Because The Defense Department's Secure Communications Options Don't Work For Everyone, Soldiers Are Turning To Signal And WhatsApp

from the breaking-the-rules-to-stay-in-touch dept

The military has an obvious need for secure communications. It offered its support of encryption even as the NSA tried to find ways to undercut to make its surveillance ends easier to achieve.

The problem is the military doesn't have a great plan for securing communications between personnel. Due to tech limitations the Defense Department has yet to overcome (despite billions in annual funding), soldiers are turning to third-party messaging services to communicate orders and disseminate information.

The use of the encrypted messaging app Signal is ubiquitous within the Department of Defense. Service members have received briefings about operational security (OPSEC) and information security (INFOSEC) and have taken the dangers of living in a digital world seriously by making sure that the work-related text messages they send on their cell phones are encrypted. The contradiction is that using Signal for official military business is against regulations.

Securing communications apparently means breaking the rules. The DoD forbids the use of non-DoD-controlled messaging services to handle the distribution of nonpublic DoD information. The Defense Department insists personnel use its services, but those services can't be accessed by employees who don't have military-issued cell phones. And everyone has a cell phone, so it's often easier to use third-party platforms to communicate.

When this happens, it raises the risk that unauthorized access or sharing of information could occur. It also puts many communications beyond the reach of public records requests, which often cannot access communications between privately owned devices.

And there appears to be no fix on the immediate horizon. The Defense Department is quick to point out the use of Signal and WhatsApp violates regulations. But it has nothing in place that would allow the many military members not in possession of government-issued cell phones to communicate when out in the field.

This is what the Secretary of Defense's Public Affairs Officer (Russell Goemaere) told Audacy when asked about how military members were expected to use DoD-approved communications platforms they didn't actually have access to on their personal devices.

"DoD365 provides a messaging capability that is approved for CUI and use on DoD mobile devices. The Services are in the final stages of testing Bring Your Own Approved Device (BYOAD) and Bring Your Own Device (BYOD) solutions that provide access to the DoD365 collaboration capability on service member's personal devices," Goemaere said.

It's 2022 and the Defense Department is only at the "final stage of testing" for solutions it needed years ago. Cell phone usage has been ubiquitous for nearly two decades at this point. For the Department to still be weeks or months away from a solution should be considered unacceptable. Denying soldiers access to third-party options means cutting them off from communications that can often have life-or-death implications.

This also means the Defense Department is still weeks or months away from ensuring communications subject to FOIA law are being captured and retained. The priority should still be personnel safety, but this is another downside of the Defense Department's slow roll into the 21st century.

Filed Under: dod, encrypted messaging, encryption, military, soldiers
Companies: meta, signal, whatsapp

Defense Department Is Buying Domestic Internet Metadata From Data Brokers

from the bringing-the-war-back-home-via-bulk-purchases dept

Joseph Cox broke the news for Motherboard late last year: the US military was also making use of location data purchased from data brokers, joining a host of other federal agencies that seemed to feel buying from brokers was an acceptable alternative to respecting the Fourth Amendment.

Of particular interest to the Defense Department was location data generated by apps popular with the world's Muslims, including the Muslim Pro prayer app and Muslim Mingle, a Muslim-centric Tinder. The DoD didn't have much to say in its… um… defense at that time, obviously preferring everyone to assume the focus on Muslim-focused apps was indicative of its good and righteous work fighting terrorist organizations around the world.

Unfortunately, the data came from brokers who also collect plenty of location info from US located app users and there was no information provided by the government that showed the military made an effort to steer clear of acquiring this data.

More confirmation has arrived, via some half-answers, redactions, and "can we talk about this in private?" responses to Senator Ron Wyden's demand for more information from the Defense Department. Once again, it's Joseph Cox and Motherboard bringing us the latest:

The Pentagon is carrying out warrantless surveillance of Americans, according to a new letter written by Senator Ron Wyden and obtained by Motherboard.

Senator Wyden's office asked the Department of Defense (DoD), which includes various military and intelligence agencies such as the National Security Agency (NSA) and the Defense Intelligence Agency (DIA), for detailed information about its data purchasing practices after Motherboard revealed special forces were buying location data. The responses also touched on military or intelligence use of internet browsing and other types of data, and prompted Wyden to demand more answers specifically about warrantless spying on American citizens.

