Justin Lynch, Author at Navy Times

CENTCOM chief: The future of warfare demands more cyber authorities

Justin Lynch — Tue, 18 Dec 2018 19:14:12 +0000

The Pentagon has received more power to conduct cyber operations in the past 18 months. But for the top Army commander in the Middle East and Central Asia, the new authority is not enough.

The head of U.S. Central Command, Gen. Joseph Votel, wrote in a Dec. 18 paper that the Pentagon must “normalize” electronic warfare and cyberattacks and incorporate them into daily operations.

“Normalizing the cyberspace domain means broader authorities that are more responsive than current bureaucratic processes,” Votel wrote in the Army’s Cyber Defense Review. “It also means we need simple and streamlined organizations and processes to increase lethality and enhance performance.”

The paper was coauthored by Votel, Maj. Gen. Julazadeh and Maj. Weilun Lin.

“Our failure to operationalize and normalize the cyberspace domain effectively cedes it to our adversaries, gives them a competitive advantage and, ultimately, creates an increased attack vector against our objectives,” the authors said.

President Trump gave the Pentagon new authorities to conduct cyber operations in August and minimized the process where other agencies can object to cyberattacks, known as “deconfliction.”

Secretary of Defense Jim Mattis can conduct hacking operations without approval from the White House so long as they do not interfere with the American “national interest,” according to four current and former White House and intelligence officials who were either part of internal deliberations or briefed on the changes.

Yet some current and former U.S. officials are skeptical that the new authorities will mean more effective hacking operations for the Pentagon, because it does not solve the nuances of cyberattacks.

But the new mandates do not go far enough for the three officer authors, who argued that cyberwarfare should be under the same authorities as other types of operations.

“We must not see cyberspace as drastically different and separate from other domains that we create new processes to prepare, plan and fight in this new domain. We continue to seek processes that smooth and simplify operations, reducing friendly friction and accelerating decision-making.”

Current and former Pentagon officials have pointed to conducting cyberattacks against enemies that use networks of neutral or partner nations as an area where the Pentagon has changed its decision-making process in recent years. Those officials also pointed to how the Pentagon was able to use hybrid warfare tactics during the 2016 liberation of Mosul, Iraq, as a textbook example of future hybrid operations.

Votel, Julazadeh and Lin echoed the sentiment of other Pentagon officials who have advocated for cyberattacks, electronic warfare and other information operations to be integrated earlier in military operations.

“We need to proactively execute cyberspace and information operations early in ‘Phase 0 / steady state’ of the planning process — well before operation execution. Only then can we shape the [information environment], hold our adversaries’ capabilities at risk and execute at the speed of war,” the three wrote.

For example, Pentagon officials say they closely monitored Russia’s 2014 hybrid war in Ukraine and learned from Moscow’s tactics.

Votel, Julazadeh and Lin shed light on the changes, writing that information operations were previously “integrated as an afterthought.” Yet over the last two years, Central Command has incorporated cyberattacks, electronic warfare and military deception at the “strategic level.”

And this hybrid warfare has driven new acquisition demands in the Pentagon.

“We need technology and capabilities to keep pace with the operational environment and continue to build the partnerships to do so,” the three officers wrote.

In recent years, Central Command has bolstered its hybrid warfare through new contracts. The centerpiece of that effort is a July 2017 contract worth $621 million to Science Applications International Corporation for IT support to Central Command that could last seven years.

In August 2018, Vistra communications was also awarded a $22 million contract to support offensive and defensive cyber operations for Central Command.

Inside the Pentagon’s struggle to build a cyber force

Justin Lynch — Mon, 29 Oct 2018 21:46:34 +0000

The Pentagon is taking new steps to build cyber talent in the U.S. military, but experts suggest the armed forces have structural problems that prevent them from becoming a digitally cohesive unit.

Current and former U.S. military officials also tell Fifth Domain that recruiting enough cyber forces is a struggle for the Pentagon.

The U.S. Air Force’s cyber warfare operations is only 46 percent filled, according to a 2016 Air Force Research Institute report, the most recent year available.

The Pentagon is hoping to hire 8,300 cyber positions starting this year, Brig. Gen. Dennis Crall told lawmakers Sept. 26.

“It’s difficult to recruit competent quality that we’re looking for in every part of the country. In some cases, it’s due to high-demand, low-density assets,” Crall said. “There’s just really a strict competition. In other place, they just don’t exist, writ large, where we need them.”

“We recognize that we are in a competition for talent,” Gen. Richard Angle told reporters at an Aug. 8 roundtable. He said that the Army is currently recruiting enough cyber soldiers but if the force wants to grow, it will have to increase its retention. “This is a very high-demand space with a low density population to draw from.”

Angle said that the Pentagon is considering changing the ratio of civilian and military officials in its national mission force, although no decision has been made.

Noting its issues, the Pentagon has taken some steps to attract and retain talent.

The Department of Defense announced Oct. 25 that it is opening the Tatooine workspace in Augusta, Georgia, a facility that will house civilian and military officials working on cyber issues.

In the new work space, Pentagon officials will be working together in “unclassified, collaborative, startup-like spaces using technology and tools found in the private sector,” the Department of Defense said in a statement.

The partnership will “serve as a powerful retention and recruitment tool,” said Lieutenant General Stephen Fogarty, which is expected to occur because top tech talent will be cultivated and supported with the program.

