Ask Lt. Col. John Bircher About Cyber Warfare Concepts

The Air Force is not the only U.S. military branch trying to come to grips with the electronic side of warfare, both current and future. The U.S. Army Computer Network Operations (CNO)-Electronic Warfare (EW) Proponent (USACEWP), located at Fort Leavenworth, Kansas — home to the U.S. Army's Combined Arms Center — serves as the Army's hub for cyber-electronic concepts and capabilities. This is the organization responsible for developing doctrine, materiel and training to prepare the Army for cyber-electronic engagements. For example, USACEWP has developed training teams to ensure that U.S. commanders and soldiers around the world are fully informed of cyber-electronic capabilities at their disposal. Leading the Proponent's Futures branch is Lt. Col John "Chip" Bircher; Bircher entered the Army in 1989 as an Infantry officer, then served in various command and staff positions, most recently Information Operations (IO). He was the IO Chief for the 25th Infantry Division (Light), Hawaii, and Director of IO for Combined Joint Task Force -76, Bagram, Afghanistan. If you want to know more about the realities and challenges that face an armed, global IT department in a time when electronic warfare is ever more important and dangerous, now's your chance to ask Lt. Col. Bircher some questions. We'll pass on the highest-moderated questions for Lt. Col. Bircher to answer. Usual Slashdot interview rules apply.

Comments

John Bircher?

[Lilith's Heart-shape]

Wait a second. Aren't members of the John Birch Society called "John Birchers"? If so, I'd say this poor bastard has an unfortunate name.

Re:John Bircher?

[QRDeNameland]

His superior officer, Col. Kukla X. Clanner, wasn't available for comment.

Re:John Bircher?

[Daniel Dvorkin]

That may well be why he goes by "Chip."

Re:John Bircher?

[Illbay]

I believe that Col. Bircher's group is scheduled to deliver a talk next week on the ongoing attempts by terrorists to introduce trojan code into the GNU/Linux project, that would allow them to take control of compromised machines in future. It's being delivered by Colonel S. Compromised.

Re:John Bircher?

[core_dump_0]

At least his name isn't Mike Hunt.

Re:John Bircher?

[Lilith's Heart-shape]

Or Haywood Jablowme.

Re:John Bircher?

[Dahamma]

I just looked at that wiki entry, and found this even weirder:

"It was named after John Birch, a United States military intelligence officer"

Re:John Bircher?

[cyphercell]

vampire?

Re:John Bircher?

[Ellis D. Tripp]

Isn't he related to Felashi Ofan?

Re:John Bircher?

[tehcyder]

Wait a second. Aren't members of the John Birch Society called "John Birchers"? If so, I'd say this poor bastard has an unfortunate name.

Yes, because the US Army is well known as a left wing organisation.

Technique?

[Manip]

Does the US Army take advantage of traditional misconfiguration and social engineering techniques in order to compromise a network or are the US government developing a home grown list of exploits to gain access to foreign government systems?

Re:Technique?

[dreamchaser]

Good question, but I highly doubt he'll answer any questions directly relating to methods used.

Re:Technique?

[notdotcom.com]

If by "social engineering" you mean "torture", then yes, I'm pretty sure the US excels at social engineering.

Re:Technique?

[msromike]

Yes the US is the best at extracting information without leaving any long term psychological or physical effects. To find the countries that are the best at extracting information while leaving the subject permanently disfigured or mentally impaired you will need to look elsewhere. Try North Korea, China, Cuba, Iran, Argentina, the list goes on and on...

Re:Technique?

[querist]

While I would greatly appreciate seeing Lt. Col. Bercher's response, being in the computer security industry myself, I strongly suspect that his answer will be something along the lines of "We will utilize all available and appropriate methods necessary to accomplish our mission. These may include, but are not necessarily limited to, known and published techniques and tools as well as special tools, tactics, and vulnerabilities that are not available to the general public. I cannot answer that question in any greater detail for reasons that I believe are obvious."

Or, as a security professonal and academic, I believe the "real" answer is "of course they're working on home-grown exploits, just like anyone else would. The broadly used ones are the ones that the regular IDS/IPS software can detect. They want highly specialized and highly targeted attacks so that they will not be detected by commercial detection software."

Think of it as the "cracker" version of "spearphishing" - highly targeted to reduce exposure, and thus increase the time before it is easily detected.

Legal Ramifications

[muellerr1]

How does the military ensure that it is operating within the law regarding online military offensive activities? Are there any laws or oversight, as such? If so, how are those laws and/or oversight affected by a declaration of war?

Re:Legal Ramifications

[0racle]

I'm willing to bet they don't really give a damn.

Re:Legal Ramifications

[tooler]

Since war never gets declared anymore, I doubt they've even thought about your latter question.

Re:Legal Ramifications

[Xaositecte]

In the military, there are legal assistants whose entire job is to ensure military actions are only carried out against legal targets. In theory, you would stand next to the commander and make the call when an important call has to be made. In conventional operations, this means making sure you know what's a hospital or orphanage, what is an acceptable target, what zones the politicians have declared off-limits for troops to go into, etc. Around 95% of the time, this actually works, and the military actually obeys the law!

This is a terrible job to have that other 5% of the time, because it makes you the designated fall guy when something happens. Especially when an order comes down from on high to ignore the law, and just get something done.

I imagine the same legal assistants will be present to inform commanders of whether a target is legal or not in regards to cyber warfare.

Re:Legal Ramifications

[msromike]

Of course the military considers the question. How else would they be able to wage war in an ethical and legal manner? Furthermore the members of the US military receive ongoing training on the subject.

Don't confuse military and governmental policy. Two entirely separate things.

US Constitutional law does not require a deceleration of war prior to initiation of military action. Imagine what peril that would place our nation in if it was required. To say that the rules of warfare are ignored unless there has been a declaration of war is disingenuous.

Re:Legal Ramifications

[tooler]

I was just playing with semantics. It is a fact that there are no declarations of war. If he had said "in wartime" then I wouldn't have had the opportunity to be snarky here. And obviously they've thought about situations even when there is a full declaration by Congress.

But you're right, I can't even imagine the peril our nation would be in if the military couldn't act without Congressional approval. I'd probably be dead, and my puppy dogs would be sold into slave labor camps. Plus, my wife would be forced to wear a burqa.

A few years ago I'd be right behind you, but now I'm a full-on skeptic. :|

Why so many directly connected networks at all?

[BadIdea]

I'm interested in why so many sensitive networks are even hooked up to the internet in the first place, or why trivial systems are so often bundled with sensitive ones under the same security frameworks.

Why aren't there more isolated networks that would require physical contact or interception to get to in the first place? Do sensitive systems really need any connection at all to the conventional internet in the first place?

I know that many places in the DoD do take this approach (people having one computer for safe email and browsing, and a completely different computer for sensitive intel), and certainly it's more expensive and less convenient. But when the internet is basically just a big pathway leading directly to your backdoor, why take any chance at all, ever?

Re:Why so many directly connected networks at all?

[Lev13than]

I'm interested in why so many sensitive networks are even hooked up to the internet in the first place, or why trivial systems are so often bundled with sensitive ones under the same security frameworks.

Good point - I guess if the Internet had been designed by the military (or, say, by a military research group) it certainly wouldn't have ended up this way...

Re:Why so many directly connected networks at all?

[qbzzt]

Why aren't there more isolated networks that would require physical contact or interception to get to in the first place?

Maybe they have people who can go places and attach wireless / satellite access points to various networks. It's not a safe job, but the military has plenty of jobs that aren't safe.

Re:Why so many directly connected networks at all?

[BadIdea]

You probably meant that as a joke, but that actually might be a good point: perhaps the internet's origins in the military have led to some overexposure in modern use that wouldn't have otherwise been the case if it had its roots elsewhere.

Re:Why so many directly connected networks at all?

[Peter Mork]

It is often the case that the sensitive systems aren't directly connected to the Internet. Instead, the sensitive system gets inadvertently connected to another (less-sensitive) system that is connected to the Internet. The second systems gets compromised, which gives the attacker a way to attack the first system.

For example, as I understand it, a nuclear plant was taken offline by attackers. The control system was not connected to the Internet. However, the management system (payroll, timecards, etc.) was connected to the Internet so that managers could get work done via the Web. Based on some insider knowledge, the attackers subverted the management system, which was mistakenly connected to the control system (by the contractors responsible for the management system). Thus, the attackers were able to shut down the plant. So, the people responsible for the sensitive systems know to keep these systems off the Internet, but mistakes happen.

Re:Why so many directly connected networks at all?

[kitgerrits]

Sometimes, safer solutions require time and/or hardware that is not available.
Long-distance communications over sat-link is cool, but expensive and limited in capacity.
Sometimes a simple e-mail has a better chance of getting to its intended destination.

Re:Why so many directly connected networks at all?

[Anonymous Coward]

Because everyone needs to connect their sites in a secure manner. Even corporations that just want to defend trade secrets. But they also need to exchange information, you can't just lock everything down or they can't do their job. Security is hard stuff.

