Slashdot Mirror
Lt. Col. John Bircher Answers Your Questions
I'd like to preface my responses to your questions by first remarking on the quality and intensity of the input. I was quite literally blown away by the questions you asked, and humbled. Quite candidly, I had some difficulty answering them all. Part of my responsibility in participating in this forum is sticking to "my lane," which means not speaking about things I don't know anything about and not speculating beyond my level of experience and expertise. In those cases where I either didn't know or couldn't answer the question specifically, I inform you of this fact. Still, you will note that every question has an answer because I use every opportunity to share some aspect of the Army's story. Thank you for this rare chance to engage great minds in an important discussion.
1) "What is that?"
by khasim
What, specifically, would be a "cyber-electronic engagement".
Include examples.
Compare/contrast with traditional forms of intelligence gathering (wiretaps, listening devices, etc) and their counter-measures.
As I mentioned in my preface, I'll try to stick to my lane. I have been given the challenge of helping the Army map out the concepts for how we will operate in and through cyberspace in the future: specifically, 2015 and beyond. Sometimes I feel like I'm part science fiction writer, part futurist, part planner. Other times I feel as though I'm leaning into the proverbial windmill. All that said, it's an exciting time to be associated with the Army. One of the concepts we're working on is the thought that you can create effects both in cyberspace and through cyberspace. There are a myriad of tasks, actions, and activities that you can do in order to achieve effects in and through cyberspace - we're grouping these "things" under the banner Cyber-Electronics as a place holder for now. For example, you and I are engaged in a cyber-electronic engagement right now: I'm answering you through cyberspace, as opposed to in person, in order to achieve the effect of informing you.
At its foundation, this is what military operations are about: effects generation and management. Traditionally, we tend to think about effects having impact in the physical domain only, but military operations have always been about cognitive effects, too. In cyberspace, most effects are cognitive: they inform, affect and influence our beliefs, values, dogmas and, ultimately, decisions. One of the best aspects of my current job is that I am afforded the luxury of "engaging" (there's that word again) in discussions, debates, and decision processes that actually cause me to think beyond traditional military functions, and I get to "engage" in these forums with some pretty smart, outside-of-the-box thinkers who are not in uniform (and some who are!).
There has long been a debate about the appropriateness of the military participating in influence operations but if we think about it, influence operations are fundamental to everything we as a society do. Rather than shy away from the debate, we are actively embracing it as we strive to articulate an appropriate role for the Army in cyberspace. The American Public, too, has its role - that of defining the checks and balances that proscribe the acceptable limits of these operations.
2) "Threat Assessment"
by mykepredko
As I understand it, every military in the world assess the threat its opponents pose by their capabilities rather than perceived intents.
How do you perform a threat assessment in the area of cyber-warfare where the physical weapons (as was pointed out in an earlier post) is the keyboard and mouse with much of technology being used as a threat being developed in the U.S?
New capabilities and technological breakthroughs always challenge the ability to assess the threat, but the fundamentals of threat assessment will not change. Today, we use terms such as kinetic and non-kinetic to describe military operations: kinetic meaning motion and physical impact; non-kinetic meaning non-physical impact, something akin to "winning hearts and minds." Cyberspace is an interesting amalgam of both. While largely non-kinetic, it can yet produce kinetic outcomes, especially when you think about not just creating effects in cyberspace but also when you consider creating effects through cyberspace. A virus can crash systems, rendering hardware useless. Malicious rumors on the Internet can result in someone taking their own or someone else's life.
There's a scene in the movie Patton, where Patton is watching a battle unfold on the North African desert against his arch adversary Erwin Rommel. Patton is winning and triumphantly explains why, "I read your book, you son of a b****." Part of threat assessment is not only tallying up an adversary's arsenal of weapons but also getting inside his head. Cyberspace is highly cerebral and highly diffused, where threats can come from any corner. This reality demands new assessment tools. It's all unfolding fast and furiously, and we're working hard to ensure we have the capabilities needed to assess and defeat these new threats effectively. The Army is not acting alone. We work very closely with the Department of Homeland Security, Department of Justice, FBI, and just about every other government organization that operates in cyberspace to make sure we don't overstep our bounds. The Army and all the Department of Defense organizations are very aware of our legal restrictions and requirements, and we go to great pains to make sure we do not cross over into another organization's area of responsibility concerning cyberspace.
3) "Technique?"
by Manip
Does the US Army take advantage of traditional misconfiguration and social engineering techniques in order to compromise a network or is the US government developing a home-grown list of exploits to gain access to foreign government systems?
First, it's important to clarify that as far as I'm aware, we're not in the business of compromising networks or gaining access to other governments' systems without just cause. When there is a clear threat to national security, we then employ legal and just means to deal with that threat. Also, I'm not able to discuss specific methods that the Army might or might not be employing but only speak in terms of concepts and capabilities that we should have in order to be successful conducting operations in cyberspace. If you have insights and skills that might broaden our capabilities in this arena, I encourage you to consider joining the emerging DoD cyber-workforce.
As members of the military, we are sworn to uphold the Constitution against all enemies foreign and domestic. The challenge in cyberspace is being able to discern with clarity one's enemy. Social engineering takes advantage of this anonymity. There are significant legal implications with which we are constantly checking. The rules of war have always been their own; yet we have always held American forces to a higher standard, and the same will hold true in cyberspace.
4) "Attacks"
by Notquitecajun
Without diving into details that compromise security, can you reveal anything about the types or quantities of attacks that the US military is able to fend off, and how often they are faced?
If the Air Force television commercial is accurate, the Pentagon alone is cyber-attacked at least three million times a day. So military-wide, the number of attacks is likely significant, but I would suspect relatively few of these attacks are pernicious enough to comprise a significant threat and fewer still are successful. Beyond this, I am not privy to details about the nature and magnitude of these attacks.
5) "China"
by je ne sais quoi
What is the U.S. Army doing to protect U.S. sensitive information from the frequent number of cyber-attacks originating from inside the People's Republic of China? Is it primarily defensive?
U.S. sensitive information requires safeguarding, no matter who may be probing or attacking our systems in order to gain access to this information. This fact demands that we undertake all protective measures possible ... and we are.
