About Defense Tech

Defense Tech exam­ines the inter­sec­tion of tech­nol­ogy and defense from every angle and pro­vides analy­sis on what’s ahead.

Tip Us Off

Tip for Defense Tech?

SEND IT!

It’s Confidential!

Archive for October, 2006

The Fake Boarding Pass Saga

Tuesday, October 31st, 2006

boardingpass_veganstraight.jpgLast week Christopher Soghoian, a 24 year-​​old Ph.D. stu­dent in infor­ma­tion secu­rity at Indiana University, whipped together a web­site that allowed any­one to cre­ate a fake Northwest Airlines board­ing pass. He hoped to bring atten­tion to a secu­rity hole that allows any­one, includ­ing some­one on the No-​​Fly list, to enter the secu­rity line with a fake doc­u­ment. Instead he got another kind of atten­tion.
For those unfa­mil­iar with the story, it’s one I’ve been fol­low­ing in my blog and in a proper news story for Wired News since Soghoian told me about his site Wednesday night.
Soghoian, a secu­rity researcher who has done work at Google, Apple and IBM, told me the site’s pur­pose was to demon­strate the futil­ity of the No-​​Fly list:

I want Congress to see how stu­pid the TSA’s watch lists are. Now even the most tech­ni­cally incom­pe­tent user can click and gen­er­ate a board­ing pass. By doing this, I’m hop­ing [Congress] will see how silly the secu­rity rules are. I don’t want bad guys to board air­planes but I don’t think the sys­tem we have right now works and I think it is giv­ing us a false sense of security.

Even with­out his gen­er­a­tor, the No-​​Fly list can be avoided:

If you can pur­chase a ticket over the inter­net with a pre-​​paid debit card and can fly with­out I.D., then for domes­tic flights the No-​​Fly list doesn’t work.

On Friday, Congressman Ed Markey (D-​​Mass) called for the site to be shut down and arrested, and later that day, the FBI shut­tered the site and met with Soghoian. Whatever he said must not have been con­vinc­ing, since the FBI raided his house with a search war­rant signed by a judge at 2 a.m. Saturday morn­ing and seized his com­put­ers, though they didn’t arrest him. Markey then retracted his call for Soghoian’s arrest on Sunday and in fact, sug­gested the gov­ern­ment hire him instead (though Markey called the site a ‘lousy way’ of pub­li­ciz­ing the prob­lem).
Since Sunday, the story has slowed con­sid­er­ably. Soghoian has lawyers now and isn’t talk­ing to reporters, though is occa­sion­ally updat­ing his blog.
Soghoian’s site exploited a well-​​known secu­rity hole, one first pub­li­cized by secu­rity expert Bruce Schneier in 2003, given the full-​​on Slate treat­ment in 2005, and, accord­ing to secu­rity blog­ger Adam Shostack, was explained to high-​​level Homeland Security offi­cials in 2004.
That doesn’t mean all secu­rity researchers applaud Soghoian’s method. Indeed, Avi Rubin, who’s best known for his vot­ing secu­rity work, told Xeni Jardin that his for­mer teach­ing assis­tant should have shown this to the gov­ern­ment pri­vately.
So what’s the upshot? Will the gov­ern­ment ban board­ing passes tick­eted at home? Will they pros­e­cute Soghoian for build­ing this site? Won’t other hack­ers put their own ver­sion online? Will this prompt recon­sid­er­a­tion of the use of noto­ri­ously inef­fec­tive watch lists for domes­tic travel?
The short anwsers, in my opin­ion, are No, No, Maybe but not as many as you’d expect, Definitely Not.
The long answers are here at 27BStroke6, which despite Noah’s dig, is a great name for a blog. (Think Brazil).
Ryan Singel
Photo: VeganStraightEdge

WaPo Digs for Bombs

Tuesday, October 31st, 2006

This Washington Post Magazine story, on “The Bomb Squad,” is one of the best reads you’ll get in the main­stream press on the real­ity of the counter-​​bomb fight in Iraq.
buffalo_dust.jpgThere’s only one, teeny-​​tiny prob­lem with the piece: It’s not really about a “bomb squad,” or explo­sive ord­nance dis­posal (EOD) unit, at all. Nobody is asked to defuse any bombs. Instead, the story cen­ters around what appears to be a group of com­bat engi­neers — EOD’s blood rivals. These guys go comb­ing roads for impro­vised explo­sives and, if they have any brains at all, call in EOD once the bombs are found.
In either case, the story is well worth check­ing out. Here’s a snippet:

