Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×
The Military

Air Force Cyber Command General Answers Slashdot Questions 543

Here are the answers to your questions for Major General William T. Lord, who runs the just-getting-off-the ground Air Force Cyber Command. Before you ask: yes, his answers were checked by both PR and security people. Also, please note that this interview is a "first," in that Generals don't typically take questions from random people on forums like Slashdot, and that it is being watched all the way up the chain of command into the Pentagon. Many big-wigs will read what you post here -- and a lot of them are interested in what you say and may even use your suggestions to help set future recruiting and operational policies. A special "thank you" goes to Maj. Gen. Lord for participating in this experiment, along with kudos to the (necessarily anonymous) people who helped us arrange this interview.


How do we prevent "mission creep" (Score:5, Insightful)
by Jeremiah Cornelius (137)


It appears that the military is increasingly involved in areas who's jurisdiction was once considered to be wholly in the civil domain. Use of jargon like "cyberspace" seems only to obfuscate and distract from the core issue. This appears an effort to recruit public opinion and defuse the deeper questions that strike at the heart of a free and civil society. I think that if we had a statement that "The private mails are a warfighting domain" would generate a fair amount of debate on the role of the military as opposed to the police, the function of constitutional protection of liberties, and the question of what actually constitutes a state of war.

What are the limits on this jurisdiction? Who enforces these limits, and how is the public informed of that status? How are efforts to extend being safeguarded from creating mission creep that threatens all civil discourse in the United States and abroad form targeting, suppression, propaganda and extra-legal surveillance?

ANSWER:

A very good question. It's a complex issue, but bottom line is that we won't need new laws to be able to fly and fight in cyberspace. The DoD's role in protecting cyberspace is governed by domestic and international law to the same extent as its activities in other domains. Other U.S. agencies, such as the Department of Justice and the FBI, have important and, in many cases, leading roles to play.

Attacks on the US and its Allies by China (Score:5, Interesting)
by Yahma (1004476)


There have been several recent news reports that China has and is engaging in a nationally funded effort to hack into and attack US government computer systems. The German government recently announced that they traced recent aggressive cyber-attacks back to the Chinese government. What, if anything, is being done against this type of cyber-terrorism against us and our allies? Why do we still confer most-favored nation trading status onto a Nation who is actively engaged in efforts to spy on and attacak our government and corporate computer systems?

ANSWER:

Yes, there are lots of news reports on that, but I'm sure you can appreciate the fact that there are other branches of the U.S. government that must answer your foreign policy questions. I can tell you that securing cyberspace is difficult and requires a coordinated and focused effort from our entire society - federal government, state and local governments, the private sector and the American people. The Air Force is working to improve our ability to respond to cyber attacks, reduce the potential damage from such events, and to reduce our vulnerability to such attacks.

Accept, Retain, Solicit good people? (Score:5, Interesting)
by Lally Singh (3427)


General,

Some of the most talented people in computer security tend to have the sort of records that prevent them from getting clearance. Maybe nothing heavily criminal, but enough of a colored background that traditional security clearance mechanisms would throw them out of the room before they get started. Often the same types of minds that are really good at computer security are also the rebel types, who'll have some history. Will you work to get these people in, or are we looking at a bunch of off-the-shelf programmers/admins who've taken a few simple courses in computer security?

Also, how do you plan to attract/retain them? Again, rebel types are some of the best hackers, and they're not likely to go in without incentives. Not due to any lack of patriotism per se, but an unexplored understanding of it. More importantly, they're likely to be anti-establishment types who aren't comfortable in the strict traditional chain of command. Finally, usually the outside industry pays quite well for the good ones. Are you prepared to financially compete for the best?

Finally, will there be any connections back to the research/academic community? You may find academics more happy to help than usual, as cyber warfare can often be nonviolent. Also, will the existing (and immense) capability within the NSA be properly leveraged?

ANSWER:

I believe even the most unlikely candidate, when working for a cause bigger than himself, turns out to be a most loyal ally. Young men and women come into the military for any number of reasons - education, health care, etc. - but end up staying because they believe what they're doing matters. We know money doesn't create loyalty--a sense of purpose does. We'll take what they have to offer, and in turn they might be surprised by what they get back. It's not just our military members either, it's all those who partner with us . . . academia and private industry, our civilians and contractors, too. In the cyber command, there is a purpose and sense of urgency to be ready. You can bet that we leverage all the expertise out there to help us do our job.

Older recruits? (Score:5, Interesting)
by rolfwind (528248)


It seems that in the military traditionally it was always looking for people fresh out of highschool for EMs and if you wanted to get anywhere in the military you had to be either college educated or, to really have a high end military career, start really young in something like the Valley Forge Military Academy and work from there.

In a traditional branch of the army/navy/airforce that is probably as it should be.

But in this area people have to be trained for years, still not know as much as the older hands in the private industry, and before they really know enough their enlistment would be over. Also, it would be unacceptable for an older IT person to join but take a pay cut to a Private's level or perhaps even a Lieutenant's -- so I imagine this branch would have to be somewhat different.

Is the military going to do to reach out toward the older folks who have extensive experience and knowledge outside the military?

ANSWER:

As I work alongside today's Airmen, many with very specialized skill sets in great demand outside the Air Force, I find them to be incredibly well trained and up-to-speed on current technologies. We bring them in from a general practitioner level and take them to expert level in reasonable time ... and well before retirement age indeed! We train them with specific technical skills as well as overarching abilities required to lead in today's environment. You're right in that we couldn't compete in the cyber world without the experts in the civilian industries who give us the technology in the first place, provide the architectures we use, and even the software we need. People don't have to enlist or take a pay cut to help us out. Certain skill sets can also be brought on board as civilians or contractors, and in many cases we do offer compensation competitive with the commercial sector.

Which acts of war should be illegal in cyberspace? (Score:5, Interesting)
by cohomology (111648)


War is never clean.

In conventional warfare, certain actions such as hiding among civilian populations are forbidden. These actions are considered war crimes because of the collateral damage they are likely to cause. What actions in cyberspace do you think should be outlawed? How about intentionally bringing down hospital IT systems, or destroying undersea cables without regard to the effects on civilian populations?

