type of organization?
If so, can you tell me why you chose ASP to run your website? Won't you have enough trouble recruiting as is without alienating some open-source loving folks right off the bat?
So far everything I've seen about this organization is riddled with basic mistakes. I wish you the best of luck but I'm just not convinced you have any idea what you're getting yourself into with this initiative.
I touch computers in naughty places
General,
Perhaps the reason you are having difficulty in attracting top talent is partly due to the name of your unit. Cyber Command? Sorry, but that just sounds soooo 1980's. How about Electronic Defense Command or something, anything without the word 'cyber' in it. Seriously, have there been any thoughts about a name change?
- Space Rogue
I wise man once said "It is good that war is so terrible, lest we grow too fond of it". If cyberwarfare ever becomes a reality, how do we respond to the fact that is isn't "terrible"?
The direct damage from such warfare would be primarily economic or data security related (rather than a cost in human lives) how do you feel we can prevent it from becoming a monthly, yearly, or daily occurance?
The classified networks (such as SIPRnet and JWICS) are already not connected to the commodity internet. Only unclassified networks (which can still contain troves of sensitive and other information, and whose interruption can cause havoc in all manner of other ways) are connected to the commodity internet.
The answer is the same for anything else that is connected to the internet: that the benefits -- real or perceived -- of being connected to the internet on the unclassified side, with proper security controls, etc., outweighs the risks.
General Lord,
Does the AFCC have a mandate to pursue criminals that use information infrastructure to commit crimes, or is your group intended to defend against warlike attacks only?
If the latter is true, how would you distinguish between criminal activity and warlike activity in cyberspace?
Equine Mammals Are Considerably Smaller
Will the USAF Cyber Command be full of TPS reports and other crap like long wait times with lots of paper work to get small thing like adding ram, getter better systems, install new software and other things?
Will you be forced on to the standard USAF window base image with limited admin accounts like how the navy and marine systems that are a Big mess are setup?
Will you use mac and linux like how the army does?
Just post a list of the stuff you want hacked and the more patriotic hackers will enjoy doing it for free.
Due to the nature of hacking and what many people do to acquire such skills, they may not want to 'join up' and all that.
But if you post a list of IP's that are okay to bring down, and networks you want information stolen from, with the understanding that the US will not condemn any attacks, and I'm sure more than enough people would do it for free.
Is there anything like this already in place? Cause I got nothing better to do this weekend. Or most any weekend.
Seriously, Don't take anything I say seriously.
General Lord,
I'm curious to know if you have have any criteria that would enable you do decide when a cyber attack is an act of war. Would it be possible for some kind of action inside a network to lead to a shooting war without some kind of overt physical threat occurring first?
Equine Mammals Are Considerably Smaller
Can you explain some about the situation developing between Barksdale AFB and Offutt AFB as they try to fight over the eventual final location for CyberCommand? My thoughts are that finding and recruiting talent, and laying the foundation for such a large wired infrastructure in the Omaha, Nebraska area may be easier to accomplish than in and around Shreveport, LA. What types of things is the DoD looking for when they choose the final location for this new Command?
Hmmm.
General Lord,
Some of the "hacker" types that I understand the AFCC is looking for probably will prefer to work with Linux and Linux applications.
Due to the international nature of software like Linux that has been developed through the "free" paradigm, would this be allowed? These tools will have been produced by nationals from many different countries, perhaps even those that the United States could find itself fighting a cyber war against.
Equine Mammals Are Considerably Smaller
Why doesn't AFCYBER fit at one of the national labs (e.g. LANL, or LLNL) or NSA?
I thought those were the popular destinations for educated people who want to serve their country, they're already technically oriented, and they already have a lot of really smart people, so it would have seemed to me a good fit. When I'm looking at my employment possibilities, I need a way to differentiate you.
General,
Some of the most talented people in computer security tend to have the sort of records that prevent them from getting clearance. Maybe nothing heavily criminal, but enough of a colored background that traditional security clearance mechanisms would throw them out of the room before they get started. Often the same types of minds that are really good at computer security are also the rebel types, who'll have some history. Will you work to get these people in, or are we looking at a bunch of off-the-shelf programmers/admins who've taken a few simple courses in computer security?
Also, how do you plan to attract/retain them? Again, rebel types are some of the best hackers, and they're not likely to go in without incentives. Not due to any lack of patriotism per se, but an unexplored understanding of it. More importantly, they're likely to be anti-establishment types who aren't comfortable in the strict traditional chain of command. Finally, usually the outside industry pays quite well for the good ones. Are you prepared to financially compete for the best?
Finally, will there be any connections back to the research/academic community? You may find academics more happy to help than usual, as cyber warfare can often be nonviolent. Also, will the existing (and immense) capability within the NSA be properly leveraged?
I'm glad to see our DoD taking our nation's networked security seriously. Right now it's just a bad, bad joke.
Best of Luck!
-Lally Singh
Care about electronic freedom? Consider donating to the EFF!
Oh for fuck's sake, at least do something with the song!
I am the very model of a modern cyber-General,
I've information on viruses, digital, and veneral,
I know the pings of the LAN, and I know the games historical
From Marathon to Pikachu, in order categorical;
I'm very well acquainted, too, with matters quite impractical,
I endlessly retell old jokes, both the tired and scatological,
About conspiracy theories I'm teeming with a lot o' news
My many fanciful facts pin it squarely on the Jews.