And this is where the whole expe­di­tion turns … well, into a “Wizard of Oz” moment for me. Because as I peer through the haze of the Iraqi noon, the Buffalo’s claw pon­der­ously rak­ing the grass beside the road, I real­ize that the heart of the Pentagon’s pro­gram for defeat­ing IEDs [impro­vised explo­sive devices] is: 1) buy some armored trucks with big win­dows; 2) send young sol­diers out to drive up next to bombs; 3) inves­ti­gate with a phone truck [which is what the author says the Buffalo reminds him of].
As Tate points out later: “I’ve seen tanks destroyed. I’ve seen Bradleys destroyed … There’s only so much armor can do.“
Fortunately, this par­tic­u­lar wired rock turns out to be an irri­ga­tion pump. After another hour or so, I’m dropped off at a nearby patrol base.
Fifteen min­utes later, Tate’s RG-​​31 nearly runs over an IED.
McGorvin — dubbed “the Jedi mas­ter” by his fel­low sol­diers for his abil­ity to, as they put it, “detect ord­nance” — tells me about it the next day as he fid­gets on a torn couch behind the TOC. He explains that he sensed the bomb a mile before he reached it — notic­ing first the grin­ning face of a taxi dri­ver who squat­ted down behind his cab to key a Motorola phone. A few min­utes later as the con­voy rum­bled through a small town, McGorvin felt it again out­side a clus­ter of mud wat­tle shacks, their yards sus­pi­ciously empty.
Then, all at once, his RG-​​31 passed a mound of dirt with a cone of rusty metal show­ing through its side. McGorvin’s gaze locked on a sliver of blue plas­tic tucked behind the mound. “I got some­thing!” he yelled. “I don’t know what it is, but it’s got a cell­phone on it!“
The RG-31’s armor wouldn’t pro­tect McGorvin stand­ing in his gunner’s nest, so, as radios barked and the con­voy scat­tered, he tucked his thighs against his chest and squat­ted.
“McGorvin — good look­ing,” Tate shouted as their truck finally jolted to a stop out­side the bomb’s blast radius.

Rapid Fire 10/​31/​06 — Updated

Tuesday, October 31st, 2006

* Military Officers: Set Deadlines

* Google in Cahoots with Spooks?

* No-​​Fly List Snags Another Congress Critter

* Kerry: Study Hard Or End Up in Iraq

* Milbloggers Strive to Get Voice-​​Activated Laptops for Amputees

* General: Military Must Be Open To Press

* X-​​48B Ship 2 Blended Wing-​​Body pr0n

* Homeland Security: What Would Dems Do?

* The Italian Connection: Weldon, Daughter, Friend, Marine One, Earmarks

* Anti-​​IED Buffalos Charging to Iraq

* Police Stun-​​Gun Kills Bible-​​Toting Teen

(Big ups: RC, Xeni)
Ryan Singel

Operation Vigilant Correction

Tuesday, October 31st, 2006

The Pentagon’s pub­lic affairs office admit­ted to reporters today that it had cre­ated the equiv­a­lent of a rapid reac­tion force to strike back at media cov­er­age it con­sid­ers inac­cu­rate and to har­ness new tech­nolo­gies like “instant mes­sag­ing” and “pod­cast­ing.“
The Pentagon has been punch­ing back at reporters and colum­nists recently with let­ters to the edi­tor which have got­ten promi­nent treat­ment in Early Bird, a daily clip­ping ser­vice intended to keep the mil­i­tary and con­trac­tors intended to keep them abreast of mil­i­tary news.
The first item in Monday’s edi­tion was an unpub­lished let­ter to the Washington Post, which read:

To the Editor:
Your arti­cle and the accom­pa­ny­ing head­line (“Rumsfeld Tells Iraq Critics to ‘Back Off,’” October 26, 2006) said incor­rectly that the Secretarys com­ments in his Thursday press con­fer­ence were aimed at “detrac­tors” and “crit­ics.” In fact, the Secretary was refer­ring specif­i­cally to jour­nal­ists seek­ing to cre­ate a per­cep­tion of major divi­sions between the posi­tions of the U.S. and Iraqi gov­ern­ments. Secretary Rumsfeld was not refer­ring to crit­ics of the administration’s Iraq pol­icy.
Sincerely,
Dorrance Smith, Assistant Secretary of Defense for Public Affairs

