Slashdot Mirror


USAF Considers Creation of Military Botnet

sowjetarschbajazzo writes "Air Force Col. Charles W. Williamson III believes that the United States military should maintain its own botnet, both as a deterrent towards those who would attempt to DDoS government networks, and an offensive weapon to be used against the networks of unfriendly nations, criminal groups, or terrorist organizations. "Some people would fear the possibility of botnet attacks on innocent parties. If the botnet is used in a strictly offensive manner, civilian computers may be attacked, but only if the enemy compels us. The U.S. will perform the same target preparation as for traditional targets and respect the law of armed conflict as Defense Department policy requires by analyzing necessity, proportionality and distinction among military, dual-use or civilian targets. But neither the law of armed conflict nor common sense would allow belligerents to hide behind the skirts of its civilians. If the enemy is using civilian computers in his country so as to cause us harm, then we may attack them." What does Slashdot think of this proposal?"

23 of 440 comments (clear)

  1. I'm Suprised by zehaeva · · Score: 5, Interesting

    I'm Surprised that they are not doing this already. That begs the question, who's computers would host the bots? Patriotic Americans who allow the govt to install software on their machine to attack the enemy is all well and good but what happens when the alphabet soup figures out that the govt has software on most of America's PC's?

    1. Re:I'm Suprised by gunnk · · Score: 5, Insightful

      You hit the nail on the head!

      A botnet's great strength is that it is dispersed. House it only on military computers and you cripple it. Put it "out there" in some form, though, and you risk having the CNC reverse engineered and the botnet might suddenly "belong" to someone else.

      Bad idea.

      --
      Life is short: void the warranty.
    2. Re:I'm Suprised by apt142 · · Score: 5, Insightful

      Why would they need to install them on civilian PC's? The US Gov't, unlike a lot of botnet creators, has a hell of a lot of funding. They could just buy a bunch of computers specifically for the task.

      Or, they could just take every computer that is upgraded/rotated out of a federal government facility and set it aside for this job.

      Or the US Gov't could just add a program to all of their active computers that relinquishes their idle time to the botnet. Sort of a militant version of Folding@home. (Civilians could even opt into this one.)

      Or they could do all of the above. They wouldn't need to touch a civilian PC to get a formidable botnet.

    3. Re:I'm Suprised by nizo · · Score: 5, Funny

      Maybe they could outsource it?

    4. Re:I'm Suprised by OeLeWaPpErKe · · Score: 5, Interesting

      you risk having the CNC reverse engineered and the botnet might suddenly "belong" to someone else.

      Only if you're stupid and use symmetric encryption. Such a problem would most certainly not manifest with a distributed public-key encrypted network. Obviously this is an area where even good organizations and intellient people have been known to have made utterly stupid mistakes.

      But it is certainly possible to create an uncompromiseable botnet.

      Actually, to be honest, I'm really surprised such a botnet doesn't exist already. Oh well, perhaps it's just one of the better hidden ones.

      One thing bothers me about botnets though : they all seem to originate either in Russia or deep into China. Especially in China I find it very surprising that ip's closer to the command center of those botnets tend to trace deep inside China, and not to the coastal cities, where you'd expect the Chinese script kiddies to be.

      So aren't we just kidding ourselves that other nations don't already have these ? Storm might very well be Putin's botnet.

    5. Re:I'm Suprised by hodet · · Score: 5, Informative

      Isn't the strength of a botnet that it controls systems behind millions of different broadband connections? It's not the number of PC's that matter but being able to use the sum of all bandwidth available behind a gazillion connections. If the military spreads their botnet on 100,000 systems behind 1000 networks then that wouldn't be very effective.

    6. Re:I'm Suprised by iminplaya · · Score: 5, Insightful

      Patriotic Americans who allow the govt to install software on their machine to attack the enemy is all well and good...

      And it makes the civilian population a legitimate military target. A little like hiding the missiles in the churches.

      --
      What?
    7. Re:I'm Suprised by AndGodSed · · Score: 5, Funny

      and what will stop them from suddenly morphing and becoming an entity in and of itself? Did these people not watch the Matrix or Terminator???

