Cyber at a pre-9/11 Moment
Massive cyber attacks that could wreak widespread disruption, physical destruction, and loss of life are now well within the capabilities of America’s adversaries. The US military is preparing both to defend against them and respond—but not necessarily in kind.
That was the warning from Defense Secretary Leon E. Panetta in an October address to the Business Executives for National Security. Speaking in New York City, Panetta warned that cyber violence has leaped beyond simply hackers and criminals trying to steal information or create mischief. Instead, the US could well experience a “cyber Pearl Harbor” that would “paralyze and shock the nation and create a new, profound sense of vulnerability.”
Panetta said the Defense Department doesn’t have the lead in defending against a cyber attack—that job falls to the Department of Homeland Security—but it is heavily engaged in cyber defense and it would be up to the military to hit back, if US leaders deemed it necessary.
“We defend. We deter, and if called upon, we take decisive action to protect our citizens,” Panetta asserted.
“If a foreign adversary attacked US soil, the American people have every right to expect their national defense forces to respond,” he said. If the President orders a response, the armed forces “must be ready to obey that order and to act,” Panetta intoned, clearly implying a physical retaliation.
He also said the US military should have authority to pre-empt a cyber attack if the signs of a looming massive assault are unmistakable.
“If we detect an imminent threat of attack that will cause significant, physical destruction in the United States or kill American citizens, we need to have the option to take action against those who would attack us to defend this nation when directed by the President,” Panetta said.
To that end, the Pentagon is “now finalizing the most comprehensive change to our rules of engagement in cyberspace in seven years,” Panetta said. “The new rules will make clear that the department has a responsibility, not only to defend DOD’s networks, but also to be prepared to defend the nation and our national interests against an attack in or through cyberspace.” These new rules make the department “more agile” and “provide us with the ability to confront major threats quickly.”
While drawing down in almost every other area of the Pentagon budget, cyber defense spending is either holding steady or increasing and is now above $3 billion annually, Panetta said. It’s important for adversaries to know that fact and that American cyber defenses are strengthening daily. He noted that great gains are being made in identifying the source of cyber attacks, no matter how craftily enemies try to cover their tracks, and this fact should help deter them.
“Our cyber adversaries will be far less likely to hit us if they know that we will be able to link [them] to the attack or that their effort will fail against our strong national defenses,” Panetta said.
He detailed a number of recent attacks that illustrate the rapidly expanding scope and power of cyber warfare.
In the weeks before his speech, US firms were hit by a series of “so-called Distributed Denial of Service attacks,” Panetta said. Though these sort of attacks are not new, “the scale and speed with which it happened was unprecedented.”
He also revealed that in August, more than 30,000 computers in Saudi Arabia’s state oil company, Aramco, got hit with what Panetta said was a “very sophisticated virus called Shamoon,” which both replaced data with images of a burning American flag and overwrote everything else with “garbage” data. All of the machines were effectively destroyed and had to be replaced.
Days later, a similar attack was perpetrated against a Qatar energy company, RasGas.
“All told, the Shamoon virus was probably the most destructive attack that the private sector has seen to date,” Panetta said.
However, these assaults pale against the potential for much larger and deadly strikes, he said.
“We know that foreign cyber actors are probing America’s critical infrastructure networks. They are targeting the computer control systems that operate chemical, electricity, and water plants, and those that guide transportation throughout this country,” he said.
In some instances, “Intruders have successfully gained access to these control systems,” Panetta said.
He warned that cyber intruders could derail passenger trains or trains carrying toxic chemicals, crash the power grid, contaminate water supplies, and “disable or degrade critical military systems or communications networks.”
So immediate is this threat, Panetta said, that he described the nation in a “pre-9/11” status—except now, the nation is aware of the threat and is taking steps to be ready and respond.
“The good news is this: We are aware of this potential. Our eyes are wide open to these kinds of threats,” and the US is “on the cutting edge of this technology. We are the best and we have to stay there.”
With the National Security Agency, DOD has developed “the world’s most sophisticated system to detect cyber intruders and attackers” and is putting measures in place to “stop cyber attacks dead in their tracks.”
Panetta said the US is cooperating and coordinating with allies in the cyber defense arena and is doing its utmost to share information and develop partnerships with the private sector, where so much of the cyber domain is located.
But that’s not enough, he said.
“We’ve got to work with the business community to develop baseline standards for our most critical private-sector infrastructure; our power plants, our water treatment facilities, our gas pipelines. This would help ensure that companies take proactive measures to secure themselves against sophisticated threats, but also take common-sense steps against basic threats.”
Panetta said that although awareness of the danger is increasing, “the reality is that too few companies have invested in even basic cybersecurity.”
He urged Congress to act immediately to pass the “comprehensive … bipartisan Cybersecurity Act of 2012,” co-sponsored by Sen. Joe Lieberman (I-Conn.), Sen. Susan Collins (R-Maine), Sen. Jay Rockefeller (D-W.V.), and Sen.Dianne Feinstein (D-Calif.).
