Let’s Talk Cyber in the US

I want to bring up a few cyber issues which are overclassified and most of it should, I say again, should be in the unclassified realm.

1.  Morris Worm.  Old but relevant, from November 2, 1988.  Dr. Robert Tappan Morris is teaching at MIT now.  This worm is not really a “proof of concept” but it revolutionized how we thought of information sharing, security in cyberspace, et al.  Not that it ever really effected how we do cybersecurity but it should have.

2.  Eligible Receiver should be downgraded and most of it declassified now, but NSA was a big player, so we might not see too much.  After ER was over, I lead a ‘government Tiger Team’ and we wrote an unclassified paper recommending how the United States should do cyber defense.  Many of the recommendations were instituted but no General Officer wanted to sign the paper.  Yes, Jimmy, I’m referring to you.

3.  Solar Sunrise, most of it hit the news back in 1998 so it should be unclassified but we’d need to pop out some FOIA request papers to see the rest of it.  I see the Israeli player in the news from time to time. He’s in jail in Canada at the moment for credit card fraud, I believe.

4. Moonlight Maze.  The London times did a piece on this in July of 1999 but other than that, I’ve never seen anything less than TS-Multiple Codeword papers.  I was the intelligence lead on the JTF that stood up that investigation, we handed off to JTF-CND in January 1999.  I wrote a position paper for DIA when the FBI wanted to shut it down and approach the FSB.  We said no, the FBI flipped us the bird and approached the FSB.

5. Chinese Espionage.  Notice most of the investigations after 2004 are civilian?  Tons written on this, most of it circular reporting.  Bottom line, the Chinese are raping us and we lack the cajones to institute real cyber security.  If we were to really do an active defense, who would complain?

6. Estonia, Russian attacks in 2007.  Tons written on this, most of it incorrect.

7.  Georgia and South Ossetia. Same as above.  Interesting enough, I gave a speech in Moscow at Lomonosov Moscow State University on cyberwar in 2010.  When I mentioned the attacks coinciding with the Russian invasion of South Ossetia, a fairly large portion of the audience had a tither.  I later found they were a part of Nashi.

8. Buckshot Yankee. The problem here is 99% of this is unclassified but nobody wants to talk about it because of the classified part – how deeply we were hurt and why.  Will somebody ever tell us about the flash drive found in the parking lot?

9. Olympic Games/Stuxnet. You can get a lot of fluff written about this but unless somebody in the actual program talks, it’s just guessing.  Okay, this one is probably in a Special Access Program and will probably remain so until we’re all dead, but I wanted to mention it.  Why?  I’m still interested in it and so are most of the bad guys.  They want to blame us for everything.  Yes, Iran, China and Russia, I’m pointing at you.

Bottom line.  Cyber is mostly all talk without any real substance.  Those who know are restricted by classification or a lack of cajones.  We’ve been doing this for many, many decades but the same wimps are in charge.  Wimps.