Slashdot Mirror
Air Force Firewall Now Designated a Weapons System (gazette.com)
An anonymous reader writes with a report from the Colorado Springs Gazette that the U.S. Air Force Space Command has declared its first cyber "weapons system" operational. The weapon, deemed fully operational this month, is basically a big firewall designed to protect the Air Force's internal 1 million-user network from hackers. It will be a hot topic at the Rocky Mountain Cyber Symposium, which is expected to draw hundreds of computer experts to The Broadmoor for a four-day confab starting Monday."
More from the article about why a firewall would be called a weapon: The biggest reason for the weaponization push is financial: When it comes to budget battles, weapons, even those with a keyboard and a mouse, get cash from Congress. "Designating something as a weapons system really does help us justify our funding," Col. Pamela Wooley, who commands the Alabama-based 26th Cyberspace Operations Group, which includes the new weapon.
Fair warning/full disclosure: I"m an Airmen in the USAF.
A 'weapon system' is a special designation. Lots of things are weapon systems. A truck is a weapon system. Every weapon system gets a System Program Office (SPO) that is responsible for developing, managing, updating/upgrading/improving the weapon system. Weapon systems have full certification processes that the SPO oversees. Think change management on steroids.
Want to modify the weapon system? Better clear it with the SPO. If you don't, it just became de-certified and you can't deploy it. If it were a plane, that would mean its grounded.
Without knowing more details other than their is a weapon system that is a firewall, that would mean that the hardware and software gets certified before it is deployed (turned on/plugged in). Chances are there are standard configurations that are then mandated.
This also means that its going to be heavily vetted. Chances are its not a commercial-off-the-shelf device., but if it is they'd be taking it apart looking for backdoors and other exploits.
So personally I'm excited by this, but then I know what it means...
Disclaimer: I am US military officer (not the same AC as above), not an expert on cybersecurity or the legal details of US foreign weapons sales. I agree that firewalls are not a weapon.
That being said, I suspect that, in addition to the funding aspect mentioned in the summary, this is a legal maneuver to protect the details of this particular firewall. Generally firewalls are fair game for export worldwide (as they should be in my opinion) under the terms of the Wassenaar Arrangement (see Category 5). However that means the USAF has very little legal recourse against anyone leaking the operational details of the firewall, including the source code and what system it is deployed on, to either the intelligence apparatus of foreign powers or to the general public. Classifying the firewall as a weapon brings it under the purview of the Arms Export Control Act of 1976, which has a lot more teeth to it and can carry some pretty severe penalties. By classifying it as a weapon, the USAF blocks their firewall, and only their firewall, from being sold to foreign powers, without limiting the ability of cybersecurity companies to sell firewalls to friendly foreign powers.