6) "Hacker war..."
by Notquitecajun
I doubt you could REALLY answer this, but Is the US military playing any sort of role in the semi-underground "hacker war" that appears to be going on between China and the US?
You're right NQC ... I really can't answer this. Beyond the sensitive nature of the subject, I simply don't know because it is well beyond my scope of responsibility. There's a laundry list of government organizations focusing on the threats to our nation and to our military TODAY. Remember - I'm focusing on how to operate in and through cyberspace in the future.
7) "And if and if ..."
by khasim
And if there actually is a "Hacker War" between us ... and if our military is currently playing a role in such ... are there any civilian applications that will be released to help defend our non-military assets (corporations, education, etc)?
Example: the NSA has worked on SELinux.
The Army, especially the Commanding General of the Combined Arms Center, Lt. Gen William B. Caldwell IV, firmly believes that the challenges we face today can only be addressed using a whole-of-government approach. We often use the acronym JIIM, which speaks even beyond our own government. It stands for Joint, Interagency, Inter-governmental and Multinational partnerships and collaborations to deal effectively with increasingly global problems. The defense of cyberspace is akin to the defense of our fledgling nation: it will require that everyone do his or her part. It behooves us all to work together to protect cyberspace, a frontier where a strong civil-military partnership is vital to success.
8) "Are We At War?"
by Doc Ruby
What is the "cyber command" doing to protect the US from current serious attacks on major Federal government sites, including the attacks on sensitive Congressional sites [slashdot.org] reported this week?
Is there any traditional military precedent for tolerating these attacks to the extent we do? Is that hesitancy making us weaker, so our eventual delayed military (or "cyber-military") response will be compromised from winning the conflict to our satisfaction?
At what point do these attacks constitute acts of war, does that need to be declared by Congress, and how does the "cyber command" change its response at that point?
In the last question, I spoke about the need for a whole-of-government approach to serious threats but we have a ways to go before we have the equivalent of a national "cyber command." We currently rely on each agency protecting its own assets and working in collaboration when there are overlaps. Without question, the overlaps are rapidly increasing. With this in mind, the Combined Arms Center recently hosted an interagency symposium to discuss ways to strengthen whole-of-government responses and capabilities.
Your second question is both tough and fundamental to the nature of a democracy. Our nation was founded in opposition to a strong standing army. Throughout our history, we have wrestled with the dichotomy of eschewing a strong military even as we recognized the need for one. You will find a compelling analysis of this dichotomy in T.R. Fehrenbach's classic study of the Korean conflict titled This Kind of War.
Recently, historians and pundits have noticed increasing tension within this dichotomy: a continued suspicion of a strong military by the American public coupled with an ever-growing dependence on that military to solve intractable problems. Robert D. Kaplan wrote in The Atlantic Monthly:
The acceleration of technology is driving a wedge between military and civilian societies and bringing about, for the first time, a professional-caste elite. Thus today's volunteer Army is different from all others in our history. Soldiers are becoming like doctors and lawyers -- another professional group we'd like to need less of but upon which we rely more. And just as health reform requires the consent of the medical community, because doctors own a complex body of knowledge, foreign policy will over the decades be increasingly influenced by the military, because war, peacekeeping, famine relief, and the like are becoming too complex for civilian managers.
Given this framework, words like "hesitancy" and "weakness" become problematic. How much do we want the military involved in cyber defense? Is a weaker military the price a democracy pays for being a democracy? Excellent questions and worthy of discussion. I encourage forums such as this one to continue the debate. Quite honestly, my hands are full enough trying to figure out what cyberspace will look like in seven years!
Because we are a democracy, your last question is best answered by our civilian leadership. Only the President can determine what constitutes an act of war.
9) "Recruitment"
by caljorden
Does the US Air Force, or any branch of the armed services, currently recruit for cyber-related positions directly? Or is it a requirement that all members come out of the standard armed services personnel? If there is currently no system for recruiting the best and brightest CS/IT/Security personnel from the civilian population, would that ever be considered?
I encourage you to contact Air Force Cyber Command folks to better understand how the Air Force is structuring its newest command.
In the Army, we do not yet have cyber soldiers. That is part of what my office is chartered to do: determine what skills sets are needed, what training is needed to produce these skills sets, what organizations these skills sets will be assigned to, and what doctrine they will employ. We currently have soldiers with related MOS or Additional Skill Identifiers (ASI). These include soldiers who are in intelligence, signal, fires and maneuver specialties, and ASIs such as Electronic Warfare and Information Operations. I do envision that cyber-electronics will evolve into its own specialty for which we will actively recruit both soldiers and civilians.
10) "Jurisdiction?"
by Caerdwyn
Given that the most likely targets for cyber warfare are civilian targets, and that the perpetrators will likely be either non-government organizations or non-military employees of foreign governments, how do you see the jurisdiction question playing out? In particular, at what point are there handoffs in investigation, arrest, and prosecution between the US military, the FBI, and local authorities of affected civilian targets?
Issues of legality and jurisdiction are outside my lane; however, there are plenty of lawyers around to tell me what can and cannot be done (usually the latter!). Unfortunately, in an increasingly inter-connected electronic world - a world inhabited by both flesh and blood actors, as well as their virtual avatars - the ability to discern "the enemy" with clarity is made incredibly complex. Again, only a whole-of-government approach will enable us to navigate these tricky issues successfully.
11) "Legal Ramifications"
by muellerr1
How does the military ensure that it is operating within the law regarding online military offensive activities? Are there any laws or oversight, as such? If so, how are those laws and/or oversight affected by a declaration of war?
Again, I can't speak to specifics, both because I don't know and because the legal issues involved in operations in cyberspace are just now being tackled in earnest. More broadly, the military has a very deliberate process for assuring it adheres to the law and is aggressive in its vigilance. But cyberspace is truly a "brave new world," and we will collectively have to wrestle with questions such as this one. Our ultimate oversight comes from you, the American Citizen...so you have an important role in this conversation.
12) "Making defenses available to the tax payers"
by scorp1us
Would you support the release of information and software (Like Security-Enhanced Linux from the NSA) regarding successful defensive configurations and strategies to the general public so that the tax payer can derive additional benefits from your work? Surely the private industries in this country are valuable and may be attacked in order to cause economic harm.
