Released Feb 12, the Pentagon’s strategy shows how the American military will rely on artificial intelligence as a defensive tool.

“We will increase our focus on defensive cybersecurity of hardware and software platforms as a precondition for secure uses of AI,” the Pentagon’s new strategy states. “ In order to ensure DoD AI systems are safe, secure, and robust, we will fund research into AI systems that have a lower risk of accidents; are more resilient, including to hacking and adversarial spoofing.”

A particular focus of the new strategy is researching “emergent effects,” which is what happens when two artificial intelligence systems interact. The Army’s Aberdeen Proving Ground, for one, is conducting studies into how artificial intelligence can protect soldiers’ tactical networks and communications from cyberattacks.

The Pentagon’s artificial intelligence strategy comes as both the American military and hackers have embraced machine learning for cyberattacks.

According to an analysis by Fifth Domain, more than half of the new challenges and programs announced by the intelligence community’s research arm in 2018 involve machine learning or predictive analytics, which represents a potential boon for cybersecurity researchers.

In December, the Pentagon announced that Air Force Lt. Gen. Jack Shanahan would be head of a new artificial intelligence center.

Hackers are using artificial intelligence during cyberattacks, Sam Curry, the chief security officer at Cybereason, a threat intelligence firm, told Fifth Domain. Curry said that a particular risk with artificial intelligence is the use of “second order chaotic systems,” where events cause data inputs to change, using the stock market as an example.

“Second order systems with badly applied, overreacting machine learning are prone to exploitation,” Curry said.

With the release of the artificial intelligence strategy, the Pentagon is attempting to combat significant investments in machine learning by other countries.

“Other nations, particularly China and Russia, are making significant investments in AI for military purposes, including in applications that raise questions regarding international norms and human rights,” the strategy says. “The costs of not implementing this strategy are clear. Failure to adopt AI will result in legacy systems irrelevant to the defense of our people, eroding cohesion among allies and partners, reduced access to markets that will contribute to a decline in our prosperity and standard of living, and growing challenges to societies that have been built upon individual freedoms.”

Three recently announced solicitations are all efforts to expand the cyber training environment for American soldiers, which was recently called insufficient by experts.

The Air Force released a Feb. 5 public solicitation to support expansion of its CyberWorx project by building new training facilities located at the service’s academy in Colorado. The $30 million expansion is expected to be the first phase of the project and will include new cyber research and testing facilities. CyberWorx is a Pentagon effort to partner with cybersecurity businesses and researchers. Ultimately, the Air Force vision includes a 40,000-square-foot center at the Air Force Academy in Colorado that will also be home to the Department of Homeland Security’s Center of Innovation.

The U.S. Army Cyber Center of Excellence also released a public solicitation for information about classroom and virtual training and hands-on exercises for the center’s cybersecurity courses. Specifically, the solicitation notes a need for instructors and doctrine developers. The Army Cyber Center of Excellence provides training to American soldiers and is home to its signals school, among other institutions.

Finally, a Feb. 8 solicitation details U.S. Army plans to build new cyber ranges in four locations; Orlando, Florida, Charleston, South Carolina, Patuxent River, Maryland, and Fort Walton Beach, Florida. Tied specifically to the Pentagon’s new cyber mission force, the new ranges are an effort to conduct more cybersecurity training and certification events.

The flurry of solicitations comes as the Trump administration announced plans to be more aggressive in cyberspace, and require more hackers. But experts have criticized the lack of hands on training that American soldiers receive.

“A common mantra within the U.S. military has been to ‘train as you fight,’” wrote Jennifer McArdle, a non-resident fellow at the Center for Strategic and Budgetary Assessments, in a Jan. 25 paper. “Yet, live training fails to replicate with fidelity the type of cyber and informationized operations that war fighters will experience in a contested and complex battlespace.”

In what is considered the seminal yearly report of foreign threats to the United States, leaders from six high profile intelligence agencies warned that the “post-World War II international system is coming under increasing strain amid continuing cyber” threats, among other avenues of attack.

“China, Russia, North Korea and Iran are advancing their cyber capabilities, which are relatively low-cost and growing in potential severity,” Director of National Intelligence Dan Coats told the Senate Intelligence Committee. “As the world becomes increasingly interconnected, we expect these actors, and others, to rely more and more on cyber capabilities when seeking to gain political economic and military advantages over the United States and its allies and partners.”

China topped the list of cyber threats facing the United States.

“China remains the most active strategic competitor responsible for cyber espionage against the U.S. government, corporations and allies,” the accompanying document read. “Beijing will authorize cyber espionage against key U.S. technology sectors when doing so addresses a significant national security or economic goal not achievable through other means.”

“The Chinese counterintelligence threat is more deep, more diverse, more vexing, more challenging, more comprehensive and more concerning than any other counterintelligence threat that I can think of,” FBI Director Christopher Wray told lawmakers.

Questions emailed to the Chinese embassy in Washington D.C. were not returned.

The sharp rhetoric regarding Beijing comes just one day after the Justice Department accused Chinese telephone conglomerate Huawei of fraud and stealing sensitive trade secrets. American intelligence officials have previously warned against using Huawei phones out of fears it was a sieve for Chinese intelligence. In August, Fifth Domain reported that Huawei phones are vulnerable to hacking.

“China had a remarkable rise in capabilities that are stunning. A significant amount of that was achieved through stealing information of our companies,” Coats, the intelligence chief, warned.

The American intelligence community’s assessment of Chinese digital aggression comes during a trade war between the two countries, and after an agreement between the two nations to limit the use of cyberattacks for business intelligence broke down.

Experts say that China frequently uses publicly available tools, which are relatively cheap, during their cyberattacks. Their attack patterns are also easy to emulate, and experts say that hackers are increasingly making their viruses look like they came from China.