Riiiight. Well, glad that got cleared up. As Sharon Weinberger pointed out last week, this empha­sis is becom­ing a trend.
From Agence France-​​Presse:

Eric Ruff, the Pentagon press sec­re­tary, insisted that the new pub­lic affairs pro­gram was not prompted by either the elec­tions or polls show­ing that only about 37 per­cent believe the war is going well.
“What were look­ing at doing is, ‘How can we get bet­ter, how can we get faster, how can we trans­form pub­lic affairs?’,” he told reporters.
“And we’re look­ing at being quicker to respond to break­ing news. Being quicker to respond, frankly, to inac­cu­rate state­ments,” he said.
“And we’re look­ing at this whole issue of new media — pod­cast­ing, and IM-​​ing and all those kinds of things, where peo­ple are basi­cally run­ning cir­cles inside us,” he said.
Ruff dis­closed the expanded oper­a­tions after ques­tions were raised about a wall being built in the Pentagon press oper­a­tions cen­ter that will sep­a­rate the new unit from Pentagon pub­lic affairs offi­cials who deal with the media.

Hunh, and this has noth­ing to do with low poll num­bers at all? Sorry, Ruff’s denials don’t pass the smell test.
Combine the news of this new nit­pick­ing oper­a­tion with the Pentagon’s crack­down on mil­blog­gers and its con­tin­ued heavy-​​handed treat­ment of reporters embed­ded in Iraq, a death toll of 101 American sol­diers so far this month, dete­ri­o­rat­ing rela­tions with the Iraqi gov­ern­ment, and a CNN poll reg­is­ter­ing domes­tic sup­port for the war at 34%, and you have a stew with the rather unpleas­ant odor of des­per­a­tion. Is this really what Rummy wanted when he begged pub­lic affairs to “adapt to today’s media age?“
I expect my first mis­sive from the Delta Force-​​esque PR flacks will be in my inbox pronto.
Ryan Singel

60 Minutes Covers the “Golden Hour”

Monday, October 30th, 2006

chopper60minutes.jpgIt’s no secret that the military’s trauma units have saved the lives of thou­sands of injured ser­vice mem­bers and Iraqi civil­ians whose wounds would likely have killed them in ear­lier con­flicts.
But last night, 60 Minutes ran a pow­er­ful 13 minute piece on the doc­tors, nurses and medics who oper­ate in the­ater and on the field heli­copters. The Hueys UH-​​60 Blackhawks are sta­tioned around Iraq so that no casu­alty is more than 25 min­utes from a heli­copter, help­ing to ensure that injured sol­diers are treated in a hos­pi­tal within 60 min­utes, known as the “Golden Hour.“
The piece focuses on two American solid­ers, Kenny Lyon and Brad Fulks. Lyon was hit by a mor­tar while fix­ing his vehi­cle, and lost half his blood through three sev­ered arter­ies before arriv­ing the Air Force the­ater hos­pi­tal on the Balad Air Base north of Baghdad.
Fulks was hit by a road­side bomb, which burned the skin over half his body and destroyed one of his lungs.
The Balad Air Base trauma cen­ter sees 300 trauma cases a month, but sends many via C-​​17s trans­formed into air­borne med­ical cen­ters to Germany. In the Vietnam war, it took an aver­age of 40 days to get wounded sol­diers back to the States; in the Iraq war, it now aver­ages three days.
You can read a tran­script of the piece here, but I highly rec­om­mend watch­ing the video, even if you already know the extra­or­di­nary efforts of the military’s trauma teams.
Ryan Singel

Citizen’s Guide to Getting the Goods

Monday, October 30th, 2006

The Freedom of Information Act isn’t just for jour­nal­ists or activist groups — cit­i­zens (with and with­out blogs) can also peti­tion the fed­eral gov­ern­ment to turn over doc­u­ments. While it’s rather sim­ple to file a request, it’s a bit more com­pli­cated to file one that actu­ally gets you infor­ma­tion.
The Electronic Frontier Foundation, which hired two of the best FOIA fil­ers in the coun­try this sum­mer, just updated its legal guide for blog­gers with a FOIA primer.