Do you think the department of Energy is going to wire their own dedicated fiber to connect all their sites? Department of transportation? Boeing? General Electric? If they decide to share secure networks it just increases the risk, because one breach could compromise every network.

They may have a leased line, which isn't logically connected to the internet. But it's still going through switches that are also carrying other networks traffic. That switch may not even carry internet traffic (but one of it's other customers is on internet). The site thinks it's secure but if that switch gets broken into, it's all over. There were recent slashdot articles about counterfeit cisco equipment, who knows what kind of vulnerabilities they may have.

Lots of sites also need to be able to move information from their secure side down to their internet network, or vice versa. Even if you have them burn a CD, get scanned, etc it's still a vulnerability. The problem with completely airgapped networks is you need a lot of people whose only job is to move data between networks.

Also networks may not be tracking their equipment well enough. Someone moves desks and tries to setup their computer, plugging a phone line into a modem on their secure machine. That box could be sitting there for years before someone notices. That one gateway compromises their network.

The job of security is to find that hole, that mislaid cable, bad gateway, flawed encryption. It's hard work, networks are always changing. The job of intruder is to search for that same flaw.

Re:Why so many directly connected networks at all?

[Anonymous Coward]

Sensitive systems usually DONT have a connection to the internet. A lot of the time due to costs, systems are bundled into one framework or domain, but this only happens under low level security. Higher classified systems tend to have one function only due to the security required around them.

If you read the DOD standards, all systems are classified as to what level of information is on them. So a low level system, which may have non-national information on it can be connected to the internet through a secure gateway. On the other hand, TOP SECRET systems are not connected to the internet due to the rammifications should the information be comprimised.

It is a risk based approach, and most places do it. Internet and email are only required when dealing with other agencies, media monitoring, HR systems etc.

I have never come accross any highly classified system that is not air gapped to the internet, let alone not locked in a bank vault style room or faraday cage. The closest you will get is secure systems at a mid level security classification, linked together over a secure network. Eg through Fibre cables, high grade encryption etc.

Re:Why so many directly connected networks at all?

[Toonol]

Oh Thank God, an actual intelligent question. I was worried I'd get all the way through the thread without reading anything but inane knee-jerk blather.

What is that?

[khasim]

What, specifically, would be a "cyber-electronic engagement".

Include examples.

Compare/contrast with traditional forms of intelligence gathering (wiretaps, listening devices, etc) and their counter-measures.

Re:What is that?

[jbeaupre]

Please write your complete answers in the blue examination book

Re:What is that?

[Stray7Xi]

It's easy to understand once you look at radio communications (which is essentially a communication network). If I jam your radios I disrupt your communications. If I jam your radars your equipment doesn't work right. If I actually get into your radio network, I could pretend to be someone on your side and feed you false info or propoganda.

http://en.wikipedia.org/wiki/Electronic_Warfare
http://www.avweb.com/news/avionics/182754-1.html
http://en.wikipedia.org/wiki/Radio_Free_Europe

Interview Question

[Anonymous Coward]

With the political tilt as it is, a large part of the software development community is likely prejudiced against helping our country. With this in mind, how do you recruit the most creative and skilled people that this country has to offer?

Re:Interview Question

[Daniel Dvorkin]

With the political tilt as it is, a large part of the software development community is likely prejudiced against helping our country.

You made a typo there. Here's a correction:

With the political tilt as it is, a large part of the software development community is likely inclined against helping politicians use the Army as a tool to fight wars which harm our country.

Re:Interview Question

[flaming error]

a large part of the software development community is likely prejudiced against helping our country Say what?

If you mean to say lots of us don't support invading foreign countries without causus belli, or we start complaining at the suspension of habeas corpus and being jailed indefinitely without charges, then you're confusing "helping our country" with supporting the government.

Defending Liberty and Supporting our President are not necessarily the same thing.

Re:Interview Question

[qbzzt]

With this in mind, how do you recruit the most creative and skilled people that this country has to offer?

Probably he'd rather recruit people who will obey orders to the best of their abilities as long as those orders are legal. I don't think the military is interested in people who want an option to leave if they don't agree with their orders.

There are people who don't make good soldiers. I'm one of them. That doesn't mean that out of a population of ~300 million he won't find the people he's looking for.

Re:Interview Question

[Anonymous Coward]

No, he's pretty much right. I gave up DARPA contracts and the opportunity to work in the Defense Industry recently because I felt like I had blood on my hands. It wasn't because I thought that the war was bad for America. It's because I didn't want to program guidance systems which lead to the direct death and maiming of civilians. It's because I didn't want to write simulators that teach our soldiers to kill without showing them ramifications of that killing. It's because I don't want to have a hand in collateral damage, no matter how small.

Re:Interview Question

[Anonymous Coward]

I'll stay anonymous since I'm an Army Contractor but they would never ask such a question during the interview process. What they will do however is anyone at such level has to go through an extensive background check to gain Security Clearance, asking about each and everything you've done in the past 7 years. And when I say everything, I mean everything!

Re:Interview Question

[Doc Ruby]

Which country would that be, Anonymous enemy Coward? Perhaps you mean the country carved out by the politicians who have destroyed the US every way they could, from the inside? Or are you posting from one of our foreign enemies, which any American SW developer would gladly smash when it threatens the USA?

Re:Interview Question

[drinkypoo]

Probably he'd rather recruit people who will obey orders to the best of their abilities as long as those orders are legal.

You're making an awfully big assumption about his integrity.

Hacker war...

[Notquitecajun]

I doubt you could REALLY answer this, but Is the US military playing any sort of role in the semi-undergroung "hacker war" that appears to be going on between China and the US?

Increasing Complexity & Risk Management?

[networkconsultant]

With an ever increasing amount of information on the battle field, how would you limit risk when Murphy's law is not functioning in your favour?

For us geeks who'd be sitting behind a computer ..

[Anonymous Coward]

to fight. Will we have to go to basic training?

If so, would basic training be to train us to stay up all night, living on pizza, soda, Skittles, and porn?

If so, where do I sign up?!?

Relationship with the Air Force?

[El Cubano]

Since the Air Force is the U.S. military branch claiming dominance in "cyberspace" (along with air and space), how do you view the Army's relationship with the Air Force in "cyberspace"? Will the Army seek to take over all of the "cyberspace warfare", carve out its own niche in cyberspace, or peacefully coexist with the Air Force?

With respect to leadership in this area across the DoD, do you feel that the Air Force being denied the program executive role for all DoD UAV endeavors represents an opportunity for the Army increase its role with respect to UAVs (as many people see cyberspace and UAVs to be inextricably linked)?

Re:Relationship with the Air Force?

[HasselhoffThePaladin]

What you're talking about is similar to the question of who "dominates" the strategic warfare front. Rather than one dominating, each service has its own forces for that mission area, but they all typically fall under the respective Unified Command.

The US Strategic Command often, not always, has its commander come from either the Air Force or the Navy (with one exception, Marine General James Cartwright), as they have the preponderance of strategic nuclear weapons (AF with ICBMs and long-range strategic bombers and Navy with sea-launched ballistic missiles (SLBMs)--the triad).

That all leads to my question: Do you foresee the eventual formation of another unified command like USSTRATCOM whose area of responsibility is that of maintaining US dominance of cyberspace--with each of the services providing their own forces to this unified command? How long until we have USCYBERCOM?

Re:Relationship with the Air Force?

[TubeSteak]

Will the Army seek to take over all of the "cyberspace warfare", carve out its own niche in cyberspace, or peacefully coexist with the Air Force? Or peacefully coexist. Ha!

The Air Force is looking for ways to stay relevant in a world where they've essentially over-achieved to the point that nobody can really challenge them for air dominance.

IMO, the only thing that would make them coexist peacefully with the Army is if the Pentagon buries the tensions & rivalries under a pile of cash.

Re:Relationship with the Air Force?

[hypergreatthing]

That's a easy one. The army will enter cheat codes when playing doom and the airforce will play falcon 3.0 and provide backup against all enemys.

It'll be an unstopable one two punch!

On a serious note, i can't believe tax payer money will be spent on idiotic ideas like cyberwars in the future.

Re:Relationship with the Air Force?

[moxley]

Yeah... I guess being able to sit in a chair and fly a UAV into battle wasn't helping the chAir Force get rid of that unflattering pseudonym that was perfected so many years ago...

Re:Relationship with the Air Force?

[Stray7Xi]

In the same way the Air Force dominates airspace. Navy, Army and Marines all have plenty of planes and helicopters to provide support for their missions. It will be the same with computer warfare. Also with how mingled the services get, I doubt there will be competition because they're likely sitting at same desks.

Re:Relationship with the Air Force?

[finity]

You won't think it's idiotic when the Cylons built in Chinese sweatshops come knocking on your door.

"Bring out your living, bring out your living."

Attacks...

[Notquitecajun]

Without diving into details that compromise security, can you reveal anything about the types or quantities of attacks that the US military is able to fend off, and how often they are faced?

Re:Attacks...

