'fight the net': pentagon unveils 'defensive' cyberwar strategy

from time: The Pentagon rolled out its new cyber-defense strategy Thursday, hyping it with the news that foreign hackers (from an unidentified country) invaded the computers of one of its (unidentified) contractors in March and pilfered 24,000 sensitive documents in one fell swoop. Cyber-security is a Pentagon growth area, make no mistake about. Lord knows, I've contributed to the deluge. But it's one of those arcane areas where progress is hard to measure. Is the threat as dire as sometimes portrayed? It's important to realize that the Pentagon doesn't store real secrets on networks linked to the Internet. Nonetheless, the press can't resist stories about offensive cyber warfare. Deputy Defense Secretary William Lynn, who unveiled the new cyber strategy, told an audience at the National Defense University in Washington that "crucial" files -- not "secret" or "top secret" -- have been stolen in recent years. Much taken was of little value, he said: "But a great deal of it concerns our most sensitive systems, including aircraft avionics, surveillance technologies, satellite communications systems and network security protocols." Over breakfast Thursday, Marine General James Cartwright, the vice chairman of the Joint Chiefs, said the Pentagon's current emphasis on cyber defense needs to change. It's currently 90% defensive and 10% offensive; he said those numbers need to be swapped. "This strategy talks more about how we are going to defend the networks," he said. "The next iteration will have to start to talk about here's a strategy that says to the attacker, ‘If you do this, the price to you is going to go up.'" Safe bet the price to us is going to go up, too.

related updates: former cia head keith alexander says we should 'build a new internet to improve cybersecurity'*
pentagon perception manager knows how to manipulate search engine algorithm*

dhs to gain 'autonomy' under obama cybersecurity plan

dhs merges with dod/nsa under obama's cyber threat plan
from kurt nimmo: Obama has proposed legislation that will give the Department of Homeland Security more “autonomy” in its effort to protect civilian computer networks from ostensible cyber attack, according to Information Week. White House officials testified Monday before the Senate Committee on Homeland Security and Governmental Affairs about the comprehensive plan presented by the administration two weeks ago to create legislation to protect critical infrastructure and networks. It will merge operations with the Pentagon.

“One key aspect of the plan is to put the DHS’s mission to protect U.S. federal civilian networks on par with the DOD’s mission to protect U.S. military networks, giving the DHS more autonomy to act against cyberthreats on behalf of the government than before,” writes Elizabeth Montalbano for the technology publication.

DHS has also sought to merge the effort with the NSA and various civilian operations.

Last October, the Obama administration adopted new procedures for using the Defense Department’s vast array of cyberwarfare capabilities in case of an attack on vital computer networks inside the United States, “delicately navigating historic rules that restrict military action on American soil,” according to the New York Times.

According to the Times, a team of military networking experts would be assigned to the operations center at the Homeland Security Department. The new approach will begin with a Department of Homeland Security team deploying to Fort Meade, Maryland, home to both the National Security Agency, which specializes in electronic espionage, and the military’s new Cyber Command.

At the time, government officials said the new rules contain “a rapid response to a cyberthreat while balancing concerns that civil liberties might be at risk should the military take over such domestic operations,” in other words the government announced effort to protect against the hyped threat of cyber terrorism would require a sacrifice of liberty.

The DHS plan announced on Monday will give “the DHS – recognizing our similar role to DOD with regard to federal civilian networks – similar authority with regard to personnel so we can bring them on board rapidly,” Philip R. Reitinger, deputy undersecretary for the DHS National Protection and Programs Directorate, told Congress.

The plan also gives DHS “much clearer authority and responsibility to work in a voluntary way” with the private sector, something it already has been doing, Reitinger added.

In 2009, Pentagon spokesman Bryan Whitman sidestepped answering if the Pentagon’s cyber command would be capable of offensive operations as well as protecting the Department of Defense. “This command is going to focus on the protection and operation of DoD’s networks,” he said. “This command is going to do what is necessary to be able to do that.”