ANSWER:

The U.S. military complies with all applicable domestic and international laws, and that will certainly apply equally within cyberspace. The Law of Armed Conflict, for example, arose from a desire among civilized nations to prevent unnecessary suffering and minimize unintended destruction while still waging an effective war. It would be possible, as you mentioned in your scenario, that some who ignore the laws of civilized nations could conduct operations in cyberspace that may have unlawful negative consequences on civilian populations. For us, abiding by these laws, being good at we what do and maintaining a technological advantage over our adversaries provides us a first line of defense. Those who commit unlawful acts would certainly face potential criminal liability for war crimes.

Physical Fitness (Score:5, Interesting)
by spacerog (692065)


General, You were recently quoted in Wired as having said "So if they can't run three miles with a pack on their backs but they can shut down a SCADA system, we need to have a culture where they fit in." Is this an accurate quote? As a former member of the US Army I must say that passing a PT test is not very difficult and the suggestion that some soldiers should be exempt from basic minimum requirements is rather upsetting. Are you actually advocating the relaxation of military physical fitness standards for 'cyber warriors'? Would this not create a double standard and animosity between the cyber command and other sections of the military? Surely there must be other recruitment incentives that can be applied to attract the talent you need.

ANSWER:

I don't disagree with you . . . and I am not advocating changing our PT test. What I am saying is that we, as a military culture, need to look beyond what we've traditionally recruited. The very nature of our military requires that we be able to work in combat conditions and be able to establish and protect our cyber/communications structures and networks in remote, even austere conditions. As anyone who has worked in these austere locations will tell you, being fit is critical to mission success, so I don't foresee or advocate for a relaxation of standards just to bring in this specific type of talent. But, as we know, some of what we do in cyber can be done at home station as well, so what will our force look like in the future? This is something we need to look at and evaluate as we progress in this area.

It is good war is so terrible... (Score:5, Insightful)
by MozeeToby (1163751)

A wise man once said "It is good that war is so terrible, lest we grow too fond of it". If cyberwarfare ever becomes a reality, how do we respond to the fact that is isn't "terrible"?

The direct damage from such warfare would be primarily economic or data security related (rather than a cost in human lives) how do you feel we can prevent it from becoming a monthly, yearly, or daily occurance?

ANSWER:

The fact is we are dealing with this on a daily basis and it won't be going away anytime soon. Not for any of us. The way to shield ourselves from these attacks is to be at the forefront of technology, tactics and procedures relating to operating in cyberspace. We have systems and software that are protected by multiple layers of security and functional redundancy. We train our people to be on the cutting edge of this technology, and we find ways secure our information. We have to take this very seriously because we rely on our networks to conduct military operations all around the world. The person who hates war the most is the warrior who has to go to it ... we want to prevent that.

Criminal vs Warlike Actions (Score:5, Interesting)
by florescent_beige (608235
)

General Lord,

Does the AFCC have a mandate to pursue criminals that use information infrastructure to commit crimes, or is your group intended to defend against warlike attacks only?

If the latter is true, how would you distinguish between criminal activity and warlike activity in cyberspace?

ANSWER:

The speed and anonymity of cyber attacks makes it very hard to distinguish what actions would be those of terrorists, criminals, nation states or just some lone prankster. Our command coordinates with government partners such as the DoD's Cyber Crime Center staff, who work with law enforcement officials to investigate and prosecute criminal acts if necessary. A "war-like activity" can also include presenting misleading information to our battlefield commanders. So, we've got to be spot on about authenticating the trusted source of that information in the first place. But, generally speaking, if something is a coordinated attack that would cause disruption or an attack that required a high level of technical sophistication to carry out, that would cause us to take a closer look and recommend a proper response.

Legal Hacking... (Score:5, Funny)
by JeanBaptiste (537955)


Just post a list of the stuff you want hacked and the more patriotic hackers will enjoy doing it for free.

Due to the nature of hacking and what many people do to acquire such skills, they may not want to 'join up' and all that.

But if you post a list of IP's that are okay to bring down, and networks you want information stolen from, with the understanding that the US will not condemn any attacks, and I'm sure more than enough people would do it for free.

Is there anything like this already in place? Cause I got nothing better to do this weekend. Or most any weekend.

ANSWER:

YGTBKM! LOL! I like your enthusiasm, but you know the Air Force neither encourages nor condones criminal activity.

Could a Cyber Attack Trigger a Real War? (Score:5, Interesting)
by florescent_beige (608235)


General Lord,

I'm curious to know if you have have any criteria that would enable you do decide when a cyber attack is an act of war. Would it be possible for some kind of action inside a network to lead to a shooting war without some kind of overt physical threat occurring first?

ANSWER:

Within the Department of Defense, we are careful not to speculate about what would be considered an act of war. Our nation's elected officials are the ones who will decide what threats to, or actions against our national security will constitute an act of war against the United States. These same leaders will likewise determine what an appropriate response would be, and that could be diplomatic, economic or involve the military to demonstrate the nation's resolve. That's why it's my responsibility to oversee the building of a command that will provide our leaders, through the appropriate chain of command, with many options with which to deter threats in the first place or respond when necessary.

Why was the Air Force tasked with this? (Score:5, Interesting)
by Isaac-Lew (623)


Why should the US Air Force be tasked with this, instead of DISA or NSA, neither of which is tied to a specific branch of the military?

ANSWER:

Don't confuse the fact that we are standing up the Air Force Cyber Command to mean we are the lead for the nation, or the primary command to respond to a particular incident. We are just one part of a combined effort. Our first priority is to work with DoD to defend AF military resources, but many of those resources rely on civilian entities, so we obviously have a keen interest in protecting those items as well. We thought it was the right thing to do to consolidate our efforts and to align all the Air Force cyber-related resources so we can have better command and control. This command will be able to respond better to the needs of our commanders and be the focal point within the Air Force for cyber security and defense missions, as well as respond to emergencies and natural disasters. Make no mistake, we are partners with the other sister services--the Army, Marines, Navy--as well as with DISA, NSA and Homeland Security to name a few. We're all in this together.

