7 ms·

The military is an impossible place for hackers, and what to do about it (2018)

95 points by NavinF 2y ago

cdwhite 2y ago
2018, FWIW. I'd be curious to hear how (if) things are different now.
- alephnerd 2y ago
  Pay has gotten better, plus the individual branches all have stronger CyberCorps now. That said, CyberCom still has issues because it's a unified command and not a branch, which means it has limited say and will always get overshadowed by individual branches and the NSA. Another interesting change is the rise of private sector players and public-private partnerships to help remediate the pay gap - this is what China and Russia did due to similar issues around renumeration, and most other NATO+ allies like Israel, UAE, Singapore, etc leverage this model. Anecdotally, outside of the NSA, it appears that most what I'd term "white collar lifers" within branches prefer Intel over Cyber because it's easier to learn due to less STEM, and a significant portion of those who do Cyber will tend to leave for private sector. That said, Cyber Reserves forces are fairly prominent now and probably the best way to remediate this gap. I'm biased, but imo, the US needs to adopt the Israeli model of public-private offensive security capabilities plus a strong reserves component, because the pay gap and the respect gap just won't be fixed due to internal intertia in the services.
- 9659 2y ago
  USAF now has Cyber Warrant Officers.
- dang 2y ago
  Year added above. Thanks!
evanjrowley 2y ago
It is important to learn from one's own mistakes, but if an institution is too big to fail, then does it ever really learn?
- Terr_ 2y ago
  If any entity can't fail, does it need to learn? :p That said, some of it is a matter of perspective: To bacteria, individual humans are "too big to fail" in the same way geography is.
  - thaumasiotes 2y ago
    > To bacteria, individual humans are "too big to fail" in the same way geography is. ...which is why diseases rapidly evolve away from lethality?
    - Terr_ 2y ago
      That sounds like an attempted "gotcha", but I think you missed the "matter of perspective." Imagine some strain of surviving bacterial-descendants are a marginally less-deadly than their predecessors after one solar year. What measure would you use for the comparison? If you were to pick "generations", that might be ~9000 for the bacteria, while applied to humans it's ~40x longer than all recorded history. Anywho, point is that for every "too big to fail" things there is usually a longer timescale where it stops looking that way.
spiritplumber 2y ago
TLDR: Copy the medic track model. Makes sense to me.
hipadev23 2y ago
The answer to every problem cited is simply pay. When there’s unlimited DoD budget for Palantir or Anduril contracts compared to barely livable wage for enlisted personnel, it’s a no-brainer why people go work for defense contractors instead. Enlisted or Officer, you’ll not break $200k annual earnings until at least 20 years of experience and Lieutenant General or higher rank. NSA after a decade of experience you may approach 200k. Anduril starts entry-level at $200k.
- master_crab 2y ago
  Yup. 95% pay. 5% antiquated culture. There are some aspects of the military culture that are a bit anachronistic, but it’s minor compared to the pay and the career progression problems the military creates. It forces an up and out system where you can’t continue doing what you’re good at for increasing amounts of pay.
  - generic92034 2y ago
    But is that not also a common issue with many IT companies? The technical career path is short and the higher levels on that path are already supposed to work more on powerpoints and meetings than on code.
    - Aeolun 2y ago
      There’s thousands of companies you can hop between, but there’s only a single military. They need to have good career progression.
      - relaxing 2y ago
        You could probably switch militaries once, but it gets tricky.
        bigfatkitten 2y ago
        It can and does happen, usually with a few years doing other things (and gaining citizenship in a new country) in between.
dctoedt 2y ago
CyberCommand might be able to do something like the Navy nuclear-propulsion program: Enlisted "nukes" get enlistment bonuses and (if they "re-up" after their initial six-year enlistment) fairly-decent "STAR" reenlistment bonuses. https://www.navytimes.com/news/your-navy/2023/06/23/big-enlistment-bonuses-offered-to-sailors-entering-the-nuclear-field https://www.navytimes.com/news/your-navy/2023/06/23/big-enli... https://www.mynavyhr.navy.mil/Portals/55/Career/ECM/Nuclear/Nuclear%20Command%20Career%20Counselor%20Newsletter%20Issue%202_JAN2023.pdf https://www.mynavyhr.navy.mil/Portals/55/Career/ECM/Nuclear/...
- halJordan 2y ago