Unfortunately, further details have yet to be released. For the moment, Senator Wyden is indulging the Pentagon's demands for further secrecy. But his letter lets the public know some of what he knows -- even if the Defense Department has refused to make this information public.

"I write to urge you to release to the public information about the Department of Defense's (DoD) warrantless surveillance of Americans," the letter, addressed to Secretary of Defense Lloyd J. Austin III, reads.

The DoD may not have publicly admitted to this surveillance of Americans but Wyden is willing to make that disclosure on its behalf.

According to Wyden staffers, this refers to the DoD's bulk purchases of internet metadata that contain information about US persons' communications. Some of these are wholly domestic conversations. Some involve communications between Americans and people located in other countries. In either case, the DoD appears to be bypassing protections erected to prevent this sort of bulk surveillance. And while components of the Defense Department are in the intelligence business, their adversaries and targets are supposed to be foreigners. Incidental collection is one thing. Buying data in bulk and sifting through it with zero oversight is quite another.

Filed Under: 4th amendment, data brokers, defense department, dod, metadata, privacy

Two Studies Show Giving Military Gear To Cops Doesn't Result In Lower Crime Rates

from the law-enforcement:-we-would-like-to-continue-to-define-insanity-tyvm dept

One of President Trump's main goals while in office was to roll back anything his predecessor had put in place. One of his earliest executive orders removed the (minimal) restrictions Barack Obama had placed on the Defense Department's 1033 program. This program allowed local law enforcement agencies to acquire military gear at almost zero cost -- something that had been used and abused for years until the sight of an armored vehicle rolling up on protesters in Ferguson, Missouri proved to be a bit too much for Americans and their Congressional representatives.

Trump's reopening of the 1033 program was based on a couple of factors: his all-encompassing love of all things law enforcement and some dubious research that claimed giving cops access to war gear actually reduced crime.

That was the point made by then-Attorney General Jeff Sessions ahead of the rollback.

President Trump is serious about this mission. He is doing all he can to restore law and order and support our police across America. And that is why, today, I am here to announce that President Trump is issuing an executive order that will make it easier to protect yourselves and your communities. He is rescinding restrictions from the prior administration that limited your agencies' ability to get equipment through federal programs, including life saving gear like Kevlar vests and helmets and first responder and rescue equipment like what they’re using in Texas right now.

[...]

Those restrictions went too far. We will not put superficial concerns above public safety.

Those "superficial concerns" included genuine concerns that deploying war gear against US citizens tends to make officers think they're soldiers in a war zone, rather than public servants who need a solid relationship with those they serve to make meaningful changes that reduce crime and increase public safety.

The push for more distribution of military gear was backed by a study by the American Economic Association, which claimed law enforcement agencies that utilized the 1033 program were more effective at lowering crime rates. That data has now been examined by two other sets of researchers, and the conclusions they've reached contradict the AEA's findings.

When Emory scholars read the studies, they noticed statistical flaws in the analysis. They set out to rigorously test those two previous studies’ claims by replicating them. They utilized the same 2014 NPR data and applied the studies’ same methods of analysis.

What immediately got the attention of the Emory scholars was that the studies were doing analysis at the county level, not the municipal level (i.e., the individual jurisdictions of cities). So, there wasn’t a way to directly compare which local agencies received SME and their specific crime rates. That’s because the federal government only reported the 1033 Program data at the county level.

Fortunately, there was more data available now to double-check the claims made by these earlier studies. Obama's 1033 program reforms mandated more reporting on acquisition, which gave these researchers more to work with. The granular detail missing from the first studies was included in the second examination.

It was only after Emory used the new, agency-level data in analysis that they determined the SME didn’t reduce crime.

“It crystalizes so many of the concerns and claims both pro and con about policing in the U.S. It raises the matter of funding the police and how do we provide resources to the police — through money or giving them equipment. It raises the matter of police militarization — that the police look and act like they are soldiers at war against citizens,” [Associate Professor Michael] Owens says. “And it raises questions about efficiency — costs and benefits."

It's not just Emory researchers arriving at this conclusion. A simultaneously-released study by the University of Michigan professor Kenneth Lowande says the same thing:

I use 3.8 million archived inventory records to estimate the magnitude of sources of bias in existing studies of the 1033 Program. I show that most variation in militarization comes from previously unobserved sources, which implies that studies that show crime-reduction benefits are unreliable. I then leverage recent policy changes to evaluate the effect of military equipment: the Obama Administration recalled property under Executive Order 13688, which resulted in a forced demilitarization of several hundred departments. Difference-in-difference estimates of agencies that retained similar equipment show negligible or undetectable impacts on violent crime or officer safety.