The intelligence chiefs’ briefing also offered insights into how the cyberthreat against the United States is growing more complex.

Wray told lawmakers that nation-states are working with criminal hackers in a “form of outsourcing that makes it even more of a menace.”

“Foreign cyber criminals will continue to conduct for-profit, cyber-enabled theft and extortion against U.S. networks,” the 2019 intelligence assessment said.

However in the immediate future, Coats warned that protecting the 2020 presidential elections represent “a top priority for the intelligence community.”

“We assess that foreign actors will view the 2020 U.S. elections as an opportunity to advance their interests,” Coats said.

The intelligence community assessed that the 2018 midterm elections were targets of foreign nations. Both Democratic and Republican party officials were targets of cyberattacks or misinformation, U.S. officials said.

During his testimony to lawmakers, Coats said election security would continue to be a top focus for the intelligence community.

“On the heels of our successful efforts to protect the integrity of the 2018 midterm elections, we are now focused on incorporating lessons learned in preparation for the 2020 elections.”

The Navy is looking to support research in 36 areas that can help protect weapons systems from cyberattacks, Naval Air Systems Command said in a Jan. 7 update to a broad agency announcement.

“Its not necessarily cutting edge research, but it is the first step in cybersecurity quality control that should have already been done for mission systems,” said Bryson Bort, the founder and CEO of Scythe, a cybersecurity platform.

The Navy had admitted as much.

Research into protecting the department’s weapons comes amid reports that the American military suffers from sustained cyberattacks. In December, an Inspector General report found that some in the Pentagon were not taking basic cybersecurity steps to protect its ballistic missile system. Although the Pentagon’s weapons are worth roughly $1.66 trillion, an October report from the Government Accountability Office found that “nearly all” American missiles, jets, ships and lethal equipment in development are vulnerable to cyberattacks.

The announcement comes after Congress has mandated the Pentagon address its cyber vulnerabilities.

Three of the research areas the Navy is interested are commonly described as the pillars of strong cybersecurity, no matter the institution. They include:

Dynamic reconfiguration

In an effort to confuse attackers, the Navy wants to research “dynamic reconfiguration.” The National Institute of Standards and Technology defines the term as “changes to router rules, access control lists, intrusion detection/prevention system parameters, and filter rules for firewalls and gateways.”

“Organizations perform dynamic reconfiguration of information systems, for example, to stop attacks, to misdirect attackers, and to isolate components of systems, thus limiting the extent of the damage from breaches or compromises,” NIST officials wrote.

Research by the University of Maryland’s Christian Johnson found that pairing predictive analytics with dynamic reconfiguration tactics, the new approach can lead to the “successful development of learning models that identify specific classes of malware such as ransomware,” Johnson wrote in a paper for the RSA conference.

Deception tactics

Experts have long used strategies of physical war in digital battles, including with the use of denial and deception tactics. The Navy wants to boost understanding of this area to better secure its weapons systems.

In 2015, researchers at MITRE, which conducts federally funded research, advocated for a 10-step process for planning and executing deception operations.

“Leveraging classical denial and deception techniques to understand the specifics of adversary attacks enables an organization to build an active, threat-based cyber defense,” a team of researchers wrote.

But the Intelligence Advanced Research Project Activity, the intelligence community’s research arm, says that the use of deceptive software and hardware in cybersecurity is still in its infancy.

“Many techniques lack rigorous experimental measures of effectiveness,” the organization said, adding that “information is insufficient to determine how defensive deception changes attacker behavior.”

Artificial intelligence

If there was a common denominator of the federal government’s investment in cybersecurity it is the use or artificial intelligence.

The Navy has embraced artificial intelligence since its Task Force Cyber Awakening project in 2015.

“We see that the more we automate our networks and the more we use machines to do the heavy lifting, the better. Our brains do not have the intellectual capacity to process all of that information,” Rear Adm. Danelle Barrett, Navy Cyber Security Division Director, told Defense Systems, a trade publication, in a 2017 interview.

More than half of the challenges and research opportunities announced by IARPA in 2018 involved machine learning, according to an analysis by Fifth Domain.

Cyber Command has embraced the technology in a short time period, Capt. Ed Devinney, director of corporate partnerships at the body, said during the November Cyber Con conference hosted by Fifth Domain.

“If you talked to anyone at the command two or three years ago about a system that would be all autonomous, you probably wouldn’t get much traction. But I think there is a growing understanding and consensus that we need to operate at machine speed, especially when talking about active defense of the network,” Devinney said.

He said that everyone likes to use the phrases “artificial intelligence” and “machine learning,” however “there aren’t that many people who do AI very well.”

So where will the country’s hub of cybersecurity innovation reside? A new paper argues that a nucleus of new cybersecurity technologies may struggle to form in the United States.

Because the Department of Defense’s research facilities are dispersed throughout the country and located in smaller metropolitan regions, the Army is in danger of stagnating when it comes to technology innovation, a Dec. 18 paper in the Army’s Cyber Defense Review argued.

“Without immediate, bold action, the Army will miss its best opportunity to seize the initiative in the current Cyber Cold War,” wrote Col. Stoney Trent, an Army official who now works for the Pentagon’s top IT officer in the Joint Artificial Intelligence Center. “The Secretary of Defense fully understands the need for dramatic improvement, and fifteen years of Army acquisition failures have created the crisis necessary for change.”

Trent took aim at the Army’s decision to move its cyber headquarters to Fort Gordon, Georgia, saying it “lacks most of the characteristics that have attracted technologists to other innovation regions.”

“Limited public infrastructure and services, sparse employment options, a humid subtropical climate, a lack of a private research university, and distance from urban centers will likely delay the emergence of innovative technologists in Augusta-Richmond County,” he wrote.

