18 September 1998
Thanks to D. Date: Fri, 18 Sep 1998 08:44:10 -0400 To: jya@pipeline.com Subject: CNN: Terrorist threat may limit Pentagon Web site Terrorist threat may limit Pentagon Web site September 17, 1998 Web posted at: 2:08 p.m. EDT (1808 GMT) [Sidebar: For site security purposes and to ensure that this service remains available to all users, this government computer system employs software programs to monitor network traffic to identify unauthorized attempts to upload or change information, or otherwise cause damage. -- Department of Defense] WASHINGTON (CNN) -- The Pentagon, concerned that some of the massive amounts of information it puts on the Internet might be useful to terrorists, is considering whether to trim its Web presence. The government's various military Web sites -- one for the Department of the Defense and one for each service branch -- "perhaps provide too much information," said Pentagon spokesman Ken Bacon. During a Wednesday news briefing he did not say whether a specific threat prompted the Pentagon's concern. Tempting to terrorists? But in August, after the United States fired cruise missiles at suspected terrorist targets in Afghanistan and Sudan, the Pentagon departed from its normal procedure and did not provide operational details of the strikes. Commanders of all service branches also were reminded not to put detailed information about the attacks on their Web sites. Military officials say information such as the names of commanders and the location of their families could be used by terrorists seeking retaliation. Some of the military's Web pages contain unclassified but detailed information about ships, planes, weapons, troop deployments and bases. Determining what stays and what goes is a project headed by Deputy Defense Secretary John Hamre, the Pentagon's point man on technology issues. [Sidebar: Unauthorized attempts to upload information or change information on this service are strictly prohibited and may be punishable under the Computer Fraud and Abuse Act of 1986 and the National Information Infrastructure Protection Act. -- Department of Defense] Bacon said Hamre and the Joint Chiefs of Staff office have been looking "aggressively" at the military's Web sites to see what information currently is available on: • Building plans; • "Actual diagrams of buildings of certain military installations"; • "Lessons learned on certain military operations or programs"; • Future research and development goals; and • "Personnel information that could perhaps provide too much information in terms of locating people or recreating identities from information provided on the Internet." Changes under review; no decision yet The Pentagon's review of material it puts on the Internet has been ongoing for some time. An announcement of what it plans to do will be made "at some appropriate time," Bacon said. "We're in the process now, as I believe many private companies are, of trying to sort out what the right balance is between providing useful information and providing more information than is necessary over the Internet," he told reporters. "Some of this involves cutting out clutter on the Internet and focusing Web sites so that they provide useful amounts of information without overwhelming users," Bacon said. U.S. government Web sites are frequent targets for hackers. Last year, the Pentagon alone recorded more than 250,000 break-in attempts and in February, hackers succeeded in gaining access to the Pentagon's unclassified files.
DoD News Briefing Mr. Kenneth H. Bacon, ASD PA Tuesday, September 15, 1998 - 2:15 p.m. [Excerpts] Q There was a report I guess last week about an impending memorandum from Dr. Hamre to lay out some stricter guidelines, I guess, on what the DoD posts on its web site. I was wondering if you could maybe give us a little bit of background on this activity, and whether or not there are some specific cases where the Pentagon may have released information inadvertently or perhaps some other fashion, and it's led Dr. Hamre to be concerned about this. A This is an example of a challenge that balances two goals. The challenge is to balance two goals. One is to have web sites that provide useful information to the users of those web sites but don't go too far in providing information that could be dangerous if misused by malefactors of various sorts. So Dr. Hamre and the Joint Staff have been aggressively looking at the content of web sites to see what sort of information they may provide on building plans, for instance; actual diagrams of buildings of certain military installations; on lessons learned on certain military operations or programs; on future R&D goals or programmatic goals, and also personnel information that could perhaps provide too much information in terms of locating people or recreating identities from information provided on the Internet. We're in the process now, as I believe many private companies are, of trying to sort out what the right balance is between providing useful information and providing more information than is necessary over the Internet. Some of this involves cutting out clutter on the Internet and focusing web sites so that they provide useful amounts of information without overwhelming users. This is a process that has been going on for some time. I don't believe it's quite over yet. At some appropriate time we'll be able to make a more detailed announcement. Q Have there in fact been specific cases where it is believed that these malefactors have gained permission and might be... A I think this is an example of trying to anticipate future problems rather than waiting for the problems to catch us.
DoD News Briefing Thursday, September 17, 1998 - 1:55 p.m. Mr. Kenneth H. Bacon, ASD (PA) [Excerpts] Q Has there been a decision yet to scrub those military web sites? And could you say how many web sites there are, and the sorts of information that would be removed from them? A First of all there has been no decision signed out on the question of web site security. I do not know offhand how many military web sites there are, but there are a lot I can tell you. Hundreds may understate it. But the policy has not been signed out yet by Deputy Secretary Hamre. Q Do you have any sense of the kind of information that you're concerned about... A Some of it is personal information such as social security numbers, home addresses, telephone numbers, home telephone numbers, things like that. Some of the information would deal with very specific information about the capabilities of weapons, particularly weapons that are being developed through the contracting process, that might come out through the contracting process. A third area would be anything that looked like, that might provide very detailed floor plans of facilities, for instance certain types of facilities. Those are the types of issues that we're looking at now, and as I said, this is something of concern to the Joint Staff and also to Secretary Cohen and Deputy Secretary Hamre. We've been looking at a way to balance the convenience of the web sites and to make them helpful and functional without giving away information that might lead to compromises of personal or other types of security. Q What can you say about the way in which this problem developed? Was it a lack of oversight and planning in terms of web site technology? Or... Why are we seeing this now? A First of all, as I said on Tuesday, we're trying to act before real problems develop. The best problems are ones you head off before they become bad problems. That's what we're attempting to do. We're attempting to make people more conscious of web site security issues. That's really the goal of the policy that's in draft form now. Q But in terms of planning or strategizing before web sites were even created... A I think that web sites bring out creativity and a desire to disclose information in people. That's what they're designed for and many of the people who have designed these web sites want to make them as sort of full of information as possible. All we're asking commanders to do, or we will ask commanders to do, is to review the web sites with a couple of basic principles that deal with personal and other types of security, and to make sure that they don't give out information that could compromise our very legitimate security needs. Q Were technical requirements for arms, or for weapons development contracts being put on web sites? A I listed that as an example of the type of thing we'd be concerned about. I don't want to get into specifics. I don't think it's appropriate to do that right now. We estimate that there are about one thousand Department of Defense web sites, but there is no central registry of web sites in the Department so we don't have a clear number. Any of you who have logged onto DefenseLink, and I hope all of you have, because it's the window into the public affairs office at the Department of Defense, and the best way to get information quickly and cheaply. Any of you who have logged into that know that you can go from DefenseLink which is the DoD web site into web sites for each of the services, for instance. From there you can go into web sites for a specific unit. Sometimes even specific ships. So there's this sort of multiplication effect where you go into the Navy web site and from there you can go into many other web sites down to carrier battle groups or ships. You can go into web sites for particular units or wings and the Marine Corps, Army, and Air Force. Then of course many agencies, many defense agencies, also have their own web sites, and many installations. For instance if you wanted to learn the history of Moody Air Force Base, you could find the Moody Air Force Base web site and it would give you a history of the base and tell you who the commander was and the command structure and what units are assigned there. I'm sure you can do this for almost any installation in the military. Moody is one I happen to have explored myself. It's quite an exciting web site. If any of you are interested in the history of Moody Air Force Base, I commend it to you.