Of course, these studies have drawn some criticism. Law enforcement officials -- who've performed no research of their own -- dispute these findings.

"This is just a symptom of the larger defund the police movement and this has turned political," retired police Sgt. Betsy Brantner Smith, a spokesperson for the nonprofit National Police Association, which educates the public on policing in America, told ABC News. "Obama took it away, Trump gave it back, and now we’ll probably see Biden take it away again so that they can say, ‘I took this away from the big bad police.'"

Wow. What a thoughtful counterpoint. On one hand, we have data showing handing cops military hand-me-downs doesn't reduce crime. On the other hand, we have a police union rep claiming math is politicized. At least the other police union rep quoted in piece makes a better point while still disputing the findings.

Patrick Yoes, national president of the Fraternal Order of Police, the world's largest organization of sworn law enforcement officers, also slammed the two studies as "convoluted logic."

"It has never been the contention of the FOP that surplus military equipment prevents crime, but rather that such equipment plays a critical role in protecting police officers and citizens in life-threatening situations such as active shooters at large, civil disturbances, and natural disasters."

But do cops really need war gear to make them safer? Crime rates in most of the country are still at historic lows. Officer safety remains at an all-time high. This last decade has been the safest time in history to be a cop and yet complaints like these are always offered up anytime someone points out the flaws in their logic.

So, military gear given to cops doesn't reduce crime. And it likely doesn't make officers much safer than they are already. What it does do is cultivate a warrior mindset that harms law enforcement's relationship with the public. And maybe that's all law enforcement really wants: more distance between them and those they've declared war on.

Filed Under: 1033, crime, defense department, dod, militarized police, military gear, police, warrior cops

Defense Department Oversight Thwarted By Defense Department Officials Who Refused To Talk About Trump's Communications

from the cut-to-DoD-officials-tying-gags-over-their-own-mouths dept

Every presidential administration seems to make a game of thwarting oversight. The current one is no different. President Trump is setting himself apart from the pack by firing IGs at an alarming pace. Whatever's being done in our name at various government agencies is being done in the dark. Whistleblowers and leakers are being hunted down and persecuted/prosecuted (another favorite presidential sport).

What would be considered unlawful obstruction in a criminal investigation is just business as usual at the Executive branch. The latest (but certainly not the last) obstruction was revealed in the investigation of the "JEDI" contract procedure. Amazon really wanted to be a part of American bloodsports, but was beaten out by Microsoft for lucrative Pentagon cloud storage contracts. Amazon sued, alleging it got illegally screwed by the President, claiming his frequent derogatory comments about Amazon and the Jeff Bezos-owned Washington Post pushed the Pentagon towards selecting Microsoft.

An investigation was opened by the Defense Department's Inspector General. And we'll never know what really happened because it appears the administration inserted itself into the investigation. Jacqueline Feldscher has more details at Politico:

The Pentagon’s inspector general “could not definitively determine” whether the White House influenced the procurement process for a major cloud computing contract because senior Defense Department officials were barred from answering questions on the subject during interviews, according to a 313-page report released on Wednesday.

Sticking it to the Deep State, I guess. So, what looks like some impropriety now officially only looks like some impropriety because the Defense Department's general counsel told DoD officials to not answer any questions about communications between the DoD and the White House. "Presidential communications privilege" successfully asserted.

Given the lack of answers, it seems pretty ridiculous for the Pentagon to hang the "Mission Accomplished" banner and declare everything to be above-board. But that's what has happened because that's the the kind of government we have. Here's the Pentagon's spokesperson pretending there's nothing to see here.

"This report should finally close the door on the media and corporate-driven attacks on the career procurement officials who have been working tirelessly to get the much needed JEDI cloud computing environment into the hands of our frontline warfighters while continuing to protect American taxpayers."

Everything is over except its eventual fading into obscurity, washed under the flotsam that is the day-to-day horror of living in an ongoing pandemic. The Pentagon has cleared itself of any wrongdoing by refusing to answer questions related to alleged wrongdoing. The overseers were neutralized by presidential privilege, resulting in the Inspector General drawing inconclusions the Pentagon has declared to be exculpatory with one comment to the press. The IG's office decided to release the incomplete report anyway, stating it did not want to further delay any reporting on its non-findings since it was apparent no amount of waiting things out was going to get these officials to discuss things they didn't want to discuss.

