16 February 1999. Add AP report and historical article.

15 February 1999. Thanks to D.
Source: http://www.washingtonpost.com/wp-srv/national/dotmil/arkin.htm

The Washington Post, February 15, 1999

The Pentagon and the Web: Round Two

By William M. Arkin
Special to washingtonpost.com

"I think that our government is hemorrhaging in a way that I have never seen in my lifetime," CIA director George Tenet told Congress February 2 in an unusually emotional appeal regarding the state of official secrecy.

Tenet mostly pointed fingers at people in the executive branch, who he said were probably responsible for 80 percent of what appears in the news media.

Lt. Gen. Patrick Hughes, director of the Defense Intelligence Agency, who was testifying alongside Tenet chose a different culprit. His focus was not the Washington sport of peddling secrets for influence (after all, DIA has always been notorious for successfully keeping its thousands of employees in a protected bubble).

Hughes instead point at the Web: "We seem now to have erred on the side of making so much information available that some of it has been damaging to our governmental collective effort."

I suspect the very dynamism and anarchy of the web is at the heart of the new found military discomfort. A network that was once the military's own not only has been fully appropriated. But it shifts and changes by the minute, moving at a speed that exceeds anything that the weapon's makers can produce.

For old timers like Hughes, it is easier to focus on what is truly new with the end of the Cold War rather than to address the breakdown of internal discipline that seems to have struck the military and spy agencies in the same time period.

The Hughes-Tenet war cry may suggest leak investigations and internal crackdown. We've all heard that before.

The more tangible and publicly damaging fallout comes in the ever expanding Internet opposition in the national security community. Official Internet haters latch on to such high level statements and find solace in the call for greater control over information, and in the general sense in Washington that the United States is threatened by cyber-terror.

One senior Pentagon official likens the current dispute between "public affairs" and security proponents over the benefits and dangers of the World Wide Web to be two opposing trains careening towards one another on the same track. So seemingly successful has been the anti-web assault of late that the Federation of American Scientists, a secrecy watchdog, opines that the "golden age of public access to government information" over the Internet is over."

Granted there is a profusion of closed websites and "access denied" messages that have sprung up in the .mil domain in recent months. But FAS hyperventilates as much as the chief intelligence officers do.

The Internet is its own bullet train. Despite the efforts of security goons and information warfare operators who would like to obliterate the web, the public .mil domain remains vibrant and is growing.

The chief of Internet security for the Pentagon is J. William Leonard. Bill Leonard chairs the Department "information vulnerability and the world wide web" task force. Its December 7 "guidance" regarding the content of 3,000 or so official military websites could if taken literally, shut down the .mil domain.

Some see Bill Leonard as the Internet anti-Christ, but in his corner of the security world (that is, where they've actually taken the time to understand the web and what it's all about), Leonard is far less alarmed than Hughes-Tenet.

"When we started the review, I took a look at some random [official] websites," he says. "What struck me first was what I didn't see, which was any sort of consistency. I liken the web to business correspondence. You don't put a business letter on a postcard." Official websites, Leonard says, should have the same formality.

The task force guidance charged military commanders and agency directors with responsibility for the content of their sites. Webmasters are being elbowed aside. It is a phenomenon that every sector of the web deals with at some point - the tyranny of the techies - when the question is raised: how do all the doo-dads and gimmicks enhance our mission?

Bill Leonard denies any overall anti-web campaign ("it's like repealing the law of gravity" he says) nor any attempt to create a new classification for electronic information (see earlier column hyperlink here?).

Data mining and electronic aggregation, he argues nevertheless, is a real threat, particularly when it comes to personal information. "When you put out a personnel roster electronically, you have incurred a new host of risks and vulnerabilities," he says.

Leonard readily admits that many proposed security controls are at conflict with some of the most promising applications of web technology. These include Defense Department favorites like electronic contracting and paperless operations. "When we embark on electronic commerce, there's tremendous advantages," Leonard says. But he points out: the Pentagon is contracting for military goods and services. "There is some information that shouldn't leave the country, even by statute."

In the short term, the Pentagon is making greater use of passworded and IP controlled sites. The long term dream is to establish a superpower intranet only accessible to the cleared.

Does Leonard think that any broad system of passwords or user certificates will be secure, given that the community that the .mil domain serves -- active duty soldiers and reservists, families, veterans, allies, contractors and subcontractors -- numbers in the millions? Probably not. His crash course on the web has taught him, moreover, that the technologies that we see today will certainly not be what we see tomorrow.