The state of Georgia, which is partnering with the Army on innovation near Fort Gordon, opened the first phase of a planned a $100 million dollar center earlier this year.

But while Trent argued that the Army has “limited input over the location of its installations and major activities,” because basing decisions are made by Congress, the dispersed locations are not ideal for improving the Pentagon’s cyber prowess.

“Due to the location of Army research activities, very few scientists and engineers have access to the operators and analysts who will have to use the technologies under development,” he wrote.

On the contrary, large cities are engines of innovation because they have more local resources, a higher degree of subject area experts and a larger local workforce, Trent argued.

“This exponential increase in innovation is related to social networks and access to ideas, resources, and expertise in more populated urban settings.”

That makes locations like Moffett Air Field in Santa Clara County near Silicon Valley, Fort Devens near Boston, and Fort Hamilton in New York City as potential hubs that “have been left fallow,” Trent argued. “Decades of studies indicate the importance of a culture of experimentation. While our adversaries are experimenting, we must not dither.”

The focus of the hacking spree was an apparent attempt to steal American trade secrets for the benefit of Chinese firms, with the NASA Jet Propulsion Laboratory, the Goddard Space Center and seven companies involved in the aviation, space and satellite industry among the targets. More than 100,000 Navy personnel were also victims, with names, social security numbers, and other personal details stolen, according to the indictment against the two alleged Chinese hackers, Zhu Hua and Zhang Shilong.

“China’s goal simply put is to replace the U.S. as the world’s leading superpower and they are using illegal methods to get there,” said FBI director Christopher Wray. “They are using an expanding set of non-traditional and illegal methods.”

The Chinese embassy in Washington did not return an email seeking comment.

How the Chinese hacked

The Chinese hackers relied on phishing messages sent over email to gain access to victims computers, according to the indictment.

“C17 antenna problems,” read the subject line of one apparent phishing email, which had an attachment containing a malicious Microsoft Word document.

Managed service providers, who remotely store clients’ information, were an apparent target for the Chinese hackers.

“By targeting managed service providers, or firms that store commercial data and intellectual property, the Chinese hackers could steal sensitive business information that gives Beijing based firms an unfair advantage,” said Ron Rosenstein, the deputy attorney general.

The Chinese tactics could put more attention on machine learning programs that can spot the intrusion method. More than 80 percent of cyber attacks and over 70 percent of those from nation states are initiated by exploiting humans rather than computer or network security flaws, according to a fact sheet from the Defense Advanced Research Projects Agency.

A DARPA project, the Active Social Engineering Defense, experiments with using automated learning to warn users of phishing attempts.

Breakdown of Obama-Xi accord

The indictment marks the second time the U.S. has accused China of breaking a 2015 agreement between the two countries which prohibited the use of hacked data for commercial benefit.

“The activity alleged in this indictment violates the commitment that China made to members of the international community,” Rosenstein said.

“We strongly urge China to abide by its commitment to act responsibly in cyberspace and reiterate that the United States will take appropriate measures to defend our interests,” said a joint statement by Secretary of State Michael Pompeo and Secretary of Homeland Security Kirstjen Nielsen.

But experts told Fifth Domiain that the breakdown of the accord, known as the Obama-Xi agreement, would not have a significant impact.

“The accusation from the U.S. government today that China has violated the 2015 Cybersecurity Agreement means little without a case study or data to support,” Priscilla Moriuchi, director of strategic threat development at Recorded Future, a threat intelligence firm, told Fifth Domain. “Demonstrating a violation would require compiling data into an end-to-end narrative; compiling evidence that Chinese intelligence or military officials not only conducted the theft of intellectual property, but then passed that information to a Chinese company, which then used it in a product in a competitive situation with a U.S. business.”

Lawmakers want more cyberattacks and better defense

On Capitol Hill, lawmakers hailed the indictment and called for a strong response from the Trump administration.

Sen. Mark Warner, D-Va., reiterated his call for the Trump administration to take more aggressive action in cyberspace.

“While legal action is important, a truly effective response will require a coordinated approach with our allies and a comprehensive strategy to protect our national security and enhance U.S. competitiveness and resiliency,” Warner said.

But others used the indictment to trumpet legislation.

Rep. Jim Langevin, D-R.I., pushed for the passage of the Cyber Deterrence and Response Act, which he said would “codify important authorities and allow the government to take swift action in response to violations of international norms.”

So when the North Korean leader promised to tame Trump with “fire,” in September 2017, White House officials considered how to slow the Asian country’s march to developing a nuclear weapon.

During a meeting in late 2017, Secretary of Defense Jim Mattis presented a military strategy and Secretary of State Rex Tillerson presented a diplomatic answer. But when it came time to discuss intelligence and hacking options for the National Security Agency and U.S. Cyber Command, some on Trump’s team were frustrated with the answer. They argued the NSA couldn’t digitally deter Kim.

For nearly a year, White House leaders had debated the rules for how America should operate in cyberspace. After brazen hacks by the Chinese and Russian governments that targeted millions of Americans and the 2016 presidential election respectively, senior officials believed they needed to stop the raid on American bits and bytes.

Administration leaders broadly fell into two camps. The first blamed Obama-era rules to operate in cyberspace as too timid and the reason America did not have digital options to deter North Korea’s nuclear program. Unleashing viruses that could upend North Korea’s rockets would require a wide swath of consensus across U.S. government agencies, which all but stifled many hacking plans.

Other officials, such as then Homeland Security adviser Tom Bossert, disagreed, and over a period of months argued that while the procedures needed to change, loosening the rules of engagement too liberally and without caution would be dangerous.

A decision loomed.