Question about Existing Contractors (Score:5, Interesting)
by tachyon13 (963336)


General Lord, I currently work as the exact type of 'cyber warrior' you intend to recruit. But I already have a Top Secret clearance, already familiar with DoD systems, etc. The dynamic with what we call 'Information Assurance' is that of a constant struggle with our contractor management (stay within the contract, the budget, etc) and with our 'warfighter' higher ups (educating them on why they can't have full access from their home in the spirit of "operations are a priority, to hell with security"). So assuming you can get the type of expertise that are eligible for clearances, and that are willing to relocate to Offutt/etc, how are you going to address the core issue of security in the DoD: Operations/budget/schedule will always trump security. Or alternatively, security will always be back burner to 'hot' issues. Thank you for your time.

ANSWER:

Certainly the balance between having access to do our mission and having robust security is an issue where not everyone agrees on just how much to restrict or how much to allow. The Air Force takes the security of its computer networks very seriously and has taken several measures to educate our users and to provide secure means for them to operate. As with many other issues, the Air Force through its commanders, must assess the risks and make a decision. I don't agree or I maybe I just haven't seen where security is always a back burner item.

CyberCommand Location (Score:5, Interesting)
by Mz6 (741941)


General,

Can you explain some about the situation developing between Barksdale AFB and Offutt AFB as they try to fight over the eventual final location for CyberCommand? My thoughts are that finding and recruiting talent, and laying the foundation for such a large wired infrastructure in the Omaha, Nebraska area may be easier to accomplish than in and around Shreveport, LA. What types of things is the DoD looking for when they choose the final location for this new Command?

ANSWER:

The government actually has a regulation that covers the whole process for choosing a location for a command and it's a very defined, thorough process. The bases must meet certain criteria -- existing infrastructure would be just one aspect of many items along with communications or square footage requirements, but there are other considerations, such as the impact to the environment that the Pentagon will consider. I would hope that no matter where it was located, we would still be able to attract the talent needed to work in this exciting command and that all communities see the need to protect this domain.
This discussion has been archived. No new comments can be posted.

Air Force Cyber Command General Answers Slashdot Questions

Comments Filter:
  • by swm ( 171547 ) <swmcd@world.std.com> on Wednesday March 12, 2008 @10:43AM (#22728724) Homepage
    and the answers are content-free.

    Oh, well. At least they tried.
    • Re: (Score:3, Insightful)

      I agree. There's not much here to actually inform someone. Basic PR. I guess it was worth a shot. Maybe they'll get a little more latitude in the future, if this is tried again.
    • Re: (Score:3, Interesting)

      by DerekLyons ( 302214 )
      Not content free at all - merely phrased in military speak and bureaucrat speak and quite informative. I really don't know what you expected.
      • quite informative

        So tell me, what did you learn, other than the good general is well practiced in PR-fu?
        • by truthsearch ( 249536 ) on Wednesday March 12, 2008 @11:27AM (#22729260) Homepage Journal
          I learned:

          - that they don't believe they need new laws to "fight" in cyberspace.
          - "People don't have to enlist or take a pay cut to help us out."
          - "Within the Department of Defense, we are careful not to speculate about what would be considered an act of war."

        • Answers translated (Score:4, Informative)

          by DaveV1.0 ( 203135 ) on Wednesday March 12, 2008 @03:23PM (#22732260) Journal
          1a) The realspace laws that govern military activities apply to our cyberspace activities.
          1b) The same people who oversee us to make sure we comply with the other laws.
          1c) We do like we do with realspace things, we turn them over to the appropriate civilian authorities.

          2a) We are doing our best to defend the nation's interests. As you can imagine, it is hard and complicated by politics.
          2b) Good question, but the military doesn't make those decisions. Ask your democratically elected government.

          3a) We are constrained by what Congress, the President, and the rest of the mucky mucks decree. We let in those we can. We also have little say over security clearances.
          3b/c) We will attract them as we always have: patriotism, money for college, a chance to learn and earn, and even health care. We are an all volunteer service. Our people will stay because they want to stay. We may not pay the best, but we want loyal servicemen, not mercenaries. Our members will stay because they are making a difference as a part of a larger organization.
          3d) We have had, continue to have, and will have a strong connection with the research/academic community.
          3e) You are asking the wrong person again. We will work with them, but how much they do is up to the rest of the government.

          4) Other people make those decisions. But, even if one is too old to enlist, one can always work for the military as a civilian employee/contractor.

          5) We don't make laws and I really can't answer this question without getting my ass in trouble. That said, we will abide by the laws of war and those that don't will be punished.

          6) I don't think we should lower fitness requirements, especially for people who are deployed. But, we may want to rethink some of the requirements and how they are measured. And, we should rethink what we look for in recruits. Fitness can be increased, but stupid is forever. And, for some posting, especially ones in the U.S. maybe we can use people who would not be deployable or who may be forced out due to health or weight. We might even want to consider converting those people into civilian employees/

          7) You have just mentioned what makes my job hard. How to make cyberwar "terrible" so as to make it undesirable? Right now, it is a matter of a good defense. It may come to trying to isolate countries or enlisting other governments in the hunt for cyberterrrorists. We REALLY want to prevent a cyberwar because war sucks for us more than you will ever appreciate.

          8)We are really for defending against outside groups attacking the U.S., but sometimes it is hard to tell that from civil crime. When we investigate, if we determine that it is outside our mandate, we turn it over to the appropriate civilian agency, such as the FBI, CIA, etc.

          9)YGTBKM! LOL! I like your enthusiasm, but you know the Air Force neither encourages nor condones criminal activity.

          10) We don't decide what constitutes an act of war. That is for the civilian government. We just fight the battles they pick.

          11) We are tasked with defending military computers and networks. The other agencies defend other systems. We will work together, but they have their job and we have ours.

          12) I don't see the mindset you are talking about. Maybe I am not exposed to it, but I don't think that is the way things are.

          12) If I answered this it would be TL:DR. There is an entire process in place which I, and many people in the military, have little to no control over.
    • by wsanders ( 114993 ) on Wednesday March 12, 2008 @11:00AM (#22728908) Homepage
      Q: Please g3ve u5 r00t to m133ile l3nche5!
      A; No.

      Q; You suxx0r!
      A; I love my job! { must ... control ... fist .. of .. death ...]
    • by timholman ( 71886 ) on Wednesday March 12, 2008 @11:02AM (#22728932)

      and the answers are content-free.