How do I know what to ask for?

News arti­cles, gov­ern­ment reports, press releases, and Congressional hear­ings are good start­ing points for think­ing up FOIA request ideas.

How do I make a FOIA request?

You can make a FOIA request by mail­ing or fax­ing a let­ter to the agency. You may also be able to sub­mit your request by email. Check the agency’s web site for infor­ma­tion about how and where to send requests.

Are there any step-​​by-​​step guides for writ­ing and sub­mit­ting FOIA requests?

Yes. Reporters Committee for Freedom of the Press has pub­lished a guide called How To Use the Federal FOI Act, and also has a FOI Letter Generator. The National Security Archive also has help­ful guid­ance for FOIA requesters.

It’s a bit sim­pli­fied since gov­ern­ment agen­cies vary widely in their atti­tude towards requests. The best advice is to make your request very nar­row. Ask for a report by name (for instance, ask for the Pentagon’s Inspector General’s report on the Iraqi National Congress), instead of ask­ing for all agency records about Chalabi and the INC. (BTW, there’s a good pos­si­bil­ity that report exists and hasn’t been pub­lished).
Another fun place to start would be to fol­low on Michael Ravnitzky’s FOIA work, which unearthed the indexes to four inter­nal NSA pub­li­ca­tions, whose arti­cles have tan­ta­liz­ing titles like “Was a Cryptologic Corporal.” All you have to do is look through the indexes, find a title or two that inter­ests you and ask for it. You just might get it.
Another place to get inspired is Russ Kick’s The Memory Hole, a col­lec­tion of doc­u­ments he’s built with FOIA requests he’s filed after read­ing news arti­cles. For instance, he’s the one who got offi­cial pic­tures of the coffins of sol­diers killed in Iraq when they landed at Dover Air Force base, after the pho­tog­ra­phy ban was debated in the news.
You could be charged a small amount, but gen­er­ally if it’s going to be more than $25 dol­lars or so in fees, the agency will let you know.
And if an agency stonewalls you or ignores you, well, you can either sue your­self (not a good idea and even if you win, you don’t get attorney’s fees) or ask a group like EPIC or the First Amendment Center or a pub­lic inter­est law clinic to help.
Think of it like a let­ter to the edi­tor or your con­gress crit­ter, it’s some­thing every cit­i­zen should try at least once.
On an unre­lated note, I’m pretty hon­ored that Noah handed me the keys and I’ll likely be focus­ing mostly on anti-​​terrorism and gov­ern­ment data­base stuff since that’s my nor­mal beat.
But keep the tips and com­ments com­ing and together we’ll keep DefenseTech hum­ming while Noah racks up speed­ing tick­ets in 10 dif­fer­ent states.
Ryan Singel

Rapid Fire 10/​30/​06

Monday, October 30th, 2006


* Airborne Anti-​​Missile Laser Actually a “Light Saber
* From Barbary War II to Iraq War in 90 sec Flash
* Gov puts RFID in IDs, Despite Damning Report (shame­less self-​​promotion)
* Letter From Iraq Goes Viral
* U.S.-provided Weapons Untraceable in Iraq
* Blair Outsourcing Iraq War?
* Ahmadinejad to Sanctions: Bring It On
* Pakistani Gunships Attack Radical Madrasa, Kill 80


Ryan Singel
(Big ups: RC, Michael Wilde)

Singel Signs In

Monday, October 30th, 2006

Ryan Singel has bro­ken some of the biggest pri­vacy and secu­rity sto­ries of the last few years — like AT&T’s cheek-​​to-​​cheek coop­er­a­tion with the NSA’s domes­tic spy­ing, and Jet Blue’s fishy use of cus­tomer records, to test a fed­eral passenger-​​screening data­base. These days, he heads up Wired News’ horribly-​​named, must-​​read secu­rity blog, 27B Stroke 6. And he’s still scoop­ing folks on the reg­u­lar; check out his cov­er­age of the roll-​​your-​​own board­ing pass gen­er­a­tor.
So I am really fired up to have some­one with this strong a track record blog­ging for Defense Tech. He’ll be tak­ing over the site this week, as I pack up for — and drive out to — Los Angeles, where I’ll be spend­ing the next few months.
Be good to my whiskey buddy Ryan. Send him tips. I’ll see y’all on the other side.