As for Amazon, it must be refreshing to be on the other side of impropriety accusations for once. The run-up to the awarding of the contract saw a few DoD officials becoming far too friendly with the cloud service provider.

The inspector general substantiated allegations of ethical misconduct against Deap Ubhi, a Pentagon employee who worked on the early stages of crafting the JEDI program before leaving the department to work for Amazon.

Investigators did not, however, find evidence of ethical misconduct by other senior defense officials, including former Defense Secretary Jim Mattis, who attended a dinner with Amazon officials organized by his former aide Sally Donnelly.

Ah. Well, at least the IG found out something about somebody. The President's dislike for Amazon and Bezos remains under "presidential privilege" wraps and the swamp will continue draining at its current rate of 0 liters/flush.

Filed Under: communications, contract, dod, donald trump, inspector general, jedi, oversight, retaliation, transparency
Companies: amazon, microsoft

How Attorney General Barr's War On Encryption Will Harm Our Military

from the stop-it-guys dept

We've highlighted in the past that there are large parts of the federal government that recognize that strong encryption is actually very, very important for national security, and that the framing by Attorney General William Barr, FBI Director Christopher Wray, and even President Trump -- that there need to be back doors to encryption for "security" reasons -- is utter nonsense. The intelligence community has long recognized the importance of strong encryption. Even many people within the FBI think their bosses' position on this issue is bonkers. Late last year, we were pleasantly surprised to see the Defense Department step up as well, with a letter to Congress talking about just how important encryption is for national security.

Over at Cyberscoop, former National Security Council cybersecurity expert Ari Schwartz has a nice article explaining just how important encryption is to protecting the military. It won't tread any new ground for anyone who understands the basics here, but it's nice to see more and more people highlighting this.

Last month, a brigade of U.S. soldiers deployed to the Middle East received instructions from their superiors to use two commercial encrypted messaging applications, Signal and Wickr, on their government issued cell phones. These leadership cues trickled down from the Department of Defense’s (DoD) position that strong encryption is critical to national security. While U.S. Attorney General William Barr continues to push for a broad mandate for backdoors for law enforcement, those on the front lines of protecting America have notably decided on a different approach. Simply put, weakening encryption means putting our military service members at risk.

The key point -- and one that many of us have made for years is that the framing by Wray/Barr (and, for what it's worth, James Comey before them) is that there's some sort of conflict here between "security" and "privacy." But that's always been bullshit. The issue has always been between having both security and privacy vs. giving law enforcement easier access to data and information they can almost always get elsewhere with a little more effort. In short, it's a debate between having security and privacy widely available against a bit of convenience for law enforcement. As such, this should be no debate at all.

Let’s stop wasting time suggesting that we need universal solutions that may solve law enforcement’s short-term needs, but then put consumers and our military at risk.

Somehow, I don't think the time wasting is going to go away any time soon, unfortunately.

Filed Under: dod, doj, encryption, going dark, military, national security, william barr

Defense Department To Congress: 'No, Wait, Encryption Is Actually Good; Don't Break It'

from the seems-important dept

As Senate Judiciary Committee Chair Lindsey Graham has continued his latest quest to undermine encryption with a hearing whose sole purpose seemed to be to misleadingly argue that encryption represents a "risk to public safety." The Defense Department has weighed in to say that's ridiculous. As you may recall, the DOJ and the FBI have been working overtime to demonize encryption and pretend -- against nearly all evidence -- that widespread, strong encryption somehow undermines its ability to stop criminals.

However, it appears that other parts of the government are a bit more up to date on these things. Representative Ro Khanna has forwarded a letter to Senator Graham that he received earlier this year from the Defense Department's CIO Dana Deasy, explaining just how important encryption actually is. The letter highlights how DoD employees rely on the kind of strong encryption found on mobile devices and in VPN services to protect the data of their employees, both at rest (on the devices) and in transit (across the network).

All DoD issued unclassified mobile devices are required to be password protected using strong passwords. The Department also requires that data-in-transit, on DoD issued mobile devices, be encrypted (e.g. VPN) to protect DoD information and resources. The importance of strong encryption and VPNs for our mobile workforce is imperative. Last October, the Department outlined its layered cybersecurity approachto protect DoD information and resources, including service men and women, when using mobile communications capabilities.

