Justin Lynch, Author at Army Times

CENTCOM chief: The future of warfare demands more cyber authorities

Justin Lynch — Tue, 18 Dec 2018 19:14:12 +0000

The Pentagon has received more power to conduct cyber operations in the past 18 months. But for the top Army commander in the Middle East and Central Asia, the new authority is not enough.

The head of U.S. Central Command, Gen. Joseph Votel, wrote in a Dec. 18 paper that the Pentagon must “normalize” electronic warfare and cyberattacks and incorporate them into daily operations.

“Normalizing the cyberspace domain means broader authorities that are more responsive than current bureaucratic processes,” Votel wrote in the Army’s Cyber Defense Review. “It also means we need simple and streamlined organizations and processes to increase lethality and enhance performance.”

The paper was coauthored by Votel, Maj. Gen. Julazadeh and Maj. Weilun Lin.

“Our failure to operationalize and normalize the cyberspace domain effectively cedes it to our adversaries, gives them a competitive advantage and, ultimately, creates an increased attack vector against our objectives,” the authors said.

President Trump gave the Pentagon new authorities to conduct cyber operations in August and minimized the process where other agencies can object to cyberattacks, known as “deconfliction.”

Secretary of Defense Jim Mattis can conduct hacking operations without approval from the White House so long as they do not interfere with the American “national interest,” according to four current and former White House and intelligence officials who were either part of internal deliberations or briefed on the changes.

Yet some current and former U.S. officials are skeptical that the new authorities will mean more effective hacking operations for the Pentagon, because it does not solve the nuances of cyberattacks.

But the new mandates do not go far enough for the three officer authors, who argued that cyberwarfare should be under the same authorities as other types of operations.

“We must not see cyberspace as drastically different and separate from other domains that we create new processes to prepare, plan and fight in this new domain. We continue to seek processes that smooth and simplify operations, reducing friendly friction and accelerating decision-making.”

Current and former Pentagon officials have pointed to conducting cyberattacks against enemies that use networks of neutral or partner nations as an area where the Pentagon has changed its decision-making process in recent years. Those officials also pointed to how the Pentagon was able to use hybrid warfare tactics during the 2016 liberation of Mosul, Iraq, as a textbook example of future hybrid operations.

Votel, Julazadeh and Lin echoed the sentiment of other Pentagon officials who have advocated for cyberattacks, electronic warfare and other information operations to be integrated earlier in military operations.

“We need to proactively execute cyberspace and information operations early in ‘Phase 0 / steady state’ of the planning process — well before operation execution. Only then can we shape the [information environment], hold our adversaries’ capabilities at risk and execute at the speed of war,” the three wrote.

For example, Pentagon officials say they closely monitored Russia’s 2014 hybrid war in Ukraine and learned from Moscow’s tactics.

Votel, Julazadeh and Lin shed light on the changes, writing that information operations were previously “integrated as an afterthought.” Yet over the last two years, Central Command has incorporated cyberattacks, electronic warfare and military deception at the “strategic level.”

And this hybrid warfare has driven new acquisition demands in the Pentagon.

“We need technology and capabilities to keep pace with the operational environment and continue to build the partnerships to do so,” the three officers wrote.

In recent years, Central Command has bolstered its hybrid warfare through new contracts. The centerpiece of that effort is a July 2017 contract worth $621 million to Science Applications International Corporation for IT support to Central Command that could last seven years.

In August 2018, Vistra communications was also awarded a $22 million contract to support offensive and defensive cyber operations for Central Command.

The new way the Army will conduct information operations

Justin Lynch — Mon, 19 Nov 2018 23:20:19 +0000

A new guide from the U.S. Army tells soldiers thinking about information warfare missions to consider a simple task: build a street map.

Such a map should include details about if a United Nations representative is nearby, whether a natural disaster took place and what kind of graffiti covers the walls. Layered with different attributes, events and details about communications, the map could provide a clear picture of which messages may work in specific locations.

That 118-page guide, named “The Conduct of Information Operations,” was released in October and is a fusion of cyber and information warfare that describes how the Army wants to conduct future missions.

“It provides Army leaders and [information operations] professionals with the essential information necessary to integrate IO effectively into their unit’s operation,” Lt. Col Joey Sullinger, a public affairs officer at the Army Combined Arms Center, whom Fifth Domain was referred to by other Army officials, in an email. “All members of the Army Profession ensure they conduct IO in accordance with the moral principles of the Army Ethic.”