Milblogger Clamp Down Blows Up (Updated)

Monday, October 30th, 2006

TOC.JPGFor the last cou­ple of weeks, Defense Tech has been look­ing into the increas­ingly hos­tile atmos­phere that sol­dier– jour­nal­ists — mil­blog­gers — have been fac­ing. Now, a bunch of big­ger out­lets have picked up on the story — and advanced it sev­eral steps.
Stars & Stripes:

The [Army’s] August order [about blogs] specif­i­cally states that sol­diers may not cre­ate or update their blogs dur­ing duty hours, and the sites must not ‘con­tain infor­ma­tion on mil­i­tary activ­i­ties that is not avail­able to the gen­eral pub­lic.‘
That includes ‘com­ments on daily mil­i­tary activ­i­ties and oper­a­tions, unit morale, results of oper­a­tions, sta­tus of equip­ment, and other infor­ma­tion that may be ben­e­fi­cial to adver­saries.‘
If sol­diers are found vio­lat­ing those rules, both the ser­vice­mem­bers and their com­mand­ing offi­cers are noti­fied… lead­er­ship can decide what pun­ish­ment, if any, the sol­diers should face…
Noah Shachtman, edi­tor of defensetech​.org, said… “The fact that sol­diers want to write about their expe­ri­ences is some­thing that should be embraced by the Army… Theyre not look­ing to bad-​​mouth the mil­i­tary. Theyre look­ing to talk proudly about their experiences.”

AP:

“We are not a law enforce­ment or intel­li­gence agency. Nor are we polit­i­cal cor­rect­ness enforcers,” Lt. Col. Stephen Warnock, [head of the Virginia National Guard “Big Brother” website-​​monitoring unit] said. “We are sim­ply try­ing to iden­tify harm­ful Internet con­tent and make the authors aware of the pos­si­ble mis­use of the infor­ma­tion by groups who may want to dam­age United States inter­ests.“
Some blog­gers say the guide­lines are too ambigu­ous — a sen­ti­ment that has led oth­ers to pre-​​emptively shut down or alter their blogs.
“It’s impos­si­ble to deter­mine when some­thing crosses the line from not a vio­la­tion to a vio­la­tion. It’s like try­ing to define what pornog­ra­phy is or bad taste in music,” said Spc. Jason Hartley, 32, who says he was demoted from sergeant and fined for repost­ing a blog he cre­ated while deployed to Iraq with the New York Army National Guard.
According to Hartley, the Army had forced him to stop the blog even before the over­sight oper­a­tion existed, cit­ing pic­tures he had posted of Iraqi detainees and dis­cus­sions of how he loaded a weapon and the route his unit took to get to Iraq.

Wired NewsXeni Jardin (who has the best story of the lot):

Blackfive’s [Matt] Burden says sol­diers are receiv­ing mixed mes­sages: some receive approval from their imme­di­ate com­man­ders, only later to be rebuked by more senior offi­cials. Burden says his site and another mil­blog, Armor Geddon, were once fea­tured in an inter­nal Army PowerPoint pre­sen­ta­tion which described both as seri­ous oper­a­tional secu­rity risks.
“That kind of mes­sage from the admin­is­tra­tion of the Army sends a chill­ing sig­nal to a young sol­dier who was told by his com­man­der that it was okay to do what he was doing,” Burden told Wired News.
He and fel­low mil­blog­gers gath­ered this year in April for a first ever MilBlog Conference in Washington, DC. They plan to recon­vene in May, 2007. Debate over how to address author­i­ties’ OPSEC con­cerns with­out cre­at­ing a “chill­ing effect” among blog­gers was a heated topic at the 2006 gath­er­ing.
“My advice would be to bring together active duty, reserve and vet­eran blog­gers to take a look at this issue in a way that would help the mil­i­tary,” Burden says, “There’s a lot of pos­i­tive infor­ma­tion com­ing from these 1,200 or so mil­i­tary blogs, and if it’s not pos­i­tive, it’s giv­ing peo­ple a bet­ter under­stand­ing of what it’s like to be a sol­dier or the fam­ily of a sol­dier fight­ing this war.“
Active duty mil­blog­ger John Noonan co-​​edits OPFOR (mil­i­tary slang for “oppos­ing force”) and posts on such top­ics as “for­eign pol­icy, wargam­ing, grand strat­egy and hippy bash­ing.“
Noonan is among those who believe the cur­rent flap is partly the result of a gen­er­a­tion gap between younger, tech-​​savvy recruits for whom life online is sec­ond nature and older, more senior mil­i­tary offi­cials who don’t get the net and are accus­tomed to the military’s long-​​established his­tory of care­fully mon­i­tor­ing release of infor­ma­tion from the bat­tle­field.
“They don’t want to lose the tra­di­tional con­trol they’ve had over infor­ma­tion released from the bat­tle­field to the American peo­ple,” Noonan said. “It’s coun­ter­in­tu­itive for mil­i­tary guys who are used to total con­trol over what infor­ma­tion is released and what isn’t, to all of a sud­den hav­ing zero control.”