[....]

As the use of mobile devices continues to expand, it is imperative that innovative security techniques, such as advanced encryption algorithms, are constantly maintained and improved to protect DoD information and resources. The Department believes maintaining a domestic climate for state of the art security and encryption is critical to the protection of our national security.

So, there you have it. The Defense Department believes that strong, unbroken encryption is critical to national security, as opposed to the DOJ which appears to think (incorrectly) that it undermines national security. At the very least, this should mean that politicians should stop uncritically claiming that encryption is some sort of "debate" between privacy and national security. It is not. Encryption protects both of those things. Breaking encryption harms both privacy and national security... in the hopes that it might make law enforcement's job marginally easier.

Filed Under: backdoors, dana deasy, defense department, dod, encryption, lindsey graham, ro khanna

The Afghanistan Papers v. The Pentagon Papers: How A Whistleblower Worked Much Better Than Endless FOIA Litigation

from the people-are-dying dept

On Monday morning, the Washington Post released The Afghanistan Papers, an incredible (though, tragically, not surprising) collection of unpublished notes and interview transcripts revealing that the past three administrations -- Trump, Obama, and Bush -- all lied consistently and repeatedly about how bad things were going in Afghanistan, pretending that various actions were succeeding, while the reality was they knew it was an unwinnable war.

“We were devoid of a fundamental understanding of Afghanistan — we didn’t know what we were doing,” Douglas Lute, a three-star Army general who served as the White House’s Afghan war czar during the Bush and Obama administrations, told government interviewers in 2015. He added: “What are we trying to do here? We didn’t have the foggiest notion of what we were undertaking.”

“If the American people knew the magnitude of this dysfunction . . . 2,400 lives lost,” Lute added, blaming the deaths of U.S. military personnel on bureaucratic breakdowns among Congress, the Pentagon and the State Department. “Who will say this was in vain?”

And, as part of that, there was the concerted effort to hide this reality from the American public:

Several of those interviewed described explicit and sustained efforts by the U.S. government to deliberately mislead the public. They said it was common at military headquarters in Kabul — and at the White House — to distort statistics to make it appear the United States was winning the war when that was not the case.

“Every data point was altered to present the best picture possible,” Bob Crowley, an Army colonel who served as a senior counterinsurgency adviser to U.S. military commanders in 2013 and 2014, told government interviewers. “Surveys, for instance, were totally unreliable but reinforced that everything we were doing was right and we became a self-licking ice cream cone.”

John Sopko, the head of the federal agency that conducted the interviews, acknowledged to The Post that the documents show “the American people have constantly been lied to.”

For fairly obvious reasons, this release is being compared to the Pentagon Papers, a similar trove of documents that revealed how officials knew the Vietnam war was a lost cause and deliberately misled the American public about it for years.

There is one stark contrast between the two, however: how they came out. The Pentagon Papers came out because whistleblower Daniel Ellsberg leaked them to the press (for which President Nixon then tried to destroy his life in a bunch of different ways). The Afghanistan Papers, on the other hand, are coming out because of a years long FOIA battle by the Washington Post to get these documents released, against the wishes of the US government (who still was able to black out a bunch of information):

For all the talk about how whistleblowers and leakers should "use the proper channels," every time we see the "proper channels" in action, they seem to only open up opportunities for the government to delay, hide things, and continue whatever destructive (but embarrassing) policy they have in place. There is a place for whistleblowers to call out this kind of misconduct, and as Ellsberg himself has been saying for years, the growing attacks (by each administration) against whistleblowers and leakers has much more to do with government embarrassment, rather than any legitimate attempt to "protect national security."

Filed Under: afghanistan papers, daniel ellsberg, dod, doj, foia, forever war, leaks, pentagon papers, transparency, whistleblowing

Cool Cool Cool Oversight Office Says It's Incredibly Easy To Hack The Defense Dept.'s Weapons Systems

from the just-a-hack-away-from-a-dystopian-hellscape dept

holy_shit(1).pdf [PDF]:

In operational testing, DOD routinely found mission-critical cyber vulnerabilities in systems that were under development, yet program officials GAO met with believed their systems were secure and discounted some test results as unrealistic. Using relatively simple tools and techniques, testers were able to take control of systems and largely operate undetected, due in part to basic issues such as poor password management and unencrypted communications.