  The problem with that is a) the pay still isnt enough. But mainly the problem is that army bonuses are by MOS. The cyber mos can be done by a high schooler (by design). You can just get another high schooler by selling them that theyll be a hacker. Actual operators already get the highest bonus the Army offers. But the reality is the Army will pay a civilian twice what a soldier gets (total compensation, including bonuses and intangibles) for the exact same job.
- alephnerd 2y ago
  CyberCom is a command, not a branch. Individual branches have leeway to make those compensation changes. A unified command can only provide some additional monies. That said, individual branches absolutely are doing that, and have started doing that after the 2018 hearing referenced in the article above.
Terr_ 2y ago
> To add insult to injury, tool developers often perform technical due diligence for capabilities procured from contractors. These capabilities typically mirror the capabilities that talented tool developers create on a quarterly basis, and the government will pay multiples of a developer’s annual salary for them. Nowhere else in the military is its economic rent so clear to the servicemember. As someone who feels more like a thing-builder than a thief-saboteur, this description is definitely off-putting.
deleted 2y ago
[deleted]
deleted 2y ago
[deleted]
neilv 2y ago
> The intersection of people who can run a 15-minute two mile and dissect a Windows kernel memory dump is vanishingly small. When I was doing consulting computer stuff for aviation safety[1], I used to joke to myself that I had The Right Stuff... for sitting on my butt, typing on a computer. But I never voiced that joke in the presence of clients or partner organizations. Where some of the personnel were actual fighter pilots, and who knows what else. [1] Incidentally, that might be the work I'm most proud of being a part of. I'm not disrespecting government work at all. I only pivoted from Federal technical consulting, back to tech industry startups, because of performing like a FAANG ~L7 for years, yet still not being able to afford a condo in my HCOLA. (And, just when I'd finally verbally negotiated a big chunk of work that would've fixed the money problem, a perfect storm of bad luck ruined that.)
analogwzrd 2y ago
I almost graduated (switched programs) from a graduate school cybersecurity program. They tried making the program "interdisciplinary" which essentially meant that they dumbed down the technical classes so that non-technical undergraduate degrees could pass them. I tried to put together a team of students to compete in one of MITRE's cybersecurity competitions, but struggled to get other students to create SSH keys so that they could get access to the competition server. Not hack into the server, just follow instructions that I gave them to create keys and give me the public ones so that they could log in and participate. The industry has a similar problem that the military does: It's very difficult to take non-technical people and train them to be cybersecurity professionals, much less hackers. You need to start with an engineering background, and it almost has to be electrical or computer engineering, or at least computer science. Of those people with that background, hacking in particular is a type of thinking, problem solving, and mentality that not everyone has. If you want to defend, attack, or manipulate cyber infrastructure you need an understanding of how that infrastructure is designed and operates. An engineering background will at least give you the building blocks for that.
- neilv 2y ago
  Can we say that Technical vs. Non-Technical in this space isn't so much about formal credentials, as it is about putting in a lot of time to learn about many relevant things, hands-on and probably exploratory? The person whose only degree is Art school dropout, but who's logged many hours coding personal projects, running their own Linux or BSD machines, playing with networking, tweaking a game binary, etc., will wipe the floor with more-credentialed others, at a lot of real-world computer technical stuff. Compared to person with a Engineering degree, or even a Computer Science degree-- but who spent no time outside of classwork, Leetcode memorizing, and a GitHub profile that was motivated only by FAANG-application coaching. Those people who couldn't create their keypairs probably have fine raw material for becoming the kind of Technical person you need. But they're just having a pile of information shoveled at them in lectures and homework. And maybe they just wanted a job. And nobody told them that, if you want to be good, you have to put in the hours of quality unstructured learning time.
  - 2y ago
SpartanHUD 2y ago
[dead]

