4 ms·

If we're trying to use uniformed military troops to hack servers remotely, we deserve to lose any 'cyber war.' They should be used to gain physical access to h

If we're trying to use uniformed military troops to hack servers remotely, we deserve to lose any 'cyber war.' They should be used to gain physical access to hardware and people, for the purpose of applying the xkcd decryption heuristic[1]. Leave the hacking to the experts. [1] http://xkcd.com/538/ http://xkcd.com/538/

sliverstorm 12y ago
Just because you can find it on the internet, doesn't mean you can get physical access, even if you are the US armed forces. First, you have to find it...
lmkg 12y ago
Why not both? I say that flippantly, but I mean that quite seriously. With the amount of resources available to the US military, I see no reason why they should constrain themselves to only a subset of capabilities, especially if the one they're cutting is less capital-intensive. I absolutely agree that the "$5 wrench algorithm" is a rational choice for the military to pursue: not only is it more available to them than to other organizations, it also aligns more closely with some of their existing core competencies. But that doesn't need to, and shouldn't be, pursued to the exclusion of other approaches.
bithive123 12y ago
I like xkcd as much as the next guy but we already had a perfectly serviceable metaphor: http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis
s_q_b 12y ago
Those guys exist. But there are a whole host of reasons you'd want a force that could attack an enemy country's infrastructure remotely. As a chief example, it's far less inflammatory than boots on the ground. Can you imagine the difference in reaction if we sent door-kickers on the ground to Natanz and smashed the Iranian centrifuges, rather than using Stuxnet? The problem here is that there is a fundamental tension between hacking (or "advanced penetration testing" or "ethical hacking" or whatever) and the structure of the military. The military relies upon rules and procedures to accomplish repeatable tasks at massive scale. Hacking is an individual or small collective endeavor that involves non-linear thinking and creative leaps. Right now, they're trying to figure out how to work around that tension, and all we're seeing now are the early tests.
- walshemj 12y ago
  nd for a lot of the sigint elements of cyber warfare almost all of the value is in not being detected.
phaus 12y ago
>If we're trying to use uniformed military troops to hack servers remotely, we deserve to lose any 'cyber war.' Not all Soldiers are incompetent. Some of the most brilliant people I've met are people that I met while I was in the Army. China has created numerous units that focus on offensive hacking, and they are wildly successful. Now, to clarify, I'm not saying that we should have troops performing cyber attacks, I'm just saying that it isn't necessarily an endeavor that's doomed to failure. You seem to be making the assumption that people in the military can't be as good at something as a civilian. That's simply not true. There is a lot of talent in the Army, its just that the organization and its rules are making it hard to be effective.
- mullingitover 12y ago
  I mean no disrespect to the soldiery, but why use soldiers for this, and not the DIA/NSA/CIA/various other TLAs? I guess that's what I'm confused about. Grunts wearing camouflage sitting in front of a laptop trying to outbrain someone seems humorously perverse. It's like some high-level bureaucrat has it in his mind that 'cyberattack' necessarily means that the military has to do it, because we obviously use the military for attacking things.
  - doug11235 12y ago
    You probably don't realize how much crossover there is between the military and intel. For example, the CSS in NSA/CSS - http://www.nsa.gov/about/central_security_service/ http://www.nsa.gov/about/central_security_service/
  - phaus 12y ago
    >I mean no disrespect to the soldiery, but why use soldiers for this, and not the DIA/NSA/CIA/various other TLAs? I specifically said that I wasn't advocating this as a military mission. I was just stating that if it was a military mission, the Soldiers themselves wouldn't be the reason that it fails. >Grunts wearing camouflage sitting in front of a laptop trying to outbrain someone seems humorously perverse. A grunt is an infantryman. Not all Soldiers are grunts. The Soldiers that work as security analysts do it as a full time job. They still have to take a couple PT tests each year and qualify once or twice a year with an M16, but they spend most of their time doing their job. I'm not sure how wearing camofluage affects a person's ability to use a computer? They are people like everyone else.
wisty 12y ago
There's at least one other well known agency that focuses on cyber security. The uniformed forces might have hackers, sure. The Coast Guard has heavy machine guns, but the US doesn't rely on them for naval defence - it's also got a whole other force (the Navy) which can do the heavy lifting. If the Army doesn't have hackers to win cyber wars, it has hackers because it's a huge organisation that needs internal cyber security expertise.