In 2006, a Pentagon document entitled the Information Operation Roadmap was released to the public after a Freedom of Information Request by the National Security Archive at George Washington University. It states that the Pentagon has developed a “robust offensive suite of capabilities to include full-range electronic and computer network attack… We Must Fight the Net.”

related updates:
facebook & google join forces to oppose privacy bill*
18 places censored by google maps:
from aberdeen proving grounds in maryland to... north korea*
nsa collects as much data as is stored in the entire library of congress every 6hrs?*
video: nsa whistleblower tom drake talks espionage act, 9/11 & intel with '60 minutes'*

11/25 defcon: sick, switch, risks

US launches giant eavesdropping satellite*
govt focusing on cyber warfare, armed forces chief reveals*
study says wifi makes trees sick*
3rd eye: nyu artist gets camera implanted in head*
should obama's 'internet kill switch' power be curbed?*
cyber shopping poses fraud risks*
wikileaks diplomatic cable dump reportedly imminent*

11/18 defcon: extra staff & virtual property

fbi brass ask google, facebook to expand wiretaps*
google vp issues stark internet warning*
youtube hiring extra staff to tackle al-qaeda videos*
state-led cyberterror set to rise: report*
gates: huge threat of cyber attack*
cyber experts have proof china hijacked US-based internet traffic*
searching for news is riskier than searching for porn, study says*
man made 1/2-a-mil on virtual property*
x-37b secret US space plane may be too mysterious*

when cyber command pulls the plug?

dead drops: when cybercom pulls the net
Is there a dead drop in your future when Cyber Command pulls the plug on the net? Aram Bartholl suggests a how-to build an offline network using those old usb flash drives around the house. 'Dead Drops' is an anonymous, offline, peer to peer file-sharing network in public space. It's 21st Century ingenuity and coolness all at once! Please check out the Dead Drops video on You Tube and add your dead drop to the list of locations and make your .pdf for the time when the net is no longer at your fingertips. There are dead drops in Melbourne, Paris, Ontario, New York and Germany.

cyber command seeks to expand battefield

Gen. Keith B Alexander, NSA Director and Cyber Command chief, seeks to go "full spectrum" with offensive measures in cyberspace. Cyber Command reached full operational status just within the past month, looks to push boundaries according to Washington Post article.  "But current and former officials say that senior policymakers and administration lawyers want to limit the military's offensive computer operations to war zones such as Afghanistan, in part because the CIA argues that covert operations outside the battle zone are its responsibility and the State Department is concerned about diplomatic backlash." Does this mark the twilight of the internet as we've known it these past few years?

11/4 defcon: cybercom, holograms & chatbot

it begins: military's cybercom is fully operational*
military ready for war in cyberspace*
russia to wikileaks: we could break you*
china takes supercomputing lead*
myanmar hacked before election*
denver voters reject tracking space aliens*
insider claims US govt funds 'the event'*
groups fear huge health database*
hologram messaging coming of age*
prize-winning chatbot steers the conversation*
'internet of things' is on the way*

10/21 defcon: do-it-yourself domestic domains

US says military can respond to domestic cyberthreats*
cyberspace is the new domain of warfare*
cybercom operational this month*
enormous ring developing on the sun*
planetary defense coordination office proposed to fight asteroids*
facebook 'encourages to children to spread gossip & insults'*
video: father & son film outer space, do-it-yourself style*
developing: wikileaks claims to be under attack, calls press conference*
update: wikileaks plans 'major' announcement in europe*

officials publish cyberspace operations doctrine

from defencetalk: The LeMay Center for Doctrine Development and Education approved and published the newly developed Air Force Doctrine Document 3-12, Cyberspace Operations. Maj. Gen. David S. Fadok, the LeMay Center's commander, said cyberspace operations are critical to effective operations across the range of military operations.

"The Air Force is a key member on the joint warfighting team and is dedicated to developing and presenting highly skilled forces to joint force commanders who can deliver decisive effects in, from and through cyberspace," General Fadok said.

The doctrine outlines Air Force cyberspace operations and their importance. A few items discussed in the new doctrine include: cyberspace fundamentals, command and organization information, and the design, planning, execution and assessment process.

The document also defines cyberspace operations as the employment of cyber capabilities, where the primary purpose is to achieve objectives in or through cyberspace. Such operations include: computer network operations and activities to operate and defend the global information grid. The global information grid includes owned and leased communications and computing systems and services, software (including applications), data, security services, other associated services and national security systems.