Continuing partisan gridlock on such a bill “frankly is unacceptable, and it should be unacceptable not just to me but to you and anyone else concerned with safeguarding our national security.”
While awaiting that action, he said, government has been brainstorming ways around obstacles to a coordinated defense.
“They are considering issuing an executive order as one option to try to deal with the situation, but very frankly, there is no substitute for comprehensive legislation, and we need to move as far as we can in the meantime,” Panetta said.
Before 9/11, “the warning signs were there,” Panetta said. “We weren’t organized. We weren’t ready and we suffered terribly for that lack of attention. We cannot let that happen again.”
He continued, “This is a pre-9/11 moment. The attackers are plotting. Our systems will never be impenetrable, just like our physical defenses are not perfect, but more can be done to improve them. We need Congress and all of you to help in that effort.”
Sixth Just Got Real
The Pentagon has at long last launched the first stage of a project to develop a successor to the F-22 and F-35 fighters, putting the Defense Advanced Research Projects Agency in charge of an 18-month, $30 million “concept definition” effort to solicit ideas from industry, the Air Force, and the Navy. The start date for the project has not yet been set.
Industry has been impatiently awaiting word of a “sixth generation fighter” program for years, warning the Defense Department that without any new fighters to work on, its ability to offer world-beating air superiority designs will steadily erode. That consideration was clearly on the mind of Frank Kendall III, the Pentagon’s acquisition, technology, and logistics chief, when he set the project in motion with an October memo.
“Our ability to design cutting-edge platforms of this type is already atrophying,” Kendall said in the memo. Without action soon, the potential to have competitors to Lockheed Martin—which built the F-22 and now builds the F-35—”will shrink or be eliminated,” Kendall wrote.
The competition will evaporate and America’s technology edge in air combat “will not endure unless we provide [industry] with a meaningful opportunity for leading-edge design, build, and test activities.”
The US is already down to just three companies deemed capable of serving as a prime contractor in fighters: Lockheed Martin, Boeing—builder of the F/A-18E/F Super Hornet—and Northrop Grumman, which is Lockheed’s principal partner in building the F-35.
By comparison, when the F-22 program was in its infancy, potential competitors included Boeing, McDonnell Douglas, Vought, Lockheed, Martin Marietta, General Dynamics, Fairchild, Rockwell, Northrop, and Grumman. Through mergers and acquisitions—a response to a steep post-Cold War drop in demand for capacity—those airframe houses have largely consolidated.
In the Pentagon’s annual report to Congress on the defense industrial base, released in early fall, DOD noted the tactical aircraft research and development budget “is projected to decline with the end of F-35 development and an absence of any new fighter requirements” in the Future Years Defense Program, and it warned of the erosion of fighter design capability.
“This challenge is compounded by an aging aerospace workforce and dwindling interest from younger engineers in the aerospace domain,” the report said, pointing out that there are already “shortages” in the availability of design talent.
Pentagon officials said the new DARPA-led effort will focus on channeling the ideas into a real system, and not serve as merely a hobby shop for ideas that never see production.
Results of the 18-month concept definition phase would transition into a five-year period when “multiple competing concepts may be demonstrated,” according to Kendall.
The F-35 will provide a “decisive advantage” in air combat for the coming decades, but “it is not too early to begin consideration of the next generation of capability that will someday complement and eventually replace the F-35,” Kendall said.
Indeed, the Air Force is already behind the power curve in developing a replacement for the F-22 by most assessments. That aircraft took 20 years to bring from drawing board to initial operational capability, and the earliest examples of the F-22 will reach the end of their planned life expectancies in the late 2020s, a scant 15 years away. Senior USAF leaders have acknowledged this is one reason they have slowed the pace of F-22 operations and are seeking to do more training in simulators, in order to make the fighter last long enough for its successor to arrive.
Air Combat Command asked industry for sixth generation fighter ideas in late 2010, but that effort simply informed an analysis of alternatives and apparently did not lead to a hardware program. Air Force Secretary Michael B. Donley said that year a sixth gen program was at least three years away.
Kendall’s memo suggested a single fighter will replace both the F-22 and F-35, as well as the F/A-18. The Navy has been pursuing its own early effort toward such an aircraft with its F/A-XX project.
The F-22 was supposed to have served as the basis for the Naval Advanced Tactical Fighter, intended to replace the F-14 Tomcat as the Navy’s chief interceptor and dogfighter. The Navy was even included on the source selection committee that chose the F-22, but the service terminated the program in favor of the less costly F/A-18E/F and, later, the F-35.
Kendall also admonished that there should be “no preconceived notions about the nature of air dominance a few decades into the future,” and that any and all “innovative … concepts” for the airframe, propulsion, sensors, weapons integration, and avionics will be considered. He said an unmanned concept, or an unmanned system working in coordination with manned aircraft, might prove to be the solution and that military evaluators shouldn’t rule out any ideas.