Terrified/horrified yet?

In addition, vulnerabilities that DOD is aware of likely represent a fraction of total vulnerabilities due to testing limitations.

The Government Accountability Office's report contains nearly no good news. Just bad news on top of bad news with the chilling reminder that these are weapons systems so a malicious attack could do more than damage systems or exfiltrate sensitive data. It could actually kill people.

Why is the Defense Department's… um… defense in such shoddy shape? Well, it didn't get that way overnight. It took literally decades for it to arrive at this nexus point of technological advances and laissez-faire cybersecurity oversight.

Multiple factors contribute to the current state of DOD weapon systems cybersecurity, including: the increasingly computerized and networked nature of DOD weapons, DOD’s past failure to prioritize weapon systems cybersecurity, and DOD’s nascent understanding of how best to develop more cyber secure weapon systems. Specifically, DOD weapon systems are more software and IT dependent and more networked than ever before. This has transformed weapon capabilities and is a fundamental enabler of the United States’ modern military capabilities. Yet this change has come at a cost. More weapon components can now be attacked using cyber capabilities. Furthermore, networks can be used as a pathway to attack other systems. We and others have warned of these risks for decades. Nevertheless, until recently, DOD did not prioritize cybersecurity in weapon systems acquisitions.

The GAO points out the DOD has spent more time locking down its accounting systems than its weapons systems, even as the latter has increasingly relied on computer hardware and software to operate. The systems used by the DOD are a melange of commercial and open-source software, which relies on vendors to provide regular updates and patch vulnerabilities. (Unfortunately for the DOD, some vulnerabilities may not have been disclosed to software/hardware vendors by other government agencies like the NSA.) But the DOD gives itself a 21-day window to apply patches and some remote weapons systems may go months without patching because they often need to return from deployment to be patched properly.

The end result is a network of defense systems riddled with security holes. The GAO says it doesn't take much to commandeer weapons of mass destruction.

Test teams were able to defeat weapon systems cybersecurity controls meant to keep adversaries from gaining unauthorized access to the systems. In one case, it took a two-person test team just one hour to gain initial access to a weapon system and one day to gain full control of the system they were testing.

Some programs were slightly more resistant to outside attacks. But they couldn't fight off attacks from insiders or contractors.

[O]ne assessment found that the weapon system satisfactorily prevented unauthorized access by remote users, but not insiders and near-siders. Once they gained initial access, test teams were often able to move throughout a system, escalating their privileges until they had taken full or partial control of a system. In one case, the test team took control of the operators’ terminals. They could see, in real-time, what the operators were seeing on their screens and could manipulate the system. They were able to disrupt the system and observe how the operators responded.

System data could be easily manipulated, resulting in the exfiltration of 100 GBs of sensitive data. Other data was altered by testers, with the alterations going unmolested and unnoticed.

Ready for more horror?

[I]n some cases, simply scanning a system caused parts of the system to shut down. One test had to be stopped due to safety concerns after the test team scanned the system…

[...]

One test report indicated that the test team was able to guess an administrator password in nine seconds.

[...]

Multiple weapon systems used commercial or open source software, but did not change the default password when the software was installed, which allowed test teams to look up the password on the Internet and gain administrator privileges for that software.

And no one at the DOD is learning from their mistakes.

One test report indicated that only 1 of 20 cyber vulnerabilities identified in a previous assessment had been corrected. The test team exploited the same vulnerabilities to gain control of the system. When asked why vulnerabilities had not been addressed, program officials said they had identified a solution, but for some reason it had not been implemented. They attributed it to contractor error. Another test report indicated that the test team exploited 10 vulnerabilities that had been identified in previous assessments.

Other tests by the GAO went "undetected for weeks." DOD employees did not see crashes as possible indicators of malicious attacks, stating that "unexplained crashes were normal for the system." Operators had become desensitized to security warnings, thanks in part to one system that always indicated it was under attack.

This isn't to say the DOD isn't try — dear sweet god in heaven:

One test report indicated that operators identified test team intrusion attempts and took steps to block the test team from accessing the system. However, the test team was able to easily circumvent the steps the operators took. In another case, the test team was able to compromise a weapon system and the operators needed outside assistance to restore the system.