    8. Re:I'm Suprised by mckinnsb · · Score: 5, Informative

      Actually - they would have to use civilian PC's in some manner , one way or the other, to be effective.

      Part of the strength - and 100% of the resilience - of a bot net lies in compromising trusted computers and networks. A bot net built on every army base in the nation would be within the governments military domain space, which would be really only trusted by those within the United States government itself.

      Overflowing computers in other countries via DDoS attacks could easily be thwarted by simply blocking incoming packets from those military bases - or all incoming requests from any US domain. If you tried to avoid this block by bouncing these packets somewhere along the way to the attacked computer from the US, then you are involving civilian computers somehow, foreign or US. So you risk bombing either a) US civilian computers , or b) foreign innocent civilian computers, since the military's traffic would have to go through some civilian computer at some point even if it was originally funneled through dark fiber (like Internet 2), and its well within the realm of possibility that the civilian computer would not be able to handle the incoming storm of packets before said storm got to it's intended target, so you would completely miss your objective while simultaneously tanking a potentially friendly system.

      You could build it without using a civilian computer, but you couldn't use it without effecting a civilian computer, and the odds of hitting an innocent would be huge. It sounds like they are considering "Counter DDoSing" people that attempt too "DDoS", which personally sounds like a really, really dumb idea. It could potentially cause a lot of collateral damage. Conventional military thinking does not apply analogously to the internet; you can return fire in real life, but returning fire on the internet isn't always a smart decision.

    9. Re:I'm Suprised by bill_kress · · Score: 5, Interesting

      Doesn't the US government already have monitoring at the choke-point of virtually every ISP? Equipment that undoubtedly has the ability to generate any number of packets, spoofing any source...

      Would that be enough?

  2. Hmm? by Kingrames · · Score: 5, Insightful

    No good can come of this.

    A botnet is like a disease. Not a bomb. Deliberately infecting your own computers is a horrible idea.

    --
    If you can read this, I forgot to post anonymously.
  3. reminds me of the NSA backdoor.. by gbjbaanb · · Score: 5, Funny

    You have 4 windows updates to install:

    Security hotfix for XML services KB0453456
    Security hotfix for Windows
    Microsoft Silverlight
    US DoD anti-terrorist cyberwarfare battle attack bot v3.1

    Do you think they really wouldn't do it?

  4. lol by Anonymous Coward · · Score: 5, Funny

    We must not allow a botnet gap!!

  5. Which country would that be again? by Ice+Tiger · · Score: 5, Insightful

    "If the enemy is using civilian computers in his country so as to cause us harm, then we may attack them"

    It might be found that the enemy botnet just doesn't respect political borders and will be using machines within ones own country. What happens then?

    --
    "Because we are not employing at entry level, offshoring will kill our industry stone dead."
  6. where can i get some by FudRucker · · Score: 5, Interesting

    if China or Iran or some other enemy country wants to attack the USA and the US government wants to start a botnet let me know i have 2 PCs on 24/7/365 on cable broadband, i will volunteer my PCs to work for the US Government as part of a botnet, Bush may not be my favorite president but i am still an American and know what side my bread is buttered on (just make a Linux version too)...

    --
    Politics is Treachery, Religion is Brainwashing
    1. Re:where can i get some by nizo · · Score: 5, Funny

      You think Comcast had a cow about downloading movies, just wait until they see the traffic our government botnet generates.

  7. Inaccurate Title by hoshino · · Score: 5, Funny
    "USAF Considers Creation of Military Botnet"?

    The views expressed here are the authorâ(TM)s own and do not necessarily reflect those of the Air Force or Defense Department.
    Me: I like vanilla ice cream
    Slashdot: Internet Ranks Vanilla as the Best Ice Cream Flavour Ever
  8. Re:The path... by CogDissident · · Score: 5, Informative

    Read the article. And don't mod people insightful before reading the article yourselves!

    It specifically states, in no uncertain terms that they will only use USAF computers for this. And that it will be a way to use retired computers from other sections of the government that would normally be slated for destruction.