The manual takes operators through a multi-stage process of information warfare. In each of the Army’s six battle phases ― which range from the initial “shape” stage to the final “enable civil authority” step ― the guide suggests a tactic for spreading information. Those steps may range from monitoring persons of interest, disrupting communications or cyberattacks.

The Army guide for information warfare comes as the service has focused on combining cyber and information operations with physical attacks. Part of the strategy was informed from when the Pentagon monitored how the Russian military was able to combine cyber, information and physical operations in the Ukraine starting in 2014, according to Pentagon officials.

The new manual also includes a focus on social media, which is described as “a dominant aspect of the information environment.” However, the Army cautions that outlets such as Twitter and Facebook can be used for more than spreading propaganda. Social media should be viewed as a form of intelligence gathering as well, the manual reads.

Yet while the new guides provides a technical step-by-step process of when to use information warfare, it stresses that a coherent narrative is critical. “The why of operations comes down to credibility and legitimacy,” it reads.

Christopher Paul, a senior social scientist at the Rand Corporation, a California-based think tank, said that the Pentagon was previously hesitant about conducting information operations through the internet because Defense Department leaders did not want to risk the possibility of their influence messages inadvertently reaching Americans.

The guide also comes as experts say the U.S. Army lags behind other nations when it comes to information operations.

“The U.S. Army does not have the same level of over-match in the [information environment] that it maintains in the land domain,” said a 2018 study by the Rand Corporation. A tripartite deficiency in capacity, planning, and authorities are the causes of the information warfare gaps, according to the Rand report.

However, the Rand study concluded that if the Army wanted to become more effective in information operations and catch up with other countries, it might have to change some its values.

“Some other actors operate in a virtually unconstrained fashion, while the Army operates in accordance with its authority and guided by statutes, policies, and ethics.”

Inside the Pentagon’s struggle to build a cyber force

Justin Lynch — Mon, 29 Oct 2018 21:46:34 +0000

The Pentagon is taking new steps to build cyber talent in the U.S. military, but experts suggest the armed forces have structural problems that prevent them from becoming a digitally cohesive unit.

Current and former U.S. military officials also tell Fifth Domain that recruiting enough cyber forces is a struggle for the Pentagon.

The U.S. Air Force’s cyber warfare operations is only 46 percent filled, according to a 2016 Air Force Research Institute report, the most recent year available.

The Pentagon is hoping to hire 8,300 cyber positions starting this year, Brig. Gen. Dennis Crall told lawmakers Sept. 26.

“It’s difficult to recruit competent quality that we’re looking for in every part of the country. In some cases, it’s due to high-demand, low-density assets,” Crall said. “There’s just really a strict competition. In other place, they just don’t exist, writ large, where we need them.”

“We recognize that we are in a competition for talent,” Gen. Richard Angle told reporters at an Aug. 8 roundtable. He said that the Army is currently recruiting enough cyber soldiers but if the force wants to grow, it will have to increase its retention. “This is a very high-demand space with a low density population to draw from.”

Angle said that the Pentagon is considering changing the ratio of civilian and military officials in its national mission force, although no decision has been made.

Noting its issues, the Pentagon has taken some steps to attract and retain talent.

The Department of Defense announced Oct. 25 that it is opening the Tatooine workspace in Augusta, Georgia, a facility that will house civilian and military officials working on cyber issues.

In the new work space, Pentagon officials will be working together in “unclassified, collaborative, startup-like spaces using technology and tools found in the private sector,” the Department of Defense said in a statement.

The partnership will “serve as a powerful retention and recruitment tool,” said Lieutenant General Stephen Fogarty, which is expected to occur because top tech talent will be cultivated and supported with the program.

Projects included in the new center include hunting for adversaries in Pentagon networks and redesigning training for cyber soldiers, as well as drone-detection technologies.

This summer, U.S. Cyber Command also went on a hiring spree and created a new process to recruit professionals. The new process included on-the-spot job offers and the first-ever public hiring event.

But the new steps are not likely to be enough, according to former military officials. They tell Fifth Domain that the Pentagon needs to consider using civilians for some tasks.

“We really need to think hard about what needs to be in uniform, what is nice to be in uniform, and what just needs to be done,” said Bryson Bort, a former U.S. Army officer and the founder of SCYTHE, a cybersecurity firm.

“There is a lack of understanding in the combat arms about what cyber could be beyond the latest du jour.”

Hiring cyber talent is a national security priority, a 2018 Defense Science Board report argued.

“The recruiting challenge in the military is especially challenging because of the competition they face with the private sector,” Dave Weinstein, a former official at U.S. cyber command told Fifth Domain.