"Today, our society relies on technology and cyberspace more than ever, and this medium must be secure," General Fadok said. "The joint warfighting team, including the Air Force, must lead the way in cyberspace to ensure we maintain a distinct advantage over our adversaries in this contested domain."

read full report in pdf format

10/7 defcon: spooks, satnav & sightings

pentagon says 'the global cyberwar is just beginning'*
military spooks step up war on leakers*
obama pressures isp's to censor websites*
microsoft wants govt licensing net access*
aol says infowars 'whipping the internet into a frenzy of anxiety'*
iran say it has captured 'western spies' involved in nuclear cyberattack*
researchers using rat-robot hybrid to design better brain machine interfaces*
uk man dies after satnav sends him into a reservoir*
ufo forces airport closure in china*
best image yet of comet closing in on earth*

'ex-cia' head hayden says US should be able to shut down internet

from reuters: Cyberterrorism is such a threat that the U.S. president should have the authority to shut down the Internet in the event of an attack, Former CIA Director Michael Hayden said.

Hayden made the comments during a visit to San Antonio where he was meeting with military and civilian officials to discuss cyber security. The U.S. military has a new Cyber Command which is to begin operations on October 1.

Hayden said the president currently does not have the authority to shut down the Internet in an emergency.

"My personal view is that it is probably wise to legislate some authority to the President, to take emergency measures for limited periods of time, with clear reporting to Congress, when he feels as if he has to take these measures," he said in an interview on the weekend.

"But I would put the bar really high as to when these kinds of authorities might take place," he said.

He likened cyberwarfare to a "frontier."

"It's actually the new area of endeavor, I would compare it to a new age of exploration. Military doctrine calls the cyber thing a 'domain,' like land sea, air, space, and now cyber … It is almost like a frontier experience" he said.

Hayden, a retired U.S. Air Force general, was director of the Central Intelligence Agency during the administration of President George W. Bush from 2006 to 2009.

defcon 9/9: sex, spies & vulnerabilities

craigslist unexpectedly pulls adult services listings*
cia money behind wi-fi positioning system, or wps*
google pays $8.5m to settle buzz privacy invasion suit*
video: google creepier & more omnipresent with 'instant search'*
court ok's warrantless cell-site tracking*
nsa: US must secure the internet*
dhs cybersecurity watchdogs miss 100s of vulnerabilities on their own network*
cyber task force passes mission to cyber command*
cyber warfare: US military hackers & internet spies*
canada unveils new speed bump: optical illusion of a child*

defcon 9/2: cyborg, spy school, asteroids

intel developing improved mind reading computers*
pentagon may apply preemptive warfare policy to the internet*
flashback: defense official discloses cyberattack*
judge says pennsylvania district must pay $260k in spying case*
flashback: no charges in pennsylvania school's webcam spygate*
video: our terrifyingly crowded solar system - how the asteroids are closing in*

crack the code in cybercom's logo

"be sure to drink your ovaltine fight the net"
from danger room: The U.S. military’s new Cyber Command is headquartered at Ft. Meade, Maryland, one of the military’s most secretive and secure facilities. Its mission is largely opaque, even inside the armed forces. But the there’s another mystery surrounding the emerging unit. It’s embedded in the Cyber Command logo.

On the logo’s inner gold ring is a code: 9ec4c12949a4f3147
4f299058ce2b22a

“It is not just random numbers and does ‘decode’ to something specific,” a Cyber Command source tells Danger Room. “I believe it is specifically detailed in the official heraldry for the unit symbol... While there a few different proposals during the design phase, in the end the choice was obvious and something necessary for every military unit,” the source adds. “The mission.”

With that hint in hand, go crack this code open. E-mail us your best guess, or leave it in the comments below. Our Cyber Command source will confirm the right answer. And the first person to get it gets his/her choice of a Danger Room T-shirt or a ticket to the International Spy Museum.

update: code cracked! cybercom logo's mystery solved
from danger room: Okay, maybe it wasn’t that much of a mystery. In fact, it took a little more than three hours your Danger Room reader jemelehill to figure out the odd string of letters and numbers in the logo of the U.S. military’s new Cyber Command. Turns out, it’s the new unit’s mission statement, translated into 32 digits with the md5 cryptographic hash:

USCYBERCOM plans, coordinates, integrates, synchronizes, and conducts activities to: direct the operations and defense of specified Department of Defense information networks and; prepare to, and when directed, conduct full-spectrum military cyberspace operations in order to enable actions in all domains, ensure freedom of action in cyberspace for the U.S. and its allies, and deny the same to adversaries.