What limitations or rules would you use for release of such information?
Clearly I don't have the authority to make such a decision. Philosophically, however, I do feel that strong civil-military collaboration in cyberspace is and will be essential to our national security. How this will play out (the degree to which military applications will find their way into the civil and corporate sectors) remains to be seen. I can tell you that my organization is actively looking to partner with industry and academic institutions (and not just the Defense Industrial Complex) in this field to make sure that we not only generate a free-flow of information but also capture the ideas of the best and brightest minds available. It's no secret that industry is well into the notion of operating in and through cyberspace, and in many instances, has paved the way for the military to follow.
13) "Timing and relevancy"
by zappepcs
It's common knowledge that what we call the Internet was suckled by the military. Black-hat and white-hat security conferences and practices have been an active part of Internet security for over a decade.
Can you explain what seems to be the US Military arriving at the game in the third inning?
Having had TSEC and observed security processes and procedures, such as tempest precautions some time ago, I'm having trouble understanding why the 'cyber defenses' of the US Military only now seem to be actually realized.
Is the delay due to funding? Priorities? or simply to underestimation of what the rest of the world was up to all this time?
Please be as specific as you are able to be.
This question is an important one because it speaks to some of the themes that have echoed in earlier questions. Let me start by citing an observation about our current wars in Afghanistan and Iraq. Last year a reporter from a national magazine asked me what it would take for our nation to win the Global War on Terrorism. I offered the opinion that we're not a nation at war - we're a group of military folks, about 200,000 at a time, who are at war. The difference between the war today and World War II is that in 1941 our entire nation mobilized for war: Detroit began producing more tanks and less cars; when you went to the movies you saw Movietone newsreel releases instead of ads for popcorn and sodas; American citizens had victory gardens, fuel rationing, and metal collection drives. The war affected everyone in America. If you put this in perspective of a future war in cyberspace, I think the best question is what will be the nation's response to cyber war? Are cyber threats, cyber terrorism, cyber attacks, cyber war purely the province of the military or the entire nation? The ways in which we answer this question will determine our future priorities and funding.
Over the last seven years, we have been largely focused on the global war on terror and counter-insurgency operations, within which cyber operations and engagements have emerged as significant threats. If we are late to the game, it is attributable to a complex array of reasons, as it always is for a military within a democracy.
14) "Hurdles of Cyber Warfare"
by Digital Ebola
One issue to cyber warfare is linguistics. How does a military unit overcome this? Does the unit consist of people skilled at the various languages used in theater plus the technical concepts required to execute, or are you forced to cooperate with any other agency?
Also, agency cooperation: are there good relationships between the cyberwarfare units and the intelligence community, and can you say whether or not there are SOPs in place that would utilize cyberwarfare units in conjunction with a physical offensive, i.e. disable Three Gorges Dam right before an op?
Having enough trained linguists is challenge enough in "meatspace," so it will likely remain one in cyberspace. In essence, we're essentially asking for dual linguists...those who can speak Farsi, Chinese, Spanish or Urdu, as well as C++, Java, XML, Perl, etc. Sadly, there is a growing gap between the skills we need and the skills brought to us by graduates of our public education system. In many school districts that are struggling for funding, foreign language instruction is considered a luxury they can't afford to sustain. And we have yet to integrate computer science into our high school curriculum fully or effectively.
The military has a long tradition of recruiting, training and employing linguists in support of full spectrum operations. In fact, the Defense Language Institute is a subordinate command of my higher headquarters, the Combined Arms Center. Again, part of my task overseeing the Futures division of the U.S. Army Computer Network Operations-Electronic Warfare Proponent is helping to define the requisite force structure the Army will need to operate in cyberspace successfully. This effort will certainly include an analysis of language needs and capabilities. While we will always need humans involved in this process to deal with the fine nuances of language, cyberspace offers new possibilities (software applications, for example) that facilitate interpretation. Our developmental efforts will also include development of doctrine and capabilities that cross joint, interagency, inter-governmental and multinational boundaries.
15) "Relationship with the Air Force?"
by El Cubano
Since the Air Force is the U.S. military branch claiming dominance in "cyberspace" (along with air and space), how do you view the Army's relationship with the Air Force in "cyberspace"? Will the Army seek to take over all of the "cyberspace warfare", carve out its own niche in cyberspace, or peacefully coexist with the Air Force?
With respect to leadership in this area across the DoD, do you feel that the Air Force being denied the program executive role for all DoD UAV endeavors represents an opportunity for the Army increase its role with respect to UAVs (as many people see cyberspace and UAVs to be inextricably linked)?
16) "Avoiding Redundancy or is it Necessary?"
by introspekt.i
What steps is the Army taking to avoid overlap with the Air Force's "cyber warfare" program(s)? Is avoiding overlap considered necessary, or is redundancy considered a good thing? Are there plans to collaborate on large scale with the Air Force, or keep the programs isolated from one another?
Let me tackle these two questions together.
I applaud the Air Force's aggressiveness in tackling the challenges that confront us in cyberspace. To employ a naval maxim: when the tide comes in, all ships rise. The Air Force's focus and emphasis on cyberspace has helped ensure all of us are placing requisite attention to it. It's important to note that at its recent symposium in Massachusetts, the Air Force made very clear that it is focused squarely on developing Air Force-unique cyber requirements.
I would say that we are doing likewise: focusing on our service-unique requirements, even as we explore collaborative strategies. As a land component force that operates in and amongst populaces that are increasingly connected through cyberspace, the Army must focus on that portion of cyberspace that is virtually contiguous to the land on and in which we operate. Only when we know our own roles and requirements can we adequately integrate our efforts with the other services to support full-spectrum operations. And we have an existing structure in place with the Joint Staff to ensure that internecine turf battles are avoided.
17) "Civilian contractors"
by faloi
Do you foresee a high utilization of civilian contractors? Knowing that there are some restrictions on people that can be recruited into the Army for any number of reasons (asthma, medications, criminal records), do you see a need for either more lax recruiting guidelines for some of the "front line" troops in the cyber warfare field, or a higher use of civilian (or at least non-Army) personnel?