While the North Korean debate did not lead to immediate policy changes, it was one of several events that helped push the Trump administration toward a new cybersecurity strategy, according to four current and former White House and intelligence officials who were in the room or briefed on the situation. When the White House announced the new policy in September, national security adviser John Bolton was blunt: “We’re going to do a lot of things offensively, and I think our adversaries need to know that.”

America enters the cyber age

In the early 2010s, Russia was known inside the U.S. intelligence community for its clandestine cyber operations. If White House administrators or National Security Agency analysts spotted Moscow’s cyberwarriors probing American networks before 2014, the Kremlin spies would often suddenly disappear.

“The Russians were known for being stealthy and highly targeted. If you saw them on the network, they would vanish like ghosts and go quiet,” Michael Daniel, the top cybersecurity official at the Obama administration, told Fifth Domain.

“After 2014 they start becoming much more aggressive. We start detecting them trying to penetrate U.S. government networks and instead of melting away they come right back at us, saying ‘I dare you to try and find us. I dare you to try and kick us off your network.’”

One of the first digital disinformation operations against the United States targeted diplomats. Digital sleuths from the Kremlin listened in on a phone call between Victoria Nuland, then the top U.S. American diplomat to Europe, and Geoffrey Pyatt, the U.S. ambassador to Ukraine, according to the State Department. Nuland and Pyatt discussed how to support a new government in Ukraine. Nuland believed the Europeans were being too timid and made her position clear in colorful language.

The phone call was being secretly recorded and was posted to YouTube days later.

“It wasn’t their first use of cyber and aggressive tactics, including manipulating emails and leaking things,” said Nuland, who is now head of the Center for a New American Security. “What was new is their targeting of Americans and the United States in a way where their hand was not masked. Obviously, they denied it, but it was transparent what was going on.”

“What is most interesting is looking at Putin’s first and second term, where they were still relatively cautious about their espionage and tradecraft, as they were in Soviet Union operations. They used only authorized trade professionals and tried to mask their hand to have real deniability,” Nuland said. “Compare that to Putin’s third and fourth term, where they are almost gleeful in their non-denial denials.”

Russian hackers breached the White House’s networks and swiped President Obama’s email correspondence in 2014, according to the New York Times. Two days before Christmas in 2015, Russian hackers allegedly used spear-phishing emails and malicious code embedded in Microsoft Word documents to launch the first publicly acknowledged cyberattack in the world to cause power outages against Ukraine.

But the Russian government was not the only country developing a playbook for hacking. China was revving up a campaign to infiltrate the U.S. government as well.

In April 2015, U.S. officials say that China hacked records of 22 million government officials that were stored by the Office of Personnel Management. That included copies of all U.S. government security clearances. Everything from romantic affairs to undercover assignments to work histories of top-secret programs were pilfered by the Chinese. It was a wakeup call for the U.S. government, Jim Richberg, a national intelligence manager at the Office of the Director of National Intelligence, told Fifth Domain.

The intelligence community needed to re-think what was a target for foreign hackers. “It was kind of a eureka moment of, ‘Oh my goodness, look what can be done and look at the value of data like that.’ That was a watershed,” Richberg said. “There is no dataset too big to talk about potentially exposing.”

Election meddling

It took less than a year for another historic breach.

In a cream-colored building with roman arches near the meandering Moscow River, Russian intelligence officials sent a spear-phishing email to Tony Podesta, the campaign chairman for Hillary Clinton on March 19, 2016. The hackers disguised the email as a Google security notification and tricked Podesta into changing his password. An accompanying link was a disguised Russian intelligence agency website, and the Kremlin spies soon swiped a trove of emails. Russian officials then passed the emails to WikiLeaks, according to a July 13 indictment from Special Counsel Robert Mueller.

“The Russians were over time perfecting their ability to target social media to specific political objective in their own country, in Ukraine, and across Europe before 2016,” Nuland said during 2018 Senate testimony,

But to leaders inside the U.S. government, Russia’s role was not immediately clear. Former U.S. officials said the assessment of Moscow’s responsibility solidified around June after Americans analyzed the activity of Guccifer 2.0, who claimed to be a digital vigilante but was actually a group of Russian spies, according to the Mueller indictment.

It was then that Russian hackers allegedly broke into the Illinois state election network and stole voter registration information of up to 200,000 people. While the hack remained secret for weeks, it set off alarms within the White House and intelligence agencies, two former U.S. officials said.

Jeh Johnson, Obama’s head of the Department of Homeland Security, began contacting state election officials to encourage them to strengthen their cybersecurity efforts, but the effort had mixed success. Some state and local election officials did not trust the Department of Homeland Security and inaccurately believed they were embarking on a federal takeover of the voting process, Suzanne Spaulding, then an undersecretary at the agency, told Fifth Domain. In terse phone calls with Johnson, Georgia Secretary of State Brian Kemp refused help from the federal government. Kemp, now the governor-elect in Georgia, did not respond to a request for comment.

Trump in charge

From the onset of the Trump administration, former and current White House and Pentagon officials were set on changing how the America operated in cyberspace. With information about Russia’s hacking and disinformation becoming clearer by the day, their discussion took a new sense of urgency.

Government officials recalled the shock of the incoming Trump team when they learned how conservative the military was when it came to hacking. “The incoming Trump administration had this assumption that the U.S. was some big gorilla in cyberspace and was actively hacking everyone. There was a little bit of surprise that U.S. policy was very conservative,” a former White House official told Fifth Domain.

The Obama-era rules that governed American cyber operations were called Presidential Policy Directive 20 and said that cyber operations likely to result in “significant consequences” needed presidential approval. Hacking operations also needed to have near unanimous consent between U.S. government agencies.

