16 February 1999. Add AP report and historical article.

15 February 1999. Thanks to D.
Source: http://www.washingtonpost.com/wp-srv/national/dotmil/arkin.htm

The Washington Post, February 15, 1999

The Pentagon and the Web: Round Two

By William M. Arkin
Special to washingtonpost.com

"I think that our government is hemorrhaging in a way that I have never seen in my lifetime," CIA director George Tenet told Congress February 2 in an unusually emotional appeal regarding the state of official secrecy.

Tenet mostly pointed fingers at people in the executive branch, who he said were probably responsible for 80 percent of what appears in the news media.

Lt. Gen. Patrick Hughes, director of the Defense Intelligence Agency, who was testifying alongside Tenet chose a different culprit. His focus was not the Washington sport of peddling secrets for influence (after all, DIA has always been notorious for successfully keeping its thousands of employees in a protected bubble).

Hughes instead point at the Web: "We seem now to have erred on the side of making so much information available that some of it has been damaging to our governmental collective effort."

I suspect the very dynamism and anarchy of the web is at the heart of the new found military discomfort. A network that was once the military's own not only has been fully appropriated. But it shifts and changes by the minute, moving at a speed that exceeds anything that the weapon's makers can produce.

For old timers like Hughes, it is easier to focus on what is truly new with the end of the Cold War rather than to address the breakdown of internal discipline that seems to have struck the military and spy agencies in the same time period.

The Hughes-Tenet war cry may suggest leak investigations and internal crackdown. We've all heard that before.

The more tangible and publicly damaging fallout comes in the ever expanding Internet opposition in the national security community. Official Internet haters latch on to such high level statements and find solace in the call for greater control over information, and in the general sense in Washington that the United States is threatened by cyber-terror.

One senior Pentagon official likens the current dispute between "public affairs" and security proponents over the benefits and dangers of the World Wide Web to be two opposing trains careening towards one another on the same track. So seemingly successful has been the anti-web assault of late that the Federation of American Scientists, a secrecy watchdog, opines that the "golden age of public access to government information" over the Internet is over."

Granted there is a profusion of closed websites and "access denied" messages that have sprung up in the .mil domain in recent months. But FAS hyperventilates as much as the chief intelligence officers do.

The Internet is its own bullet train. Despite the efforts of security goons and information warfare operators who would like to obliterate the web, the public .mil domain remains vibrant and is growing.

The chief of Internet security for the Pentagon is J. William Leonard. Bill Leonard chairs the Department "information vulnerability and the world wide web" task force. Its December 7 "guidance" regarding the content of 3,000 or so official military websites could if taken literally, shut down the .mil domain.

Some see Bill Leonard as the Internet anti-Christ, but in his corner of the security world (that is, where they've actually taken the time to understand the web and what it's all about), Leonard is far less alarmed than Hughes-Tenet.

"When we started the review, I took a look at some random [official] websites," he says. "What struck me first was what I didn't see, which was any sort of consistency. I liken the web to business correspondence. You don't put a business letter on a postcard." Official websites, Leonard says, should have the same formality.

The task force guidance charged military commanders and agency directors with responsibility for the content of their sites. Webmasters are being elbowed aside. It is a phenomenon that every sector of the web deals with at some point - the tyranny of the techies - when the question is raised: how do all the doo-dads and gimmicks enhance our mission?

Bill Leonard denies any overall anti-web campaign ("it's like repealing the law of gravity" he says) nor any attempt to create a new classification for electronic information (see earlier column hyperlink here?).

Data mining and electronic aggregation, he argues nevertheless, is a real threat, particularly when it comes to personal information. "When you put out a personnel roster electronically, you have incurred a new host of risks and vulnerabilities," he says.

Leonard readily admits that many proposed security controls are at conflict with some of the most promising applications of web technology. These include Defense Department favorites like electronic contracting and paperless operations. "When we embark on electronic commerce, there's tremendous advantages," Leonard says. But he points out: the Pentagon is contracting for military goods and services. "There is some information that shouldn't leave the country, even by statute."

In the short term, the Pentagon is making greater use of passworded and IP controlled sites. The long term dream is to establish a superpower intranet only accessible to the cleared.

Does Leonard think that any broad system of passwords or user certificates will be secure, given that the community that the .mil domain serves -- active duty soldiers and reservists, families, veterans, allies, contractors and subcontractors -- numbers in the millions? Probably not. His crash course on the web has taught him, moreover, that the technologies that we see today will certainly not be what we see tomorrow.

