Hamre Acts to Hamper Hackers

WASHINGTON, UNITED STATES

03.18.1998

Courtesy Story

Defense.gov         

As U.S. troops, combat aircraft and warships gathered in the Persian Gulf in February, the U.S. military was quietly attacked on a second front. Defense officials detected systematic, sophisticated intrusions into DoD computer networks.

Was this the work of hackers who regularly attempt electronic break-ins, or was it a true cyber attack by the Iraqis? That was the question defense and justice department officials had to answer -- quickly. What they learned is now serving as a wake-up call at home and abroad.

Deputy Defense Secretary John J. Hamre traveled to Europe, March 14 to 19, to discuss the growing threat to computer-based information systems. In Cologne and Bonn, Germany, Brussels, Belgium, Paris, The Hague and London, Hamre warned NATO allies: if this can happen to us; it can happen to you. Because computers are linked together, information assurance is only as strong as the weakest link in the chain, he said.

People regularly try to breach DoD computer networks, Hamre explained here March 17. "We get people every day who are just pinging on our computers," he said. "It's been going on for several years. There's kind of a hackers' mentality that it's fun to get inside."

In the first part of February, DoD officials noticed a pattern which could have been the early stage of a computer attack. They noticed the incidents of break-ins were more frequent and more systematic, Hamre said. "Because this was occurring at the same time we were preparing for potential operations in the Gulf, we were particularly concerned that they might be related."

For three weeks, defense officials tracked unauthorized activity. "After about the first week, we became convinced that it was probably hackers," Hamre said. "But, we didn't know for sure because there was an overseas element to this."

As it turned out, in late February the FBI arrested two 16-year-old boys in California for allegedly breaking into DoD networks. Even though Pentagon officials were relieved, the incident remained cause for grave concern since it could well have been an Iraqi cyber invasion.

Hamre said the teenagers did not get into DoD's classified computers which were all protected. "But, we still do an awful lot of things over unclassified systems that could have been damaged." The episode stressed the importance of better protecting DoD systems.

"Two kids were able to create an awful lot of disruption in the Department of Defense," Hamre said. "We went to 24-hour shifts. We created a crisis action team. We had to go through an enormous amount of effort to protect the computer systems, to monitor them and clean them up."

Was it simply a test of skill for the two young hackers? Did they understand it was wrong to break into these computers? Hamre said children who've grown up with computers may not understand the difference between what's real and what's a game. They may not understand that breaking into a computer electronically, is no different than breaking into somebody's house. It's private property.

"One of the kids, when asked why did he do it, said, 'It's the power, dude,'" Hamre reported. What they may not realize "is that they're really opening doors for other people whose motives aren't as innocent."

Private industry as well as the government needs to change this mindset and instill computer discipline, Hamre said. "There was a famous case several years ago about a clique that would break into computers to change the grades kids got in classes."

Hackers even defaced the CIA homepage about two years ago, changing the title from the "Central Intelligence Agency" to the "Central Stupidity Agency." While the CIA break-in was obvious to anyone opening the homepage, detecting electronic breaches is not always easy, Hamre said. "What's a lot harder is if someone doesnt want you to know they've been in your computer and they've manipulated the data.

"Let's say that a hacker -- just to have fun -- got into the Pentagon's telephone directory and changed every tenth number. It would take several days to figure out why the numbers were not going through? Since it wouldn't be happening all the time, it wouldn't be clear that a computer hacker had randomly changed telephone numbers."

The potential for disrupting defense operations via computer manipulation is multifaceted, Hamre said. Almost all DoD business is now done on computers -- everything from sending messages, to ordering supplies, to paying troops, to keeping track of medical records. "If someone can come in and disrupt those computers, change the data or send misleading messages, they could do tremendous damage to a military operation."

Once it's discovered data has been intentionally manipulated, people lose confidence in computer networks, Hamre said. "How do you know that it's real? You're looking at a screen and the name says John Hamre, but how do you know it's really John Hamre at the other end of that computer terminal?

"It takes you a long time to regain confidence in the system. You have to download all the computers, go back to historical tapes, bring them back up again, and see if that data looks real. It's a very long and cumbersome and expensive process."

The recent experience highlights the need for a much more systematic "information assurance" program to safeguard computers, Hamre said. The goal is to ensure DoD computer information is "true, reliable and has not been manipulated," he said. This will require continually monitoring central computer processors and employing software that automatically signals an alert. Sensitive data must be encrypted and unauthorized people must be kept off the net.

So far, DoD classified networks have been secure. Firewalls separate them from the other networks, Hamre said. "But, firewalls in computers are just like firewalls in a movie theater. They simply slow the movement of the fire so people can get out of the building. A firewall in software simply slows down a hacker as they're working their way through it so you can take action."

In the long run, DoD will have to encrypt data that goes from one computer to the next. "Before it leaves the computer, the message gets scrambled and then decoded at the other end," Hamre explained. Routine commercial transactions will be encrypted, while classified networks will have much stronger encryption.

"Key recovery" will go hand-in-hand with encryption. "You have to encrypt the data so that it can't be read when it's going over public networks. Then you have to develop a system of electronic identification so that when you're reading that encrypted message, you can confirm whoever sent it to you is really that individual."

DoD employees will have an "electronic dog tag," Hamre said Although some people fear this will enable the government to read their e-mail, he said, this is not the case. "Our program is simply going to be buying encryption and key recovery for Department of Defense communications so we'll be able to confirm who's talking to us."

Eventually, Hamre said he believes most people are going to want to adopt encryption so that when they use their credit card on the Internet, it's not going to be compromised. "Most business applications and Department of Defense applications will require a key recovery system so that we'll have confidence in who we're talking to."

DoD has already has negotiated a contract with Netscape to place an encryption and key recovery system on the web browser for more than a million DoD users. "This fall, we hope to have this encryption and key recovery system operational," Hamre said.

Another related DoD goal is promoting computer literacy among the ranks, Hamre said. Young troops today have far more computer savvy than the previous generation, he said. "We ought to find ways to help soldiers, sailors, airmen and Marines who have an interest in computers to become more proficient."

Unfortunately, retaining highly skilled people is difficult. "As soon as our people become trained they become very attractive to the private sector," Hamre said. He's asked Rudy deLeon, undersecretary for personnel and readiness, to suggest personnel policy changes to ensure DoD trains and keeps highly skilled computer people. This may include added tuition assistance and training programs and bonuses in certain critical skill areas. DeLeon is scheduled to report his recommendations in about three weeks, he said.

"I hope this generation becomes even more interested in computers than what they are now because we're going to need their help," Hamre said. "Us old buzzards don't know what to do."

Story by Linda D. Kozaryn, American Forces Press Service

• Date Taken: 03.18.1998
• Date Posted: 07.04.2025 00:36
• Story ID: 529907
• Location: WASHINGTON, US