In memos and long email chains, officials from the State Department, CIA and the NSA often argued to take a more cautious approach for hacking operations, according to former Obama administration officials. Those officials argued that destroying a server that an enemy like the Islamic State used would eliminate valuable intelligence. This was counterproductive, these officials argued, because the NSA wanted to silently sit on an enemy’s computer network and collect intelligence.

Former Secretary of Defense Ash Carter was among those who expressed frustration with America’s cyber operations, particularly against the Islamic State. Whenever Cyber Command had a plan to hack the Islamic State, “the intelligence community tended to delay or try to prevent its use, claiming cyber operations would hinder intelligence collection. In short, none of our agencies showed very well in the cyber fight,” Carter wrote in a Harvard University paper in 2017.

The clash of philosophies meant gridlock. “Sometimes we would meet for 90 minutes to two hours, and then at the end decide that we need to come back tomorrow for part two,” an Obama White House official told Fifth Domain.

Current and former officials recalled a rough beginning to the Trump administration’s cyber planning. National security adviser Michael Flynn brought in a team of staffers who had a hawkish view on cybersecurity, according to four current and former White House and Pentagon officials. When White House officials drafted the first executive order on cybersecurity it was sloppy, according to two former White House officials, with one adding that it included a potentially hostile and unexpected reference to nuclear weapons. And when intelligence agencies asked for permission to partner with European governments, they were given carte blanche to operate without raising the policy to senior Trump administration officials, one former official said.

But most conversations led back to changing America’s offensive cyber operations.

Leaders in the Trump administration were set on changing how the United States operated in cyberspace. The question was whether the White House was going to modify the Obama rules or throw them out completely. Bossert, Trump’s clean-cut homeland security adviser, was respected by U.S. officials because of his experience in the Bush administration.

“What we need to do, living in the largest cyber glass house in the world, is to figure out how to increase our defenses and put in place a rational strategy before we go out and do things that are going to make us – and our private critical infrastructure owners – more vulnerable,” Bossert said during the July 2017 Aspen Security Forum.

Mattis embraced the rising role of cyber and digital warfare, and his office pushed to have more authority. Pentagon leaders said they needed to conduct cyber operations just like they could with land, air and sea, creating a lethal swarm of digital and physical attacks. Other officials also argued that more offensive cyber operations would be a deterrent for nations hacking America, like Russia and China.

For some, an inflection point came as the White House considered options to deter North Korea’s nuclear capability. The lines of code honed inside NSA labs to monitor, stop or alter Pyongyang’s nuclear and military capably would likely have to travel through China, which supplies nearly all North Korea’s internet. During previous debates, officials feared China might mistakenly believe the Americans were hacking them instead of North Korea. The scenario was deemed too risky by some because it could have unforeseen consequences. Advocates for the more aggressive approach in cyberspace argued that the Obama-era rules for cyberspace effectively blocked America from embedding and prepositioning this malware inside of North Korea’s systems. As a result, America was empty-handed when it came to hacking options, according to this line of thinking.

But other officials disagreed. Rather, some in the administration, such as Bossert, believed that the Obama rules in cyberspace were being unfairly scapegoated, as if the nuances of hacking another nation would disappear with more authority. According to this view, America needed to take more aggressive actions in cyberspace to deter foreign countries, but glossing over the nuances of hacking was also dangerous.

And by some accounts there was also evidence that America already had effective hacking programs to deter North Korea’s nuclear ambitions.

According to Bob Woodward’s book “Fear,” during the Obama administration, the United States was able to infect the North Korean government’s missile telemetry with malware that caused errors in their launch sequence. Two former intelligence officials said that North Korea offers limited cyber options because a majority of the country does not have internet access. And by cutting off North Korea’s internet, U.S. officials feared they could also lose intelligence capabilities.

Both the Pentagon and the NSA declined to comment and respond to questions.

Publicly, support for more offensive cyber operations came in the form of congressional testimony from Adm. Michael Rogers, the head of the NSA, and the incoming commander, Gen. Paul Nakasone.

“President Putin has clearly come to the conclusion there is little price to pay here … and that therefore I can continue this activity,” Rogers told Congress in February 2018.

‘Our hands are not tied’

After Trump’s national security adviser H.R. McMaster left the White House in March 2018, Trump replaced him with John Bolton. Days later, Bossert was pushed out of the White House, along with the White House cybersecurity coordinator Rob Joyce.

At the time, a senior Pentagon cyber official described the administration’s cyber policy as “a potential catastrophe.” The official explained how critical cyber issues were not being coordinated and briefings were either being missed or not even taking place.

That summer, the White House finalized its strategy to overhaul the Obama rules from cyberspace. Mattis was given the ability to conduct cyber operations without authority from the president except if it could interfere with the “national interest” of the United States. After Trump rescinded the Obama-era rules Aug. 15, Bolton described the changes in drastic terms.

“Our hands are not tied as they were in the Obama administration,” Bolton said. “Our presidential directive effectively reversed those restraints, enabling offensive cyber operations through the relevant departments.”

Still, some current and former U.S. officials caution that greater authority in cyberspace might not actually deter hacking from foreign nations in some situations.

And there are questions about if the new cyber authorities will have any effect at all on offensive operations. Some experts argue that the officials making a decision about whether to hack another country are more important than the process they use.

“What the Russians did is a little bit like 9/11,” Michael Hayden, the former director of the CIA and the NSA under the Bush administration, told Fifth Domain. “It was an attack from an unexpected direction against a previously unappreciated target.”

Hayden believes that America has encountered a new threat, and like the September 11th attacks, the U.S. government needs a dedicated effort to respond to Russia’s hacking. “President Bush did that. A lot of it was controversial, but you can’t argue it wasn’t extraordinary. President Trump has never called on us to go extraordinary. Everyone is doing their best, but they are playing traditional positions.”