      Did anyone seriously expect anything else?

      We live in an age where the press routinely goes over every single word spoken by celebrities, politicians, and public figures, and tries to make a scandal out of any off-hand comment that can be construed to embarrass the speaker.

      Any officer who has not learned to cover his ass and keep his mouth shut will have a short career in today's military.
      • by Firehed ( 942385 ) on Wednesday March 12, 2008 @12:27PM (#22729962) Homepage
        A perfectly understandable and valid reason for the response, but that doesn't change the fact that most of those responses either dodged the question or answered something entirely different. Or in one case ("YGTBKM!" - which I had to look up), a blatant lie. You can bet your ass that the government would love to hand over a bunch of IP targets to script kiddies to piss off the Chinese government and would happily grant them immunity, if not for the fact that they couldn't sufficiently distance themselves from such a list. I just can't take seriously any answer that says "we don't condone illegal things" coming from anyone in the government, let alone a high-up in the military, even if I were to disregard that whole torture thing. Apologies if that makes you guilty by association, but you know what's going on and still choose to work there.
      • Re: (Score:3, Interesting)

        by demachina ( 71715 )
        "Did anyone seriously expect anything else?"

        Reference Admiral Fallon who was either fired, or resigned yesterday as head of Centcom, because of his excessive honesty in this Esquire article [esquire.com] or General Shinseki who had his head taken off for pointing out the Iraq war was being waged with to few troops and they wouldn't be able to control Iraq during or after the invasion. Someone what Fallon said in that article completely escape censorship, but it didn't certainly "shorten" his career. I wager he was so s
    • AGREED (Score:5, Interesting)

      by rutledjw ( 447990 ) on Wednesday March 12, 2008 @11:04AM (#22728966) Homepage
      But I think your second point is most important - they tried. Assuming (hoping?) they really are reading feedback we can hope they will adjust their filters accordingly. being vague on questions such as roles and responsibilities between government agencies will only create a general sense on unease in the general population.

      Furthermore, we should remember as a group of large agencies, there's bound to be politicking and may not be the level or coordination desired. Of some of this vague area may reflect reality, they don't really know where lines actually exist...
      • Re: (Score:3, Insightful)

        by kanwisch ( 202654 )
        I'm in the encouraged realm. I learned something that I did not already know and some of his replies (like the PT item) provide an interesting understanding of the degree of change that leadership in that organization is considering.
      • by ThousandStars ( 556222 ) on Wednesday March 12, 2008 @11:34AM (#22729342) Homepage
        The general's answers were also interesting because they demonstrate the gap between what we're used to reading on blogs and in /. comments: unfiltered, highly opinionated pseudo-anonymous people who speak only for themselves. There are no or few repercussions for most people if they make a foolish statement or unfairly lay into someone or whatever. But public officials -- and a general is at the very least a semi-public official -- don't have that luxury. So what such a public official will say will be different in tone and content than what we're used to.

        This indicates something of a culture gap between the kind of hackers who the general presumably wants to recruit and the generals themselves. Paul Graham states it [paulgraham.com] well:

        Most imaginative people seem to share a certain prickly independence, whenever and wherever they lived. You see it in Diogenes telling Alexander to get out of his light and two thousand years later in Feynman breaking into safes at Los Alamos. Imaginative people don't want to follow or lead. They're most productive when everyone gets to do what they want.

        Such "prickly independence" is the opposite of the stereotype of the military that's lodged in my mind. Now, I know that stereotype is somewhat inaccurate, but nonetheless the rebel/renegade streak that runs through many -- though by no means all -- of the creative, intelligent people who often know technology well. I'm not sure I'd go as far as Paul Graham's "most," but I'm definitely going to use "many."

        Finally, regarding the tone of the answers, remember too that it's easier for an individual speaking for himself (Neal Stephenson, anyone [slashdot.org]?) to answer candidly than it is for someone who represents millions, especially because the military sometimes has PR problems. If the general says anything forceful, it will be spun around the Internet, quoted -- perhaps out of context -- in newspapers, and generally leave the military open to the PR of others.

        I'm not sure how to solve such cultural problems between hacker types who need direct unvarnished honesty ("Where is the mistake in this?") versus PR types in public ("How do I make sure my words won't be used against me?").

        • by DerekLyons ( 302214 ) <fairwater.gmail@com> on Wednesday March 12, 2008 @02:18PM (#22731514) Homepage

          Such "prickly independence" is the opposite of the stereotype of the military that's lodged in my mind. Now, I know that stereotype is somewhat inaccurate, but nonetheless the rebel/renegade streak that runs through many -- though by no means all -- of the creative, intelligent people who often know technology well.

          Well, from my decade of service in the USN Submarine Service I'd say that a significant (if not vast) majority of my fellow bubbleheads exhibited the traits of "prickly independence" and "rebel/renegade". From encounters and conversations with other parts of the Navy and other branches of the service over the years I'd say that (outside of the more elite branches, like the Submarine Service) the traits are present in what amounts to only a very slight minority.
           
          Many in the military also tend to be more creative than you might think. Certainly we're trained as most people think, to treat The Book as something to be followed slavishly. What most people don't realize is that we are also schooled in the principles behind The Book so that when the shit hits the fan and The Book has to be tossed over our shoulder - we are ringing the changes [wikipedia.org] rather than merely improvising. (And even when we do have to improvise, we've still got that grounding to work from.)
           
          Which is why the military values those traits - someone who doesn't have them flounders when you have to heave The Book. And the military knows full well that in the real world things will go all pear shaped - its inevitable. (And, inevitably, leads to tension between 'the kind of serviceman you want in peacetime' and 'the serviceman you need in harm's way'.)
           
          The difference between the typical creative person and the military mind, I think, lies in the ability of the military mind to 'switch modes' as it were. The discipline to stay in robot mode when needed, matched with the ability to operate creatively when needed. You can't have artistic tantrums when the bullets are flying, or even in peacetime in garrison.
    • by Jeremiah Cornelius ( 137 ) * on Wednesday March 12, 2008 @11:09AM (#22729026) Homepage Journal
      Content free?