[Sloppy]

Without diving into details that compromise security

Can you imagine what might have happened, if you had not so qualified your question? He might have let the cat out of the bag!

Personally, I would have phrased it this way: "Please tell us everything you're up to. (It's ok. We're cool.)"

Re:Attacks...

[legirons]

Personally, I would have phrased it this way: "Please tell us everything you're up to. (It's ok. We're cool.)"

Actually, that's probably a very good question to start the interview with...

China

[je ne sais quoi]

What is the U.S. Army doing to protect U.S. sensitive information from the frequent number of cyber-attacks originating from inside the People's Republic of China? Is it primarily defensive?

Re:China

[legirons]

What is the U.S. Army doing to protect U.S. sensitive information from the frequent number of cyber-attacks originating from inside the People's Republic of China? Buying and installing routers from there? ;)

Re:China

[ndogg]

On top of that, do you buy it when China says it lacks the skill to hack our systems?

Recruitment

[caljorden]

Does the US Air Force, or any branch of the armed services, currently recruit for cyber-related positions directly? Or is it a requirement that all members come out of the standard armed services personnel? If there is currently no system for recruiting the best and brightest CS/IT/Security personnel from the civilian population, would that ever be considered?

Re:Recruitment

[db32]

I can answer this one for you. Yes they do. The Air Force in particular has been getting much more active in advertising it's increasing need for the intel/cyber style missions. You basically go through the same process everyone else does.

1. Go to the recruiter and say "I want to do XYZ". If you are lucky you will get a recruiter that isn't a slimeball and will actually help you do specifically what you want. Hit or miss here, some are really amazing folks that know how to work things, others are asshats that know how to sleaze kids in. Do your research first. Non military and recruiters are about the last people you want to talk to for "how it really is" information, one is clueless and comes up with nonsense stories, the other has a clue and comes up with nonsense stories. Currently active or recently retired people will have the best information, though it will frequently be a bit dated. It is best to refine your questions with them and then ask specific pointed questions of the recruiters.

2. Go to the MEPS (Military Entrance Processing Station I believe) and do the tests. ASVAB being the big one here, all branches use these scores in one way or another to determine what jobs you are qualified to do. This isn't exactly a hard test by any stretch, more than anything it gives the military a guess as to how complex of a school they can send you to without wasting money on you failing out. You will also go through the whole physical thing, eye tests, piss tests, blah blah blah.

3. Go to the career manager folks. Each branch has a different name for them and this part will typically happen at the MEPS. Again, much like recruiters they are hit or miss. However, they have a bit better of an excuse. They aren't there to convince you to join so much as for you to tell them what specific job you want to do. These are the people that look up your scores and compare that to job requirements and then check for openings in that job. They process tons of people per day, many of which have no idea what they want to do other than "work on computers" or "fix planes" or whatever. The key to coming out of this is to do your research well before you go. Narrow down what you want to do to a few jobs and know their code for whichever branch you are talking to. These people are experts at human resources stuff, not the details of whatever career you want. They probably won't be able to answer much unless they came from that career or know someone in that career. The best bet is to get your recruiter to arrange some time to meet people in the career field you are interested in and get the answers that way.

4. Go to basic training. Everyone goes, no way past that.

5. Go to your school. Each branch does this a bit differently, but after basic training you will go to the school for your chosen job. This could be 2 weeks long, it could be 2 years long, all depends on the job.

6. Pray for your assignment. Now you are in, you have the career you want, and now it is a roll of the dice. You go where they need your career, period. There are a number of programs to finagle your way around to places you want, but don't expect any of them to help you much in your early days. Your best bet here is to do a damned good job, don't be a fuckup, and let your supervisors know what your goals are. Good supervisors will help you get where you want to go. Above all else, don't expect it to happen quickly.

National Guard units basically follow the same steps, except for the assignment process. With the Guard you will be joining a specific unit when you enlist. So you will already know exactly what your assignment will be. The Guard units are able to do much more targeted recruiting because of this. The Active Duty world you kind of go into a big pot and stay there unless you managed to get into special assignments (usually by being really good at what you do and leaning forward for opportunities).

Re:Recruitment

[fprintf]

http://interviews.slashdot.org/article.pl?sid=08/02/29/1733222

If you look at past interviews with the Air Force and Army, you will find that they work with a significant number of contractors. So you do not need to be "in the armed forces" to work on anti-cyber terrorism.

Obviously you need to be able to get a security clearance.

Re:Recruitment

[BadIdea]

This is a really important question going forward. A lot of military recruitment seems to still be somewhat centered around the sorts of "grunt"-based wars we were fighting decades ago. But there's no reason a fat out of shape guy who happens to be a brilliant programmer needs to go through boot camp and get shouted at by a drill instructor, or learn how to march, just to be part of a group devoted to fighting cyber-terrorism.

Obviously quasi-military operations need lots more in the way of security clearance and chains of command, but it seems like civilian-structured government organizations are better suited to many of these tasks than the conventional military. The NSA, DOD, CIA, etc. are full of bright people, many of whom have never done a push-up.

Is it the military that's going to change how it trains and retains, or will it be civilian-based government agencies that start to take over more and more of the functions of technological-based warfare?

Re:Recruitment

[samkass]

Or will the military continue to hire defense contractors to utilize their expertise in these matters? (Full disclosure: I work for a defense contractor.) The Air Force, for the most part, doesn't have their officers design aircraft parts, either.

Re:Recruitment

[TubeSteak]

1. Go to the recruiter and say "I want to do XYZ". If you are lucky you will get a recruiter that isn't a slimeball and will actually help you do specifically what you want. Hit or miss here, some are really amazing folks that know how to work things, others are asshats that know how to sleaze kids in. If it isn't part of the enlistment contract that you sign, the military can make you peel potatoes and wash dishes for the term of your enlistment and you have zero recourse.

"But the recruiter promised me" means absolutely nothing.
If it isn't in writing, don't expect it to happen.
The corollary to this is: if it is in writing and you have to sue, at best expect a Pyrrhic victory.

Re:Recruitment

[Anonymous Coward]

As a member of the Military (enlisted in the USMC, and now a Coast Guard Officer) I would have to disagree somewhat with the process you suggested.

  I would definitely try for an Officer program considering that most IT/CompSci people have (or will have) a college education. The various services will pay differing amounts for your eduction costs depending on your chosen program (ROTC, etc). You will also receive a stipend for expenses as well. You then owe the Service a couple of years where you will be relatively highly paid (as an Officer) with many benefits.

After this Service, you can continue in the Reserves... I cant think of too many part-time jobs that beat it. You get paid for 2 days every drill day you preform, medical benefits, etc. Most states also have very nice benefits for Reservists and Vets (which you will be after your 1st tour) such as a reduction of property taxes on your home. Not to mention VA bennies... ... a decision I've never regretted... even with a tour in Iraq during college.

Re:Recruitment

[Anonymous Coward]

I would have to disagree about being yelled and screamed at... A someone who completed Marine Corps boot camp, and Officers Candidate School the physiological factors of the training were as just as or more important then the physical ones.

One of the primary purposes of military training is to instill discipline in an individual. Military discipline is the "instant obedience to orders," which is what that yelling and screaming is all about.

Re:Recruitment

[Stray7Xi]

AFAIK recruits are recruits. They have same requirements for basic training and military expectations (physical fitness, firing ranges, etc). If you want to be a civilian, join a civilian agency (NSA, CIA, FBI, etc). That said the basic requirements for military service aren't that hard. The minimum for Army (after basic and advanced training) for a 17-22yr male is 42 pushups, 53 situps and 15:54 2-mile run. That may sound rough, but many people entering basic can't do 10 pushups or situps.

Army doesn't have a MOS dedicated to this specifically. Meaning certain MOS's do this among other jobs (so you can't sign up for this specifically)

Navy has a dedicated rating:
http://en.wikipedia.org/wiki/Cryptologic_Technician

The other post on joining military is very accurate. But I want to emphasize don't trust the recruiter. In most cases they just don't know better. Your recruiter may be a tanker that knows about as much about computers as you'd expect. If you say "I want to work with computers" well they see their "administrative specialist" working on computers all day long. So look through the MOS's and use common sense. None of them are going to be called "1337 ha>0r", they'll all sound dry and generic. Talk to someone in military, better yet talk to someone in branch of military you're interested. Combat Arms probably can't explain the differences between Military Intelligence professions and vice versa. If you go in saying "I want to be a 35S Signals Collector/Analyst and nothing else" or "Chinese Linguist" you'll likely eventually get it (they may say it's not available right now, but follow up, there's always classes going through). Don't worry about not knowing Chinese or any of the job technicalities, they'll train you in that (if you score well enough on ASVAB to qualify, which is just High School level knowledge).

Also if you do join, maintain a good attitude, a lot of positions in military are filled by a commander recognizing someone has the appropriate skills but they're not going to put someone that has a bad attitude. If you don't start in position you want, work hard in the one you're at and let it be known what you want to do. I hope this helps someone.