While speaking Dec. 7 at the Center for a New American Security, Warner said the Pentagon should review its focus on conventional weapons systems after aggressive cyber operations by the Russian and Chinese governments.

“We need to realign our priorities while we still can” Warner said. “We need to redirect some of our DoD spending to cyber and, frankly, within other parts of our government, misinformation and disinformation.”

The Pentagon has a $8.5 billion budget for cybersecurity funding in fiscal 2019, according to the White House.

Warner’s comments come amid uncertainty in the Pentagon budget process. The White House Office of Management and Budget has ordered the Pentagon to cut its budget to $733 billion in FY 20, a cut of roughly $33 billion. Pentagon officials and some lawmakers are opposed to the cuts.

In his speech, Warner took aim at two countries for the rise of the nation-state conflict: Russia and China.

Russia devotes “a much greater portion of its much smaller budget to cyber and other tools of asymmetric warfare,” Warner said. When it comes to cyber, Russia is already America’s peer, Warner warned, and when it comes to disinformation and misinformation, Russia “is already ahead of us.”

What Russia spent on disinformation campaigns during the 2017 French and 2016 American elections as well as the 2016 British referendum to leave the European Union was less one F-35 fighter jet, Warner said.

“The notion that this is a one-off isn’t the case,” Warner said.

But in addition to Russia’s growing cyber capabilities, Warner said that China poses a threat because of its defense priorities.

While China spends an estimated $200 billion per year on its defense budget, Warner said the country spends a disproportionate amount on areas of asymmetric warfare.

“The frightening thing to me is the delta of what we spend on our defense budget and what China spends, that $500 million. China is investing in artificial intelligence, quantum computing and 5G and a whole host of other technologies where China wants to be our peer.”

Experts have warned the United States is too reliant on conventional capabilities.

“We are in a great place if we have to re-fight the Persian gulf war,” said Paul Scharre, senior fellow and director at the Center for a New American Security. “Russia doesn’t have to fight us in a military way and they can attack the central nervous system of American democracy,

This paradox is highlighted in a new report, “Cyber Acquisition,” which describes the Department of Defense’s cyber acquisition process as “too slow,” a “support nightmare” and one that “puts the warfighter at risk.”

Because of the delay in acquiring cybersecurity equipment, “the military will be forced to utilize increasingly inferior capabilities,” the paper reads. It will appear in the upcoming Cyber Defense Review, an academic journal.

Frustration over the Pentagon’s acquisition process are not new, but the paper argues that because of rapid innovations in cybersecurity the discontent has been compounded.

“Cyber is at the shortest extreme of the acquisition needs time scale,” the study reads. It was written by Thomas Klemas and Rebecca Lively, both of the U.S. Air Force, and Nazli Choucri, a professor at the Massachusetts Institute of Technology.

Staffers charged with deciding whether to purchase a system or develop a program of record at the Pentagon are rarely the sole arbiter of what is eventually acquired, the paper argues. Instead, layers of bureaucrats are also included in the process, which only exacerbates the delays, the experts said.

“The current system emphasizes rigid adherence to written process and systems over measurable outcomes and speed,” according to the article. “This is not surprising where the volume of regulations, restrictions, and documentation is so vast and acquisition personnel are not trained to operational needs.”

“The system today does not account for unique attributes of cyber capabilities, such as the need for variety and constant change in the environment,” said Katherine Charlet, a former Pentagon deputy assistant secretary and a director at the Carnegie Endowment for International Peace. Charlet warned that the Pentagon should also take into consideration cybersecurity of traditional weapons purchases. “Quality, cost and schedule won’t matter if your system can be immediately defeated by an adversary as soon as it’s fielded, or if it take hundreds of millions more dollars to add cybersecurity mitigations after-the-fact.”

Experts argue that recent policy changes have made the purchasing problem worse.

Pentagon officials can use a process known as “other transaction authorities” to help accelerate the acquisition process. But a recent decision by the Government Accountability Office to review the process sets a dangerous precedent, said Bill Greenwalt, a fellow at the Atlantic Council.

Greenwalt called the Pentagon’s cyber acquisition methodology a “crisis,” in part because the United States is already technologically behind other countries.

However, Greenwalt said that the Pentagon’s new cyber rapid acquisition authority, which Cyber Command used for the first time last year to amass information technology-related research and services, has driven down purchasing time.

Although the need for better purchasing was a recommendation of the Pentagon’s Defense Science Board, a group of outside experts, idea is not explicitly mentioned in the department’s new cyber strategy.

“Many of the problems that we saw which were handicapping IT acquisition were also handicapping cyber acquisition,” said Nick Tsiopanas, a staff member at the 809 panel, which makes purchasing recommendations to the Pentagon.

He highlighted the “separate determination and findings process” that the Pentagon uses in its acquisition method, which he called a “redundancy.”

Tsiopanas argued there has recently been momentum from Pentagon officials to change how equipment is purchased.

“The most intractable thing is the culture. It is the hardest nut to crack.”

If you have a tip, contact us through text message or Signal at 518-727-7885, or via email at jlynch@fifthdomain.com.

12:41 a.m. — Quiet Election Day early sign of cyber policy success — Officials monitoring the U.S. midterm elections have seen no significant hacking attempts, a sign that foreign countries sat out the 2018 vote.

The Department of Homeland Security was worried that Russia and other countries were biding their time for an Election Day surprise. However, there is no evidence that came to fruition, according to an agency official.

Still, DHS monitored general misinformation that tried to sow discord and disrupt Americans faith in the democratic process, according to the agency official.

While U.S. officials will offer a final judgment on the fate of the 2018 midterm vote in 45 days, the preliminary result is a positive sign for the Trump administration’s new cyber plan.