“A lot of DoD roles are not open to civilians. If the Pentagon approach staffing agnostic of whether or not the person wears a uniform for cyber, they might expand their access to human capital.”

Polar fitness app broadcasted sensitive details of intelligence and service members

Justin Lynch — Mon, 09 Jul 2018 02:58:38 +0000

Military officials working at nuclear weapons facilities. FBI and NSA employees. Americans in the sensitive Green Zone of Bagdad, Iraq.

These are some of the military or intelligence officials who could be identified using public data from the popular Polar Flow fitness platform, according to an investigation by the news website Bellingcat and the Dutch news agency De Correspondent. The public data could be a gold-mine of sensitive information and represents one of the largest open-source security vulnerabilities for the Department of Defense since a similar lapse was found in the Strava exercise app in January.

More than 6,500 users who worked at more than 200 sensitive sites across the world appear to have been unknowingly broadcasting their exercise location and their name to the entire world, according to the joint investigation.

Bellingcat was able to pinpoint the name of a “high-ranking officer” at a base known to host nuclear weapons. It took just a few clicks. Using the Polar Flow app and other information found on the internet, De Correspondent was able to collect a disturbing amount of one Dutch solider’s personal information. They found the name of the solider, the fact he was stationed at one of the key locations where the war against the Islamic State is being waged from, the soldier’s home address, and the names of his wife and kids.

Because of its broad search functions, public data appears to be easier to find in the Polar Flow application compared to the Strava fitness website.

Due to the joint investigation, Polar has disabled the ability to search for exercise data on its platform. In a statement, the company said that “there has been no breach of private data,” and that users must “opt-in” to have their training locations public. Polar reminded users “to avoid publicly sharing GPS files of sensitive locations.”

The investigation comes as the Department of Defense has warned its employees and soldiers to be aware of the information it chooses to make public over the internet.“

Protect your health, biometrics and financial information,” wrote Secretary of Defense Jim Mattis in a June memo. “The potential consequences of compromised data could be serious, not just for you and your families, but for the readiness and resiliency of this department.”

A spokesperson for Polar and the Department of Defense were not immediately available for comment.

Japanese peacekeepers arrive in South Sudan with new powers

Justin Lynch — Mon, 21 Nov 2016 15:10:56 +0000

JUBA, South Sudan — Japanese peacekeepers, with a broader mandate to use force, landed in South Sudan on Monday, the first overseas deployment of the country’s troops with those expanded powers in nearly 70 years.

Dressed in green camouflage uniform, squad leader Yoshino Tanaka stepped off the plane at the head of the Japanese group. He was greeted by and shook hands with Japan’s ambassador to South Sudan, Masahiko Kiya.

The 350 Self-Defense Forces will replace a previous contingent of Japanese peacekeepers who served in the United Nations Mission in South Sudan, but did not have mandate to use force. The new troops will be tasked with engineering and construction in the capital, Juba.

For the first time since the end of World War II, these peacekeepers will have the ability to use force to protect civilians, U.N. staff and themselves. Japan’s constitution, drafted under U.S. direction after the war, forbids the use of force in settling international disputes but the government has reinterpreted the constitution to allow Japanese troops to use force in some situations.

Approved by the Japanese legislature in 2015, the expanded capacity to use of force was opposed by some in Japan who feared that it could entangle the country’s military in an overseas conflict and that it violates Japan’s anti-war constitution.

But Japanese Prime Minister Shinto Abe argued that the broader military powers give Japan the ability to respond to growing threats that include China’s increasing military assertiveness and North Korea’s nuclear ambitions.

The deployment shows the growing trust the Japanese public places in its Self-Defense Forces, Sheila Smith, a senior fellow for Japan studies at the Council on Foreign Relations told the Associated Press.

However she said that many “people are worried that this first case of the Self-Defense Forces’ greater powers could run into problems and be put into a bad situation in South Sudan.”

The forces’ expanded powers will first be tested in the troubled East African nation that has seen continuous fighting since its civil war broke out in December 2013. There are more than 12,000 U.N. peacekeepers already in South Sudan who have faced criticism for failing to protect civilians.

In July, two Chinese peacekeepers died and five others were wounded after their vehicle was struck with a rocket propelled grenade as fighting swept Juba.

Japan’s Self-Defense Forces will still not be able to engage with an opposing army — like South Sudan’s — the only force that is in the capital, said the Council on Foreign Relations’ Smith.

“It’s not as if Japan has unleashed its military,” she said.