William M. Arkin, author of "The U.S. Military Online," is a leading expert on national security and the Internet. He lectures and writes on nuclear weapons, military matters and information warfare. An Army intelligence analyst from 1974-1978, Arkin currently consults for Washingtonpost, Newsweek Interactive, MSNBC and the Natural Resources Defense Council.

Arkin can be reached for comment at william_arkin@washingtonpost.com.

© Copyright 1999 The Washington Post Company

    SOURCE: http://wire.ap.org/ (AP Breaking News)

    Associated Press, 16 February 1999, 01:31 EST

    Pentagon Reassesses Its Web Sites
    By The Associated Press

    WASHINGTON (AP) -- The chairman of the Joint Chiefs of Staff looked on
    as Pentagon cyber-warriors clicked away at their laptops and showed how
    would-be terrorists could find his son's home address.

    Army Gen. Henry Shelton then got a demonstration of how a skilled
    adversary might combine publicly available biographies and contractor
    information on military Web sites with a few well-placed phone calls to
    pin down the dates of highly classified nuclear exercises.

    The classified briefing, held in Shelton's Pentagon office, was then
    given to other generals and admirals as well as senior civilians,
    generating a momentum that has led the military to order a massive scrub
    of its vast network of Internet sites.

    Deputy Defense Secretary John Hamre said military Web sites offered
    adversaries "a potent instrument to obtain, correlate and evaluate an
    unprecedented volume of aggregated information" that could, when
    combined with other sources of information, "endanger Department of
    Defense personnel and their families."

    Instituted Dec. 7, the policy change has touched off a debate as some
    critics argue the Pentagon went too far in restricting the information
    it makes public on the Internet.

    In response, defense and national security officials have become more
    willing to discuss, on condition of not being identified by name, the
    nature of the risk their detailed review of military Web sites revealed.

    "There was information that was potentially tactically useful to an
    adversary, the kind of thing where if someone really wanted to do harm
    to your personnel, it could facilitate them in undertaking an attack,"
    said one senior defense official working on Internet security issues.
    Another national security official called the briefings "eye-openers"
    that startled commanders.

    The briefings stemmed from work done in 1997 and 1998 by Pentagon "red
    teams," a term associated with a notional enemy force in war games. Team
    members tried to learn how much mischief they could do by skillfully
    scanning military Web sites, without any sophisticated hacking. They
    showed Shelton, himself a former special operations specialist, how his
    own biography posted on a military Web site combined with non-military
    databases could quickly lead a terrorist to the home address of one of
    his sons living in Florida.

    The red teams found detailed maps and aerial photographs of military
    installations that would help anyone planning a strike or a terrorist
    action. These were the kinds of pictures, one senior official noted
    ruefully, that the United States spent billions to get during the Cold
    War through its spy satellite network. Now the United States was giving
    such imagery away for free on the Internet.

    Senior officers were particularly concerned when one of the red teams
    was able to combine a variety of data and make highly accurate estimates
    about the timing of nuclear weapons drills, exercises and readiness
    checks, according to two senior national security officials familiar
    with the briefings.

    Biographies of individual commanders of units likely to be involved in
    such operations combined with phone calls to those commanders' bases
    yielded information about temporary duty assignments in Nevada at
    installations involved in nuclear weapons handling. Military Web sites
    containing contractor information, particularly formal requests for bids
    to supply particular security equipment, helped further hone this
    detective work, according to the officials.

    Cleaning the military Web sites of potentially dangerous information has
    proved a monumental task. Bill Leonard, a top Pentagon information
    security official, said the military was unsure initially how many Web
    sites it had, and even today can only provide an estimate. For a time,
    the Army completely closed off access to its 1,000 Web sites. Now back
    on line, the Army's Web sites have been substantially trimmed, as have
    those of the other services. Entire Internet addresses have been put off
    limits, with the terse message on the computer screen that information
    previously available has been removed for security reasons.

    Some think the scrub of military Web sites has gone too far.

    "This is a wartime information policy," said John Pike of the Federation
    of American Scientists, a Washington-based research group that follows
    military and intelligence matters. "All kinds of program information is
    being withdrawn. Almost anything that discloses what an agency actually
    does, beyond a brief mission statement, is going away."

    The Federation is pursuing release of some of the deleted information
    under the Freedom of Information Act. In its filing with the Pentagon's
    security review office, the Federation said anything released as a
    result of the complaint should come in electronic form so the Federation
    can post the information on its Web site.

    To date, the Pentagon cannot point to a specific incident where
    information posted on a military Web site resulted in harm to U.S.
    national security.

    "The menacing scenarios have remained just that -- only scenarios,"
    according to George Smith, editor of The Crypt Newsletter, an online
    publication dealing with computer security.