Though I've never touched a woman i've watched a lot of porn;
Gigabytes and gigabytes, a greater expert was surely never born:
I've information on viruses, digital, and veneral,
I am the very model of a modern cyber-General.
Kwisatz Haderach
Sell the spice to CHOAM
This Mahdi took Shaddam's Throne
Why should the US Air Force be tasked with this, instead of DISA or NSA, neither of which is tied to a specific branch of the military?
One of the storied stereotypes of the hacker domain is that of the nabbed "black hat" being impressed Into a "white hat" role. (Think Leonardo DiCaprio's role in "Catch Me If You Can".) However, the US armed forces no longer offer service as an alternative to prison (last I checked anyway), even though it offers a hacker in such a position the best deal he or she may ever get.
Would you seriously consider trying to exploit the talents of convicted hackers if you thought those talents could be a viable asset?
--- The American Way of Life is not a birthright. Hell, it's not even sustainable.
General Lord, I currently work as the exact type of 'cyber warrior' you intend to recruit. But I already have a Top Secret clearance, already familiar with DoD systems, etc. The dynamic with what we call 'Information Assurance' is that of a constant struggle with our contractor management (stay within the contract, the budget, etc) and with our 'warfighter' higher ups (educating them on why they can't have full access from their home in the spirit of "operations are a priority, to hell with security"). So assuming you can get the type of expertise that are eligible for clearances, and that are willing to relocate to Offutt/etc, how are you going to address the core issue of security in the DoD: Operations/budget/schedule will always trump security. Or alternatively, security will always be back burner to 'hot' issues. Thank you for your time.
During times of war, special laws come into effect. The killing of another human being, normally considered one of the most heinous of crimes, is a legitimate practice under combat conditions. My question is this: Does the law come into play at all during cyberwarfare, or is "code" the new law, as far as the USAF is concerned? Does cyberwarfare relate more closely to a covert operation? If there is a strict legal framework for cybercombat, what are its fundamental aspects?
I am an Indian and what the US does have non-trivial effects on my day to day life. US military publicly and actively declaring meddling with the internet to be a part of their job can amongst other things motivate my political overlords into some kind of action.
:P
Like everything else this has both good and bad effects for me. I don't think our establishments here have a very good idea of what freedom of speech means and they could easily do some wrong here. On the other hand it opens up business opportunities for people like me which is the part I would be interested in.
So, here are my questions. What kind of stuff does your division do? Do you outsource any of it to the private sector? Do you outsource any of it to India or other countries?
I suppose data mining the internet would be a key part of your operations. What kind of tools and cyber-technologies would you consider? Which are you already investing in? What kind of tools/techs could I work on that could benefit operations such as the ones you plan to undertake?
The military entering new domains has historically benefited the research and development in these sectors and I look forward to the new cool civilian tech this could bring along with it.
General Lord,
I served proudly as an active duty member of the United States Air Force for 4 years and then in the Reserves for another 4 years. Although the Air Force is generally regarded as the most "modern" of the U.S. military branches, I still found that the overall structure was too rigid to take me where I wanted to go, so I followed my inner geek and moved fully into the civilian sector.
You said, 'We have to change the way we think about warriors of the future.' At first, I guessed that you would hire these individuals into government contractor positions, but the Wired article implies otherwise. Many of the brightest security experts, by nature, are highly independent and have a noted distaste for many of the standards that being in the Air Force require, such as basic training, dress and appearance, and physical fitness. How far will the Cyber Command bend the traditional standards in order to persuade the best and brightest in the security field to sign up into a military career?
Superworms such as Storm represent perhaps the greatest threat to the internet becasue their stealthy natures allows the organization of millions of computers into a covert zombie botnet before their true exploit is finally launched. Will Cyber Command launch offensive operations to hunt down and destroy superworms already imbedded in cyberspace civilian computers, or create supermilworms (new word for CC use if you wish, with zero Google hits) that covertly draft millions of civilian cyberspace computers as secret War Reserve resources available for future callup and deployment in a future cyberspace battle?
Dear Gen Lord:
In major campaigns, the National Guard (and Air National Guard) play a significant role and are often the front line service. How do you see the individual state Guard units participating? In addition, what Civilian roles will be both a part of the Guard and contracted to the Guard?
Banjo - The more I know about Windoze, the more I love *nix
This is something I really hope gets asked. A lot of the comments here seem to be of the "the people you need aren't going to fit in with the military structure" as well as, "are you sure you even know what you're getting into doing this?"
I think Internet Privateers, a sibling-comment suggests, would be perfectly legitimate - and as effective, if not more effective, than an organized USAF "cyber attack" on, e.g, the PRC. I don't doubt the need for a "cyber command" to protect American information infrastructure, but I strongly suspect that an distributed, head-less method of attack is a better offensive strategy than a monolithic one. And I think most people on Slashdot would agree (although I am eager to hear arguments against it).
So really - what is your response to what the parent suggests? In the case that an offensive is required against enemy information targets, would the USAF be willing to publish a list of IP addresses for private citizens to crack?
Nemilar http://www.techthrob.com - Visit Me!