Re:Recruitment

[db32]

Not exactly. You can get your contract to promise a specific job. This basically means that you will only ship off when they have an opening to get you into that field. However, with all things military it isn't quite that simple. Typically it will be one of three things. 1. Specific job. 2. Open area (electronics, mechanics, etc), or 3. Open (they can make you do anything). Now even with a specific job it isn't exactly a promise that that will be your only job. The quickest way to lose that job is to wash out of your school at which point they can make you do anything. The Navy does this a ton with their Nuclear career fields. The schools are incredibly fast paced and very difficult, but they get tons of people in with flashy bonuses and the like. However, once you wash out they can give you whatever shit job they can't get enough people to sign up for.

However, in the end it does boil down to the needs of the service and they CAN hose you, but it doesn't happen as often as people thing it does. Typically what I have seen happen in situations outside of doing something stupid to lose your job is "change jobs or go home".

Re:Recruitment

[db32]

Yup yup. The other branches rely on officers for that stuff more than the Air Force does, but other than that you are 100% correct. Guard and Reserve are basically the same type of deal with a few differences. The quirks and differences come from Guard being state controlled and the Reserves are federally controlled.

Re:Recruitment

[Iamthecheese]

If it isn't part of the enlistment contract that they sign

Fixed it for you.

Re:Recruitment

[inKubus]

I'm interested to know what the grey lines of the roles military vs. intel play in this cyber battle. What are the rules of engagement for the military? And we're talking about DEFENSE of course, they don't call it the Department of Offense. I mean, are you guys tasked with monitoring all of our undersea cables and satellites also? What layers of the OSI stack are you active in? Purely IP and packets, or the physical layer as well? And what about deploying covert datacenters inside the enemy network? Do you work with the NSA? I don't understand why we need a cyber task force when we have the NSA. Unless this is a purely offensive force. In which case I'm not interested.

Re:Recruitment

[cjsnell]

Before you show up in a recruiter's office, your first step should be to get online and find the MOS (Military Occupational Specialty, aka your job title) that you want.

Your recruiter may or may not try to get you into something else, but don't accept anything but what you want. It's very hard to change jobs once you've signed the papers. Now, that said, the military is hurting for smart geeks like us and more than likely, you'll walk into the recruiters and say, "I want to be an information warfare technician" and they will offer you a fat sack of cash to sign up for this job. They really need you!

Oh, and start exercising now!

Good luck!

Re:Recruitment

[BadIdea]

Which is fine if your purpose is to be a dot on a general's battlefield-eye view of things. But that's not necessarily the right stance for all sorts of other jobs which involve innovative responses and solutions. That's not to say that soldiers cannot be innovative problem solvers, but the point is that the training is gearing people towards different things.

What limitations do you observe?

[Anonymous Coward]

Conventional military is bound by the Geneva convention. To date, there is no international law governing military info-war. Are you therefore no longer bound not to attack civilian targets? Is scrambling hospital records to create civilian deaths by mistreatment considered a valid attack?

Re:What limitations do you observe?

[Applekid]

I love parent's question, and therefore love them and hate not having mod points.

Why does the Army have a love affair with Windows

[Anonymous Coward]

the worlds most insecure operating sytem? Seriously, I just had to go through the Army accreditation process at work, and all the guidelines basically say that Windows is the most secure according to the army. Several of the policies do nothing to increase security but are windows only features, a not so subtle hint that if you want to be "secure" you should be using Windows. The policies also states that since open source is "unsupported" you should use a commercial OS unless you can find "support" for the open source software. The scrutiny that the Linux/Unix machines are put through is MUCH more than Windows machines are. Windows machines are basically said to be "secure" if you apply all the patches and set a couple of settings. Its as if the Army considers Windows to be the most secure instead of the least secure. The whole security accreditation process seemed to be a giant push for us to move to Windows, which means that in my opinion the whole exercise was intellectually bankrupt. Why does the Army continue to push windows despite its absolutely horrendous security track record?

Being Proactive

[Cormacus]

What kind of proactive steps are being taken in advance of any cyber dust-ups? We frequently see articles that talk about security holes used for attacks that could have been closer earlier. Is closing these security holes a priority? Also, with increasing numbers of infrastructure control systems (power grid, etc) being attached to the internet, is the defense of targets like these being attended to?

I have more doubts.

[khasim]

I doubt that he'll answer ANYTHING with any details. This will be a recruiting and PR piece. His "answers" will be vetted by at least 3 different agencies and any content will have been removed.

Jurisdiction?

[Caerdwyn]

Given that the most likely targets for cyber warfare are civilian targets, and that the perpetrators will likely be either non-government organizations or non-military employees of foreign governments, how do you see the jurisdiction question playing out? In particular, at what point are there handoffs in investigation, arrest, and prosecution between the US military, the FBI, and local authorities of affected civilian targets?

Re:I would like to finally see people talking...

[maxume]

Just go down to your local Hippy Dippy Noodles.

Avoiding Redundancy or is it Necessary?

[introspekt.i]

What steps is the Army taking to avoid overlap with the Air Force's "cyber warfare" program(s)? Is avoiding overlap considered necessary, or is redundancy considered a good thing? Are there plans to collaborate on large scale with the Air Force, or keep the programs isolated from one another?

Payment

[phantomcircuit]

Can we see some definitive numbers on what the pay scale will be? For example there is http://www.airforce.com/careers/paychart/index.php

Re:Payment

[jmkaza]

All of the Armed Forces use the same pay chart. An E5 in the Army makes the same as an E5 in the Air Force.

Source Code

[g0bshiTe]

In the event of a "Cyber Attack" (read we go after them) would the task force secure source code, to search for hidden vectors of attack?

I realize this is based on the assumption that we know what OS and programs they are running, but Windows for instance, it's reasonable to assume that most computer users use some form of it either legally aquired or illegally.

And if and if ...

[khasim]

And if there actually is a "Hacker War" between us ... and if our military is currently playing a role in such ... are there any civilian applications that will be released to help defend our non-military assets (corporations, education, etc)?

Example: the NSA has worked on SELinux.

Re:And if and if ...

[TubeSteak]

And if there actually is a "Hacker War" between us ... and if our military is currently playing a role in such ... are there any civilian applications that will be released to help defend our non-military assets (corporations, education, etc)? If you skip down about 6 articles on the front page (YMMV), you'll see:
Data Breach Study Spanning 500 Break-Ins Released
How about (1) Nearly nine in 10 corporate data breaches could have been prevented had reasonable security measures been in place,

The IT community has had a hell of a time convincing computer users that security is important..
And you can't exactly force people to take reasonable security precautions to protect their systems.

Re:And if and if ...

[Stray7Xi]

The military itself doesn't really write any code. It's the defense contractors making these big projects. For security reasons the military won't want the code made public for their cool new toys. For financial reasons the defense contractors are going to want to charge an arm and leg for it. I consider it unlikely you'll see anything like SELinux from a military project.

Timing and relevancy

[zappepcs]

It's common knowledge that what we call the Internet was suckled by the military. Black-hat and white-hat security conferences and practices have been an active part of Internet security for over a decade.

Can you explain what seems to be the US Military arriving at the game in the third inning?

Having had TSEC and observed security processes and procedures, such as tempest precautions some time ago, I'm having trouble understanding why the 'cyber defenses' of the US Military only now seem to be actually realized.

Is the delay due to funding? Priorities? or simply to underestimation of what the rest of the world was up to all this time?

Please be as specific as you are able to be.

Thank you.

Re:Timing and relevancy

[jank1887]

The military's been in it all along. It's just that the word Cyber finally got cool. Soon they'll turn it into a verb: Private, cyber that paradigm shift NOW!!

Never forget that the government, and especially the military, is just a big, inefficient, management heavy 1970's style corporation.

Re:For us geeks who'd be sitting behind a computer

[Daniel Dvorkin]

You know, you can go through basic training (or some other physically demanding training course) and get in shape ... and still be a geek. Seriously. Build some muscles, lose some fat, and you'll still be just as smart as you were before. I've done it, and so have lots of other folks on /. We didn't magically forget all our geek skills, or undergo some drastic personality transplant.

Are you running botnets?

[advocate_one]

no text

Re:Are you running botnets?

[religious freak]

(Keeping with pithy questions)...
Have we ever used hacking techniques against another nation?

Slashdotter

[slotdawg]

Do you frequent slashdot often to read news and breakthroughs in IT? How does the government disseminate whether threats of attack are legitimate or just hoaxes?

Re:Slashdotter

[gardyloo]

How does the government disseminate whether threats of attack are legitimate or just hoaxes? I suspect that should be "determine", not "disseminate", but either is an interesting question.

Re:Slashdotter

[slotdawg]

Thanks gardyloo... my head is in the clouds today

Threat Assessment

[mykepredko]

As I understand it, every military in the world assess the threat its opponents pose by their capabilities rather than perceived intents.

How do you perform a threat assessment in the area of cyber-warfare where the physical weapons (as was pointed out in an earlier post) is the keyboard and mouse with much of technology being used as a threat being developed in the U.S?

