Speaking of Stuxnet . . .

Last week The Washington Post and NBC News reported that retired Marine General James Cartwright, the former Vice Chairman of the Joint Chiefs of Staff, is a target of a Justice Department probe for allegedly leaking classified information about the Stuxnet attack on Iran's nuclear facilities to The New York Times in 2012.

I have never been a fan of Cartwright's* (i.e. he opposed the Afghan Surge in 2009, favored a drone strike rather than a JSOC-led raid against Osama bin Laden's Abbottabad compound in 2011, and since retiring has become a critic of drone strikes), but holy @#$#!!!

It may be true that Cartwright is "one of the most politically contentious military officers in Washington," and that "the foreign-plicy implications of identifying the Stuxnet virus as the handiwork of U.S. spies were enormous," but the possibile indictment of the former number two officer in the U.S. military is what Vice President Biden would call a "BFD."

Note: To be clear, these are policy disagreements. My Marine friends swear by Cartwright's integrirty, and the 2009 accusation that he had an improper relationship with a subordinate was clearly a B.S. smear job.

Retired General James "Hoss" Cartwright, former Vice Chairman of the Joint Chiefs of Staff.

"Wired" on General Keith Alexander

Speaking of cyberwar, Wired recently ran a profile of National Security Agency director and US Cyber Command commander General Keith Alexander. Given Alexander’s centrality to both the War on Terror and the development of U.S. cyber capabilities, he is an important leader to know and understand. Unfortunately, the profile’s author James Bamford chose to substitute sensationalism for insight, and one comes away without any new understanding of Alexander or of the dilemmas for U.S. policy in the face of emerging threats/technologies.

Bamford has made his career as a muckraking journalist pulling back the curtains on the U.S. intelligence community, so he would have appeared to be well-suited to write this piece. And Bamford’s early summary of Alexander’s importance – “Never before has anyone in America’s intelligence sphere come close to his degree of power, the number of people under his command, the expanse of his rule, the length of his reign, or the depth of his secrecy” – is spot on.

Unfortunately, it all goes downhill from there.

Bamford subsequently implies that Alexander was responsible for the intelligence failure of 9/11 and the prisoner abuse scandal at Abu Ghraib prison, amongst other misdeeds. He castigates Alexander has being “militant about secrecy,” which, pardon my naivete, I thought was supposed to be a good thing in the head of a spy agency (?!?). He then identifies Alexander as the mastermind behind Stuxnet, the blowback from which Bamford somehow sees as being responsible for all cyber threats, which he implies Alexander has exaggerated in order to gain more funding (“despite the sequestration, layoffs, and furloughs in the federal government, it’s a boom time for Alexander,” Bamford reports) and, again completely through innuendo, personal wealth someday as an executive.

Now this could all be true, even if it begs the question of how somebody so outstandingly incompetent was confirmed as NSA Director and received a fourth star. For all I know, General Alexander could be a cross between Dr. Evil and Lord Voldemort who drives ten miles under the speed limit in the passing lane and hunts endangered animals on the weekends. But Bamford’s presentation of the history of cyberthreats is inaccurate enough to suggest this was never intended to be anything more than a hit piece.

Genearl Keith Alexander: The man responsible for all the deposed Nigerian prince emails you've ever received?

For example, Bamford writes that Stuxnet is "The first known piece of malware designed to destroy physical equipment." But in 1982 the CIA "allegedly" planted a logic-bomb or trojan horse (depending on the account) into software managing an oil pipeline in the Soviet Union, which crashed its SCADA system and subsequently led to a massive explosion in the pipeline in Siberia. So although Stuxnet was likely the most sophisticated malware attack against physical infrastructure to date, it was not the first by at least a quarter-century.

Bamford also states that Stuxnet "proved that one successful cyberattack begets another," suggesting that the malware's discovery in July 2010 was starting point for all the cyberwar/cybersecurity threats we face today. Yet in April 2007 Estonian websites were disabled by a DDOS (distributed denial of service) attack from a Russian source in retaliation for the removal of a statue honoring Soviet forces killed in World War II, and when Georgia deployed troops to quell a violent separatist movement in South Ossetia in 2008, another DDOS attack crippled its government networks as Russian troops invaded Georgia. Similarly, in July 2009 North Korea launched a massive DDOS attack using hundreds of thousands of infected computers against U.S. and South Korean government websites. All these attacks (which don't include the plethora of cyberattacks by anonymous hackers, either criminal/individuals/organized collectives) predate Stuxnet's discovery. Thus, Bamford's implication that all of our cyber troubles can be laid at Alexander's doorstep is . . . well, bunk.