Arkin can be reached for comment at william_arkin@washingtonpost.com.

© Copyright 1999 The Washington Post Company

SOURCE: http://wire.ap.org/ (AP Breaking News)

Associated Press, 16 February 1999, 01:31 EST

Pentagon Reassesses Its Web Sites
By The Associated Press

WASHINGTON (AP) -- The chairman of the Joint Chiefs of Staff looked on
as Pentagon cyber-warriors clicked away at their laptops and showed how
would-be terrorists could find his son's home address.

Army Gen. Henry Shelton then got a demonstration of how a skilled
adversary might combine publicly available biographies and contractor
information on military Web sites with a few well-placed phone calls to
pin down the dates of highly classified nuclear exercises.

The classified briefing, held in Shelton's Pentagon office, was then
given to other generals and admirals as well as senior civilians,
generating a momentum that has led the military to order a massive scrub
of its vast network of Internet sites.

Deputy Defense Secretary John Hamre said military Web sites offered
adversaries "a potent instrument to obtain, correlate and evaluate an
unprecedented volume of aggregated information" that could, when
combined with other sources of information, "endanger Department of
Defense personnel and their families."

Instituted Dec. 7, the policy change has touched off a debate as some
critics argue the Pentagon went too far in restricting the information
it makes public on the Internet.

In response, defense and national security officials have become more
willing to discuss, on condition of not being identified by name, the
nature of the risk their detailed review of military Web sites revealed.

"There was information that was potentially tactically useful to an
adversary, the kind of thing where if someone really wanted to do harm
to your personnel, it could facilitate them in undertaking an attack,"
said one senior defense official working on Internet security issues.
Another national security official called the briefings "eye-openers"
that startled commanders.

The briefings stemmed from work done in 1997 and 1998 by Pentagon "red
teams," a term associated with a notional enemy force in war games. Team
members tried to learn how much mischief they could do by skillfully
scanning military Web sites, without any sophisticated hacking. They
showed Shelton, himself a former special operations specialist, how his
own biography posted on a military Web site combined with non-military
databases could quickly lead a terrorist to the home address of one of
his sons living in Florida.

The red teams found detailed maps and aerial photographs of military
installations that would help anyone planning a strike or a terrorist
action. These were the kinds of pictures, one senior official noted
ruefully, that the United States spent billions to get during the Cold
War through its spy satellite network. Now the United States was giving
such imagery away for free on the Internet.

Senior officers were particularly concerned when one of the red teams
was able to combine a variety of data and make highly accurate estimates
about the timing of nuclear weapons drills, exercises and readiness
checks, according to two senior national security officials familiar
with the briefings.

Biographies of individual commanders of units likely to be involved in
such operations combined with phone calls to those commanders' bases
yielded information about temporary duty assignments in Nevada at
installations involved in nuclear weapons handling. Military Web sites
containing contractor information, particularly formal requests for bids
to supply particular security equipment, helped further hone this
detective work, according to the officials.

Cleaning the military Web sites of potentially dangerous information has
proved a monumental task. Bill Leonard, a top Pentagon information
security official, said the military was unsure initially how many Web
sites it had, and even today can only provide an estimate. For a time,
the Army completely closed off access to its 1,000 Web sites. Now back
on line, the Army's Web sites have been substantially trimmed, as have
those of the other services. Entire Internet addresses have been put off
limits, with the terse message on the computer screen that information
previously available has been removed for security reasons.

Some think the scrub of military Web sites has gone too far.

"This is a wartime information policy," said John Pike of the Federation
of American Scientists, a Washington-based research group that follows
military and intelligence matters. "All kinds of program information is
being withdrawn. Almost anything that discloses what an agency actually
does, beyond a brief mission statement, is going away."

The Federation is pursuing release of some of the deleted information
under the Freedom of Information Act. In its filing with the Pentagon's
security review office, the Federation said anything released as a
result of the complaint should come in electronic form so the Federation
can post the information on its Web site.

To date, the Pentagon cannot point to a specific incident where
information posted on a military Web site resulted in harm to U.S.
national security.

"The menacing scenarios have remained just that -- only scenarios,"
according to George Smith, editor of The Crypt Newsletter, an online
publication dealing with computer security.