Thanx,

myke

Re:Threat Assessment

[Stray7Xi]

The weapons aren't the keyboard. The weapons are the training and knowledge. Some countries don't have a civilian population that knows how to use computers, you're not going to find very many CCIE and CCNP working on their networks.

"Civilian contractors"

[faloi]

Do you foresee a high utilization of civilian contractors? Knowing that there are some restrictions on people that can be recruited into the Army for any number of reasons (asthma, medications, criminal records), do you see a need for either more lax recruiting guidelines for some of the "front line" troops in the cyber warfare field, or a higher use of civilian (or at least non-Army) personnels?

Re:"Civilian contractors"

[jbeez]

I would agree that to really tap into the potential of the resources that possibly couldn't enter the armed forces for one reason or another, or didn't want to, would be a very smart move. Nothing against the men and women of our services, but I know there is some unbelievable talent floating around out there that has nothing to do with the military but could really help our national network security.

Re:"Civilian contractors"

[fprintf]

http://interviews.slashdot.org/article.pl?sid=08/03/12/1427252

In an interview with Slashdot, Major General Lord of the US Airforce responded "Certain skill sets can also be brought on board as civilians or contractors, and in many cases we do offer compensation competitive with the commercial sector."

I suspect the answer would be similar from the Army. The first answer will be a recruiting answer, how they use the talents of significant number of young men and women, but ultimately they also need to rely upon contractors.

Re:For us geeks who'd be sitting behind a computer

[BadIdea]

Jooooiiiiiiin uuuuusss. It's bliissssss.......

Hurdles of Cyber Warfare

[Digital Ebola]

Greetings,

One issue to cyber warfare is linguistics. How does a military unit overcome this? Does the unit consist of people skilled at the various languages used in theater plus the technical concepts required to execute, or are you forced to cooperate with any other agency?

Also, agency cooperation: are there good relationships between the cyberwarfare units and the intelligence community, and can you say whether or not there are SOPs in place that would utilize cyberwarfare units in conjunction with a physical offensive, i.e. disable Three Gorges Dam right before an op.

Thanks for the time!

Peace is a valid concept

[circletimessquare]

however, due to human nature, peace is achieved only with a balance of force, not with an absence of force. In other words, to maintain peace, there will always be a need for armed forces in this world.

If you think it is possible to have a world where there are no armed forces, you are not adovcating for a peaceful world when you say that. You are in fact unknowingly advocating for a more brutal, injust and violent world. This is so simply because you have not yet made yourself acquainted with, or made peace with (no irony intended), certain ugly but unremovable aspects of fundamental human nature.

Or, you could try to remove those aspects of human nature in the name of peace. This sets you down the road to autocracy, and makes you an enemy of free will and free expression. If you wish to continue to respect the notion of free will and free expression, you must understand why a force of arms is always necessary to be at the ready, in the name of peace.

Re:Peace is a valid concept

[harry666t]

> however, due to human nature

s/nature/ego/

here, fixed for you.

Very young children do not have ego. But parents are polluting their minds with a vision of a hostile, violent world. Kids often become exact mental copies of their parents. When you're born, you're a blank sheet of paper.

Animals do not have ego. They never hunt more than they could eat. Period.

When you're truly happy, you also don't have ego. You just keep laughing or smiling or whatever, you dance and sing, or you just sit or walk or run, swim, hack, climb, make love, sail, play guitar, or you do anything else, but you don't care what someone else thinks about what you're doing because you're just... happy.

Think about what stops people from being happy, and you'll have an answer to what /really/ stops us from worldwide peace. And if your answer is: other people, then ask what is making these other people unhappy. This is my POV.

Oh, and btw. I don't really care what anyone thinks about it. If you like war and stuff, fine, go murder some people. It is each one's own business what do they think about peace, happiness, the army, hippies, war, ego, love, USA or raising children. But I'd really love to see more people discussing peace rather than war.

Re:Peace is a valid concept

[maxume]

You aren't born a blank sheet of paper. Not by any means.

Computer Literacy

[AioKits]

What level of computer literacy do you feel the Commander-In-Chief and those reporting to them should have in order to comfortably and accurately convey the importance of a given situation/threat the USACEWP encounters?

Re:Why does the Army have a love affair with Windo

[gardyloo]

Interesting, because at the DoE- (mainly) and DoD- (partly) funded lab at which I work, Linux and Unix (and things like OSX) users are given much *less* scrutiny than those using Windows.

Daemon?

[Viking Coder]

Have you read the book "Daemon" by Leinad Zeraus? Or how about "The Footprints of God" by Greg Iles?
Do you think The Singularity is approaching, and if so, do you think you're prepared for it?

Materiel isn't a typo in the summary

[Starlet Monroe]

There's a "material" tag on the story pointing out an apparent typo. I can't ever seem to get tags to behave for me, so I'll post a reply instead. In military talk, "materiel" is a specific term to refer to the stuff we need to fight a battle. It has specific and distinct connotations in supply management, and it used correctly in this article's summary.

Like on Star Trek

[Intron]

What do you do about the problem where a computer is informed that it has made a logic error and it starts spewing smoke and then explodes violently?

Are We At War?

[Doc Ruby]

What is the "cyber command" doing to protect the US from current serious attacks on major Federal government sites, including the attacks on sensitive Congressional sites reported this week?

Is there any traditional military precedent for tolerating these attacks to the extent we do? Is that hesitancy making us weaker, so our eventual delayed military (or "cyber-military") response will be compromised from winning the conflict to our satisfaction?

At what point do these attacks constitute acts of war, does that need to be declared by Congress, and how does the "cyber command" change its response at that point?

Re:Are We At War?

[Keebler71]

nice post.

Re:Are We At War?

[Doc Ruby]

Thank you :).

What value does doign it in the Army add?

[scorp1us]

We already know that the USAF has a cyber-warfare division. Given that all network attacks are fundamentally based in IP Packets, it stands to reason that the Army and USAF would be duplicating work, while creating an opportunity for lack of communication.

Would you agree that a special, single cyber-defense branch should be created to assist all branches of the military as well as non-military?

Generally the armed forces are never known for technical prowess. (They are more consumers than creators) The role of creation comes from contractors. Why shouldn't we rely on contractors to perform these functions when contractors already obtain top-secret clearances? Contractors compete for projects which ensures a level of cost limitation (lets face it, Cost+ rips off the tax payer), continual advancement (beyond what the enemy throws at us).

Why should the armed forces be doing this in-house?

Re:What value does doign it in the Army add?

[scorp1us]

Clarifications: Cost+ was only possible by the large scale of operations. Any network based attack would not require the same scale of operations, meaning a small private team could provide significant value. Small private teams are plentiful, meaning an award of a Cost+ contract is unlikely.

On 2nd thought, I retract my challenging questions because I don't want to be labeled an enemy combatant, stripped of my Habeus Corpus rights and thrown in GitMo for questioning the wisdom of the military and by construct, the presidency.

Re:What value does doign it in the Army add?

[TakeyMcTaker]

Mod parent up. A new "cyber-defense branch" is a valid answer to this new type of warfare. The NSA can't fill this role -- it is too strictly defined by secrecy. Part of warfare is calling the attackers out to the international public -- there's no other way to get international support for counter-attacks. The NSA is just too hidden for that. Obviously, the CIA can't fill the role for the same reasons. None of the existing military branches really fit the job.

Traditionally, the armed forces are separated by attack mediums or "turfs". Air force is obviously in the air, Navy is in the water, Army takes the land. The Marines seemed to bridge the water-land gap early on, though now they seem like some weird hybrid that is most defined by their crazy proud human-shield machismo. They all have devolved into overlapping hybrids by now, to varying degrees, but they are still defined by their central turf.

It makes sense that a new turf requires a new branch -- for now let's call them Infosec (I know, it's taken, but cyber-blah just makes me think of a bunch of half-skinned Arnie Terminators wandering around using IE). It makes sense to overlap efforts a bit (beneficial competition), but Infosec should definitely be the first stop at the Pentagon for any big network hacking jobs.

Reminds me of Barack Obama's proposition for a Federal CTO. I wonder if he's thinking of adding a similar position to the Pentagon as well?

Re:What value does doign it in the Army add?

[finity]

I like your first question, and I think it's right on. About the second though, uniformed Military personnel should be fighting battles, whether in cyberspace or on a field. Contractors should compete to provide tools to allow the Military to fight those battles. One of the reasons it's bad to contract out the actual fight is that we open a whole nasty can of worms when a country isn't held directly responsible for the actions committed during war.

I would like to see the Col's reaction, though.

Re:What value does doign it in the Army add?

[DetpackJump]

Generally the armed forces are never known for technical prowess. (They are more consumers than creators) The role of creation comes from contractors. Why shouldn't we rely on contractors to perform these functions when contractors already obtain top-secret clearances? Contractors compete for projects which ensures a level of cost limitation (lets face it, Cost+ rips off the tax payer), continual advancement (beyond what the enemy throws at us). Why should the armed forces be doing this in-house? They are using contractors. Most of these groups are a combination of active duty and contractors. In fact, contractors are usually needed to provide long term stability since the active duty personnel will constantly be cycling out.