Moreover, even if one assumes the 2012 attacks on Saudi Aramco and Ras Gas by the Iranian-initiated Shamoon virus were direct retribution for Stuxnet (which is certainly possible), Bamford seems to assume that Iran would not be interested in cyberweapons if not for the cyber attack on the Natanz centrifuges. Again, this is ridiculous. Given the perceived vulnerability of U.S. military and/or governmental networks to cyber attack, any nation seeking an advantage against U.S. forces would naturally pursue cyber as an asymmetric strategy. For example, in 1999 Chinese strategists Qiao Lian and Wang Xiangsui wrote in Unrestricted Warfare that China could use cyber warfare to make up for its qualitative military deficiencies vis-a-vis the United States, and as Richard Clarke and Robert Knake note in Cyber War: "Since the late 1990s, China has systematically done all the things a nation would do if it contemplated having an offensive cyber war capability." (p.54) Similarly, since Desert Storm, Iran has concentrated on developing an asymmetric capabilities to counter U.S. forces (i.e. EFPs in Iraq; reliance on speed boats armed with torpedos conducting suicide attacks on larger ships in the Straits of Hormuz). So to claim, as Bamford does, that the only reason Iran now has a cyber capability is because of Stuxnet is either disingenuous or naive.

This is not to say there aren't legitimate questions to be asked regarding Alexander, including:

- How much access to domestic communications should an intelligence agency be permitted?
- Should one man should head both the NSA and Cyber Command (particularly if Admiral Stavridis is correct that Cyber Command should be made a operational command)?
- Does the potential blowback of creating an expanding market in zero-day vulnerabilities because U.S. intelligence agencies are buying large quantities of zero-day vulnerabilities outweighs these vulnerabilities potential usefulness in offensive cyberwar?

Unfortunately, Bamford comes off either so misinformed or vindictive (i.e. directly comparing Alexander to J. Edgar Hoover) that this piece fails to shed much light on these issues.

Have Drones (and Cyber . . . and SOF) Revolutionized Warfare? (Part Deux)

Making a point similar to Hsia and Sperli, last week former NATO commander Admiral James Stavridis suggested in a recent Foreign Policy.com essay that, together, unmanned vehicles, cybercapabilities, and special operations forces comprise a “New Triad” comparable the Cold War “strategic triad” of delivery systems for nuclear weapons. “Each has an important role to play,” Stavridis says, “but taken together, the sum of their impacts will be far greater than that of each of the parts when used alone.” Among his policy recommendations is that all U.S. cyberforces owned by the individual services be merged into a single organization modeled after U.S. Special Operations Command.

Although the Triad analogy is a bit strained, I find Stavridis’ recommendations/points for further analysis were generally sound. Apparently, the Lexington Institute’s Loren Thompson disagrees . . . strongly. Thompson accuses Stavridis of believing “mass and firepower have had their day,” and asks (rhetorically, one hopes) “Is it really possible that senior military officers believe such nonsense?” Unfortunately, I think Thompson badly mischaracterizes Stavridis’ argument as a straw man to argue against strategic and technological innovation.

Yes, Stavridis – and Hsia, Sperli, and many others – believe that cyber, unmanned vehicles, and SOF (engaging in both kinetic and Foreign Internal Defense-like missions) will be increasingly important in future warfare, or strategic operations below the level of major combat. But this assessment stems from a few observations:

- Because of America's enormous advantage in conventional capabilities, potential adversaries will seek to weaken us through asymmetric means, i.e. cyber or insurgency/terrorism;

- As demonstrated in Afghanistan and Iraq (post-liberation), and in Lebanon in 2006, mass and firepower are in and of themselves insufficient to defeat irregular threats;

