What if you could send a com­puter pro­gram to do the job of a spy, or a bomber, or drone? It sounds like sci­ence fic­tion — and it’ll prob­a­bly stay that way, for a long, long time. But Air Force researchers think there’s enough to the idea to start fund­ing a trio of com­pa­nies for ini­tial work into these attack­ing, snoop­ing “Cyber Craft.“
“Using the Cyber Domain to con­duct mil­i­tary oper­a­tions… has sig­nif­i­cant poten­tial,” an Air Force paper announces. Examples include long-​​term intel­li­gence activ­i­ties, like “being to mon­i­tor a mil­i­tary bar­racks, accu­mu­late finan­cial infor­ma­tion on a poten­tially hos­tile nation, or pro­vide sta­tus on the polit­i­cal cli­mate of a South American coun­try.“
Researchers think the pro­grams could answer shorter-​​term, tac­ti­cal ques­tions, too. “Like who is in this build­ing across the street, where are the tanks located in a par­tic­u­lar town or vil­lage that is going to be entered by friendly forces, or whats the lat­est intel­li­gence regard­ing adver­sar­ial forces in a par­tic­u­lar town or vil­lage.“
Obviously, it would take more than a bulked-​​up Web crawler to get the job done. Cyber Craft would have to be able to hop from stan­dard com­puter net­works to elec­tri­cal grids to wire­less nets and back, over and over again.

Cyber agents will need to embody the abil­ity to covertly travel across these medi­ums, con­stantly assess­ing the net­work lay­out, mor­ph­ing itself as net­works change, and remain­ing covert while main­tain­ing the integrity of its mis­sion. Increased use of data hid­ing tech­niques and data hid­ing detec­tion tech­niques add addi­tional com­plex­ity to the Cyber craft weapon arse­nal… Cyber weapons will need to per­form real-​​time con­tin­u­ous self-​​assessment of the adver­sarys detec­tion capa­bil­ity and be able to make instant deci­sions to morph or self-​​destruct. Both these func­tions will be required in covert­ness and with the deci­sion infor­ma­tion sent back to its Cyber Craft home.

“As an exam­ple of a Cyber Craft appli­ca­tion, con­sider a squad of marines enter­ing a res­i­den­tial area,” the Air Force paper offers.

Current intel­li­gence is about 20-​​mins old and the squad leader requires updated infor­ma­tion. The squad leader finds an elec­tri­cal out­let and plugs in. This out­let allows access to the power grid of the town and sub­se­quently access to the adver­sarys com­puter net­work. The squad leader injects a Cyber Craft into the sys­tem, whose mis­sion is to locate a) any insur­gents or b) locate any hid­den mil­i­tary facil­i­ties… The Cyber Craft detect[s] some activ­ity at a mil­i­tary instal­la­tion within 1000-​​ft of the Marines loca­tion. The Cyber Craft per­forms a ‘recce mis­sion’ to gather intel­li­gence on the insur­gents (exact loca­tion, num­ber, arms, etc.) and sends back data/​information to the marines. However, in the mean­time the marines have moved and have located a dif­fer­ent means of con­nect­ing to the net­work. The Cyber Craft has ‘sensed’ this shift so read­dresses the feed­back infor­ma­tion to the marines new loca­tion and port. The ‘Cyber Craft’ acquires a pos­i­tive ID, and sends an alert mes­sage back to the marines that the insur­gents are about to leave and may be head­ing their way… The Cyber Craft exe­cutes its orders (turns power off, locks the doors), sends back an acknowl­edge­ment and self destructs.

There’s not much of this that today’s soft­ware can do, the Air Force researchers acknowl­edge. “Agent devel­op­ment, agent size and com­plex­ity, detec­tion tech­nol­ogy, real­time agent learn­ing and self mor­ph­ing tech­nol­ogy, RF and net­work pen­e­tra­tion tech­nol­ogy are a few of the tech­no­log­i­cal chal­lenges requir­ing addi­tional invest­ment.“
But the Air Force, ear­lier this year, did hand out con­tracts to three firms to start work­ing the prob­lem. Assured Information Security of Rome, NY got a $99,170 grant to “research and develop a CyberCraft soft­ware tool that will be able to covertly enter a net­work and move about the net­work to detect intru­sions or other abnor­mal­i­ties.” Indialantic, FL out­fit 3 Sigma Research is look­ing to build “Cyber Craft orga­nized in to ‘cells’ to enhance sur­viv­abil­ity and increase resiliency to attack.” And Solidcore Systems, out of Palo Alto, will try to put together a sys­tem that include[s] a har­bor (a host), and a dock (a con­trol envi­ron­ment for Cyber Craft exe­cu­tion) and cyber craft them­selves (ordi­nary pro­grams that can get launched to hosts and run there).“
Of course, build­ing the Cyber Craft, hard as it is, may wind up being the project’s sim­plest part. The real ques­tions come if and when fight­ers start to deploy the things. For instance, “How can we trust the Cyber Craft to ‘do the right thing?’”

The goal is to develop a sys­tem that fol­lows the ‘fire-​​and-​​forget’ method­ol­ogy. However, with this phi­los­o­phy comes the dan­ger of a Cyber Craft mor­ph­ing into some­thing that per­forms unin­tended actions that would be harm­ful to friendly forces or pro­vide an adver­sary with infor­ma­tion about the senders inten­tions, posi­tion, etc. One way of con­trol­ling a Cyber Craft is have it ‘dis­solve’ after com­plet­ing its mis­sion. However, depend­ing on the level of the Cyber Craft (strate­gic, oper­a­tional, and tac­ti­cal) the mis­sion length can go from min­utes to years… Thus, the dam­age that can be inflicted by a rogue Cyber Craft could be significant.