95 points by NavinF 2y ago

cdwhite 2y ago

2018, FWIW. I'd be curious to hear how (if) things are different now.

alephnerd 2y ago
Pay has gotten better, plus the individual branches all have stronger CyberCorps now. That said, CyberCom still has issues because it's a unified command and not a branch, which means it has limited say and will always get overshadowed by individual branches and the NSA. Another interesting change is the rise of private sector players and public-private partnerships to help remediate the pay gap - this is what China and Russia did due to similar issues around renumeration, and most other NATO+ allies like Israel, UAE, Singapore, etc leverage this model. Anecdotally, outside of the NSA, it appears that most what I'd term "white collar lifers" within branches prefer Intel over Cyber because it's easier to learn due to less STEM, and a significant portion of those who do Cyber will tend to leave for private sector. That said, Cyber Reserves forces are fairly prominent now and probably the best way to remediate this gap. I'm biased, but imo, the US needs to adopt the Israeli model of public-private offensive security capabilities plus a strong reserves component, because the pay gap and the respect gap just won't be fixed due to internal intertia in the services.
9659 2y ago
USAF now has Cyber Warrant Officers.
dang 2y ago
Year added above. Thanks!

evanjrowley 2y ago

It is important to learn from one's own mistakes, but if an institution is too big to fail, then does it ever really learn?

Terr_ 2y ago
If any entity can't fail, does it need to learn? :p That said, some of it is a matter of perspective: To bacteria, individual humans are "too big to fail" in the same way geography is.
- thaumasiotes 2y ago
  > To bacteria, individual humans are "too big to fail" in the same way geography is. ...which is why diseases rapidly evolve away from lethality?
  - Terr_ 2y ago
    That sounds like an attempted "gotcha", but I think you missed the "matter of perspective." Imagine some strain of surviving bacterial-descendants are a marginally less-deadly than their predecessors after one solar year. What measure would you use for the comparison? If you were to pick "generations", that might be ~9000 for the bacteria, while applied to humans it's ~40x longer than all recorded history. Anywho, point is that for every "too big to fail" things there is usually a longer timescale where it stops looking that way.

spiritplumber 2y ago

TLDR: Copy the medic track model. Makes sense to me.

hipadev23 2y ago

The answer to every problem cited is simply pay. When there’s unlimited DoD budget for Palantir or Anduril contracts compared to barely livable wage for enlisted personnel, it’s a no-brainer why people go work for defense contractors instead. Enlisted or Officer, you’ll not break $200k annual earnings until at least 20 years of experience and Lieutenant General or higher rank. NSA after a decade of experience you may approach 200k. Anduril starts entry-level at $200k.

master_crab 2y ago
Yup. 95% pay. 5% antiquated culture. There are some aspects of the military culture that are a bit anachronistic, but it’s minor compared to the pay and the career progression problems the military creates. It forces an up and out system where you can’t continue doing what you’re good at for increasing amounts of pay.
- generic92034 2y ago
  But is that not also a common issue with many IT companies? The technical career path is short and the higher levels on that path are already supposed to work more on powerpoints and meetings than on code.
  - Aeolun 2y ago
    There’s thousands of companies you can hop between, but there’s only a single military. They need to have good career progression.
    - relaxing 2y ago
      You could probably switch militaries once, but it gets tricky.
      - bigfatkitten 2y ago
        It can and does happen, usually with a few years doing other things (and gaining citizenship in a new country) in between.

dctoedt 2y ago

CyberCommand might be able to do something like the Navy nuclear-propulsion program: Enlisted "nukes" get enlistment bonuses and (if they "re-up" after their initial six-year enlistment) fairly-decent "STAR" reenlistment bonuses. https://www.navytimes.com/news/your-navy/2023/06/23/big-enlistment-bonuses-offered-to-sailors-entering-the-nuclear-field https://www.navytimes.com/news/your-navy/2023/06/23/big-enli... https://www.mynavyhr.navy.mil/Portals/55/Career/ECM/Nuclear/Nuclear%20Command%20Career%20Counselor%20Newsletter%20Issue%202_JAN2023.pdf https://www.mynavyhr.navy.mil/Portals/55/Career/ECM/Nuclear/...