I definitely see that operations in cyberspace have the potential to alter the composition of our military, as well as broaden civil-military alliances. I mentioned earlier that cyberspace is highly cerebral. The key prerequisite becomes, therefore, "brain" rather than "brawn," and recruitment standards should probably be adjusted accordingly. Because cyberspace is also highly diffused, operating within it will demand wide participation and collaboration. Some observers have suggested the notion of creating a Cyber National Guard or Cyber Reserve, which merits consideration. How the mix of formal military, auxiliary forces, civilian allies and civilian contractors plays out will require further study, but you're right to suggest that it will need skill sets that currently exist mostly outside the military.
18) "What value does doing it in the Army add?"
by scorp1us
We already know that the USAF has a cyber-warfare division. Given that all network attacks are fundamentally based in IP Packets, it stands to reason that the Army and USAF would be duplicating work, while creating an opportunity for lack of communication.
Would you agree that a special, single cyber-defense branch should be created to assist all branches of the military as well as non-military?
Generally the armed forces are never known for technical prowess. (They are more consumers than creators) The role of creation comes from contractors. Why shouldn't we rely on contractors to perform these functions when contractors already obtain top-secret clearances? Contractors compete for projects which ensures a level of cost limitation (lets face it, Cost+ rips off the tax payer), continual advancement (beyond what the enemy throws at us).
Why should the armed forces be doing this in-house?
The notion of a single cyber-operational force merits strong consideration. Yet if we use our recent experience with the creation of the Department of Homeland Security as a benchmark, the consolidation of the cyber divisions of multiple agencies is likely to be difficult. Earlier, I spoke about the need for each service to focus on its service-unique requirements, even as we explore collaborative strategies. For now, I believe we must each master our corner of "the sandbox" completely. Over the past three decades, in particular, our emphasis on joint inter-operability has helped to ensure that we mitigate duplication of effort and collaborate wherever possible. For example, because the Marine Corps is also a land component force, the USACEWP is working with the Marine Corps Combat Developments Command to develop joint cyber-electronic concepts and capabilities.
To your observation about the role of contractors, they will play (and are playing already) an important role in the development of cyber-electronic concepts and capabilities. We clearly recognize that we can't go it alone. Beyond the use of contractors, we are leveraging academia and industry to help devise the way forward. As I've said repeatedly, the cyber environment demands such collaboration.
"A military brat asks:"
by UncleTogie
In your work as Director of IO for Combined Joint Task Force -76, what were your greatest challenges in Afghanistan? What technology threats other than IEDs were your greatest concern?
The challenges in Afghanistan are immense and include: a population that is 18-20% literate, and it drops to less than 5% once you leave the seven major population centers; the need for basic infrastructure to take root and flourish, like sewage systems, clean water, electricity, schools, medical care, and jobs; a fledgling government trying to allow a concept called Democracy to grow; and a criminally-minded, terrorist organization willing to assassinate anyone who buys into that concept called Democracy.
But the biggest challenge was expectation management, and it's a challenge I deal with every day still. We are a society of instant results and instant gratification: I get upset when I can't get a doctor's appointment that fits perfectly into my personal schedule. What we lose sight of is that we, as a nation, have been experimenting with (and trying to perfect) Democracy for 232 years - our Constitution was adopted in 1787 and has since been amended ("changed") 27 times; we suffered a pretty major Civil War over it; the Supreme Court interprets it every day. My point is that we've worked mightily at it for nearly two and half centuries and are still perfecting it. We're viewed as the hallmark for Democracy (how humbling is that?), which only means we can't let up in this grand endeavor...nor back away from the responsibilities it requires of us. I believe that what we are doing in Afghanistan and Iraq is absolutely critical to the defense of our Nation, but Democracy takes time...and sacrifice.
The ability to develop concepts and capabilities that will provide our country enduring capacity in cyberspace will also take time. While technology may be developing faster than Moore's Law ever forecasted, we cannot afford to react to the current problem in a shortsighted way. Any capabilities we develop must be enduring. At the same time, they must flexible - adaptable as technology adapts or, lead technology development. Finally, they have to be tied to the JIIM community - like I said earlier, the Army isn't going this alone.
What's your favorite team fortress class?
I was like hold on a second how is compromising networks legal and just means? Oh yeah, it's the government. They can murder and call it war.
Then only answer 2, because he thought it was in binary.
Good answers, just in time for Independence Day. I feel safe when we have such capable and smart people like Col. Bircher defending and protecting the United States of America.
I'm proud to be an American where at least I know I'm free, And I won't forget the men who died who gave that right to me, And I gladly stand up next to you and defend her still today, 'Cause there ain't no doubt I love this land God Bless the U.S.A.
I still wanna know, if I enlist for this, do I get to go through the Stargate?
My
I bet this was fun to see. Did he quite literally fly backwards out of his office chair?
It's rare in the Army to be quite literally blown away and live to tell about it.
Why in the hell do we not have these simple Q&As from our government more often? I learned more in the past 10 minutes than I would on CNN/MSNBC (Fox teaches you a lot, most of it wrong) over an entire week.
-nick
Nice answers. Completely vacuous, but nice. Let's take one of mine:
Us ex-military types refer to that as "email".
And us ex-military types refer to that as "propaganda". White, black or gray. Usually handled by the Psychological Operations staff.
No. There has not been ANY debate about it ... provided it is targeted at a declared enemy.
The ONLY debate is about whether the military should be targeting propaganda at our own people AND during peacetime.
The limits were already known. Calling email "a cyber-electronic engagement" does NOT change the facts.
This raises an interesting question as to the nature of military/civilian coordination in the future, especially as conflicts arise more and more often out of financial and ideological, rather than territorial, causes.
When does stopping spyware on your parents' computer become a means of encouraging solidarity rather than a personal privacy concern? (When) Will American companies realize that security vulnerabilities they introduce may impact the viability of the market that sustains them?
Does that mean you will be taking out whitehouse.gov and eop.gov in the near future?
Thanks in advance!