Before the midterm vote, top Pentagon officials said that the election would be one indication of the new plan to take more offensive cyber operations was successful.

4:05 p.m. — Homeland Security sees intentional disinformation efforts, no widespread hacking — While they see no widespread effort to hack the midterm elections, the Department of Homeland Security has seen both intentional and unintentional disinformation efforts as it monitors the voting process, according to top agency officials.

Examples of the intentional disinformation campaigns include more than 100 social media pages that were removed for inauthentic behavior, DHS Undersecretary Chris Krebs said during a press conference.

Krebs said that social media companies have taken down the false information. Despite the spread of fake news, DHS says it is not aware of any widespread hacking efforts.

“This is the most secure election in the modern era,” Homeland Security chief Kirstjen Nielsen during the press conference. Nielsen declined to elaborate on why foreign countries, particularly Russia, have not taken substantial efforts to sway the midterm vote.

The Pentagon is standing by with teams to assist if necessary, Nielsen said.

Inside the agency’s operations center, officials from both the Democratic and Republican Party were present, alongside military and Homeland Security officials. Television stations inside the bland conference space were fixed to CNN. Officials monitoring the vote appeared relaxed, joking with reporters and listening as Nielsen spoke.

However, down in the agency’s classified National Cybersecurity & Communications Integration Center, officials quietly browsed their computers for digital attacks uncoiling across the world. The windowless room was nearly quiet as Homeland Security officials gazed into their computers to search for the latest threats. A series of red blinking lights notified the officials inside the room to be on alert — reporters were in the normally secure space.

3:30 p.m. — Old machines cause delays — Voter protection volunteers working at polling locations across the country report that old machines prone to breaking down or experiencing bugs during voting have caused problems in many precincts and slowed down lines at polling places. Some locations were forced to open late as a result of malfunctioning machines.

Experts from Common Cause, a grassroots organization that works to support voters on election day, said that these problems are attributable to known bugs and mechanical failures, but malicious actors wouldn’t necessarily have a hard time changing results through malware.

Electronic voter rolls have incorrectly listed some voters as having already voted absentee, which required checking against other databases and prolonged voting times.

Many locations are also struggling with new poll workers who have incorrectly told people that they cannot vote or must cast a provisional ballot.

These issues combined increased wait times in many locations, including around Atlanta, Georgia, where wait times averaged three hours.

1:55 p.m. — DHS monitoring continues — Election security officials monitoring the midterm vote have seen the scanning of state election infrastructure, which they say is a normal event they expected.

The Department of Homeland Security is monitoring technical glitches, but have seen no substantial election security events so far.

11:13 a.m. — Inside Homeland Security’s Election Day efforts — The Department of Homeland Security says they have been preparing for two years to protect the midterm elections. Will it pay off?

The agency has been in an “enhanced readiness posture” since Sept. 21, adding dedicated personnel and tracking voting information as part of their election security effort, according to a DHS official.

On Election Day morning, roughly 20 states were logged into the agency’s situation awareness room, according to the DHS official, a number that was expected to fluctuate as the day goes on. The agency has several hundred people out in the field to protect the midterm vote, and has an official in every state.

Intelligence officials say that they have worked hard to communicate more with local governments and share potential threats.

9:56 a.m. — Incorrect polling information in Rhode Island — Rhode Island Secretary of State Nellie Gorbea said on Twitter that her agency has received reports of voters “receiving incorrect polling place information from 3rd party applications.”

DHS officials say that local and state websites are the most reliable source to receive polling place information.

9:27 a.m. — DHS sees uneventful start to midterm vote, concerned about fake news — In an early sign that the midterm vote is not seeing the kind of widespread disinformation efforts that were witnessed in the 2016 presidential election, a Department of Homeland Security official said hours after the polls opened on the East Coast that there is nothing significant to report regarding election security incidents.

However, the official warned that foreign countries and Russia are continuing to spread disinformation with the goal of creating mistrust.

The agency is more concerned about someone falsely claiming to have hacked voting tallies to spread sentiments that the results are tainted.

A sign of the increased preparation for the midterm vote is the actions of Facebook, the DHS official said, which took down more than 100 pages just hours before the polls opened on Election Day.

———–MONDAY, NOV. 5———–

11:30 p.m. — Facebook shuts down pages spreading disinformation at request of US authorities — Social media network Facebook said that it has taken down more than 100 pages that “may be engaged in coordinated inauthentic behavior” after first being notified by U.S. law enforcement just hours before voting beings.

Facebook identified and blocked around 30 Facebook accounts and 85 Instagram accounts, the company said in a statement late Monday night. Most of the Instagram accounts were focused on celebrities and political debate, according to the company.

“Given that we are only one day away from important elections in the US, we wanted to let people know about the action we’ve taken and the facts as we know them today,” Facebook said in a statement.

“Once we know more — including whether these accounts are linked to the Russia-based Internet Research Agency or other foreign entities — we will update this post.”

Facebook’s action come after the company has taken down hundreds of pages that originated in Iran and Russia that have focused on spreading disinformation.

7:54 p.m. — Top Trump officials warn Russia, other nations trying to sway sentiment — Although top Trump administration officials see no evidence that election infrastructure has been compromised, they are warning hours before polls open for the midterm vote that Russia and other countries are trying to sway public opinion.

“Americans should be aware that foreign actors — and Russia in particular — continue to try to influence public sentiment and voter perceptions through actions intended to sow discord,” DHS Secretary Kirstjen Nielsen, Attorney General Jeff Sessions, Director of National Intelligence Dan Coats and FBI Director Christopher Wray said in a joint statement.

“They can do this by spreading false information about political processes and candidates, lying about their own interference activities, disseminating propaganda on social media, and through other tactics.”