Re:What value does doign it in the Army add?

[scorp1us]

Oh, you mean like Black Water?

Look at all the cowardly trolls

[DaveV1.0]

When did /. turn into coward troll central? Is it spill over from Digg or something?

A military brat asks:

[UncleTogie]

In your work as Director of IO for Combined Joint Task Force -76, what were your greatest challenges in Afghanistan? What technology threats other than IEDs were your greatest concern?

Re:A military brat asks:

[UncleTogie]

Hey, maybe you civvies don't realize it, but his answer to my questions will tell you more about how he does business than you think it might...

Re:I would like to finally see people talking...

[qbzzt]

How about Pax Romana?

Damn!

[Colin Smith]

And I wanted to know the fastest way to level up.

Re:Damn!

[KGIII]

Duh?!? After you eat the giant mushroom that makes you larger and then smash your head on a brick you're able to eat the flower and spit fire.

Sheesh, kids these days.

Re:For us geeks who'd be sitting behind a computer

[SpacePirate20X6]

Just because I'm in shape and a geek doesn't mean I've stopped eating Mountain Dew and Oreos.

Making defenses availible to the tax payers

[scorp1us]

Would you support the release of information and software (Like Security-Enhanced Linux from the NSA) regarding successful defensive configurations and strategies to the general public so that the tax payer can derive additional benefits from your work? Surely the private industries in this country are valuable and may be attacked in order to cause economic harm.

What limitations or rules would you use for release of such information?

Re:Why does the Army have a love affair with Windo

[0p7imu5_P2im3]

Yeah, I've always found it hilarious that the IA (Information Assurance) guys tout the glorious impenetrable securities of Windows, even though nothing missions critical runs on Windows.

Ironically, the reason they are pushing Windows is not the security. It's the control. With windows you can remotely disable pretty much anything within a Domain. A person could have administrative access on their Domain attached work station and still not be able to do anything beyond what the Domain administrator allows.

If you have root access on a Linux machine, they can't do anything short of removing your physical workstation to keep you from installing, or even compiling, your own software. And with Linux, you can manipulate network communication that, while possible, is extremely difficult in Windows.

Most importantly though, with regard to control, is that the DoD knows most of the backdoors in Windows. Linux is watched over by millions of people. Chances are, the DoD doesn't know any more backdoors in Linux than you or I.

Re:For us geeks who'd be sitting behind a computer

[Anonymous Coward]

to fight. Will we have to go to basic training?

If so, would basic training be to train us to stay up all night, living on pizza, soda, Skittles, and porn?

If so, where do I sign up?!?

Although the parent posted humorously it does lead into an interesting chain of thought:

Where can one look to educate "him/her"self on information warfare. When recruiting; do you look for a specific mindset, skillset or qualities in candidates for this line of work?

Are there sources of internet where one can start to learn about the subject?

Witty and the US Military...

[nweaver]

The Witty worm was specifically targeting a US Military instiution's intrusion detection systems. Do you have any comments on this incident?

Re:what is your mandate?

[jstoner]

aack-forgot I wasn't logged in... this was me

Defensive or offensive?

[qbzzt]

What part of your job is to defend US systems, and what to prepare to attack against systems used by opposing forces?

Also, do you see the existence of your department as a possible deterrent for hostile organizations to use IT effectively?

Is it...

[Nathrael]

Is it possible to work for the USACEWP as a civilian, like it is possible to work as an civilian engineer at research institutions like Picatinny? Would someone who wants to work at the USAVEWP do background checks to obtain proper clearance?

As a side question...

[Foerstner]

...does the military realize that the only popular use of the prefix "cyber-" to mean "internet-related" is "cybersex?"

Is this really the association they're going for?

Doctrine and predictions

[andrewbwn]

It says that you are responsible for developing doctrine, what are the main points of the doctrine that you enforce? Also, what are your predictions on cyber warfare, how do you see it evolving over the next 5 years? What about the next 50 years?

Joint exercises with China?

[NuclearBovineBoy]

Despite all the fearmongering ("zomg chinese hackers!!!1!!one!"), legitimate or otherwise, about China as a source of threats, the U.S. and China have a lot of cybersecurity concerns in common. They both worry about cyberterrorism (from a common subset of sources), and increasingly rely on electronic infrastructure in their government operations. The U.S. has a direct interest in helping China's military secure their systems, so as to avoid rogue crackers making off with nukes or other dangerous equipment, and also to avoid confusing a rogue botnet attack with a government-sanctioned attack. Furthermore, especially in mid-level and local operations, the Chinese tend to use less secure operating systems (such as unpatched old versions of Windows), which puts them at a greater risk of compromise. Does the U.S. military have an interest in joint training or other kinds of joint operations with the Chinese military? What are ways in which the two countries' armed forces can cooperate in the cyber arena, without either side giving up its treasured secrets?

Criteria?

[AmonEzhno]

What kind of criteria is used to determine targets? As far as I have been reading many of the potential "Cyber Warfare" targets are infrastructural and there is a significant overlap between civilian and military/economic targets?

I can answer this.

[Anonymous Coward]

I used to work for a big name defense contractor and I can easily answer this question (and you can probably guess the answer). The classified networks that contain these sensitive systems usually also contain the workstations of people writing up contract bids and the like. These workstations might contain blueprints or other design specs for classified systems, as well as proprietary budget info, and the contract bids themselves.

Eventually, the bids have to go out to the government in an unclassified area, and occasionally businesses have to collaborate with each other through unclassified channels.

While it would be possible to keep ALL classified stuff and ALL unclassified stuff on totally separate networks, some business people work in both areas enough that this becomes inconvenient. So they put them together out of pure laziness. Time is money, after all.

Now, if a classified system that is purely for a functional use (i.e. weapons systems, intelligence gathering, satellite guidance, etc.) ended up on the open internet, that would be retarded.

What do you do?

[Eponymous Bastard]

People seem to be assuming you're some sort of internet vigilante or something. It occurs to me the such a unit has many options at its disposal, so, What is the task of your group?

- Support operations for army units overseas (peacetime/wartime)
- Independent internet warfare during war time (Say WW3)
- Independent internet defense during peacetime
- Independent Offense/intelligence gathering during peacetime
- Consulting for companies/agencies hardening their networks
- Finding backdoors in preparation for an engagement
- Helping companies close backdoors in their product
- etc.

Also, is you unit mostly internet-oriented or do you handle other electronic warfare styles? (DoS/hacking by manipulating power lines, RF interference, etc)?

Re:For us geeks who'd be sitting behind a computer

[redxxx]

to fight. Will we have to go to basic training?

If so, would basic training be to train us to stay up all night, living on pizza, soda, Skittles, and porn?

If so, where do I sign up?!?

I'm pretty sure you need a 4 year degree to go to Officer Candidate School, so start with that.

Don't Ask the Colonel

[aquatone282]

Ask his Smart Guy.

Every time we had to talk to the Army in regards to a technical issue, we were always referred to the "Smart Guy", usually a contractor.

I bet if you look in the Army's Table of Allowances you'll find Smart Guys right next to the beans and bullets.

West Point

[Anonymous Coward]

I'm a future Army officer candidate (I leave for Basic/OCS in Sept.).

I'm ok with doing something related to combat arms, but I'd be really interested doing something related to IW or Signals. Is there anything that I could do during MOS selection to increase my chances of getting one of these MOS's? And what can I expect as an IW officer--will I be sitting in Kansas or deployed abroad? Lastly, what role does the Army play in IW that differs from what the Navy or Air Force are doing?

your model of human nature is invalid

[circletimessquare]

the ego develops on its own, it is a fundamental facet of our biology. selfishness is very much a component of natural behavior in the animal world

without understanding this simple concept, your opinions, that you hold in great regard, are simply dysfunctional, and yet you cling to them anyway

how very egotistical of you ;-)

Is the Chinese government telling the truth?

[KC7GR]

The "hacking" of several Congressmens' computers, notably those that contained data on human rights and political dissidents, was in the news recently. The Chinese government has categorically denied any involvement despite the fact that the intrusions originated from Chinese IP address ranges.

Do you believe they're telling the truth? More specifically, do you believe they are as "unskilled" as they claim to be along these lines?

Do Army and Air Force Branches ever do blue on red

[going_the_2Rpi_way]

Just wondering if the USACEWP (the Bircher Group) and the AFCC (Lord's group) have ever gamed off against one another, or do so routinely?

If not, why the heck not?

If so, who wins most?

Crime and skills maintainance in peacetime

[BigJim.fr]

Maintaining an edge in computer security is a never ending race between finding new vulnerabilities and patching them. Constantly finding new vulnerabilities just in case war breaks out tomorrow is an expensive endeavor - just like any other arms race but iterating much faster. Only two sort of people are motivated enough to invest enough in it to maintain a lead : intelligence agencies (which probably won't tell anyone about what they find) and organized criminals who are often the origin of the knowledge that percolates through layers of lesser skilled intruders until a defense is set up. China has reputedly set up a mutually beneficial cooperation between the army and the criminals - it makes a lot of sense : the criminals are the peacetime maintainers of skills that the army can mobilize at will in exchange for turning a blind eye to their other activities. The ethics of a western democracy are incompatible with that sort of arrangement. I guess that you will not tell us the budget involved, but could you please paint us a picture of the process of keeping the digital powder dry and the digital knives sharp while remaining within the frame of our ethics ?