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
Someone from the government took time to compile thoughtful and insightful answers to your questions. This is the perfect opportunity for 90% of slashdot readers to post retarded comments about unrelated shit like the war or how the government ran over their fucking dog. What the fuck happened to slashdot, is this just a place to come and bitch about distrust of the government when you aren't even old enough to vote?
What about all these idiots who flame the US government when they don't even fucking live here.
Yep. And isn't that what was asked for? Won't self-motivated people always ask specific questions about subjects that interest them?
The "vacuous" bit was from his comment:
So you and I are now "engaged" in a "cyber-electronic engagement" because we are both posting to /. here.
In which case "cyber-electronic" is redundant. There is no non-electronic means of accessing "cyberspace" as he uses the term.
And I'm sure that Taco can point to the physical boxes that house slashdot. So "cyberspace" is a little ... whatever.
I'll still refer to it as "posting on slashdot".
I wonder what the Lt. Col. thinks of a cyber-militia or cyber-minuteman scenario? Is that a tool the military would be willing to consider?
The exact quote from Patton (the motion picture) is:
"Rommel, you magnificent bastard, I read your book!"
I read Patton's book "War as I knew it" and have to say that he must have been much more colorful in person than he paints himself in his own book.
So, at some point in the future we can expect a blockbuster movie in which the pasty army lieutenant protagonist proclaims, "Chang, you magnificent bastard, I stole your source code!"
[Cut to scene of several officers gathered to power off a compromised machine while a solemn voiceover explains that this poor machine knew no vices... well, except for that once obfuscated directory full of morale-boosting images.]
Why the hell do you put TFA directly on /.? This is an affront to all real slashdotters, you insensitive clod!
"There has long been a debate about the appropriateness of the military participating in influence operations"
Such a debate is silly. Just ask Sun Tzu about winning battles before they begin.
Please compare and contrast your theory to the simultaneous 4-day time cube.
First of all, kudos to the guy for answering the questions. The majority of answers weren't really answers though, but in this day and age of "no comment" and disappearing emails from most branches of government, it is great to see a couple of paragraphs devoted to each query.
The fact that each department wants to master its own sandbox is a big fat load of crap. Like the original question stated, an IP packet is an IP packet. There are only so many ways to secure a communication channel. There are only so many ways to setup an ACL. I remember back when I first got into networking there were governmental standards (Orange Book maybe?) that were touted as minimum levels of security required of network operating systems. I heard about that stuff in the early 1990s and I'm sure the concept has been around since long before then. What the government needs is a single entity that comes up with a set of best practices and then works with a couple of vendors to produce milspec hardware and software combinations that meet the practices.
The reality of the situation is that such a thing will never happen because of the budgeting process. Every sandbox is funded seperately and nobody wants to give up their budget for the good of the whole country. Nope, the Army wants to do the Army thing and the Air Force wants to do the Air Force thing and the NSA wants their way, and the DoJ wants their way. As a taxpayer I'm quite frankly sick and tired of all of the duplication. On the other hand, with the economy hemoraging ~65,000 jobs a month, maybe some duplication is good for employment.
I'm disappointed he didn't answer the botnet question. I really wondered about that one.
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
I'ld rather hear from Lt. Col. John Sheppard and what they are doing lately...
"Because we are a democracy, your last question is best answered by our civilian leadership. Only the President can determine what constitutes an act of war." So because we are a democracy, only the President, our dear leader, can determine what constitutes as an act of war? Wouldn't you think that it would be up to the people to determine what constitutes as an act of war if this were a true democracy?
I'm curious why the questions express so much aggression towards China (e.g., suggesting blowing up the Three Gorges Dam as part of a military strike). Are we being groomed to consider China an enemy rather than just an economic competitor? The only explicit war of aggression that Chinese have carried out was the Sino-Vietnamese War: http://en.wikipedia.org/wiki/Sino-Vietnamese_War which all the Chinese people I've met acknowledge as an utter disaster, even more so than the U.S.'s war with Vietnam. Unlike the U.S., the PRC learned from only one example how difficult it can be to invade and occupy a foreign country. Are fear, ignorance, and jealousy sufficient reasons to justify engendering an arms race between us and a people who really aren't interested in fighting us?
our Constitution was adopted in 1787 and has since been amended ("changed") 27 times
He answers 19 intelligent, informed questions in an intelligent, informed manner and then thinks that we don't know what "amended" means and can't figure out how to look it up. I'm not offended, but it is kind of unusual.
This space reserved for administrative use.
As someone sworn to uphold and defend the Constitution of the United States, perhaps Lt. Col. Bircher should read it. In Section 8, all of the responsibility for paying for and choosing to engage in war belongs to Congress (despite their having fumbled it for the past half-century, at least). The President is merely the "Commander in Chief" ONCE WAR IS DECLARED.
The President may, as a citizen, advocate that Congress make such a declaration, but Congress is failing in its collective responsibility if it takes his (so far) word for anything regarding cause without validation from OUTSIDE the President's subordinates.
Yes, it must be difficult to answer the questions after being blown to pieces. Humbled? I'd say that was a perfectly natural reaction.
Variations on "it literally blew me away" as a figurative expression are rampant these days.
...are we scared yet?
Wow. While I applaud him for such a goal and motive, it is really hard to read that and not laugh when I remember what we do at places like Guantanamo.
After serving in WW2 and winning 4 Purple Hearts I feel the soldiers of today need more training in electronic warfare. If I wasn't blind I'd be the number one hacker defending this great land! Woo Hoo. Gimme some more Viagra
Need a Russian bride? I have a large supply in a warehouse waiting for you. I offer a great trade-in plan too! Robert H
all of that was possible not too long ago - go ask your parents. it's sad how we seem to not even notice what's happening to us. also, GOML.
I hope I didn't brain my damage.
... [in World War II] our entire nation mobilized for war: Detroit began producing more tanks and less cars; when you went to the movies you saw Movietone newsreel releases instead of ads for popcorn and sodas; American citizens had victory gardens, fuel rationing, and metal collection drives. The war affected everyone in America. If you put this in perspective of a future war in cyberspace, I think the best question is what will be the nation's response to cyber war? Are cyber threats, cyber terrorism, cyber attacks, cyber war purely the province of the military or the entire nation? The ways in which we answer this question will determine our future priorities and funding.