halJordan 2y ago
The problem with that is a) the pay still isnt enough. But mainly the problem is that army bonuses are by MOS. The cyber mos can be done by a high schooler (by design). You can just get another high schooler by selling them that theyll be a hacker. Actual operators already get the highest bonus the Army offers. But the reality is the Army will pay a civilian twice what a soldier gets (total compensation, including bonuses and intangibles) for the exact same job.
alephnerd 2y ago
CyberCom is a command, not a branch. Individual branches have leeway to make those compensation changes. A unified command can only provide some additional monies. That said, individual branches absolutely are doing that, and have started doing that after the 2018 hearing referenced in the article above.

Terr_ 2y ago

> To add insult to injury, tool developers often perform technical due diligence for capabilities procured from contractors. These capabilities typically mirror the capabilities that talented tool developers create on a quarterly basis, and the government will pay multiples of a developer’s annual salary for them. Nowhere else in the military is its economic rent so clear to the servicemember. As someone who feels more like a thing-builder than a thief-saboteur, this description is definitely off-putting.

deleted 2y ago

[deleted]

deleted 2y ago

[deleted]

neilv 2y ago

> The intersection of people who can run a 15-minute two mile and dissect a Windows kernel memory dump is vanishingly small. When I was doing consulting computer stuff for aviation safety[1], I used to joke to myself that I had The Right Stuff... for sitting on my butt, typing on a computer. But I never voiced that joke in the presence of clients or partner organizations. Where some of the personnel were actual fighter pilots, and who knows what else. [1] Incidentally, that might be the work I'm most proud of being a part of. I'm not disrespecting government work at all. I only pivoted from Federal technical consulting, back to tech industry startups, because of performing like a FAANG ~L7 for years, yet still not being able to afford a condo in my HCOLA. (And, just when I'd finally verbally negotiated a big chunk of work that would've fixed the money problem, a perfect storm of bad luck ruined that.)

analogwzrd 2y ago

I almost graduated (switched programs) from a graduate school cybersecurity program. They tried making the program "interdisciplinary" which essentially meant that they dumbed down the technical classes so that non-technical undergraduate degrees could pass them. I tried to put together a team of students to compete in one of MITRE's cybersecurity competitions, but struggled to get other students to create SSH keys so that they could get access to the competition server. Not hack into the server, just follow instructions that I gave them to create keys and give me the public ones so that they could log in and participate. The industry has a similar problem that the military does: It's very difficult to take non-technical people and train them to be cybersecurity professionals, much less hackers. You need to start with an engineering background, and it almost has to be electrical or computer engineering, or at least computer science. Of those people with that background, hacking in particular is a type of thinking, problem solving, and mentality that not everyone has. If you want to defend, attack, or manipulate cyber infrastructure you need an understanding of how that infrastructure is designed and operates. An engineering background will at least give you the building blocks for that.

neilv 2y ago
Can we say that Technical vs. Non-Technical in this space isn't so much about formal credentials, as it is about putting in a lot of time to learn about many relevant things, hands-on and probably exploratory? The person whose only degree is Art school dropout, but who's logged many hours coding personal projects, running their own Linux or BSD machines, playing with networking, tweaking a game binary, etc., will wipe the floor with more-credentialed others, at a lot of real-world computer technical stuff. Compared to person with a Engineering degree, or even a Computer Science degree-- but who spent no time outside of classwork, Leetcode memorizing, and a GitHub profile that was motivated only by FAANG-application coaching. Those people who couldn't create their keypairs probably have fine raw material for becoming the kind of Technical person you need. But they're just having a pile of information shoveled at them in lectures and homework. And maybe they just wanted a job. And nobody told them that, if you want to be good, you have to put in the hours of quality unstructured learning time.
- 2y ago

SpartanHUD 2y ago

[dead]