Xeni also filed a story for NPR’s Day to Day, which should air this after­noon.
UPDATE 3:01 PM: The NPR seg­ment is up now.
UPDATE 10/​31/​06 4:20 PM: ABC News weighs in here, with some pretty bruis­ing com­men­tary from Blackfive. Note to self: Do not piss this guy off.

Iraqi Forces Don’t Suck … Entirely

Saturday, October 28th, 2006

Despite what you might have heard from other media, the Iraqi Army does not suck. In fact, by regional stan­dards, it’s a fine lit­tle army: well-​​armed, well-​​led and capa­ble of defeat­ing ter­ror­ists and insur­gents in a stand-​​up fight. It wasn’t always that way, but the coalition’s clean-​​sheet approach and years of hard work by train­ing teams has really paid off.
iraqi army.jpgBut the Iraqi Army has two major weak­nesses. First, its units are locally recruited, like the U.S. National Guard. This com­bined with Iraqis’ over­rid­ing alle­giance to tribe over nation means that most of them refuse to deploy when ordered to do so by Baghdad. Those units that have agreed to deploy, such as the highly dis­ci­plined Kurdish bat­talon sent to the Shiite town of Balad early this year, have been besieged in their for­ward oper­a­tion bases by xeno­pho­bic locals.
But even if they were will­ing to deploy, most units are inca­pable of sus­tain­ing them­selves far from their major bases for very long. This is the sec­ond major weak­ness. I go into detail in a new National Defense fea­ture:

The [Iraqi] 10th Division is capa­ble of plan­ning and exe­cut­ing its own mis­sions, but usu­ally oper­ates along­side British forces. The divi­sion, a light infantry for­ma­tion, has four brigades each with two line bat­tal­ions of 800 troops apiece, plus engi­neer and bomb dis­posal com­pa­nies. Small divi­sional attach­ments includ­ing sig­nals troops and mil­i­tary police are just now stand­ing up with for­eign assis­tance. There are cur­rently no organic logis­tics troops.
This is con­sis­tent with the over­all struc­ture of the Iraqi Army. No more than 15 per­cent of Iraqs 120,000 sol­diers are involved in logis­tics, U.S. Army Maj. Gen. Gerald Ostlund told the Associated Press. By con­trast, Western armies fea­ture more logis­ti­cians than com­bat troops.
“What you see is what you get,” [British Army Lt. Col. Tim] Barrett says, refer­ring to the 10th Division’s infantry-​​heavy struc­ture. While the bat­tal­ions are ade­quately equipped with light arms and machine guns, there is a “des­per­ate need” for vehi­cles, Lateef says. Currently, a hand­ful of Russian-​​built medium trucks com­prise the divi­sions major motor assets.
A dearth of vehi­cles plus a broader lack of logis­ti­cal sup­port means the 10th Division is inca­pable of sus­tain­ing oper­a­tions away from its bases for more than a few hours, accord­ing to Barrett. This effec­tively lim­its it to urban oper­a­tions in Basra and short sor­ties from a hand­ful of rural installations.

What all this means is that the Iraqi Army will, for the time being, remain a local defense force. A good local defense force, mind you, but local nonethe­less. So when Baghdad goes to shit, as it did a cou­ple months back, the national gov­ern­ment has few options for boost­ing the num­ber of troops in the city. All it can do is try to recruit more troops locally … and call for U.S. and British help.
David Axe