Eventually, other commenters figured it out (especially after jemelehill’s solution made it to all the databases of cracked hashes). But that didn’t stop folks from offering their own, shall we say, creative guesses, in order to win one of two coveted prizes: a Danger Room t-shirt or a ticket to the International Spy Museum.

* “If you can read this, send your resume to jobs@nsa.gov.”
* “I’m sorry, Dave. I’m afraid I can’t do that.”
* “If the intelligence community is a family, think of us as the uncle no one talks about.”
* “Darmok and Jalad at Tanagra”
* “In God We Trust All Others We Monitor”
* “Why do people keep posting the wrong answers when someone solved it like 20 comments ago?”

Yahoo News, the Associated Press, Agence Presse France, Slashdot, El Reg, and the websites of the Washington Post and the L.A. Times all joined in the fun. The hubub even provoked this reponse from an official Defense Department blog:

I cracked the code, but you can keep my t-shirt.

napolitano: US must balance liberties & cybersecurity

"those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety."
from ap: Fighting homegrown terrorism by monitoring Internet communications is a civil liberties trade-off the U.S. government must make to beef up national security, the nation's homeland security chief said Friday.

As terrorists increasingly recruit U.S. citizens, the government needs to constantly balance Americans' civil rights and privacy with the need to keep people safe, said Homeland Security Secretary Janet Napolitano.

But finding that balance has become more complex as homegrown terrorists have used the Internet to reach out to extremists abroad for inspiration and training. Those contacts have spurred a recent rash of U.S.-based terror plots and incidents.

"The First Amendment protects radical opinions, but we need the legal tools to do things like monitor the recruitment of terrorists via the Internet," Napolitano told a gathering of the American Constitution Society for Law and Policy.

Napolitano's comments suggest an effort by the Obama administration to reach out to its more liberal, Democratic constituencies to assuage fears that terrorist worries will lead to the erosion of civil rights.

The administration has faced a number of civil liberties and privacy challenges in recent months as it has tried to increase airport security by adding full-body scanners, or track suspected terrorists traveling into the United States from other countries.

1,000 jobs headed to fort meade under cyber security

'we don't wanna defend the net' (we want to fight the net)
from baltimore business journal: There are still more questions than answers, but information trickling out from the Pentagon is giving a clearer sense for what the military’s cyber security headquarters at Fort George G. Meade will look like.

The U.S. Defense Department now says about 1,000 people will work at Fort Meade in defense of the nation’s information networks, under the direction of National Security Agency Director Keith Alexander. Alexander’s U.S. Cyber Command was officially established May 21, when he was sworn in as its head.

Here’s how Deputy Defense Secretary William J. Lynn III put it in a May 21 interview with reporters, according to American Forces Press Service: “It will be the place where the Department of Homeland Security will come to on cybersecurity matters. And it will help rationalize the interagency process.”

A good portion of Cyber Command’s workers will be shifted from other military bases to Fort Meade, but Alexander could need to hire more workers than are already fending off cyberterrorists and hacking into foreign computer networks for Uncle Sam.

It’s unclear just what the new agency will look like, how much space it will take up at Fort Meade, or how many private contracting jobs might be created in support of USCYBERCOM (that’s its former Pentagon name, just like U.S. Strategic Command is known as USSTRATCOM).

pentagon's cybercom preps war against the american people

from kurt nimmo: NSA Director Lt. Gen. Keith Alexander told the Senate Armed Services Committee in April that he would work to protect the privacy rights of Americans online. It was an interesting comment from a man who heads up an organization responsible for a massive program of illegal dragnet surveillance of domestic communications and communications records of millions of ordinary Americans since at least 2001.