      I'm in the Big Brother database, now...
    • by Telvin_3d ( 855514 ) on Wednesday March 12, 2008 @11:15AM (#22729112)
      Actually, I was impressed with the quality of the answers. They seem to be well thought out and illuminate the intentions of the program if not the specifics. The only questions that eh really sidesteps on are ones related to policy and that is how it should be. Members of the armed forces should not be setting policy.
    • by florescent_beige ( 608235 ) on Wednesday March 12, 2008 @11:36AM (#22729354) Journal
      There is a whole science to reading speech that is attempting to balance many competing interests.

      In this case I'd list some of the competing interests as:

      Don't want to actually lie.
      Don't want to say anything your worst enemy shouldn't know.
      Don't want to be *perceived* to be doing either of the preceding.
      Want to appear receptive to questions.
      Want to remain politically neutral.

      I'm sure there are many more.

      I did manage to tease out one interesting tidbit from two questions of mine the General was kind enough to answer:

      Question #9: When asked if a cyber-attack could lead to a shooting war, the General replies (to paraphrase) that the response to any given scenario is up to elected officials, not the DoD. Fair enough. But...

      Question #7: When asked about the difference between criminal and military-like actions online, the General replies that, depending on the nature of the attack, his group would "recommend a proper response".

      So, while the ultimate decision is always to be up to the CinC, the DoD isn't without an opinion as the answer to #9 might imply. The real answer would get into operational planning which, of course, can't be revealed.

      Actually I find the answers interesting to parse, knowing that they must have been massaged by so many experts.

      None of which is meant to belittle the fact that the General actually took time to go though this exercise. Very refreshing.
    • by pitonyak ( 1102049 ) on Wednesday March 12, 2008 @11:42AM (#22729406) Homepage

      I considered some of the answers insightful, for example: "We know money doesn't create loyalty--a sense of purpose does".

      Yes, some answers lacked deep content in that they were the expected carefully worded answer. Unfortunately, these questions almost required such an answer. For example, "Why do we still confer most-favored nation trading status onto a Nation who is actively engaged in efforts to spy on and attack our government and corporate computer systems?" Although this is a very good question, General Lord seems like the wrong person to even attempt that question. The probable complaint is that the answers lacked detail. For example, from the same question "What, if anything, is being done against this type of cyber-terrorism against us and our allies?" The answer lacks detail, but it would be difficult to add detail to his answer without discussing a specific threat. I would have enjoyed that discussion, BTW, and use his answer as a start: "working to improve our ability to respond to cyber attacks, reduce the potential damage from such events, and to reduce our vulnerability to such attacks."

      Thank you General Lord for your time!

  • Obligatory (Score:5, Funny)

    by linux pickle ( 974544 ) on Wednesday March 12, 2008 @10:45AM (#22728734)
    I, for one, welcome our William T. Lord overlord.
  • by esocid ( 946821 ) on Wednesday March 12, 2008 @10:47AM (#22728758) Journal

    YGTBKM! LOL! I like your enthusiasm, but you know the Air Force neither encourages nor condones criminal activity.
    Are you sure this is a general and not some 14 year old girl?
  • by aquatone282 ( 905179 ) * on Wednesday March 12, 2008 @10:48AM (#22728772)

    WTF?

  • by InfinityWpi ( 175421 ) on Wednesday March 12, 2008 @10:48AM (#22728780)
    Some of those answers are obviously 'cleaned up' and somewhat evasive... but some are actually quite nice, and the man actually used 'text speak' in an answer... I'd say the questions and answers came across rather well, given that they had to be combed over. I'd love to hear more candid, off-the-cuff answers but I know that's not really an option when dealing with something of this nature.
    • by Foobar of Borg ( 690622 ) on Wednesday March 12, 2008 @10:53AM (#22728836)

      I'd love to hear more candid, off-the-cuff answers but I know that's not really an option when dealing with something of this nature.
      Well, he could always try channelling Patton:


      "No bastard ever won a cyber-war by getting hacked for his country. He won it by making the other dumb bastard get hacked for his country!"

  • by ajs ( 35943 ) <ajs@ajs . c om> on Wednesday March 12, 2008 @10:50AM (#22728802) Homepage Journal
    The security clearance question was dodged. That's too bad. I would love to work for such an organization, and might even have signed up with the Air Force if I thought I could make it into that group when I was younger. However, I know that for silly reasons that have to do more with red tape than any actual wrong-doing on my part, a security clearance is out of the question. If he'd given people some hope that the typical rules regarding security clearances would be relaxed in favor of a more "are you a potential threat" based analysis, he might have won some hearts and minds.

    • by juuri ( 7678 ) on Wednesday March 12, 2008 @11:03AM (#22728956) Homepage
      A security clearance of Secret is much easier to obtain than many expect. Top Secret can also be obtained somewhat easily, even given a set of questionable actions in the past, based on good interviews with people from your sphere of influence. Special allowance cases are made all the time for either. Many people assume (wrongly) that a past arrest or drug use immediately rule out either. The important parts here are complete honesty, showing a changed "nature" if needed and that your versions of past events match up with other witnesses.

      • 1) Do you have any foreign connections? Obviously, the biggest security concern with classified information is foreign espionage. So, they want to make sure that you aren't under the sway for a foreign government.

        2) Do you have anything that could be used as leverage to make you give up information? It isn't that the care so much what you are or what you've done, they care if you care. Your sexual orientation isn't important... unless you are scared about having it revealed, in which case it could be levera
  • by The Fun Guy ( 21791 ) on Wednesday March 12, 2008 @10:54AM (#22728838) Homepage Journal
    YGTBKM! LOL! I like your enthusiasm, but you know the Air Force neither encourages nor condones criminal activity.

    p.s. and we know where you live.

    p.p.s. and we told the FBI, DHS and your state and local PD where you live.

    p.p.p.s. and we all have guns.
  • by xxxJonBoyxxx ( 565205 ) on Wednesday March 12, 2008 @10:54AM (#22728850)
    "Cyber Command"? What time does that show air on the Disney channel?
  • by ThousandStars ( 556222 ) on Wednesday March 12, 2008 @11:05AM (#22728982) Homepage
    The way to shield ourselves from these attacks is to be at the forefront of technology, tactics and procedures relating to operating in cyberspace. We have systems and software that are protected by multiple layers of security and functional redundancy. We train our people to be on the cutting edge of this technology, and we find ways secure our information.