    But the Pentagon says it has solid electronic evidence that foreign
    countries, including some adversaries, are regular visitors to U.S.
    military Web sites.

    Copyright 1999 The Associated Press.

    American Forces Press Service, 25 September 1998

    Internet Presents Web of Security Issues
    By Paul Stone

    WASHINGTON -- In a briefing room deep in the Pentagon earlier this year, Air
    Force Lt. Col. Buzz Walsh and Maj. Brad Ashley presented a series of
    briefings to top DoD leaders that raised more than just a few eyebrows.

    Selected leaders were shown how it was possible to obtain their individual
    social security numbers, unlisted home phone numbers, and a host of other
    personal information about themselves and their families -- simply by
    cruising the Internet.

    Walsh and Ashley, members of the Pentagon's Joint Staff, were not playing a
    joke on the leaders. Nor were they trying to be clever. Rather they were
    dramatically, and effectively demonstrating the ease of accessing and
    gathering personal and military data on the information highway --
    information which, in the wrong hands, could translate into a vulnerability.

    "You don't need a Ph.D. to do this," Walsh said about the ability to gather
    the information. "There's no rocket science in this capability. What's
    amazing is the ease and speed and the minimal know-how needed. The tools (of
    the Net) are designed for you to do this."

    The concern over personal information on key DoD leaders began with a simple
    inquiry from one particular flag officer who said he was receiving a large
    number of unsolicited calls at home. In addition to having the general's
    unlisted number, the callers knew specifically who he was.

    Beginning with that one inquiry, the Joint Staff set out to discover just
    how easy it is to collect data not only on military personnel, but the
    military in general. They used personal computers at home, used no
    privileged information -- not even a DoD phone book -- and did not use any
    on-line services that perform investigative searches for a fee.

    In less than five minutes on the Net Ashley, starting with only the
    general's name, was able to extract his complete address, unlisted phone
    number, and using a map search engine, build a map and driving directions to
    his house.

    Using the same techniques and Internet search engines, they visited various
    military and military-related Web sites to see how much and the types of
    data they could gather. What they discovered was too much about too much,
    and seemingly too little concern about the free flow of information vs. what
    the public needs to know.

    For example, one Web site for a European-based installation provided more
    than enough information for a potential adversary to learn about its mission
    and to possibly craft an attack. Indeed, the Web site contained an aerial
    photograph of the buildings in which the communication capabilities and
    equipment were housed. By pointing and clicking on any of the buildings, a
    Web surfer would learn the name of the communications system housed in the
    building and its purpose.

    Taking their quest for easily accessible information one step further, the
    Joint Staff decided to see how much information could be collected just by
    typing a military system acronym into an Internet search engine. While not
    everyone would be familiar with defense-related acronyms, many of them are
    now batted around the airwaves on talk shows and on the Internet in
    military-related chat rooms. They soon discovered how easy it was to obtain
    information on almost any topic, with one Web site hyper-linking them to
    another on the same topic.

    What the Joint Staff was doing when they collected their information is
    commonly called "data mining" -- surfing the Net to collect bits of
    information on individuals, specific topics or organizations, and then
    trying to piece together a complete picture. Individuals do it,
    organizations do it and some companies do it for profit.

    While the information they discovered presented legitimate concerns, it
    wasn't all negative. The Army's Ft. Belvoir, Va., home page was cited as one
    example of a Web site which served the needs of both the military and the
    public. It had the sort of information families or interested members of the
    public need and should get.

    So what does all this mean? Is DoD creating individual and institutional
    security problems? In the rush to make information available to the internal
    audience, is too much being made available to the public and those who might
    want to inflict harm?

    The Joint Staff doesn't pretend to have all the answers to these questions,
    but is encouraging users to think about these issues whenever they put
    information on the Internet; and they believe that, in some cases, DoD is
    it's own worst enemy.

    Michael J. White, DoD's assistant director for security countermeasures,
    agrees with the Joint Staff analysis. Moreover, as a security expert, he is
    concerned DoD does indeed exceed what needs to be on the Internet.

    "For fear of not telling our story well enough, we have told too much," he
    said. "Personally, I think there's too much out there -- and you need to
    stop and ask the question: Does this next paragraph really need to be there,
    or can I extract enough or abstract enough so that the intent is there
    without the specificity? And that is hard to do because we are pressed every
    day. So sometimes expediency gets ahead of pausing for a minute and thinking
    through the process: Does the data really need to be there? Is it going to
    hurt me tomorrow morning?