Run silent, run deep.

As testers took over systems and escalated privileges, DOD officials interviewed by the GAO were expressing confidence in their cybersecurity programs. What programs the officials couldn't really say, since assessments appear to be a rarity and those that are carried are skin-deep. They admitted many systems had never been comprehensively tested, either due to the late implementation of penetration testing programs or because tests "would interfere with operations."

The only thing surprising about the report is that the systems weren't already crawling with malicious software by the time the GAO got around to engaging in penetration testing. Maybe state-sponsored hackers are just biding their time, waiting for an opportune moment to take control of US weapons systems. Or maybe the thought of turning a cyberwar into a conventional war isn't that appealing. Directly attacking DOD systems would pretty much be the software equivalent of declaring war, and very few countries are willing to escalate from military-sponsored action to boots on the ground.

But if it's only better judgment holding our enemies back, that's not going to last forever. Better judgment isn't exactly the calling card of several world powers, including our own at the present. The DOD has been told it sucks at security several times over the past 30 years. The message has yet to sink in. The GAO will revisit this years down the road. Perhaps the DOD will fare better the next time around. It certainly can't do worse than it is now.

Filed Under: cybersecurity, defense department, dod, vulnerabilities, weapons

Watchdog Stings Defense Dept., Obtains $1.2 Million In Military Gear With A Fake Cop Shop

from the 1033-open-air-bazaar dept

The Defense Department's 1033 program allows local law enforcement agencies to buy military equipment. Often, the purchases are made easier with sizable grants, meaning agencies can load up on assault rifles, grenade launchers, armored vehicles, and extra ammo at nearly no cost. (They can also get computers, office furniture, etc. through these grants, but if that were the extent of the program, there would be zero controversy.)

The 1033 program is supposed to be tightly controlled and every acquisition vetted to prevent high-powered military gear from falling into the wrong hands. We've already noted local agencies aren't performing much in the way of oversight, resulting in several agencies receiving suspensions for failing to account for the whereabouts of purchased gear.

The problem, however, isn't just on the receiving end. The Defense Department isn't doing much in the way of due diligence when adding new agencies to the list of military gear purchases. The Government Accountability Office (GAO) performed a sting operation, setting up a fake law enforcement agency to see if it could acquire used military gear. By the end of it, the fake agency had obtained $1.2 million in gear, all without ever having to speak directly with anyone at the Defense Department. From the GAO's report [PDF]:

[O]ur investigators, posed as authorized federal law enforcement agency officials of a fictitious agency, applied and were granted access to the LESO [Law Enforcement Support Office] program in early 2017. In late 2016, we emailed our completed application to the LESO program office. Our application contained fictitious information including agency name, number of employees, point of contact, and physical location. We also created mail and e-mail addresses, and a website for our fictitious law enforcement agency using publicly available resources. All correspondence, including follow-up questions regarding our application, was conducted by email with LESO officials.

The first application was sent back for fixes. The revised application -- still loaded with fake info -- sailed through. It even included fake legal authorization.

LESO officials also emailed us to request confirmation of our agency’s authorizing statute; in response, our investigators provided fictitious authorizing provisions presented as a provision in the U.S. Code. At no point during the application process did LESO officials verbally contact officials at the agency we created—either the main point of contact listed on the application or the designated point of contact at a headquarters’ level—to verify the legitimacy of our application or to discuss establishing a MOU [Memorandum of Understanding] with our agency.

Not only were there no phone calls, there was no attempt by LESO officials to physically verify the existence of this fictitious law enforcement agency.

LESO’s reliance on electronic communications without actual verification does not allow it to properly vet for potentially fraudulent activity. For example, DLA [Defense Logistics Agency] did not require supervisory approval for all federal agency applications, or require confirmation of the application with designated points of contact at the headquarters of participating federal agencies. Additionally, at the time we submitted our application, DLA officials did not visit the location of the applying federal law enforcement agency to help verify the legitimacy of the application.

Since the DoD didn't perform any sort of prerequisite checks, it comes as no surprise it paid little attention to who was receiving the 1033 handouts.

Our independent testing of DLA’s internal controls also identified deficiencies in the transfer of controlled property, such as DLA personnel not routinely requesting and verifying identification of individuals picking up controlled property or verifying the quantity of approved items prior to transfer.

[...]

