War, the military, COIN and stuff

Secretary Gates on Wikileaks

In the Q&A portion of the press conference unveiling the Pentagon's landmark Don't Ask Don't Tell survery, Secretary Gates and Adm. Mullen took questions on the other big story this week -- the publication of over 200,000 stolen diplomatic cables sent by American officials overseas which has been been blowing up front pages all week. (Actually, less than 300 cables have been published so far, in a strategy that Wikileaks is using to keep the story "fresh" for as long as it can.) While Gates and Mullen and a host of other DoD officials have commented on the leak, Gates' comments yesterday were pretty remarkable.

If you'll allow me to quote at length,it's worth reading the whole thing.

    First of all, I would say unlike the Pentagon Papers, one of the things that is important, I think, in all of these releases, whether it’s Afghanistan, Iraq or the releases this week, is the lack of any significant difference between what the U.S. government says publicly and what these things show privately, whereas the Pentagon Papers showed that many in the government were not only lying to the American people, they were lying to themselves.

But let me – let me just offer some perspective as somebody who’s been at this a long time.  Every other government in the world knows the United States government leaks like a sieve, and it has for a long time.  And I dragged this up the other day when I was looking at some of these prospective releases.  And this is a quote from John Adams:  “How can a government go on, publishing all of their negotiations with foreign nations, I know not. To me, it appears as dangerous and pernicious as it is novel.”

When we went to real congressional oversight of intelligence in the mid-’70s, there was a broad view that no other foreign intelligence service would ever share information with us again if we were going to share it all with the Congress.  Those fears all proved unfounded.

Now, I’ve heard the impact of these releases on our foreign policy described as a meltdown, as a game-changer, and so on.  I think – I think those descriptions are fairly significantly overwrought.  The fact is, governments deal with the United States because it’s in their interest, not because they like us, not because they trust us, and not because they believe we can keep secrets.  

Many governments – some governments deal with us because they fear us, some because they respect us, most because they need us.  We are still essentially, as has been said before, the indispensable nation. So other nations will continue to deal with us.  They will continue to work with us.  We will continue to share sensitive information with one another. Is this embarrassing?  Yes.  Is it awkward?  Yes.  Consequences for U.S. foreign policy?  I think fairly modest.

Published at ARES...

This Sentinel Not on Watch

Stop me if this sounds familiar: A government agency taps a major contractor to lead a complicated technical project. The parties agree on terms, budget, and timeframe. Things look great, promises are made, and big things are expected. In just a few years the project will revolutionize how said government agency goes about its business.

And then the Inspector General starts writing reports.

This time the agency is the FBI, the contractor is Lockheed Martin, the IG comes from the Department of Justice, and the project in question is called Sentinel, the Bureau’s troubled second attempt at developing a new electronic (billed as paperless) information and investigative case management system. Back in March 2006, the plan was that Sentinel would be developed in four phases for $425 million, and be completed around December 2009. But in the four and a half years since those hopeful days, the FBI has issued a full stop-work order to Lockheed Martin Services Incorporated for portions of Sentinel’s Phase 3 and all of the project’s Phase 4 “because of significant issues regarding performance, usability, and quality of work delivered by Lockheed Martin,” according to a new Department of Justice IG report. (PDF)

This all comes at the close of almost a decade’s worth of failed attempts by the FBI to move from a paper-based case management system to an electronic one--a journey that has cost over half a billion dollars and yielded almost no gains. The first attempt was the $170 million failure known as the  Virtual Case File system, which staggered along from 2001-2005 before being canceled. Then in 2006 came Sentinel, which started with a $305 million contract with Lockheed as the first part of a $425 million project, later revised to $451 million, and which the IG writes is on track to being “$100 million over budget and 2 years behind schedule.”

Please read the rest over at ARES...

Crowd Sourcing

In an effort to define just what it is the Pentagon needs to do to recruit and train an effective workforce to staff its new Cyber Command (USCYBERCOM), Lt. Col. Gregory Conti, director of West Point's Cyber Security Research Center and a PhD in computer science, took to the Internet. Conti logged on to noted techie site Slashdot.org and posed the question, “How has the military treated you and your technical friends?” Of the 415 messages posted in response, the majority were negative, with complaints ranging from lack of leadership, to the inability of the defense department to find innovative ways to train and retain talented techies.    

Just a few of the comments – which Conti reprinted in an article in the Small Wars Journal co-written with Lt. Col. Jen Easterly, a member of the US Cyber Command Commander's Action Group -- showed how the very culture of the military can at times work against it attracting and retaining the right people to work on the most complex technological issues. “The very things that make us valuable,” one commenter noted, “the ability to think critically, take the initiative, and not be weighed down by conventional thinking is exactly the thing the military seems to weed out.” Another complained about what they considered the overly rigid and standardized promotion system in the military, writing that “the system itself isn't designed to handle individuals that have technical ability, but who aren't ready/don't want to command lower level troops.”

In a separate article published last year in the Department of Defense’s IA newsletter, Conti came up with a creative, dynamic, and at the present time almost certainly unworkable solution: create a fourth branch of the military, dedicated solely to conducting the cyber mission. The two articles do bring up an important topic that the Pentagon has not spent a lot of time addressing: the trouble that the military faces in training—and more importantly, retaining—a competent cyber workforce when the freewheeling culture of the IT crowd so often clashes with the more formal structures of a traditional military career.

.....Read the rest at ARES.....

Who Will Staff the Cyber Command?

I've got a couple of stories about the standup of the U.S. Cyber Command (USCYBERCOM) in the September issue of DTI, which is out (in print) but only slowly making its way online. The first one--where I explore the staffing challenges of the command--was posted online Friday. Please ignore the first paragraph...let's just say it was altered in the course of the editorial process. Here's a little bit of it. And you can read the whole thing here.

Since the command has been set up to tackle a new and emerging kind of warfare—one which hasn’t been fully defined—it is critical that Cyber Command breaks out of the rigid historical and structural box that conventional U.S. combatant commands operate in, say several industry experts interviewed by DTI.

Michael Tanji, a security consultant who previously worked with the Defense Intelligence Agency, National Security Agency and National Reconnaissance Office, says the command should strive to “operate in a matrix fashion” and bring in the right staffers regardless of where they sit on the civilian/military divide, or even which service or office they report to, for any given problem. “A pyramid-shaped organization chart, made up of smaller pyramid-shaped organization charts, is not going to work,” he says. “Cyber Command has to deal with offense and defense, and the best way to do that is to have [everyone] work together to understand the adversary mindset and techniques. You’re a much better defender if you know how bad guys exploit software; you’re a much better attacker if you know what defenders can do to stop you from succeeding.”

The notion that this command needs to find a new way of operating is shared by another analyst, Richard Stiennon, who says “it’s not like setting up the Air Force or bringing in John Paul Jones to set up the Navy, where you take some people at the beginning of an industry and have them do it. We’re 10-15 years behind the times and playing catch-up.” Stiennon, chief research analyst at IT-Harvest and an IT security adviser who has worked for the Pentagon and private industry, adds, “Imagine if the Navy decided to get into aircraft carriers today, from scratch,” without having the benefit of decades of developing aircraft and carrier technologies, tactics and procedures in tandem. That, he says, captures the scope of the task ahead. Stiennon says the first priority of the command should be simple: start with the basics. “On Day 1, if [General] Alexander were to pound the table with his fist, it should be to discover and know every network connection and make sure it’s protected. That’s a huge task. It would be expensive, but it’s got to be done.”

Read the whole thing here.