“NSA is the only place in the U.S. government that has the capabilities we need for defense of the private networks,” James A. Lewis, a senior fellow and cybersecurity expert at the Center for Strategic and International Studies, told the CIA’s favorite newspaper last year. “We need to find a way to use those capabilities without putting civil liberties at risk.” CSIS is an insider think tank dominated by the likes of Zbigniew Brzezinski, Brent Scowcroft, Henry Kissinger and other freedom lovers.

Threats against computer networks in the United States are grossly exaggerated. Dire reports issued by the Defense Science Board and the Center for Strategic and International Studies “are usually richer in vivid metaphor — with fears of ‘digital Pearl Harbors’ and ‘cyber-Katrinas’ — than in factual foundation,” writes Evgeny Morozov, a Belarus-born researcher and blogger who writes on the political effects of the internet.

Morozov notes that much of the data on the supposed cyber threat “are gathered by ultra-secretive government agencies — which need to justify their own existence — and cyber-security companies — which derive commercial benefits from popular anxiety.”

On Friday Alexander was appointed to head up the newly activated Cyber Command, a subordinate unified command under United States Strategic Command “designed to conduct virtual combat across the world’s computer networks,” according to The Guardian. The ceremony held at Fort Meade, Maryland, was “low-key” in order to not draw media attention.

Early last week the Air Force assigned approximately 30,000 “digital troops” to “the front lines of cyber warfare,” a number that represents a third of the troops in Afghanistan. “The transformation is part of the service’s larger emphasis on cyberspace operations and merging most computer system operations and network warfare functions under Space Command’s 24th Air Force, based at Lackland Air Force Base, Texas,” reported the Air Force Times on May 19.

flashback: military response to cyber attack 'possible'

booz/mcconnell get $400m in cyberwar contracts in past 6 weeks

as cryptogon notes: guess which goons will have the largest role in recovery efforts after any 'virtual flag terrorism'...
from danger room: Coincidences sure are funny things. Booz Allen Hamilton - the defense contractor that's become synonymous with the idea that the U.S. is getting its ass kicked in an ongoing cyberwar - has racked up more than $400 million worth of deals in the past six weeks to help the Defense Department fight that digital conflict. Strange how that worked out, huh?

Everyone in the Pentagon from Defense Secretary Bob Gates on down says that the military needs to cut its reliance on outside contractors. But few firms are as well-connected as Booz Allen, the one-time management consultancy that today pulls in more than $2.7 billion in government work. And few firms sound the alarm as loudly about a crisis that they’re in the business of fixing. Back in February, for instance, former National Security Agency director and Booz Allen Hamilton executive vice president Mike McConnell declared that “the United States is fighting a cyber-war today, and we are losing.” The White House’s information security czar is one of many experts who calls such rhetoric overheated, at best. That hasn’t stopped Booz Allen from pocketing hundreds of millions of dollars from Washington to wage those battles.

Booz Allen’s latest awards were announced last Thursday — nine contracts with the Air Force, totaling over $150 million. One deal gives the firm $24 million to “provide combat-ready forces to conduct secure cyber operations in and through the electromagnetic spectrum.” A $19.8 million contract asks Booz Allen to “define information assurance scientific and technical analysis to be applied to future military satellite communication systems development.” Earlier in the month, the company got $14 million to “provide threat monitoring, detection, characterization, and actionable information for the computer network operations in order to help advance Department of Defense Global Information Grid initiative and nationally oriented cyber security priorities.”

That sounds not dissimilar to what McConnell asked for in February.

pentagon says military response to cyber attack 'possible'

prepping us for the coming of 'virtual flag terrorism'
from defence talk: The Pentagon would consider a military response in the case of a cyber attack against the United States, a US defense official said on Wednesday. Asked about the possibility of using military force after a cyber assault, James Miller, undersecretary of defense for policy, said: "Yes, we need to think about the potential for responses that are not limited to the cyber domain."

But he said it remained unclear what constituted an act of war in cyberspace. "Those are legal questions that we are attempting to address," Miller said at a conference in Washington, adding that "there are certainly a lot of grey areas in this field."
He said hostile acts in cyberspace covered a wide range, from digital espionage to introducing false data into a network, that did not necessarily represent full-blown war.