But the Pentagon says it has solid electronic evidence that foreign
countries, including some adversaries, are regular visitors to U.S.
military Web sites.


Copyright 1999 The Associated Press.



American Forces Press Service, 25 September 1998

Internet Presents Web of Security Issues
By Paul Stone

WASHINGTON -- In a briefing room deep in the Pentagon earlier this year, Air
Force Lt. Col. Buzz Walsh and Maj. Brad Ashley presented a series of
briefings to top DoD leaders that raised more than just a few eyebrows.

Selected leaders were shown how it was possible to obtain their individual
social security numbers, unlisted home phone numbers, and a host of other
personal information about themselves and their families -- simply by
cruising the Internet.

Walsh and Ashley, members of the Pentagon's Joint Staff, were not playing a
joke on the leaders. Nor were they trying to be clever. Rather they were
dramatically, and effectively demonstrating the ease of accessing and
gathering personal and military data on the information highway --
information which, in the wrong hands, could translate into a vulnerability.

"You don't need a Ph.D. to do this," Walsh said about the ability to gather
the information. "There's no rocket science in this capability. What's
amazing is the ease and speed and the minimal know-how needed. The tools (of
the Net) are designed for you to do this."

The concern over personal information on key DoD leaders began with a simple
inquiry from one particular flag officer who said he was receiving a large
number of unsolicited calls at home. In addition to having the general's
unlisted number, the callers knew specifically who he was.

Beginning with that one inquiry, the Joint Staff set out to discover just
how easy it is to collect data not only on military personnel, but the
military in general. They used personal computers at home, used no
privileged information -- not even a DoD phone book -- and did not use any
on-line services that perform investigative searches for a fee.

In less than five minutes on the Net Ashley, starting with only the
general's name, was able to extract his complete address, unlisted phone
number, and using a map search engine, build a map and driving directions to
his house.

Using the same techniques and Internet search engines, they visited various
military and military-related Web sites to see how much and the types of
data they could gather. What they discovered was too much about too much,
and seemingly too little concern about the free flow of information vs. what
the public needs to know.

For example, one Web site for a European-based installation provided more
than enough information for a potential adversary to learn about its mission
and to possibly craft an attack. Indeed, the Web site contained an aerial
photograph of the buildings in which the communication capabilities and
equipment were housed. By pointing and clicking on any of the buildings, a
Web surfer would learn the name of the communications system housed in the
building and its purpose.

Taking their quest for easily accessible information one step further, the
Joint Staff decided to see how much information could be collected just by
typing a military system acronym into an Internet search engine. While not
everyone would be familiar with defense-related acronyms, many of them are
now batted around the airwaves on talk shows and on the Internet in
military-related chat rooms. They soon discovered how easy it was to obtain
information on almost any topic, with one Web site hyper-linking them to
another on the same topic.

What the Joint Staff was doing when they collected their information is
commonly called "data mining" -- surfing the Net to collect bits of
information on individuals, specific topics or organizations, and then
trying to piece together a complete picture. Individuals do it,
organizations do it and some companies do it for profit.

While the information they discovered presented legitimate concerns, it
wasn't all negative. The Army's Ft. Belvoir, Va., home page was cited as one
example of a Web site which served the needs of both the military and the
public. It had the sort of information families or interested members of the
public need and should get.

So what does all this mean? Is DoD creating individual and institutional
security problems? In the rush to make information available to the internal
audience, is too much being made available to the public and those who might
want to inflict harm?

The Joint Staff doesn't pretend to have all the answers to these questions,
but is encouraging users to think about these issues whenever they put
information on the Internet; and they believe that, in some cases, DoD is
it's own worst enemy.

Michael J. White, DoD's assistant director for security countermeasures,
agrees with the Joint Staff analysis. Moreover, as a security expert, he is
concerned DoD does indeed exceed what needs to be on the Internet.

"For fear of not telling our story well enough, we have told too much," he
said. "Personally, I think there's too much out there -- and you need to
stop and ask the question: Does this next paragraph really need to be there,
or can I extract enough or abstract enough so that the intent is there
without the specificity? And that is hard to do because we are pressed every
day. So sometimes expediency gets ahead of pausing for a minute and thinking
through the process: Does the data really need to be there? Is it going to
hurt me tomorrow morning?