    DoD's policy on releasing information to the public, as spelled out by
    Defense Secretary William Cohen in April 1997, requires DoD "to make
    available timely and accurate information so that the public, Congress and
    the news media may assess and understand the facts about national security
    and defense strategy." The same statement requires that "information be
    withheld only when disclosure would adversely affect national security or
    threaten the men and women of the Armed Forces."

    "On the one hand," Ashley said, "we have fast, cheap and easy global
    communication and coordination. On the other hand, we find ourselves
    protecting official information and essential elements of information
    against point-and-click aggregation. Clearly, this balancing act is a
    function of risk management. Full openness and full protection are equally
    bad answers. We have a serious education, training and awareness issue that
    needs to be addressed."

    The Joint Staff repeatedly returns to the issue of "point-and-click
    aggregation" as a problem that is often overlooked when military personnel
    and organizations place data on the Internet. What they're referring to is
    the ability to collect bits of information from several different Web sites
    to compile a more complete picture of an individual, issue or organization
    with very little effort.

    "The biggest mistake people make is they don't understand how easy it is to
    aggregate information," Walsh said. The lesson from this is that even though
    what is posted on the Net is perfectly innocent in and by itself, when
    combined with other existing information, a larger and more complete picture
    might be put together that was neither intended nor desired.

    A more obvious problem, yet still one not always considered when posting
    information on the Internet, is that the "www" in Web site addresses stands
    for "world wide" Web. Information posted may be intended only for an
    internal audience -- perhaps even a very small and very specific group of
    people. But on the Net, it's available to the world.

    This, security experts agree, is an enormous change from the time when
    foreign intelligence gathering was extremely labor intensive and could only
    be done effectively on U.S. soil.

    "If I'm a bad guy, I can sit back in the security of my homeland and spend
    years looking for a vulnerability before I decide to take a risk and commit
    resources," Ashley said. "I'm at absolutely no risk by doing that. I can
    pick out the most lucrative targets before hand, and may even just bookmark
    those targets for future use. We won't know something has been compromised
    until it's too late." White agrees with the Joint Staff's concern.

    "You can sit in Germany and have access to the United States just as easily
    as you can in Australia or the People's Republic of China or Chile," White
    said. "It doesn't matter where you are. You can go back and forth and in
    between and lose your identity on the net instantaneously. Those who seek to
    use the system feel comfortable they won't be discovered."

    In addition to these issues, security experts see another recurring and
    disturbing problem. In the rush to take advantage of the Net's timeliness
    and distribution capabilities, military personnel are forgetting about or
    ignoring the For Official Use Only policies which previously made the
    information more difficult to obtain. Yet anyone using the Internet doesn't
    have to venture far into the array of military Web sites to come across one
    which states: "For Official Use Only."

    If the information is For Official Use Only, security experts said Web site
    developers, managers and commanders must ask themselves whether the
    information should be there in the first place.

    While officials are most concerned about the information being placed on
    military Web sites, they had similar warnings about individual or family Web
    sites. The Joint Staff recommends the same precautions should apply at home,
    especially as personnel move into high-ranking, key leadership positions.

    At a time when the flow of information is beyond anyone's capability to
    either digest it or control its direction, it's not likely the problems
    brought forward recently by the Joint Staff will be solved any time soon.
    The first step, security experts said, is awareness the problems exist.
    Commanders have to understand not just the information capabilities of the
    World Wide Web, but the information vulnerabilities as well.

    The second step, Walsh pointed out, is for commanders to become actively
    involved in the issue of what's being put on the Internet. Current DoD
    policies require that local commander, public affairs and security reviews
    prior to release of data on Web pages. But the flow of information is so
    great, these reviews may not be occurring and few are looking at the
    aggregation problem.

    "I think it would be very appropriate for a public affairs officer to be the
    commander's lead representative," Walsh said. "But it's a commander's issue
    and it should go down command lines. This is certainly an operational
    security issue. Just like operational security is everybody's business, this
    ultimately is everyone's responsibility."

    White concurred and recommends installations create "security-integrated
    product teams" which would be tasked to develop and implement guidelines for
    creating and monitoring Web sites on the installation.

    "I think having a group come together before the (Web site development)
    process begins will remove an awful lot of pain in the long run," White
    said. "We need to step back one step and think before we begin any effort,
    because once it's done you can't undo it. That makes it very hard in a
    digital environment."

    Although it's not possible to retrieve what's already on the World Wide Web,
    nor predict how it will influence future security issues, Walsh, Ashley and
    White believe it's not too late to make a difference. With a little more
    forethought and a lot more planning, it will be possible to better protect
    the next generation of warfighters, both on and off the battlefield, they
    said.

    End