But he said the threat to US networks from terrorists, criminals and others was real and growing. "Over the past decade, we've seen the frequency and the sophistication of intrusions into our networks increase," he said. "Our systems are probed thousands of times a day."

The Defense Department has about 90,000 employees and troops using computer networks, with about seven million computer devices, he said.

The US military recently created a new cyber command that will be led by Lieutenant General Keith Alexander, head of the secretive National Security Agency. Alexander was confirmed in his post by the US Senate last week.

In his written testimony to Congress, Alexander said that the new cyber command would be prepared to wage offensive operations as well, despite the risk of sustaining damage to US networks. He told lawmakers that he expected digital operations to take place as part of a wider military campaign, but that special legal authority would be required to respond to a cyber attack staged from a neutral country.

pentagon's cybercom says civilian infrastructure a 'legitimate' target

from antifascist calling: When U.S. Secretary of Defense Robert M. Gates launched Cyber Command (CYBERCOM) last June, the memorandum authorizing its stand-up specified it as a new "subordinate unified command" under U.S. Strategic Command (STRATCOM), one that "must be capable of synchronizing warfighting effects across the global security environment as well as providing support to civil authorities and international partners."

As Antifascist Calling reported at the time, Gates chose Lt. General Keith Alexander, the current Director of the National Security Agency (NSA), to lead the new DOD entity. The agency would be based in Ft. Meade, Maryland, where NSA headquarters are located and the general would direct both organizations.

In that piece I pointed out that STRATCOM is the successor organization to Strategic Air Command (SAC). One of ten Unified Combatant Commands, STRATCOM's brief includes space operations (military satellites), information warfare, missile defense, global command and control, intelligence, surveillance and reconnaissance (ISR), as well as global strike and strategic deterrence, America's first-strike nuclear arsenal. Designating CYBERCOM a STRATCOM branch all but guarantees an aggressive posture. As an organization that will unify all military cyber operations from various service branches under one roof, CYBERCOM will coordinate for example, Air Force development of technologies to deliver what are called "D5 effects" (deceive, deny, disrupt, degrade and destroy).

Ostensibly launched to protect military networks against malicious attacks, the command's offensive nature is underlined by its role as STRATCOM's operational cyber wing. In addition to a defensive brief to "harden" the "dot-mil" domain, the Pentagon plan calls for an offensive capacity, one that will deploy cyber weapons against imperialism's adversaries.

As a leading growth sector in the already-massive Military-Industrial-Security-Complex, the cyberwar market is hitting the corporate "sweet spot" as the Pentagon shifts resources from Cold War "legacy" weapons' systems into what are perceived as "over-the-horizon" offensive capabilities.

In association with STRATCOM, the Armed Forces Communications and Electronics Association (AFCEA), will hold a Cyberspace Symposium, "Ensuring Commanders' Freedom of Action in Cyberspace," May 26-27 in Omaha, Nebraska.

Chock-a-block with heavy-hitters in the defense and security world such as Lockheed Martin, HP, Booz Allen Hamilton, CACI, Cisco, CSC, General Dynamics, QinetiQ, Raytheon and the spooky MITRE Corporation, the symposium seeks to foster "innovation and collaboration between the private sector and government to delve into tough cyber issues." The shin-dig promises to "feature defense contractors and government agencies showcasing their solutions to cyberspace and cyber warfare issues."

During pro forma hearings before the Senate Armed Services Committee (SASC) April 15, Alexander's testimony was short on specifics, as were his written responses to "Advance Questions" submitted to the general by the SASC.

During Thursday's testimony, Alexander told the Senate panel that the command "isn't about efforts to militarize cyberspace," but rather "is about safeguarding the integrity of our military's critical information systems."

"If confirmed" Alexander averred, "I will operate within applicable laws, policies and authorities. I will also identify any gaps in doctrine, policy and law that may prevent national objectives from being fully realized or executed."

What those "national objectives" are and how they might be "executed" are not publicly spelled out, but can be inferred from a wealth of documents and statements from leading cyberwar proponents.

As we will explore below, despite hyperbole to the contrary, CYBERCOM represents long-standing Pentagon plans to militarize cyberspace as part of its so-called "Revolution in Military Affairs" and transform the internet into an offensive weapon for waging aggressive war.