DoD's policy on releasing information to the public, as spelled out by
Defense Secretary William Cohen in April 1997, requires DoD "to make
available timely and accurate information so that the public, Congress and
the news media may assess and understand the facts about national security
and defense strategy." The same statement requires that "information be
withheld only when disclosure would adversely affect national security or
threaten the men and women of the Armed Forces."

"On the one hand," Ashley said, "we have fast, cheap and easy global
communication and coordination. On the other hand, we find ourselves
protecting official information and essential elements of information
against point-and-click aggregation. Clearly, this balancing act is a
function of risk management. Full openness and full protection are equally
bad answers. We have a serious education, training and awareness issue that
needs to be addressed."

The Joint Staff repeatedly returns to the issue of "point-and-click
aggregation" as a problem that is often overlooked when military personnel
and organizations place data on the Internet. What they're referring to is
the ability to collect bits of information from several different Web sites
to compile a more complete picture of an individual, issue or organization
with very little effort.

"The biggest mistake people make is they don't understand how easy it is to
aggregate information," Walsh said. The lesson from this is that even though
what is posted on the Net is perfectly innocent in and by itself, when
combined with other existing information, a larger and more complete picture
might be put together that was neither intended nor desired.

A more obvious problem, yet still one not always considered when posting
information on the Internet, is that the "www" in Web site addresses stands
for "world wide" Web. Information posted may be intended only for an
internal audience -- perhaps even a very small and very specific group of
people. But on the Net, it's available to the world.

This, security experts agree, is an enormous change from the time when
foreign intelligence gathering was extremely labor intensive and could only
be done effectively on U.S. soil.

"If I'm a bad guy, I can sit back in the security of my homeland and spend
years looking for a vulnerability before I decide to take a risk and commit
resources," Ashley said. "I'm at absolutely no risk by doing that. I can
pick out the most lucrative targets before hand, and may even just bookmark
those targets for future use. We won't know something has been compromised
until it's too late." White agrees with the Joint Staff's concern.

"You can sit in Germany and have access to the United States just as easily
as you can in Australia or the People's Republic of China or Chile," White
said. "It doesn't matter where you are. You can go back and forth and in
between and lose your identity on the net instantaneously. Those who seek to
use the system feel comfortable they won't be discovered."

In addition to these issues, security experts see another recurring and
disturbing problem. In the rush to take advantage of the Net's timeliness
and distribution capabilities, military personnel are forgetting about or
ignoring the For Official Use Only policies which previously made the
information more difficult to obtain. Yet anyone using the Internet doesn't
have to venture far into the array of military Web sites to come across one
which states: "For Official Use Only."

If the information is For Official Use Only, security experts said Web site
developers, managers and commanders must ask themselves whether the
information should be there in the first place.

While officials are most concerned about the information being placed on
military Web sites, they had similar warnings about individual or family Web
sites. The Joint Staff recommends the same precautions should apply at home,
especially as personnel move into high-ranking, key leadership positions.

At a time when the flow of information is beyond anyone's capability to
either digest it or control its direction, it's not likely the problems
brought forward recently by the Joint Staff will be solved any time soon.
The first step, security experts said, is awareness the problems exist.
Commanders have to understand not just the information capabilities of the
World Wide Web, but the information vulnerabilities as well.

The second step, Walsh pointed out, is for commanders to become actively
involved in the issue of what's being put on the Internet. Current DoD
policies require that local commander, public affairs and security reviews
prior to release of data on Web pages. But the flow of information is so
great, these reviews may not be occurring and few are looking at the
aggregation problem.

"I think it would be very appropriate for a public affairs officer to be the
commander's lead representative," Walsh said. "But it's a commander's issue
and it should go down command lines. This is certainly an operational
security issue. Just like operational security is everybody's business, this
ultimately is everyone's responsibility."

White concurred and recommends installations create "security-integrated
product teams" which would be tasked to develop and implement guidelines for
creating and monitoring Web sites on the installation.

"I think having a group come together before the (Web site development)
process begins will remove an awful lot of pain in the long run," White
said. "We need to step back one step and think before we begin any effort,
because once it's done you can't undo it. That makes it very hard in a
digital environment."

Although it's not possible to retrieve what's already on the World Wide Web,
nor predict how it will influence future security issues, Walsh, Ashley and
White believe it's not too late to make a difference. With a little more
forethought and a lot more planning, it will be possible to better protect
the next generation of warfighters, both on and off the battlefield, they
said.

End