    The issue of Internet security and being on forefront of technology seems to me like it has much more to do with education and intelligence than with the military directly. If you want the country as a whole to be on the forefront of technology, you have to have the highly educated people who create and master said technology. To my mind, this issue becomes more of how we can improve abysmal public schools and the like than what the military can do.

    I'm reminded of Foucault, who in Power/Knowledge [stanford.edu] discussed the idea of power in the context of a network or society. The military is embedded in the network of American power, and in the domain of Internet security and the like it seems to rely even more on other parts of the network than it does in other forms of operation like physical combat.

    • Re: (Score:3, Insightful)

      by geekoid ( 135745 )
      That is clearly implied.

      "To my mind, this issue becomes more of how we can improve abysmal public schools and the like than what the military can do."
      Great, how many PTA meetings have you been to? how much time have you volunteered? Money?
      Have you tried to find a way fro them to get more moeny? discussed the issue that the cost of running a school is going up faster then the taxes that go to it? Have you talked to your representative about it? have you looked at different legislators?

      Until you have done all
  • Legal Hacking (Score:5, Interesting)

    by mikeee ( 137160 ) on Wednesday March 12, 2008 @11:06AM (#22728996)
    This is actually quite a traditional thing; what we used to call Letters of Marque [wikipedia.org] were issued to pirates to 'legalize' their attacks on the enemy. While these were banned by the 1856 Declaration of Paris, the US is not a signatory to that treaty, and theoretically Congress could issues these permissions (it's a power specifically granted them in the Constitution).
  • by DTemp ( 1086779 ) on Wednesday March 12, 2008 @11:09AM (#22729038)
    The General's answer to the third question ("Accept, Retain, Solicit good people?") clearly shows that his answer to "Usually the outside industry pays quite well for the good ones. Are you prepared to financially compete for the best?" is "No."

    So, US Government, please let us know when you're ready to put your money where your mouth is, and we'll subsequently give you the best damn computer security on Planet Earth. Until then, you're just another employer trying to get more than he's paid for out of his staff.
    • by tppublic ( 899574 ) on Wednesday March 12, 2008 @12:34PM (#22730050)
      Are you prepared to financially compete for the best?" is "No."

      Literally, his answer was no. It has to be: We haven't had a major incident in order to raise the issue to an election crisis for Congress. Thus, the ROI perceived (stress this is a perception issue, not a reality issue) by politicians on spending more for military cyber-security is dwarfed by the ROI companies can actually return from new products. Thus, private industry will employ the experts.

      Having said that, the implication in "It's not just our military members either, it's all those who partner with us . . . academia and private industry, our civilians and contractors, too." is that they can - and must (for practical financial reasons) partner with private industry. It's not like the world's experts in aircraft design are in the Air Force: they work at Boeing, Northrop, EDS, etc.

      I believe he's saying the same thing here. He can't expect to afford the experts, as they should be working for the companies developing the tools used by the military. However, he can still leverage their expertise, as those companies can be partners to the military, and those well-paid workers in private industry should expect to be helping and training the members of his command (and perhaps even developing new features that the military gets first access to).

    • Bad bet (Score:3, Insightful)

      So, US Government, please let us know when you're ready to put your money where your mouth is, and we'll subsequently give you the best damn computer security on Planet Earth.

      He doesn't want to hire you. He wants people who aren't motivated only by money.

      Because if you're motivated only by money, when the Ruskies (allow my cold war allusion) come by with a $40M bag you're going to tell them everything you know.

      Now, you may be saying to yourself, "hey, I'm not just about the money, I've got my ethics, my mo
  • by florescent_beige ( 608235 ) on Wednesday March 12, 2008 @11:10AM (#22729040) Journal
    From: Joint Chiefs
    To: General Lord
    Encoding: S00per Seekrit COd3 #5

    Ixnay on the LOL-ay, mkay?
  • by Anonymous Coward on Wednesday March 12, 2008 @11:11AM (#22729058)
    My God, how many stars is that?
  • by jtev ( 133871 ) on Wednesday March 12, 2008 @11:14AM (#22729096) Journal
    If we were to make such an attack, wouldn't that just be doing our duty as part of the unorganised militia of the USA. I mean, since every male from the age of 18-40 is already part of it, wouldn't it be part of doing our part to do war upon the infrastructure of the enemies of our nation, as much as it would be to do war upon invaders?
    • Re: (Score:3, Interesting)

      by geekoid ( 135745 )
      That is an excellent question. Assuming you are talking about a country we have declared War on, I would love to hear legal experts discuss
      that.

      I think just doing it to any country that war hasn't been specifically declared on would be a no-no. So being considered an 'Axis of Evil' won't cut it. Plus it could hurt relations.

      So in present day, how do we do this in Iraq? Iraq isn't the enemy, force not backed by the government are.
      Touchy.

      Do it, don't get officially caught, and be smart might be what it boils
  • by bbasgen ( 165297 ) on Wednesday March 12, 2008 @11:16AM (#22729128) Homepage

      It is unfortunate that the General did not talk about his vision for the future, as several questions prompted.
    Does the Cyber Command have a concrete understanding, and long term projections, of cyber wafare in the future?
    For example, could this result in the creation of a new branch of the military, in a similar way as the Army Air
    Corps spawned the Air Force? In order to instill confidence in our operations, it is important that we convey an
    appropriate vision for the future. The disparity, for example, revealed in one response about distinct cyber
    groups across the different branches of the military is counter-intuitive, to say the least! This reveals an operational, as opposed to a strategic role of IT in the military. While that may be correct today, ought we not be working towards a paradigm shift in the future?

      On the issue of internet law, while a politically understandable response, it would have been good to have read a
    more realistic grappling with these incredibly difficult problems. It is a fairly routine conception to refer to
    the internet as the wild west, and this is a significant reality in terms of effectively addressing defense. In
    particular, this contradiction is revealing:

    "It's a complex issue, but [the] bottom line is that we won't need new laws to be able to fly and fight in
    cyberspace." [....] "Those who commit unlawful acts would certainly face potential criminal liability for war
    crimes."