- The most effective way to counter a cyber threat is with equal or greater cyber capabilities (both defense and offense). The fact that a catastrophic cyberattack could cripple our ability to retaliate is what makes a cyber arms race potentially so unstable (any security studies academics reading this will nod their heads understanding the dangers of a significant first-mover advantage, which makes developing a second-cyber-strike capability vital);

- The most effective way thus far to attack a decentralized network in allied or U.S. occupied countries has proven to be SOF raids against leadership nodes in conjunction with the development of competent indigenous forces (which, to be sure, can be effectively supported with larger troop formations to protect the civilian population and gain the trust/intelligence necessary to perform the first two tasks);

- The most effective way thus far to attack a decentralized network in ungoverned or hostile territory has been UAV strikes against leadership nodes;

- Financial constraints due to America's massive structural debt, and the American public’s fatigue from the last decade of near continuous combat, will restrict our ability to engage in large-scale military interventions for less-than-vital interests.

Which of these contentions would Thompson dispute? Thompson says “Try flying a Predator over Syria, and see how long it lasts?” Well, the Israelis disabled Syrian air defenses through a cyberattack in 2007 and were able to successfully eliminate a nuclear weapons facility. Thompson says “Try using special operators to blunt a North Korean attack” across the DMZ, even though Stavridis never suggested they were a substitute for such a mission. One could easily counter “Try disrupting a terrorist plot by capturing/killing a jihadist leader with 100,000 troops that will take weeks to deploy to inhospitable terrain and produce hundreds of casualties.”

Again, this isn’t to say that large conventional forces won’t be required in the future and shouldn’t be maintained, but rather that the plethora of strategic threats America faces requires a range of more surgical military options than simply the sledgehammer of armored BCTs that take months to deploy in a world where threats emerge rapidly. (We won't even get into the problem of anti-access capabilities here . . . )

Incidentally, a much more balanced and effective critique of my argument above, unsurprisingly, comes from Major General H.R. McMaster, a highly successful counterinsurgent commander in Iraq, who challenged the potential over-reliance on Special Ops raiders and proxy forces in recent remarks at the Center for Strategic and International Studies. I highly recommend reading the transcript and anything else McMasters writes, as he is likely this generation's premier soldier/intellectual (or at least in the top three).

Have Drones (and Cyber) Revolutionized Warfare? (Part 1)

Tim Hsia and Jared Sperli, Army reservists and ROTC instructors, wrote an interesting piece in The New York Times Monday suggesting that cyberwarfare and drones represent a revolution in in military affairs similar to what the aircraft carrier meant to naval warfare. “Historians,” they write, “will look back and see advancements in cyberwarfare and robotics as the first two revolutions in military affairs of the 21st century.”

Are they correct?

In his classic work, Arms and Influence, Thomas Schelling argued that the basic nature of warfare in the civilized world has remained constant. Roughly speaking, two adversaries deploy forces against one another with the implied threat of targeting the others’ civilian population and engage in combat/deadly force. Once one side’s forces are either sufficiently weakened through attrition or outmaneuvered so that they unable to protect their noncombatants, that side surrenders on the political question at stake that Clausewitz argues is at the root of all wars. (Or something like that . . . it has been a long time since comps back in grad school).

Thus, whether the killing is done with clubs and spears or tanks and bombers, the nature of war remains essentially unchanged, only the means of gaining the strategic leverage to threaten the other side’s population evolves. (i.e. Tanks using blitzkrieg tactics could initially get behind enemy lines faster than any operational counterstroke; Planes from aircraft carriers could threaten to decimate an enemy fleet without facing return fire; Nuclear ICBMs could eliminate entire civilian populations without having to first defeat the adversary’s intervening military forces). If we strictly interpret Schelling's thesis (with which, granted, not everyone may agree) then tanks and carriers represent evolutions rather than revolutions, since they could be eventually countered by anti-tank weapons/defenses, or by other carriers. Conversely, since strategic defenses against nuclear weapons have yet to be perfected (other than deterrence through an assured second-strike capability), this is arguably the only truly revolutionary weapon-to-date. . .

. . . until cyberwarfare, that is.

