Officials at Creech Air Force Base in Nevada knew for two weeks about a virus infecting the drone “cockpits” there. But they kept the information about the infection to themselves – leaving the unit that’s supposed to serve as the Air Force’s cybersecurity specialists in the dark. The network defenders at the 24th Air Force learned of the virus by reading about it in Danger Room.
The virus, which records the keystrokes of remote pilots as their drones fly over places like Afghanistan, is now receiving attention at the highest levels; the four-star general who oversees the Air Force’s networks was briefed on the infection this morning. But for weeks, it stayed (you will pardon the expression) below the radar: a local problem that local network administrators were determined to fix on their own.
“It was not highlighted to us,” says a source involved with Air Force network operations. “When your article came out, it was like, ‘What is this?’”
The drones are still flying over warzones from Afghanistan to Pakistan to Yemen. There’s no sign, yet, that the virus either damaged any of the systems associated with the remotely piloted aircraft or transmitted sensitive information outside the military chain of command – although three military insiders caution that a full-blown, high-level investigation into the virus is only now getting underway.
Nevertheless, the virus has sparked a bit of a firestorm in military circles. Not only were officials in charge kept out of the loop about an infection in America’s weapon and surveillance system of choice, but the surprise surrounding that infection highlights a flaw in the way the U.S. military secures its information infrastructure: There’s no one in the defence Department with his hand on the network switch. In fact, there is no one switch to speak of.
The four branches of the US armed forces each has a dedicated unit that, in theory, is supposed to handle cyber defence for the entire service. The 24th Air Force, for example, “is the operational warfighting organisation that establishes, operates, maintains and defendsAir Forcenetworks,” according to a military fact sheet. These units are then supposed to provide personnel and information to U.S. Cyber Command, which is supposed to oversee the military’s overall network defence.
In practice, it’s not that simple. Unlike most big private enterprises, the 24th doesn’t have a centralised system for managing and monitoring its networks. There’s no place at the 24th’s San Antonio headquarters where someone could see all the digital traffic hurtling through the service’s pipes. In fact, most of the major commands within the Air Force don’t have formal agreements to carry the other’s network traffic. (The 24th Air Force did not immediately respond to requests to comment for this article.)
“We’d never managed the entire Air Force network as a single enterprise,” Vince Ross, the program manager of the Air Force Electronic Systems Center’s Cyber Integration Division, said in March. “That meant there was no centralised management of the network, that systems and hardware weren’t standardised, and that top-level commanders didn’t have complete situational awareness.”
The plan is to one day integrate all that infrastructure into a single Air Force network. But for now, it’s largely cybersecurity by the honour system. Each base and each unit in the Air Force has its own geek squad. They only call for help if there’s a broader network problem, or if they’re truly stumped.
That didn’t happen when a so-called “keylogger” virus hit Creech more than two weeks ago.
“Nothing was ever reported anywhere. They just didn’t think it was important enough,” says a second source involved with operating the Air Force’s networks. “The incentive to share weaknesses is just not there.”
Not even when that weakness hits the robotic weapons that have become the lynchpin for American military operations around the planet.
Photo: USAF