Re:For us geeks who'd be sitting behind a computer

[Bloodoflethe]

I like my Mountain Dew chewy too! On a more serious note, exercise will actually make us geeks think better - increased blood flow to the brain and all that. Proper nutrition doesn't hurt, the goodies are just a nice thing to add on top!

simple question...

[DragonTHC]

What does Lt. Col. John Bircher know about cyber warfare concepts?

we know that he knows how to "point and click".

Egads! Where to start?

[rts008]

"Animals do not have ego. They never hunt more than they could eat. Period." Citations? Or is this just one of your fantasies made up to support your nonsense?
Ever watch a mountain lion kill a deer, eat it's fill, then wander off to let the bulk of the deer rot? I have. How about dogs that are not fenced in killing cats for fun, or wildlife? Yep, seen that too...many times. How about the cats killing stuff and bringing it home as a trophy? Yep, all the time again.
You have no clue here on this subject.

"Oh, and btw. I don't really care what anyone thinks about it." and (in the same paragraph) "But I'd really love to see more people discussing peace rather than war."
So, you don't care what anyone else thinks about it, just what you think is important. Right.

The rest of your clueless diatribe is not even worth discussing, so crawl back into your mom's basement and use some of that internet time to get at least a LITTLE education instead of trolling forums, you will benefit from it tremendously.

Re:Egads! Where to start?

[harry666t]

I've said that it's just my POV, you have right to disagree with it as much as I have right to be wrong. What's so bad about being wrong, misinformed, delusional, having a twisted view of reality, or an unpopular opinion? From someone else's POV, we *both* might be wrong.

I'm just unhappy with people constantly discussing war, never actually discussing peace. I want finally someone not to say "you want peace? prepare for war", but "you want peace? prepare for peace".

You know, if I would have to consider someone my ENEMY just because from my point of view they're (stupid|wrong|clueless|trolls)... ...Well, I'm speechless.

Oh, and btw. Even if I live in a world made up of illusions, I think that my illusions are beautiful. I love living with them. After all, everything we ever had are only illusions, because there's no way to tell whether something is a perfect illusion or the reality.

Re:Egads! Where to start?

[danielobvt]

wow, I want whatever drugs you are taking.

Re:Egads! Where to start?

[rahvin112]

"Animals do not have ego. They never hunt more than they could eat. Period." Citations? Or is this just one of your fantasies made up to support your nonsense? Ever watch a mountain lion kill a deer, eat it's fill, then wander off to let the bulk of the deer rot? I have. How about dogs that are not fenced in killing cats for fun, or wildlife? Yep, seen that too...many times. How about the cats killing stuff and bringing it home as a trophy? Yep, all the time again. You have no clue here on this subject.

To add to what you posted, It's common knowledge among sheep farmers that predatory canines if allowed into a group of sheep will get blood lust and kill every sheep they can grab (sheep are incredibly stupid and will stand around while members of the herd are killed right in front of them) and only eat the tastiest of bits from each sheep till they are full then leave the rest to rot.

Re:Egads! Where to start?

[harry666t]

I'm afraid that it's my own body that is producing them.

Re:Egads! Where to start?

[rts008]

I was going to include dogs and livestock in my post, but I got sidetracked at the stupidity of the idiot posting.

You are truly correct, and the similarity between the sheep herd and modern most Americans is disturbingly spot on.

Re:Why does the Army have a love affair with Windo

[MasterOfMagic]

If you have root access on a Linux machine, they can't do anything short of removing your physical workstation to keep you from installing, or even compiling, your own software. I think the NSA would disagree with you...

+5?

[u8i9o0]

Conventional military is bound by the Geneva convention. To date, there is no international law governing military info-war. Are you therefore no longer bound not to attack civilian targets? Is scrambling hospital records to create civilian deaths by mistreatment considered a valid attack?

What a horribly worded question - it immediately invalidates itself. How did this get to +5 Interesting?

The question starts with "Conventional military is bound by the Geneva convention."
The interviewee is known to be a uniformed member of a conventional military.
The question ends with "Are you therefore no longer bound not to attack civilian targets? Is scrambling hospital records to create civilian deaths by mistreatment considered a valid attack?"

Here's an easy way to understand the Geneva Conventions: any technique that is intended "to create civilian deaths" will NEVER EVER be allowed by Geneva Conventions. The Geneva Conventions were devised with the SOLE purpose of protecting both captured soldiers and regular civilians - that's all that it covers. If you want to discuss war conventions, then look elsewhere (like the Hague Conventions of 1899 & 1907 or the Geneva Protocol).

I'll offer to rephrase the question. If someone can do better, then by all means...

Question: the conduct of warfare by the military is bound to international conventions (such as the Geneva and Hague conventions). Given the relatively new theater of "Cyber Warfare", specific conduct has not been codified in depth. What types of limitations/restrictions do you observe in this area?

The real #5

[Joe The Dragon]

after basic training get sent to infantry school then off to the front lines.

or #7 Get moved off your assignment and send to the front lines. As some who got hurt there is taking your assignment.

Shall we play a game?

[imadoofus]

Wouldn't you prefer a nice game of chess?

The Incentive Question

[Burn_This_City]

How does the Army plan to recruit the best of our nations underground that would no doubt be required to wage such cyber battles? It has already been stated, and is well known, that even the non-stereotypes of the hacker culture will not be quick to take huge pay cuts or trade a full head of hair for a crew cut, if they were even able to pass military PRT requirements. The Air Force answered this question with the assumption that our nations great hackers are so patriotic that they would be more than willing accept such drawbacks, but reality is the majority of us are not patriotic sheep and we do not work for peanuts.

Joint Operations

[finity]

The field of cyber-operations is an excellent opportunity for our fighting services to start working together more. Here's a field where many people from all of the services have excellent skills that we can put to work. Furthermore, based on the way we work in the field, our networks are frequently co-dependent. When will we see the political power-struggle common at the "strategic" level of the US Military dropped, in favor of a _truly_ joint cyber-operations group?

Seeing as this is the beginning of a completely new field for Military engagement, this seems like the perfect time to drop as much of the ridiculous, time/money wasting, soldier endangering, political wrangling as possible. A modern generation of military hackers have the motivation to, and are the type that can cut through this BS.

Army Network Security is a Joke

[fluffy99]

1. According to the Joint Task Force for Global Network Operations (JTF-GNO) assesments, the Army networks are the most hacked and least secure of all the military branches. Why is the Army pitching itself as experts in an area that they are obviously having problems with? Would you go to an obese dietician for advice on loosing weight?

2. Is your groups focus on actively attacking and penetrating enemy networks, or the defense of our own? The enormous financial and tactical loses associated with the ongoing penetrations of our networks is likely more important than being able to penetrate into the enemies network.

3. Most of the network security expertise in the Army is contracted out. Is the Army doing anything to bring expertise in-house?

Re:Army Network Security is a Joke

[geekoid]

"Would you go to an obese dietician for advice on loosing weight?"

why not? do you think fat people are stupid for some reason? Maybe he doesn't mind being heavy?

Hell, it would probably be better because he might understand the problems with dies change.

The worst person to see is someone who has been thin all there live becasue undoubtedly they will use themselves as data when they are only an anecdote.

The Army does have experts in this field, Army work is contracted out more due to political pressure, then skills.

Re:Army Network Security is a Joke

[fluffy99]

Okay, maybe a bad example on the obese dietician. How about getting a fashion advisor who can't seem to dress themselves very well? I call BS on politics being a reason why the Army doesn't have that many experts. The Army generally does not many network security experts, simply because military service isn't all that attractive to those who would specialize it that area. There are some DOD civilians with a fair amount of expertise, and the rest seem to be contractors. The military guys are all management types dealing with the policy enforcement and paperwork aspects. At least thats my experience dealing network security within DOD.

Re:Why does the Army have a love affair with Windo

[0p7imu5_P2im3]

Point taken; I stand corrected.

Let me rephrase:
Until SELinux, if you had root access on a Linux machine, they couldn't... yadda, yadda, yadda...

I'd still argue that there is a general lack of knowledge in the DoD regarding SELinux since it has only recently been added to RHEL. And this further supports the misguided notion that Windows Domains offer more control because the network admins in the military consider them easier to configure due to that lack of knowledge.

Just to satisfy my curiosity (and show my lack of knowledge): is there a way to configure SELinux remotely in real time? For instance, say I found out about a major vulnerability in Adobe Reader version blah.blah.blah. Could I disable versions equal to that and lower remotely the moment I found out, or would it not take effect until some amount of time until the next SELinux policy update (like a restart)?