sliverstorm 12y ago

Just because you can find it on the internet, doesn't mean you can get physical access, even if you are the US armed forces. First, you have to find it...

lmkg 12y ago

Why not both? I say that flippantly, but I mean that quite seriously. With the amount of resources available to the US military, I see no reason why they should constrain themselves to only a subset of capabilities, especially if the one they're cutting is less capital-intensive. I absolutely agree that the "$5 wrench algorithm" is a rational choice for the military to pursue: not only is it more available to them than to other organizations, it also aligns more closely with some of their existing core competencies. But that doesn't need to, and shouldn't be, pursued to the exclusion of other approaches.

bithive123 12y ago

I like xkcd as much as the next guy but we already had a perfectly serviceable metaphor: http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis

s_q_b 12y ago

Those guys exist. But there are a whole host of reasons you'd want a force that could attack an enemy country's infrastructure remotely. As a chief example, it's far less inflammatory than boots on the ground. Can you imagine the difference in reaction if we sent door-kickers on the ground to Natanz and smashed the Iranian centrifuges, rather than using Stuxnet? The problem here is that there is a fundamental tension between hacking (or "advanced penetration testing" or "ethical hacking" or whatever) and the structure of the military. The military relies upon rules and procedures to accomplish repeatable tasks at massive scale. Hacking is an individual or small collective endeavor that involves non-linear thinking and creative leaps. Right now, they're trying to figure out how to work around that tension, and all we're seeing now are the early tests.

walshemj 12y ago
nd for a lot of the sigint elements of cyber warfare almost all of the value is in not being detected.

phaus 12y ago

>If we're trying to use uniformed military troops to hack servers remotely, we deserve to lose any 'cyber war.' Not all Soldiers are incompetent. Some of the most brilliant people I've met are people that I met while I was in the Army. China has created numerous units that focus on offensive hacking, and they are wildly successful. Now, to clarify, I'm not saying that we should have troops performing cyber attacks, I'm just saying that it isn't necessarily an endeavor that's doomed to failure. You seem to be making the assumption that people in the military can't be as good at something as a civilian. That's simply not true. There is a lot of talent in the Army, its just that the organization and its rules are making it hard to be effective.

mullingitover 12y ago
I mean no disrespect to the soldiery, but why use soldiers for this, and not the DIA/NSA/CIA/various other TLAs? I guess that's what I'm confused about. Grunts wearing camouflage sitting in front of a laptop trying to outbrain someone seems humorously perverse. It's like some high-level bureaucrat has it in his mind that 'cyberattack' necessarily means that the military has to do it, because we obviously use the military for attacking things.
- doug11235 12y ago
  You probably don't realize how much crossover there is between the military and intel. For example, the CSS in NSA/CSS - http://www.nsa.gov/about/central_security_service/ http://www.nsa.gov/about/central_security_service/
- phaus 12y ago
  >I mean no disrespect to the soldiery, but why use soldiers for this, and not the DIA/NSA/CIA/various other TLAs? I specifically said that I wasn't advocating this as a military mission. I was just stating that if it was a military mission, the Soldiers themselves wouldn't be the reason that it fails. >Grunts wearing camouflage sitting in front of a laptop trying to outbrain someone seems humorously perverse. A grunt is an infantryman. Not all Soldiers are grunts. The Soldiers that work as security analysts do it as a full time job. They still have to take a couple PT tests each year and qualify once or twice a year with an M16, but they spend most of their time doing their job. I'm not sure how wearing camofluage affects a person's ability to use a computer? They are people like everyone else.

wisty 12y ago

There's at least one other well known agency that focuses on cyber security. The uniformed forces might have hackers, sure. The Coast Guard has heavy machine guns, but the US doesn't rely on them for naval defence - it's also got a whole other force (the Navy) which can do the heavy lifting. If the Army doesn't have hackers to win cyber wars, it has hackers because it's a huge organisation that needs internal cyber security expertise.