This brings up an important point about current and future warfare. Pretty much everyone understands military conflict for the control of land, so they can decide whether it is justified and offer their support accordingly. The War on Terror is somewhat different. Most Americans don't understand the motives and actions of the people we are fighting against or the people we are trying to protect. I think that this is why most people are disconnected from the wars in Iraq and Afghanistan. They don't really have enough information to form an opinion, so they can't really find it in themselves to support (or oppose) the war effort in the same way that previous generations did in previous wars.
Is strong civilian support important or necessary to win wars? I don't know, but if it is, cyber-warfare is going to be hard. Nobody will be able to even understand what is going on or why, so they won't be able to get behind it. I don't really know what the public could do to assist in a primarily cyberspace conflict in the same way that the efforts he mentioned benefited a land war. Bandwidth rationing? Donating computer cycles to the military ( a la SETI@Home)? Vigilante cracking? Whatever it is, people won't do it because they won't know what the heck is going on.
This space reserved for administrative use.
I assume this interview had as its main goal to help their recruitment efforts. However the guy failed badly. He tried to do two contradictory things at once: define his own language for his work and use common language to relate to us. So the interview sounds nothing short of psychotic. One minute he is spending a paragraph of gibberish to say "we have presence on the net and we have goals to accomplish", the next he speaks like a normal person e.g. about the Patton anecdote.
I am a researcher in biology so I am not quite his target audience but I am curious about our military and the opportunities of working with it in a more general sense and such split personality approach is a complete turn-off.
The question I have for the guy after this interview is: "Why is it so hard to cut the crap and talk straight? Do they brainwash you or something?"
Sure there is a non electronic means of accessing cyberspace. He could be using these two services... http://www.writetogranny.com/ http://slashdot.org/article.pl?sid=03/10/01/015259
You know, I truly appreciate the colonel's time in answering these questions, but WE STILL DON'T KNOW what the government and military is up to, or if they're even doing anything, right now, to defend our national interests. "The government works together with other countries and within itself, yada, yada, yada." I've heard it before.
We get cyber-attacked, everyone knows it and he admits it. But what are we DOING about it? I like the platitudes he espouses and I agree with them, but I still don't get the sense we're doing anything smart with these attacks. Obviously, we don't want to get embroiled in a full-scale cyber-war, which would lead to real war, but can't we track, trace and investigate them so we have the ability to immediately and devastatingly attack if, God forbid, we need to go to war with a major power? I've still never heard anything like this from the military folks... I can only hope the NSA is light years ahead of the military.
Eh, I suppose it's not for us (me) to know, but I'd be a little more assured if I knew they were actually doing something, and what that something was (even in a general sense).
To craft an analogy with conventional military operations, you don't need to tell me where you're putting the tanks, I just want proof you're making them.
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
Of all the questions collected for John Bircher, only ">34 comments rated a "5" score, of which only 25 were questions. Mr Bircher answered 17 questions (including two by the same questioner). One of the unanswered Score 5 questions was mine, "Are We At War?":
Some other questions about cyberwar with China were answered by Mr Bircher, but they were nonanswers about actual operational warfare, which is legitimately secret:
So we still don't know anything more about the political and legal relationship between the civilian government and the military, while we hear sporadic reports of a war raging between us and China.
But at least some of us are asking the questions.
--
make install -not war
There's a nice quote from a movie called Hunting for Red October where some Russian officers are trying to defect to America:
Capt. Vasili Borodin: I will live in Montana. And I will marry a round American woman and raise rabbits, and she will cook them for me. And I will have a pickup truck... maybe even a "recreational vehicle." And drive from state to state. Do they let you do that?
Captain Ramius: I suppose.
Capt. Vasili Borodin: No papers?
Captain Ramius: No papers, state to state.
What really upset me though is that the last time I saw a re-run on TV, the "No papers" part was gone. Why would that be, I wonder...
From what I can see, Bircher failed to answer a single direct question -- and the questions asked were pretty direct. The interview was vague; it gave the impression that the mission is diffuse and mired in bureaucracy. Somebody there needs to have a clue, but it's not clear how that clue can be imparted.
"Imaginary solutions to real problems."
First, it's important to clarify that as far as I'm aware, we're not in the business of compromising networks or gaining access to other governments' systems without just cause. When there is a clear threat to national security, we then employ legal and just means to deal with that threat. Also, I'm not able to discuss specific methods that the Army might or might not be employing but only speak in terms of concepts and capabilities that we should have in order to be successful conducting operations in cyberspace. If you have insights and skills that might broaden our capabilities in this arena, I encourage you to consider joining the emerging DoD cyber-workforce.
"Oh, absolutely not. But then again, I can't really say either way. On a completely unrelated note, if you are a l33t haxor, call us!"
1) "What is that?" by khasim
What, specifically, would be a "cyber-electronic engagement".
Include examples.
Why didn't he answer the very first question he chose?
I read TFA (it was right there on the page) and the previous one asking for questions. Neither of those answered this question and neither did he. Anyone else have an idea what it is this person and his staff does in the U.S. Army?
"yet we have always held American forces to a higher standard" This is big. Should we pick "Guantanamo"? Or "Abu Graib"? Or Mr. Rumsfeld himself? Or the supreme commander and his Vice? Or "hard questioning methods"? Big one.
I was reading through the questions and answers and noticed there was no answer to question 15? Would anybody know why that is or where the answer could be found?
This guy doesn't have a clue. I forget the name of the officer in charge of the Army's 1st Information Operations Command. It is the contractors' that work for that command who have are at war, they are the only people who have ever found and stopped a hack against the US Army in real time. They are the first and really the only people who actively defend US Army networks.
Well, yeah it is winding down, all the important people are moving their operations to Dubai, which due to some very shrewd politicking doesn't have extradition treaties with the US. And has some of the largest per-capita wealth on the planet (5 grand a month to citizens in unemployment??)
try one of these programs. http://www.defenselink.mil/cio-nii/iasp/ https://www.sfs.opm.gov/ OR if you already have the skills then try any of the big defense contractors or even some of the small ones. For most of the jobs, you must have U.S. citizenship, the ability to obtain a clearance, and most importantly the ability to withstand hours of pointless meetings.