Or

[geekoid]

Work for a contractor the military uses and take the civilian route. Better pay, better work.

If you go military, get your assignment on paper. If you don't get what the paper says, that's grounds to be released.

Re:Why does the Army have a love affair with Windo

[Stray7Xi]

The Army uses windows for most administrative tasks because they don't want to train every soldier on linux. There's no reason to train an infantry private linux when they'll mainly be using a computer to fill out leave forms (yes I'm exaggerating).

As soon as you get to job specialties that require a computer as part of conducting their mission, you'll find windows gets a lot less common. No it's not being replaced solely by linux. Heck you may even run into custom OSes (why have a general purpose OS when this computer will be only running this small set of applications). Don't expect to see Linux 2.6 though, it's just to plain new for military testing and bureaucracy.

Recruitment Methods?

[jaguth]

How does the military determine who to recruit for electronic warfare? Do they follow the traditional methods such as advertising in at local high schools, walk-ins at recruitment offices, ect.?

And how do they know the recruit is a good candidate? I mean, theres a big difference between a user and a programmer. I've met a fair number of people who, in my opinion, are borderline tech-illiterate, and yet the military recruiters found them to be good candidates and hired them.

Last but no least, how many geniuses that haven't smoked pot more then just a couple times have been accepted? Come on, its ridiculous to have a policy that says one is not eligible if they smoked pot more then 3 times in there life. People, smart successful people, experiment, even for a short period in their early 20's.

I guess that also unleashes another horde of inequalities: what about the gays? Oh, i guess they aren't really people, so fuck-em, right?

How does someone

[geekoid]

who wouldn't fit into the military, but would love to work long hours helping to investigate foreign vulnerabilities be able to aid the military?

Using Microsoft

[LifesABeach]

Would banning certain aggressor countries the use of any of Microsoft Windows be construed as to be giving "aid and comfort?"

Re:I would like to finally see people talking...

[qbzzt]

Yes, I read the wiki reference. It was a somewhat subtle attempt as sarcasm - the only way to get even relative peace is for one power to conquer the world, as the Roman Empire did.

As you said, fighting is part of human nature.

Why so many cooks?

[PhxBlue]

Rather than have the Air Force, Army, FBI, NSA, and gods-know who else each approaching cyberwarfare, why does the federal government not designate a single agency that jointly manages cyberwarfare and cybersecurity?

Re:Why so many cooks?

[fluffy99]

The roles of network defense and network offense are somewhat separate, although they need the same vulnerability information. DISA is supposed to be the defense side of it, but you also have JTF-GNO as the joint force for the DOD branches. NSA has the expertise in the offensive side. As you pointed out though, there are still several agencies claiming to be the experts and vying for funding. Even worse, for the end user in the military all of these agencies have some authority and sometimes conflict in policies and requirements.

windows update

[Venture37]

What training have you received for dealing with patch tuesday??

Insurgency-Counterinsurgency

[Kwesadilo]

How do you envision cyber warfare being applied to conflicts that are primarily against groups of insurgents (Iraq for instance), as opposed to a war against another nation?

How will Net warfare change basic strategies?

[Kwesadilo]

I am not a military historian, but up until recently, it seems as though waging war against another entity primarily meant taking control of their physical territory on the ground and taking out important resources by bombing or some similar high-impact targeted strike. How will Internet warfare change the basic structure of a military campaign? What would a full-scale war incorporating cyber warfare look like?

Some more specific questions in this vein:

• If we were in a war with another country, would cyber warfare be overt or covert, i.e. would someone on NBC ever say, "Yesterday, the Army took out several important pieces of Internet infrastructure in Country X. Here to comment is General so-and-so."?
• Would an Internet-warfare "bombardment" (to prevent communication and cause confusion) precede a physical invasion, or would the invasion and Internet warfare commence simultaneously?
• Would you ever consider trying to get another entity to surrender simply by ripping apart their communication networks spectacularly without even physically attacking them?

Nice shoutout for Fort Leavenworth

[volcanopele]

Hey, it isn't every day (or year) that the place where I was born gets mentioned on Slashdot. Sweet.

Do you have a central war computer?

[CCFreak2K]

And is it called WOPR?

Putin, Giant Robots and Cthulhu

[S3D]

2006 interview with Putin revealed that Gian War Robots is one of the most pressing issues of Russian internal policy. What is USACEWP response to Giant Russian Robots ? Could be that US heading to the new Sputnik debacle ? Ah, and can you confirm or deny that USACEWP is staffed by Cthulhu cultists ?

Re:Why does the Army have a love affair with Windo

[cjsnell]

You may not know this but I've heard that the US Army has more RHCE's than any other organization on Earth, RedHat included.

Offense and Defense

[martyb]

Balancing offense with defense. Though I understand the need to be able to respond to a cyber-threat, I am interested in your plans to improve the existing military, commercial, and civilian infrastructure to prevent and/or lessen the damage that could be caused by cyberwarfare. (eg SELinux.)

What do you see as your role in continuing and supporting the development of such technology to protect all of us from cyber threats?

Technology vs people. And a follow-on: technological solutions, however well-developed or implemented, are not sufficient protection. The best lock in the world is little protection against those who make and distribute duplicate keys to that lock. E.g., those people who paste a sticky note to their monitor which has a list of IDs and passwords.

What are your thoughts and plans to address the human element in these developments?

Cyberwarfare

[Rule303]

It is a given that wars are won and lost by hitting an enemies logistical supply chains and disrupting their economic infrastructure to produce goods and services for both units in the field as well as support units. It is also a given that battles are won and lost due to breaking an enemie's codes and reading their operational transmissions (for example: Ultra and Magic), or by inserting false information into their operational networks, and perhaps analyzing signals traffic. (e.g. Battle of Midway, Battle of the Atlantic, etc) I would like to know, what the Army is doing to secure our IT systems and networks which deal with Supply Chain Management for our Forces as well as securing our critical IT infrastructures (Power Grids, Financial Markets, Medical Databases, Petroleum Industries, Shipping Company Networks, etc) necessary to keep our Industrial Complex running in order to support our troops. Perhaps the simplest solution is simply to "pull the plug" and take the US or other countries Offline by hitting their undersea cables for communicating with other nations. Or perhaps going on the offensive and hitting their systems and thus disrupting their IT infrastructure. Comments?

Re:For us geeks who'd be sitting behind a computer

[TheQuantumShift]

Not being out of breath just taking the stairs back to my office on the third floor? Yes, yes that would be bliss.

Logistics

[dsmall]

        Where to learn about info warfare? While a fair degree of computer science skills is always good, you can start picking those up with an old PC, a Linux distro, and concentrated reading. If you want to be attacked, put your machine on the Internet.

        I'm not nearly as concerned about attackers hitting civilian targets as them hitting effective military targets.

        Example: "The Army Moves On Its Stomach" is a very old saying, but still true. Logistics is really important and the area probably the most computerized. I think an attacker would strike there first because of the damage it would do. If the troops can't get fed, there are no water trucks, can't get rounds, can't get artillery, no spare parts for tanks, planes, because the ordering systems are damaged, then the force comes off its wheels very quickly.

        I think raising awareness throughout the logistics chain that these systems could be attacked, and have a method of reporting something suspicious, might be a very good idea. People who have been sending MRI's and sabot rounds to forward locations have a pretty good feel for when a new order should be due. If an order for "0" or "1023" comes in, and it's just wildly different, they should be encouraged to report it and check it. If no order comes in, report it and check it. There should never be a penalty for picking up a phone and reporting a suspicion.

One way to overcome a large number of attackers is simply to use a large number of people, doing their normal job, but checking up on things. People are smart about their jobs given a chance. The most frustration I see is people not being allowed to be smart because of their managers.

It seems to me that the military is going to need security in its logistical lines going all the way back to its suppliers to fight any extended war. A World-War-II effort with cyber warfare would be a different thing these days.

My question is simply: Are you going to have a "Who ya gonna call?" phone line to report suspected attacks immediately?

Thanks,
    David Small

Re:For us geeks who'd be sitting behind a computer

[Lodragandraoidh]

Speak for yourself.

I was a geek before I joined the Army. I didn't have much time to program, and my skills did get rusty. But I was certainly in good shape.

On the other hand I did learn valuable skills that are applicable in my job today in the civilian sector, like 'call for fire', 'building clearing techniques', 'how to set up an L-shaped ambush', 'land navigation' (critical when trying to find the bus-stop), 'TOW Antitank Weapon System' and many more.

And I was an NCO when I got out, so I definitely had a personality transplant. :P

Various questions

[ex0duz]

What is the most interesting cyber warfare concept that you can talk about that would make us /.'ers excited? Please elaborate as much as possible. Thank you.

Is getting telco immunity another part of your cyber warfare strategy? How does one apply traditional wartime concepts like propaganda in cyberspace, where it is said that information wants to be free?

How does China's great firewall impact on the potential for a cyber war between China and the U.S? Does it give them an unfair advantage in regards to propaganda and censorship of information/intelligence? How would you fight against such a disadvantage?