      Effective warfare exploits opportunity, and the lawlessness of the internet has been exploited ad nausea by
    criminals and nations the world over. While it is not the role of the military to devise such laws, surely we can
    see the strategic importance that it is in our best interest to encourage the establishment of such laws? This should be pretty
    obvious: in the same way that a military power is want to fight insurgents/guerrillas, the US Cyber Command
    shouldn't tacitly accept a theater that strongly disadvantages what should otherwise be a significant position of
    power.

    ~~~~~~~~~~~~~~~
    Brian Basgen
    Information Security Officer
  • by neonleonb ( 723406 ) on Wednesday March 12, 2008 @11:39AM (#22729388) Homepage
    Am I the only one who can't help but think: he is the very model of a modern major general?
  • by Quiet_Desperation ( 858215 ) on Wednesday March 12, 2008 @11:51AM (#22729492)
    I think given the type of forum and nature of the subject the answers were OK. Hey, they answered.

    And I still think "General Lord" ranks up there in the top ten of title/name combinations.

    Of nothing beats Staff Sargent Max Fightmaster, and nothing probably ever will.
  • by Rorschach1 ( 174480 ) on Wednesday March 12, 2008 @11:56AM (#22729562) Homepage
    If this really IS being followed at the highest levels, then I can't help but comment.

    I worked at a certain major AFSPC base for almost a decade as a contractor. Back in the early days, when we first got a base-wide Internet connection, the local Comm Squadron was free to implement security systems as they saw fit, and we had some good stuff in place - we sorted out the Sidewinder mess that CITS dumped on us, added our own IDS, and made the best of our home field advantage, setting up tripwire alarms and things on hosts scattered throughout the network to catch internal scanning.

    This was all done by contractors, mind you, and it got done because we liked what we were doing, took pride in doing a good job of it, and we had support from the squadron commander. The blue suiters had a very high turnover rate, with average retention at something like 6-9 months for the folks down at our level. None of them ever learned to do much besides process NOTAM paperwork and handle accreditation pacakges.

    Once the MAJCOM started taking control of the security stuff, our defensive posture went to crap. What we'd done didn't fit with the overall plan, so it was all removed. We were left with poorly-implemented downward-directed systems operated by poorly-trained drones. Every week we'd have to explain to these people (mostly MAJCOM-level people, the AFCERT folks were usually a little better) basic concepts like IP spoofing (I wrote a 2-page form letter on the subject), and teach them how to read their own ASIM logs.

    I have to say that the aggressor squadron teams that'd come in and attack the network knew their stuff. And of course they were able to break in every time. But it felt a little like being armed with a paintball gun and having the Marines sent at you. We KNEW how to help prevent, detect, and respond to these attacks, but we weren't given the authority, time, or resources to do anything about it.

    If Cyber Command is going to do anything useful on the defensive side of things, then the best thing they can do, IMO, is to deploy a small garrison force to each base and give them the responsibility for base network defense. Let them interface directly with the BNCC, and plan on having them in one place for AT LEAST 18-24 months. Let all of these forces communicate with each other at the working level to share information and strategies. Some of our most productive contacts were those we made with other bases on our own initiative, and not through the chain of command. Keep the chain of command in the loop, but let the people at the bottom talk to each other.

    Most importantly, make it clear that their job is security, and not paper pushing. Certainly there's always going to be paperwork involved, but when I left, the CND office did nothing BUT push paper, and paper that was largely worthless. Not a single thing they did would have ever helped to detect an attack from within the base network.

    I don't mind saying all of this, and I'll be happy to say plenty more, because I don't work there any more, and I frankly don't care to ever get another penny of Air Force money. I WOULD like to know that the trend toward totally incompetent central management of base security is being reversed, though.
  • by sm62704 ( 957197 ) on Wednesday March 12, 2008 @12:10PM (#22729718) Journal
    Generals don't typically take questions from random people on forums like Slashdot

    When I was in the USAF I wrote a letter to president Nixon, and recieved a very nice and polite reply from a General. So Generals may not answer random people on the internet, but they do answer random servicepeople who write the Comander In Chief.
  • by shaitand ( 626655 ) on Wednesday March 12, 2008 @12:31PM (#22730002) Journal
    Bot networks have been shown to be very powerful, whether used to mass email or launch a DDOS attack. So I suggest creating an official defense botnet client that civilians can download to help our military from home.

    Naturally, the military wouldn't use this every day, but if this effort were heavily publicized through major media outlets and made easy to download and install (initiates contact with home so it bypasses most consumer firewalls without port forwarding, etc). I think you would find the number of cyber patriots to be large indeed.

    Of course, if the military ever attempted to tie a backdoor of any kind into this bot client it would create a serious backlash so I would recommend hard coding that this should never be done into the orders to create it as well as public statements. This will help reduce the possibility of a future commander doing so either.

    The other possibility is that the bot net could fall into the hands of a third party. While this is possible, and it probably isn't possible to make it impenetrable all you really need to do is make it secure enough that its easier to establish your own illicit botnet. People are doing just that every day so that barrier can't be that high.
  • Culture problems (Score:5, Informative)

    by claytongulick ( 725397 ) on Wednesday March 12, 2008 @01:00PM (#22730392) Homepage
    I've found that military/government culture is generally about a decade behind corporate culture. For example, when I was in the Navy they were pushing this "TQL" stuff, which was a bad rehash of the popular 80's TQM "Total quality management" initiatives. Corporate culture had moved past that particular management flavor of the week, but the military was just getting into it.

    I see a similar thing with hiring practices. I'm a vet, and a talented senior developer and quite patriotic (in a libertarian/contstitutionalist sense). I decided a couple years ago to try to offer my services to the government.

    I went to the usual places, such as usajobs and looked at or applied for various development positions. Most of the jobs were such a hassle to apply for, I didn't even make it past the first stage. You couldn't even talk to a human being until you had filled out a bunch of different forms, put together a "package", submitted it, had it rejected for some minor error, resubmitted it etc...

    Many of the jobs had degree requirements and wouldn't even talk to me.

    After going through all this for weeks, I didn't get a single response back. Nothing. So I figured "oh well, I gave them a chance" and I accepted one of the multitude of positions head hunters were clamoring for me to take, for a much better salary than was being offered by any of the government positions.