But first, let’s consider UAVs/drones. Here, it is important to distinguish the technology itself from their current operational/strategic use. I (and others) have argued that properly understood, UAVs are best understood as an evolutionary leap in the technology of conducting air strikes, wherein their size allows them greater loiter time than conventional bombers, and thus both greater discrimination and precision in target selection (as well as not putting human pilots at risk). Theoretically, however, they are susceptible to the same countermeasures as manned crafts, only we are using them against adversaries lacking sophisticated air defenses or technology to jam a sustained drone campaign. If we attempted to use drones on a massive scale against a more capable conventional enemy (i.e. Iran, for example), it is unclear whether they would achieve the same effects. (We could obviously jam enemy air defenses, as we did in Iraq 2003, or as the Israelis did before bombing Syria's nuclear weapons site in 2007, but that further emphasizes the similarity to manned aircraft). This is not to say they would not be extremely useful in such conflicts and reduce airman casualties significantly, but the presence of large numbers of UAVs would not necessarily revolutionize the fundamental tenets of close air support or strategic bombing.

However, UAVs do provide the perfect operational capability for a sustained targeted killing campaign against al-Qa’ida and its affiliates. Two U.S. administrations have chosen a decapitation strategy because the jihadists who comprise the terror network have a such a fanatical belief in the righteousness of their cause that – in Schelling’s terms – there is no civilian population we could sufficiently threaten or conduct punitive strikes against that would dissuade them from their course, as they would merely shrug these fatalities off as “martyrs” for the holy cause. Thus, even if you believe that we are more likely to be militarily engaged with groups of supranational non-state actors - or even superempowered individuals than conventionally armed nation-states in the future - then it is the nature of the adversary that is driving the anti-Schelling/anti-Clausewitzian nature of the Drone War, not the nature of the technology.

Now, if we fought an adversary with its own drone capability (or robot battalions, if you will), and the primary battles were drone-versus-drone with the loser surrendering on the political question as soon as its drones were defeated in order to avoid human casualties (sort of like the original Star Trek episode “A Taste of Armageddon,” only without the disintegration booths), that would be revolutionary. This is exactly what true cyberwar would look like, as theoretically cyberweapons could be used to attack an adversary’s civilian population by devastating their infrastructure through cyberattacks on dams, electrical grids, air traffic control, etc, without ever having to defeat their tanks, bombers, or massed infantry. Worse, such an attack could theoretically be conducted by non-state actors (i.e. al-Qa’ida investing in computer engineers rather than chemical/biological weapons experts; or a completely nihilist offshoot of a group akin to Anonymous or LulzSec), could be conducted in milliseconds rather than even the half-hour it takes for a missile’s intercontinental flight, and in theory could significantly degrade the ability to conduct a retaliatory strike (presuming there is a reasonable certainty of attribution, which is far from a given).

That is a revolution in warfare.

Fortunately, thus far only a few actors (i.e. the United States, Russia, China, and maybe Israel, to name a few) possess the resources/capability to launch such an attack. This not only makes attribution (and consequently deterrence) easier, it also means that -- as was the case during the Cold War -- the political questions in dispute are less likely to rise to the level requiring full-scale conflict. This is a good thing, to be sure.

But I don’t think there are any security experts out there who believe that if the political tensions were elevated enough to justify military conflict (i.e. a full-scale Chinese invasion of Taiwan or another American ally in Asia) that the conflict wouldn’t first erupt as a cyberwar before American and Chinese aircraft ever came within sight of one another.

The soldiers on Eminiar VII (or was it Vendikar?) knew about revolutions in military affairs . . . not so much about stylish headgear.

Boston's Dragnet and the Art of the Manhunt

Following up on yesterday's post on the role of facial recognition technology in the hunt for Boston Marathon bombers, this April piece in Popular Mechanics discussing manhunting tactics with retired police officer and author Jack Schonely is worth revisiting.

Although I still maintain that domestic and strategic manhunts are not wholly analogous, I think this piece reinforces three points I've made in my work:

 

1- Troop strength is not determinative of success in manhunts. In the day after the initial shootout with the Tsarnaev brothers, authorities had thousands of officers sweeping the contained area in Watertown. But Dzhokar had already broken out of that area, and if he had just kept moving might very well have evaded capture that day/night. (Of course, if the brothers had had half a brain between them they would have been in Canada or some other urban area by the time their photos appeared everywhere instead of partying in Dartmouth, MA);

 

2 - Technology is of limited value in strategic manhunts. Schonely, author of Apprehending Fleeing Suspects admits that "a heat signature [from Forward Looking Infrared] is rarely clear enough to identify as a human being" and that the incorporation of air units into manhunts can make patrolmen "overconfident."