  9. Historical Perspective by nick_davison · · Score: 5, Insightful

    "But neither the law of armed conflict nor common sense would allow belligerents to hide behind the skirts of its civilians." Remember that much celebrated tea party in, where was it, Boston? The one where none of the protagonists war uniforms or abided by the laws of armed conflict and then slipped back in to the public masses? The one where, today, the U.S. would classify them as illegal combatants and deny them access to any legal protection?

    The one where the superior military, that could crush its opposition anywhere they stood and fought, couldn't defeat an army that kept slipping in to the countryside?

    The one where the "evil" greater power could be demonised every time they caused collateral damage or took reprisals on the people the weaker force hid behind?

    The one where the great general George Washington brilliantly used geurilla tactics to make up for never having more than 17,000 men in the field at any one time?

    The one where, soon after winning its largely guerilla war, they wrote the second ammendment to their constitution to enshrine the right to that kind of combat?

    The one where the larger but distant power regarded the attacks on its own holdings as terrorism - the term just wasn't widely used yet?

    It's ironic that a nation formed on, and celebrating in its constitution, the principles of armed insurrection, guerilla warfare and terrorism when it was the weaker power gets its panties in such a collective bunch when people do exactly the same thing that worked so well for it back again.

    Remember: If you win and you're powerful enough to write the history, it's noble. If you lose, it's evil terrorism. Until it's decided, which one it's viewed as simply depends on which side you're on.
  10. Re:We must defend ourselves by boyfaceddog · · Score: 5, Funny

    Do you even know what a Botnet is?

    I can just hear the Pentagon tech-office now.

    TECH GUY 1: "Hey, we go this guy here who WANTS us to infect his PC with that Botnet thingy"
    TECH GUY 2: "Lemme check. [CLICKITY-CLICK] Nope, already got 'im"

    --
    Here will be an old abusing of God's patience and the king's English.
  11. Re:Using bots in S.American countries by OeLeWaPpErKe · · Score: 5, Informative

    This has got to be against Geneva Conventions. There is nothing in the Geneva conventions about computers. In fact except for the treatment of prisoners and civilians (and casualties) in war, there isn't anything in any of the conventions.

    Did you know that they really don't protect civilians under "contemporary" conditions ? It specifically states that if "the enemy" (anyone whom you're at war with) does not clearly identify itself (which is defined to mean military bases OUTSIDE of population centers and CLEARLY uniformed troops) that civilians, enemy troops AND casualties are fair game ?

    As in, if there is a faction using people as human shields, any army fighting them is completely within their rights to shoot all the human shields first. (think about what rights this theoretically gives Israel in fighting Gaza, they go above and beyond what Geneva requires of them, since a genocide in Gaza would be clearly within Israel's rights under the Geneva conventions)

    Even in an open war a military is completely within their rights to let a civilian population starve. Everything except direct, unprovoked attacks is not the subject of the Geneva conventions.

    The convention also CLEARLY states who gets to judge (obviously without possibility of appeal) whether the provisions of the Geneva conventions allow you to shoot a certain person : the field commander. His decision is final, and he gets to be judge, jury and executioner.

    Besides, there isn't a single warring faction in the world today, except the United States (and Israel, Turkey and "maybe" China (insofar you call Tibet a war, besides I doubt you will find China respecting Geneva in Africa)), that even pretend to respect the Geneva conventions. E.g. hezbollah has declared upon multiple occasions that it doesn't, nor does it ever intend to (and then they say something about some prophet not respecting them as justification).

    Lots of other warring parties don't respect Geneva : the islamist government of Sudan, Egypt (in it's south), Iran, Pakistan, ...

    Never mind civilian computers being fair game. These conventions date from immediately after WWII (not that anyone really thinks Hitler would have respected them if they existed, in fact he would probably have used them to his advantage, but hey, one can hope, right ?)

    Also let's not forget, article 29(3) of the Human Rights :

    "(3) These rights and freedoms may in no case be exercised contrary to the purposes and principles of the United Nations."