Thank you sir, for taking the time to try ans answer our questions.
Good luck in your rather daunting current endeavor and in the future.
<script>alert("I never liked JavaScript, really; it just seemed a bad idea.");</script>
No, you're not put up on a pedestal as some sort of poster-child for democracy. The extent of the influence of lobbyists and degree to which funding shapes the political process means that ultimately, it is forces other than public opinion and discussion that make the decisions.
And only through accepting this fact can one begin cleaning up the mess :)
No self-respecting military member will willingly post as "Anonymous Coward."
Invenio via vel creo
> We're viewed as the hallmark for Democracy
No you're bloody not. This title belongs or more correctly belonged to some european countries like Switzerland, the Netherlands or Finland.
Right now, you're viewed as the hallmark of the rise of the next generation of fascist states. (with european countries catching up, however).
- Spying upon your own people
- Taking fingerprints from travelers
- Detaining people without cause and without access to a lawyer
- Fraudulent elections via voting-machines
and so on.
Unless you repell just about every law Bush junior ever signed (and several laws his so-called "republican" and "democrat" predecessors signed, down to William McKinley) you're not going to be the hallmark of Democracy again (again? Yes, again, because you've BEEN the hallmark of Democracy -- in the 18th and early 19th century).
"The more prohibitions there are, The poorer the people will be" -- Lao Tse
I simply don't understand why anyone would be proud of their country. Unless you made the conscious decision to immigrate, it's just where you happen to live. Being proud of living in a nation you happen to live in makes about as much sense to me as being proud of being right-handed, or having blue eyes.
I understand there is a fundamental human need to define "us" versus "the other" and nationalism is the modern way to do so, but I still don't understand why it is something that we can (or should) be proud of.
BTW - people living in the West should be grateful, but that is altogether different.
*** Where are we going? And what's with this handbasket?
This guy is the best asset the Army's PR department has. And he said hardly anything that we needed to hear. He is very well spoken, to the point that I'd like to hear him again, even, maybe not online though.
The most surprising part of this whole interview and response to it, is the lack of rethinking military in cyberspace. We are all, not just in U.S. but worldwide, other countries as well as U.S. citizens abroad, under daily attack by spam, viruses, malware, identity theft, etc. and we are being targeted by organized crime which apparently sells data sets and exploit execution tasks on a dark market. It is beyond simple crime. It includes paid officers of foreign governments. I don't just mean China, I would include according to past news stories France and basically it seems every country's cyberwar team does a side business in espionage to improve their own country's businesses too.
So I would say that not saying anything solid to people asking about SE Linux related apps, and not saying anything about the reality of a daily cyberwar that is as close as your ethernet port, is astounding, and I think indicates a massive lack in vision.
I would like this Lt. Col. to rethink what is war, what is an attack, what is a vulnerable asset. What would harden the U.S. or harden the general law-abiding world against private or government sponsored attacks? My own guess is he'd be thinking about distributed agents that can run on consumer pcs to build a security blanket but of course who wants the army to put their software on your computer right?
Therefore a perfect argument for Military Open Source. Of course, they wouldn't want to put the good stuff in it because it would be used by the enemy... etc. Not a very useful forum since he is talking to his enemies and his supporters.
One thing for sure he will get lots of people to sign up for the Army if he keeps romanticizing it.
Your reply gives me a question I hope someone out there will answer.
Are the "Rainbow" series of books still out there? And if so are they worth bothering to get?
Thanks,
Dave Small
Mattr, you said,
>The most surprising part of this whole interview and response to it, is the lack of rethinking military in cyberspace.
But, if you read the opening statement, Lt. Col. Bircher says this directly:
> I have been given the challenge of helping the Army map out the concepts for how we will operate in and through cyberspace in the future: specifically, 2015 and beyond. Sometimes I feel like I'm part science fiction writer, part futurist, part planner.
>>>>>> Hmmm. I don't understand your reply, given this, Matt. I believe you must be meaning something a bit different than "rethinking". Could you expand on that?
Specifically under "threat assessment", Bircher says,
>Part of threat assessment is not only tallying up an adversary's arsenal of weapons but also getting inside his head. Cyberspace is highly cerebral and highly diffused, where threats can come from any corner. This reality demands new assessment tools. It's all unfolding fast and furiously, and we're working hard to ensure we have the capabilities needed to assess and defeat these new threats effectively. The Army is not acting alone.
He also says as an example,
> A virus can crash systems, rendering hardware useless. Malicious rumors on the Internet can result in someone taking their own or someone else's life.
I must be missing something here between his replies and your dismissing them. Is there an impedance mismatch?
To me this shows an example of how the guy is thinking. He's in long-term planning, and I think he's smart. Reading science fiction alone is a really good sign, because it's the literature of the future -- taking a look at the future and the consequences if we go a particular way.
He did NOT say, Well, we're currently using virus scanners from XX company and firewalls from YY company and we found the Chinese-brand "Cisco" routers THIS way and they have extra code that does THIS in the event of a conflict. And I would hope he would not. Slashdot gets read 'round the world, and not everyone is a friend to the United States.
While a daily cyberwar is indeed going on, as you mention, that isn't common knowledge as it should be among people like, let's say, my Dad, whom I struggled to get onto e-mail. (Many of us have been through that).
The purpose of the Armed Forces is to support the political and diplomatic decisions of the U.S. through force.
If you'll forgive me the analogy, the purpose of the Army is not to sit on the borders looking at packets of data, one by one.
Right now cyberwarfare isn't on the radar screen of most of the Congress; they're busy with elections and elections occupy their primary interest. I suspect some sort of attack will be needed to get interest, and then, poorly done, rushed legislation will go through quickly to "defend our cyberspace". See also: DMCA and other horrific legislation.
And yet, Matt, I fully support you that something needs to be done. Please do not take this as a personal attack. It isn't. I am just uncertain that the Armed Forces are the agent that should implement the change; in fact Bircher posted a quote from the Atlantic that seems to show his concerns about it, too.