 

3 - Human intelligence is still of primary importance. It was the tip from a homeowner regarding the cover on his boat that led the air units to the driveway outside the containment area in the first place, and more importantly, the Tsarnaevs do not appear to have had some place they could go where people would have voluntarily helped them to hide (in Watertown, at least).

 

Again, I hesitate to make this case too strongly, especially because the Tsarnaev's made so many missteps. But a cursory glance certainly does highlight some commonalities that may be useful for commanders and policymakers in the future.  

Al-Shabab Live Tweets Attack

Less than a week after I posted about the debate as to whether or not to shut down terrorist groups' Twitter accounts, Somalia-based al-Qa'ida affiliate al-Shabab live tweeted their suicide attack on a UN compound in Mogadishu yesterday that killed eight people and wounded an unknown number of Somalis.

The tweets themselves range from the intriguing (albeit grossly inaccurate) live accounts of the attack, to the bizarre taunting of the UN representative, Nicholas Kay. But this incident suggests that the jihadist networks are still far ahead of the U.S. Government in terms of using social media for propaganda strategic communications purposes.

"Could Facial Recognition Technology Have Caught the Boston Bombers?"

In a word, no.

Although the wide array of surveillance photos in Copley Square played a role in apprehending Dzhokar and Tamerlan Tsarnaev, advanced technology was not the key to the manhunt, as a bombing victim identified the brothers from a series of photos, which were subsequently released to the public to provide tips (a.k.a. HUMINT) that led the investigators to the brothers.

As Sean Gallagher pointed out in an Ars Technica piece last month: “For people who understand how facial recognition works, this comes as no surprise. Despite advances in the technology, systems are only as good as the data they’re given to work with.” And despite what CSI or NCIS may have led us to believe, “Video from a gas station surveillance camera or a police CCTB camera on some lamppost cannot suddenly be turned into a high-resolution image of a suspect’s face that can then be thrown against a drivers’ license photo database to spit out an instant match.”

A more optimistic take on the topic comes from ForeignPolicy.com’s Joshua Keating, who while admitting that old fashioned detective work was the key to tracking the Tsarnaevs, “this is pretty new technology and . . . we may be getting closer to this kind of thing actually being useful.”

Keating’s optimism is based on a study by Michigan State computer scientists Joshua Klontz and Anil Jain testing whether existing facial recognition software could have identified the Tsarnaevs based on the security camera images taken just before the bombings by adding three headshots of the each brother to a database of more than a million mugshots. When the database was filtered to only look at Caucasian men in their 20s (for some reason, Tamerlan’s photo seemed to draw a lot of female matches . . . which is ironic given his history of domestic violence and fundamentalist beliefs about gender relations), the program produced one bull’s eye based on Dzhokar’s high school graduation photo.  

But this is a thin reed upon which to express hope that this technology will significantly alter the tactics of manhunts, whether domestic or strategic. First, Dzhokar’s school picture would not actually have been available to law enforcement, and the headshot from a driver’s license photo did not place higher than 19th in any of the searches. Conversely, although NeoFace 3.1 did produce one correct match, another young man’s mugshot not only produced a bull’s eye, but was also ranked the third closest match against the other two photos of Dzhokar. So the facial recognition technology did produce a good match, only it was of the wrong person. Finally, because Tamerlan was wearing sunglasses on April 15th, his own mugshot from his 2009 domestic violence arrest did not place higher than 116,342nd as a match.

In other words, no matter how well the technology is developed, simple countermeasures such as wearing sunglasses will likely impede its effectiveness.

Gallagher notes that under the best circumstances, facial recognition can be extremely accurate, but to do so "almost always requires some skilled guidance from humans." This calls to mind former Delta Force commander Pete Blaber’s admonition about relying on technology in manhunts: “The reality and complexity of life virtually guarantee there will never be” an all-purpose technological panacea for finding people. “Instead, these types of capabilities should be looked at as part of an overall system. A buffet of capabilities that could be used in combination with our guys working the situation on the ground to assist in the vexing challenge of locating a wanted man.”