    In other words, anyone attempting to abolish the human rights treaty (one obvious party would be islamists) does not have any human rights.

    In practice you will find provisions like that in just about any constitution, in constitutions as varied as both the US constitution and the Iranian one (you know the one that requires the state to execute gays).
  12. Re:We must defend ourselves by Orange+Crush · · Score: 5, Insightful

    And most (real, not the jingoist xenophobic crap that passes for it now) threats to national security are surrounded by innocent civilians who lack the "sophistication" (or are just scared sh*tless) to overthrow an opressive regime themselves.

    Now, since we're not talking about injuring or killing people--just essentially jamming their net connection for a little while, and maybe messing up their computers--I'm much less concerned about "civilian casualties" of a botnet war. (That is, until the botnets send the robots to come kill us).

    A hostile ant isn't biting you because it's mean, it's instinct since you've been perceived as a threat to the colony. Hostile antbites also don't result in millions of dollars lost when mission critical infrastructure is brought down.

  13. Re:Using bots in S.American countries by Luxemburg · · Score: 5, Insightful
    For chapter 4 (pertaining to the treatment of the civilian population) of the actual conventions, see: this link.

    Let's take some of your statements:

    Did you know that they really don't protect civilians under "contemporary" conditions ? It specifically states that if "the enemy" (anyone whom you're at war with) does not clearly identify itself (which is defined to mean military bases OUTSIDE of population centers and CLEARLY uniformed troops) that civilians, enemy troops AND casualties are fair game ?

    What the conventions actually say is that it's forbidden to perform certain acts. However, if one party commits such acts, it doesn't mean that any civilian population is then "fair game". Civilians are never "fair game".

    As in, if there is a faction using people as human shields, any army fighting them is completely within their rights to shoot all the human shields first. (think about what rights this theoretically gives Israel in fighting Gaza, they go above and beyond what Geneva requires of them, since a genocide in Gaza would be clearly within Israel's rights under the Geneva conventions)

    The fact that some of the acts of one party are forbidden, doesn't mean the other party may commit crimes in response. Specifically, the Geneva conventions talk of proportionality: "Art. 53. Any destruction by the Occupying Power of real or personal property belonging individually or collectively to private persons, or to the State, or to other public authorities, or to social or cooperative organizations, is prohibited, except where such destruction is rendered absolutely necessary by military operations." Given furthermore the fact that Israeli's occupation of Gaza is illegal by international law in general, any action taken by Israel to keep Gaza occupied is in fact a crime (though not necessarily by the Geneva conventions, which only deals with very specific humanitarian issues).

    Even in an open war a military is completely within their rights to let a civilian population starve. Everything except direct, unprovoked attacks is not the subject of the Geneva conventions.

    Actually the Geneva conventions cover several aspects about war that have humanitarian consequences: the treatment of prisoners of war, the treatment of a population by their occupier, and so on.

    The convention also CLEARLY states who gets to judge (obviously without possibility of appeal) whether the provisions of the Geneva conventions allow you to shoot a certain person : the field commander. His decision is final, and he gets to be judge, jury and executioner.

    It's the responsibility, not the discretion of the commander.

    Besides, there isn't a single warring faction in the world today, except the United States (and Israel, Turkey and "maybe" China (insofar you call Tibet a war, besides I doubt you will find China respecting Geneva in Africa)), that even pretend to respect the Geneva conventions. E.g. hezbollah has declared upon multiple occasions that it doesn't, nor does it ever intend to (and then they say something about some prophet not respecting them as justification).

    It's very true that no army ever respects the Geneva conventions. Israel, the United States and many other countries tend to profess how humane their acts of war are. Ofcourse, the harder they claim this, the more of a lie it usually is. (Collective punishment in Palestine, 10,000s of civilian prisoners of war without any outlook on a trial, but with rampant torture going on, the United States ofcourse has Guantanamo Bay, the en-masse destruction of civilian infrastructure in Iraq during both wars there, and so on). Regarding the statement you make about Hezbollah's declarations on multiple occasions, would you mind providing a reference to one such declaration?

    In other words, anyone attempting to abolish