    The punchline to this story is that about four months after all this (and after I was happily settled into my new job), I got a couple calls from those agencies saying that my package had finally passed review and asking if I was available for an interview. Four months!

    With a process like that, how is the government supposed to hire talented people?
  • by Venik ( 915777 ) on Wednesday March 12, 2008 @01:05PM (#22730450)
    Reading Lord's comments I couldn't help the feeling that I was listening to a service delivery manager from one of those outsourcing companies like CSC or Unisys. All that stuff about "we know money doesn't create loyalty" and "we leverage all the expertise out there" sounds painfully familiar. And after they run out of BS and the fog of confusion finally clears, you realize that all of your Unix servers are supported by two guys in Hyderabad, who share one Solaris 2.6 certificate and know less about Unix than my cat. The worst thing USAF can do is take advice from the outsourcing industry.

    A good pay is how your employer shows you that your work and your experience are appreciated. And knowing that you are appreciated is what makes you a happy employee. And happy employees tend to be loyal to their employers. So, yes, money does create loyalty. Lord says that "in many cases we do offer compensation competitive with the commercial sector". While this may be true, working for the USAF as a civilian contractor is not like working in the commercial sector. There's a whole different level of crap that you need to put up with. So, if the USAF is serious about this Cyber Command business, they need to do a whole lot better than just salaries that are "competitive... in many cases". When hiring, don't go for the quantity - you are not planning a cyber-invasion of China - but go for quality instead.

    Speaking of quality, while Lord understands that they "need to look beyond what we've traditionally recruited", he is still under the impression that the USAF can "bring them in from a general practitioner level and take them to expert level in reasonable time". Of course, this depends on their definition of "reasonable time", but somehow I don't think they mean 10-20 years. They are probably talking about a couple of years at most. I remember reading a resume of a guy claiming to have "reached the Unix guru level". I just had to bring him in for an interview: I wanted to see what a Unix guru looked like. Apparently, some time in the past ten years the minimum guru requirements have been significantly lowered.

    Programming and system administration are not those fields where you can turn a rookie into an expert in reasonable time. The time required will be most unreasonable. For example, a good sysadmin is not someone with encyclopedic knowledge of "man" files, but someone with a big database in his head of stuff that broke down and how it was fixed. Theoretical knowledge is important - comp-sci degrees, training, certificates, etc. - but what really matters is experience - years and years of it. So hire the most experienced personnel you can afford and hold on to them as if the security of your country depended on it. Guys who are good, know they are good, so you need good ego-stroking skills to keep them around. Hint: pinning medals to their chests is not going to help, but a fatter paycheck might. So the approach along the lines of "we'll take what they have to offer, and in turn they might be surprised by what they get back" is not going to work. The people USAF needs are of that certain age where they don't like and can ill afford surprises.

    "The U.S. military complies with all applicable domestic and international laws, and that will certainly apply equally within cyberspace..." And that's what everyone is afraid of. But, hey, as long as they wear uniforms while hacking networks, they should be in the clear as far as the Geneva conventions are concerned.
  • Not Content Free (Score:4, Interesting)

    by immcintosh ( 1089551 ) <slashdot@ianmcin ... inus threevowels> on Wednesday March 12, 2008 @01:46PM (#22731048) Homepage
    Despite complaints otherwise, these answers were not entirely content free. Clearly, in many cases they were worked over EXTENSIVELY by PR people to remove any information of a sensitive nature; both politically sensitive, as well militarily. While I certainly think they have no business censoring information because of political sensitivity (an act that works against the very foundations of a democratic society, so I find it rather offensive), that's not to say that NOTHING came though.

    Some things I think I came away with:
    - Overall, he seems willing to pursue candidates who might otherwise have not been "military material."
    - They seem to be setting up a framework of SOME sort under which multiple intelligence agencies are able to cooperate effectively. According to my understanding, this is a drastic departure from the current state of affairs.
    - They WILL be dealing with domestic targets, if only in cooperation with other domestic law enforcement bodies. This was the impression I got from their answers, but it might be reading too far into it (though I doubt it).
    - Assuming the former is true, they are going to try to do an end run around domestic and civilian cyber law. The sense I got from the evasiveness (reading into what he avoided answering), was that they have no intention of abiding by the same laws that civilians and domestic law enforcement are forced to obey. My guess is it's going to be more of the same, "this is national security, those laws don't apply to us," bullshit we've been seeing for the last 8 years out of the painfully fascist leanings of the current powers that be.

    While I often read too much into what isn't said, the real impression I'm getting is that they're going to try to parlay the military nature of this new cyber command into an excuse to avoid obeying the current legal restrictions faced by domestic agencies. If you thought this whole fiasco with AT&T was bad, just wait until the military gets their fingers in the cookie jar. (BEWARE the goddamn military-industrial complex. I may sound paranoid, but that's the greatest danger out there to our freedom.)
  • I've got a question (Score:3, Interesting)

    by Shadow-isoHunt ( 1014539 ) on Wednesday March 12, 2008 @04:24PM (#22732900) Homepage
    I've got some questions, doubt they'll be answered(wish I coulda caught the original article).... or atleast answered with the nonanswers we got here.

    I've been in IS now for over a decade, almost exclusively as a blackhat. In the past few years I've gotten into doing "unconventional" threat response - blackhats can be the best whitehats, y'know, learning through doing. Now tell me, why should I go in at an entry level paygrade when I can make more as a civilian? What gaurentees do I have of immunity? Why should I bring my tricks to your trade, when it's unlikely I'd be in an enviornment of trust anyways? As is I've got a juvi record and wouldn't get a sec. clearance anyways. I've got alot to lose by going in, including the trust and respect of those around me, whom I've been running with for 12 years -- but nothing of gain is apparent. What about the risk of being given a different AFSC? I've got some friends that went in 13D together, showed up to boot, and were told they were 11B now.

    These are the thoughts on our minds. Personally, I've been considering enlisting for a long time now, but USMC. Give me some real answers(unlike those posted above), some gaurentees on paper, and maybe I'll consider USAF. 'Til then, no way.

We are Microsoft. Unix is irrelevant. Openness is futile. Prepare to be assimilated.

Working...