At this time, the officials said they have “no indication of compromise of our nation’s election infrastructure that would prevent voting, change vote counts, or disrupt the ability to tally votes.”

They officials added that “the United States will not tolerate foreign interference in our elections from Russia, China, Iran, or other nations.”

The officials said that Americans should get voting information from state and local election officials, and be cautious when reading election-related information.

“Before sharing, ask yourself, ‘Who wrote it? Who posted it? What are their sources?’”

3:55 p.m. — Illinois fears election day disinformation — While top election officials in Illinois have expressed confident that they have taken preventative steps to avoid a voting-day nightmare, there is a fear last-minute hacks could lead to the spread of disinformation and dissuade voters.

The Illinois State Board of Elections believes one nightmare scenario involves a hacker penetrating a county website and either posting false information that polling places have been closed or reporting fake results to spread mistrust, Matt Dietrich, a spokesman for the state agency, told Fifth Domain.

While there is no public evidence that hackers plan on spreading this type of disinformation, top federal officials also say this particular scenario is a possibility.

Dietrich also said that the board of elections fear a ransomware attack on its voting data system.

During the 2016 campaign season, the Illinois electronic voter registration database was breached by a cyberattack. Since then, the state board has added additional firewalls, hired new IT staff and conducted election security training. Illinois has also received more than $13 million for election security through the Help America Vote Act.

Hours from the opening of polls in Illinois, Dietrich said that the “frame of mind is vigilant. We are confident we are doing everything we can.”

2:08 p.m. — DHS official: Russia pushing fake news during midterm vote — Russia is using disinformation and influence operations to spread fake news during the midterm elections, according to a top Department of Homeland Security official.

The Russians are pushing messaging about compromised systems in the state of Texas that is “just not true,” Christopher Krebs, undersecretary for the DHS National Protection and Programs Directorate, said on CBS This Morning.

Krebs said a Boston Globe report alleging that the federal government has logged more than 160 reports of suspected meddling since Aug. 1 is evidence of better coordination with state governments.

“It is a roll up of things that are happening on a daily basis,” Krebs said, describing many of the hacks as typical phishing and scanning attempts.

“I’d caution to call these attacks,” Krebs said, adding DHS has not attributed these hacking efforts to a nation state.

1:24 p.m. — Georgia to conduct criminal investigation into hacking claim — The Georgia Bureau of Investigation will conduct a criminal investigation into allegations of cybercrimes by Secretary of State and Republican gubernatorial candidate Brian Kemp, a spokeswoman for the Georgia agency told Fifth Domain.

The investigation was requested by the secretary of state’s office, Nelly Miles, a spokeswoman for the Georgia Bureau of Investigation, said in an email.

Kemp’s office has not offered any evidence of his claim regarding a potential hack on the Georgia registration database, and has refused to recuse himself as secretary of state, a position that oversees the election effort.

Democratic gubernatorial candidate Stacey Abrams said in a interview with the Atlanta Journal Constitution that Kemp was “trying to distract voters with a desperate ploy.”

12:25 p.m. — How US intelligence agencies reformed after 2016 hacking — The U.S. government was caught off guard by Russia’s hacking efforts during the 2016 elections, current and former U.S. intelligence and White House officials have told Fifth Domain. To be clear, there is no evidence that the vote tally was changed during the 2016 elections. Instead, U.S. government officials say that Russia hacked the Clinton campaign and weaponized information through leaks to sway Americans perceptions.

Since then, the U.S. intelligence community has started a new election security task force, boosted collaboration with local officials and has taken offensive cyber operations.

The creation of the NSA’s election security small group this May was meant to monitor foreign government’s actions during future elections. Information from the task force is then given to the Department of Homeland Security and FBI, who works to update local election officials.

The NSA has also taken offensive operations “in connection with defending the integrity of our electoral process and defending the overall integrity of our information technology systems,” national security advisor John Bolton said Oct. 31 during an event at the Alexander Hamilton Institute.

Some former intelligence officials have told Fifth Domain that the changes have not been strong enough and blame an absence of executive leadership.

The intelligence community believes that it is difficult to compare the threat of election interference in the midterm elections with the 2016 presidential vote, because adversaries and the U.S. government’s tactics have changed. But American intelligence officials say foreign countries are trying to sow discord and undermine faith in the democratic process, and their midterm activity could be preparation for the 2020 election.

10:54 a.m. — DHS refers Georgia hacking claims to state — An official from the Department of Homeland Security told Fifth Domain the agency has been notified of an accusation of a potential hack on the Georgia registration database, and are deferring to the state for further details.

The office of Georgia Secretary of State and Republican gubernatorial candidate Brian Kemp has, without citing evidence, opened an investigation into the Democratic Party of Georgia for “failed efforts to breach the online voter registration system.” In a Nov. 4 statement, Kemp’s office requested the FBI investigate the claims, and said the secretary of state’s office would be working with private-sector vendors and investigators to review data logs. Kemp has refused to step down from his role as secretary of state, the office which oversees the elections.

Democratic gubernatorial candidate Stacey Abrams said in a interview with the Atlanta Journal Constitution that Kemp was “trying to distract voters with a desperate ploy.”

“This is also someone who has a strong habit of having hackable systems,” Abrams said. “He once again is overseeing a vulnerable system and is blaming someone for his mistakes.”

A spokesperson for the FBI and the Georgia Secretary of State office did not immediately return requests for comment.

Kemp was one of the few secretaries of state who refused support from the Department of Homeland Security during the 2016 elections. Former Homeland Security officials have told Fifth Domain that when DHS tired to persuade Kemp to accept federal support, the Georgia secretary argued that the federal government was trying to take over local elections.