Thanks,
Dave Small
This is the organization responsible for developing doctrine, materiel and training to prepare the Army for cyber-electronic engagements.
He needs to give real examples of what kinds of training they are actually working on. What is the area of responsibility for these doctrines? Is this about office work or battlefields? What is his group trying to achieve? Who is the enemy that they are preparing to fight?
There have been posts saying things like, they will be fighting China or Chinese hackers, they will be defending national computer networks from attack, they are a propaganda training center, or that they will be attacking U.S. and foreign civilian computer systems in response to some kind of threats. None of these sound like what he actually said or was implied by either article, so I'm looking for more information on this.
Maybe something about why people assume he is doing anything other than training soldiers in how to give website interviews or maybe send and receive emails. Which, if you read his comments, is all he actually said
Dear Dave,
Thank you. Basically I agree with you. However much of what he said could have been said by a sophmore in college. Or a bright high schooler.
I was not the only one unsatisfied by his responses, most posters said similar things.
I suppose it is the most that could have been expected. Of course I wouldn't want him to be explaining secret thinking, and in this case the conceptual approach could be an important, secret asset it's true.
I am not a military expert but it seems there is or ought to be more to the Army than hardnosed reaction to congressional/executive edicts. There are at least defense and intelligence missions too. Perhaps it would be nice for him to explain where Army ends and Homeland Security begins. And where does the CIA and FBI come in. What about cooperation with foreign countries' opposite organizations?
And there has been some interesting news about military robots in the past year, I remember a dog-like prancing robot that carried a heavy pack which looked useful for nonmilitary use too.
One point I have is that the armed forces have big budgets. But the only guys doing anything for securing home pcs and business data are antivirus manufacturers who have limited funds and aren't able to keep up. Perhaps selecting some technologies to open up would contribute to generally hardening the network at large. Or, I wonder is it better for the Army to allow a very porous network to exist and then take over what systems it needs to with its own military wares.
Of course I tend to imagine the military has superior technology or can afford to build it. But maybe it is not so superior yet, or what they have could never be publicized and so they are making a second tier of technology that would include the public.
Regarding "rethinking" sorry for being unclear. My impression is that being Army, there is a seduction for seeing things in terms of unilateral decisions, force projection, zero sum games, the game of Risk etc. You know, old-style battlefield thinking. Well in cyberspace there is no battlefield, or rather you turn on your computer, or your radio set, and voila you are there on the field. And then there is the physical location of where you are, this is generally quite vulnerable if you consider miniature drones to be a projection of cyberspace force into the realworld. I happen to work nearby some embassies in Japan where a multinational summit of leaders is going on now. Well the entire country's train system is on high alert, there are cops everywhere, and yet as far as I know the summit is a thousand miles away.
It is bizarre and I think the military needs to understand there is a similarity between cyberspace warfare perhaps and the military tactics called guerilla warfare or now "terrorism". I once made a website called Media Tero when I determined a feedback relationship existed between the Aum cult (since disbanded and yet somewhat reformed(?) and some key people still not arrested after years..) and the television news media. The cult went after the national police chief and other individuals.
I made the site with help from a Time magazine writer who wrote a great story, and I solicited help from the public to teach Japan about security. Just me, no military training or anything, applying network thinking to the news is all. It seems to me that the Army has a defensive mission to defend people who are not behind a fortress or firewall. Maybe the Army would be more effective if it adopted tactics used by criminals and terrorists, I don't know. Maybe they should lend some experienced people to the Homeland Security group and do something besides theater. I think America when I grew up in the 70s and 80s was a much nicer place to live than it is now unfortunately.
As for needing to have "some sort of attack", how do you know there haven't been any? There have been lots and lots of failed ones. How many successful ones? There are no logs if they are successful. How do you know that failed voting systems are not even un
Well said and quite thoughtful.
Thanks for taking the time to expand on what you said. I really appreciate it!
I'll digest what you say for several days ...
Many thanks,
Dave Small
http://poorgeorgesalmanac.com/?p=328/
Contains the proof for what you said.
Sorry i didn't believe you earlier. Came across it today and thought i would bring it to your notice.
Thanks
"Doing what i can, with what i have." ~ Burt Gummer
I agree about the Geneva Convention only applying to soldiers who fight openly and wear some kind of identification (traditionally a uniform).
But even if you count non-uniformed fighters as criminals, the way the US has treated many of them is below the standards that apply to a nation under the rule of law:
1) Suspects should either be charged with a crime within a reasonable timeframe or be released. The US still imprison some "illegal combatants" in Guantanamo that have been there for years. The term "illegal combatant" itself was IMHO invented to weasel around the law: an attempt to treat the prisoners neither as soldiers nor as criminals. This is gradually rolled back thanks to the Supreme Court, and it gives me hope that the USA are still a civilized country at heart.
2) A criminal's guilt has to be proven in court, with reasonable opportunity for the defense to challenge the evidence. The rules under which the military tribunals were supposed to work (see http://en.wikipedia.org/wiki/Guantanamo_military_commission) do not make a fair trial. Again, the Supreme Court has limited this practice, see http://en.wikipedia.org/wiki/Hamdan_v._Rumsfeld.
3) Lack of oversight (or maybe silent approval of the torture incidents) at Abu Ghraib.
Overall, I think the US has earned its bad reputation. Not so much because of violations of the Geneva Convention but because the minimum standards of due process for suspected criminals are not met.
C - the footgun of programming languages
Speaking as someone who (recently) has been in a higher military headquarters position (4th ID Headquarters, on a Personal Security Detail) I can say for a fact 2 things about his answers. Complaint one: Non-informative. Many of the questions, when he says they are outside his purview, really are. The military with purview on things like this are going to be incredibly compartmentalized, to prevent any useful dissemination (or leaking) of information. Pretty stupid, but thats how it goes. Complaint two: Not making sense. The United States military, and its oversight, are fond of using buzzwords and unnecesary positions for purposes of both job security and self-importance. As such, his answers being confusing is merely him doing what he has had ingrained into him by years of being an officer in the United States Army (Also known as middle management, PHB style)
Never disregard the raw power inherent to stupidity... they call it "dumb luck" for a reason...