Using fictitious identification and law enforcement credentials, along with the LESO-approved documentation, our investigator was able to pass security checks and enter the Disposition Service warehouse sites. Personnel at two of the three sites did not request or check for valid identification of our investigator picking up the property.

From the GAO's description, acquiring controlled items appears to be no more difficult than shopping on Amazon.

Our investigators, after being approved to participate in the LESO program, obtained access to the department’s online systems to view and request controlled property. We subsequently submitted requests to obtain controlled property, including non-lethal items and potentially-lethal items if modified with commercially available items. In less than a week after submitting the requests, our fictitious agency was approved for the transfer of over 100 controlled property items with a total estimated value of about $1.2 million. The estimated value of each item ranged from $277 to over $600,000, including items such as night-vision goggles, reflex (also known as reflector) sights, infrared illuminators, simulated pipe bombs, and simulated rifles.

And, to top everything off, the DLA managed to ship this fake agency more items than it actually requested.

Furthermore, although we were approved to receive over 100 items and the transfer documentation reflects this amount, we were provided more items than we were approved for. The discrepancy involved one type of item—infrared illuminators. We requested 48 infrared illuminators but onsite officials at one Disposition Services site provided us with 51 infrared illuminators in 52 pouches, of which one pouch was empty.

The report goes on to note the DLA has never performed its own fraud audits, suggesting it has almost no interest in ensuring military gear only ends up in the hands of approved and thoroughly-vetted law enforcement agencies. Yes, all of this appears to be changing going forward, but considering the 1033 program has transferred billions of dollars of equipment already, there's really no telling how many others have obtained equipment with fictitious entities or simply ended up with a bunch of items they never ordered. That the weapons obtained were only simulators is of little comfort. They're simply modified versions of the real thing which could be made operable again with items obtained from non-government entities.

It's not that the DoD is only a few steps away from being logistically-bulletproof either. The GAO report notes the systems and controls used aren't even adequate -- which would be the minimum needed to ensure control of potentially-dangerous items. When presiding over the distribution of military gear, the DoD needs to implement controls far surpassing "adequate." So far, it can't even meet this very low bar.

Filed Under: 1033, controls, defense department, dod, gao, law enforcement, military gear, surplus

Secret Defense Dept. Report Shows Manning Leaks Did No Serious Damage

from the confirming-unofficial-statements-from-US-officials dept

Prosecutors seeking to justify a lengthy sentence (and the abuses that had already occurred) in the Chelsea Manning case insisted the documents she leaked had caused serious damage to those exposed by them. They said this even as multiple government officials admitted the most the United States had suffered was some embarrassment.

Jason Leopold has obtained an official assessment of the Manning leaks which shows the same thing: no real damage was done.

Regarding the hundreds of thousands of Iraq-related military documents and State Department cables provided by the Army private Chelsea Manning, the report assessed “with high confidence that disclosure of the Iraq data set will have no direct personal impact on current and former U.S. leadership in Iraq.”

This doesn't necessarily mean no damage was done. But the report confirms the United States didn't suffer from the Manning leaks.

The report also determined that a different set of documents that was published the same year, relating to the U.S. war in Afghanistan, would not result in “significant impact” to U.S. operations. It did, however, have the potential to cause “serious damage” to “intelligence sources, informants and the Afghan population” and U.S and NATO intelligence collection efforts.

The report [PDF] also notes investigators located the encrypted Wikileaks "insurance" file -- one Julian Assange says he'll release the key to if he feels his ability to disseminate information is threatened. (Stay tuned!) The assessment concludes it's unlikely this file contains anything damaging either.

Based on public statements by Assange, the IRTF assesses with moderate confidence that the "Insurance File" does not contain any USG data beyond what the IRTF has already reviewed.

The document dates back to 2011. It may have been some use in Manning's defense during the trial (a defense severely limited by the nature of espionage proceedings). As Leopold notes, Manning was not allowed to view this report. Instead, she was forced to fight the charges blind while prosecutors cherry-picked portions of the report to bolster their arguments.

Not that any of this matters at this point. The damage has already been done to Manning's life. And Manning's prosecution likely serves as a low-key chilling effect to dissuade potential leakers and whistleblowers from publicly humiliating the US government. But it does show the government is willing to use evidence that doesn't actually exist to secure a conviction.

Filed Under: chelsea manning, damage, defense department, dod, leaks, state department
Companies: wikileaks