Projects included in the new center include hunting for adversaries in Pentagon networks and redesigning training for cyber soldiers, as well as drone-detection technologies.

This summer, U.S. Cyber Command also went on a hiring spree and created a new process to recruit professionals. The new process included on-the-spot job offers and the first-ever public hiring event.

But the new steps are not likely to be enough, according to former military officials. They tell Fifth Domain that the Pentagon needs to consider using civilians for some tasks.

“We really need to think hard about what needs to be in uniform, what is nice to be in uniform, and what just needs to be done,” said Bryson Bort, a former U.S. Army officer and the founder of SCYTHE, a cybersecurity firm.

“There is a lack of understanding in the combat arms about what cyber could be beyond the latest du jour.”

Hiring cyber talent is a national security priority, a 2018 Defense Science Board report argued.

“The recruiting challenge in the military is especially challenging because of the competition they face with the private sector,” Dave Weinstein, a former official at U.S. cyber command told Fifth Domain.

“A lot of DoD roles are not open to civilians. If the Pentagon approach staffing agnostic of whether or not the person wears a uniform for cyber, they might expand their access to human capital.”

Polar fitness app broadcasted sensitive details of intelligence and service members

Justin Lynch — Mon, 09 Jul 2018 02:58:38 +0000

Military officials working at nuclear weapons facilities. FBI and NSA employees. Americans in the sensitive Green Zone of Bagdad, Iraq.

These are some of the military or intelligence officials who could be identified using public data from the popular Polar Flow fitness platform, according to an investigation by the news website Bellingcat and the Dutch news agency De Correspondent. The public data could be a gold-mine of sensitive information and represents one of the largest open-source security vulnerabilities for the Department of Defense since a similar lapse was found in the Strava exercise app in January.

More than 6,500 users who worked at more than 200 sensitive sites across the world appear to have been unknowingly broadcasting their exercise location and their name to the entire world, according to the joint investigation.

Bellingcat was able to pinpoint the name of a “high-ranking officer” at a base known to host nuclear weapons. It took just a few clicks. Using the Polar Flow app and other information found on the internet, De Correspondent was able to collect a disturbing amount of one Dutch solider’s personal information. They found the name of the solider, the fact he was stationed at one of the key locations where the war against the Islamic State is being waged from, the soldier’s home address, and the names of his wife and kids.

Because of its broad search functions, public data appears to be easier to find in the Polar Flow application compared to the Strava fitness website.

Due to the joint investigation, Polar has disabled the ability to search for exercise data on its platform. In a statement, the company said that “there has been no breach of private data,” and that users must “opt-in” to have their training locations public. Polar reminded users “to avoid publicly sharing GPS files of sensitive locations.”

The investigation comes as the Department of Defense has warned its employees and soldiers to be aware of the information it chooses to make public over the internet.“

Protect your health, biometrics and financial information,” wrote Secretary of Defense Jim Mattis in a June memo. “The potential consequences of compromised data could be serious, not just for you and your families, but for the readiness and resiliency of this department.”

A spokesperson for Polar and the Department of Defense were not immediately available for comment.

Japanese peacekeepers arrive in South Sudan with new powers

Justin Lynch — Mon, 21 Nov 2016 15:10:56 +0000

JUBA, South Sudan — Japanese peacekeepers, with a broader mandate to use force, landed in South Sudan on Monday, the first overseas deployment of the country’s troops with those expanded powers in nearly 70 years.

Dressed in green camouflage uniform, squad leader Yoshino Tanaka stepped off the plane at the head of the Japanese group. He was greeted by and shook hands with Japan’s ambassador to South Sudan, Masahiko Kiya.

The 350 Self-Defense Forces will replace a previous contingent of Japanese peacekeepers who served in the United Nations Mission in South Sudan, but did not have mandate to use force. The new troops will be tasked with engineering and construction in the capital, Juba.

For the first time since the end of World War II, these peacekeepers will have the ability to use force to protect civilians, U.N. staff and themselves. Japan’s constitution, drafted under U.S. direction after the war, forbids the use of force in settling international disputes but the government has reinterpreted the constitution to allow Japanese troops to use force in some situations.

Approved by the Japanese legislature in 2015, the expanded capacity to use of force was opposed by some in Japan who feared that it could entangle the country’s military in an overseas conflict and that it violates Japan’s anti-war constitution.

But Japanese Prime Minister Shinto Abe argued that the broader military powers give Japan the ability to respond to growing threats that include China’s increasing military assertiveness and North Korea’s nuclear ambitions.

The deployment shows the growing trust the Japanese public places in its Self-Defense Forces, Sheila Smith, a senior fellow for Japan studies at the Council on Foreign Relations told the Associated Press.

However she said that many “people are worried that this first case of the Self-Defense Forces’ greater powers could run into problems and be put into a bad situation in South Sudan.”

The forces’ expanded powers will first be tested in the troubled East African nation that has seen continuous fighting since its civil war broke out in December 2013. There are more than 12,000 U.N. peacekeepers already in South Sudan who have faced criticism for failing to protect civilians.

In July, two Chinese peacekeepers died and five others were wounded after their vehicle was struck with a rocket propelled grenade as fighting swept Juba.

Japan’s Self-Defense Forces will still not be able to engage with an opposing army — like South Sudan’s — the only force that is in the capital, said the Council on Foreign Relations’ Smith.

“It’s not as if Japan has unleashed its military,” she said.