98153. Hamre Acts to Hamper Hackers

By Linda D. Kozaryn

American Forces Press Service



	BRUSSELS -- As U.S. troops, combat aircraft and warships 

gathered in the Persian Gulf in February, the U.S. military was 

quietly attacked on a second front. Defense officials detected 

systematic, sophisticated intrusions into DoD computer networks.

	Was this the work of hackers who regularly attempt 

electronic break-ins, or was it a true cyber attack by the 

Iraqis? That was the question defense and justice department 

officials had to answer -- quickly. What they learned is now 

serving as a wake-up call at home and abroad. 

	Deputy Defense Secretary John J. Hamre traveled to Europe, 

March 14 to 19, to discuss the growing threat to computer-based 

information systems. In Cologne and Bonn, Germany, Brussels, 

Belgium,  Paris, The Hague and London, Hamre warned NATO allies: 

if this can happen to us; it can happen to you. Because computers 

are linked together, information assurance is only as strong as 

the weakest link in the chain, he said.

	People regularly try to breach DoD computer networks, Hamre 

explained here March 17. "We get people every day who are just 

pinging on our computers," he said. "It's been going on for 

several years. There's kind of a hackers' mentality that it's fun 

to get inside."

	In the first part of February, DoD officials noticed a 

pattern which could have been the early stage of a computer 

attack. They noticed the incidents of break-ins were more 

frequent and more systematic, Hamre said. "Because this was 

occurring at the same time we were preparing for potential 

operations in the Gulf, we were particularly concerned that they 

might be related."

	For three weeks, defense officials tracked unauthorized 

activity. "After about the first week, we became convinced that 

it was probably hackers," Hamre said. "But, we didn't know for 

sure because there was an overseas element to this."

 	As it turned out, in late February the FBI arrested two 16-

year-old boys in California for allegedly breaking into DoD 

networks. Even though Pentagon officials were relieved, the 

incident remained cause for grave concern since it could well 

have been an Iraqi cyber invasion. 

	Hamre said the teenagers did not get into DoD's classified 

computers which were all protected. "But, we still do an awful 

lot of things over unclassified systems that could have been 

damaged." The episode stressed the importance of better 

protecting DoD systems.

	"Two kids were able to create an awful lot of disruption in 

the Department of Defense," Hamre said. "We went to 24-hour 

shifts. We created a crisis action team. We had to go through an 

enormous amount of effort to protect the computer systems, to 

monitor them and clean them up."

	Was it simply a test of skill for the two young hackers? Did 

they understand it was wrong to break into these computers? Hamre 

said children who've grown up with computers may not understand 

the difference between what's real and what's a game. They may 

not understand that breaking into a computer electronically, is 

no different than breaking into somebody's house. It's private 

property.

	"One of the kids, when asked why did he do it, said, 'It's 

the power, dude,'" Hamre reported. What they may not realize "is 

that they're really opening doors for other people whose motives 

aren't as innocent."

	Private industry as well as the government needs to change 

this mindset and instill computer discipline, Hamre said. "There 

was a famous case several years ago about a clique that would 

break into computers to change the grades kids got in classes." 

	Hackers even defaced the CIA homepage about two years ago, 

changing the title from the "Central Intelligence Agency" to the 

"Central Stupidity Agency." While the CIA break-in was obvious to 

anyone opening the homepage, detecting electronic breaches is not 

always easy, Hamre said. "What's a lot harder is if someone 

doesn’t want you to know they've been in your computer and 

they've manipulated the data.

	"Let's say that a hacker -- just to have fun -- got into the 

Pentagon's telephone directory and changed every tenth number. It 

would take several days to figure out why the numbers were not 

going through? Since it wouldn't be happening all the time, it 

wouldn't be clear that a computer hacker had randomly changed 

telephone numbers."

	The potential for disrupting defense operations via computer 

manipulation is multifaceted, Hamre said. Almost all DoD business 

is now done on computers -- everything from sending messages, to 

ordering supplies, to paying troops, to keeping track of medical 

records. "If someone can come in and disrupt those computers, 

change the data or send misleading messages, they could do 

tremendous damage to a military operation."

	Once it's discovered data has been intentionally 

manipulated, people lose confidence in computer networks, Hamre 

said. "How do you know that it's real? You're looking at a screen 

and the name says John Hamre, but how do you know it's really 

John Hamre at the other end of that computer terminal?

	"It takes you a long time to regain confidence in the 

system. You have to download all the computers, go back to 

historical tapes, bring them back up again, and see if that data 

looks real. It's a very long and cumbersome and expensive 

process."

	The recent experience highlights the need for a much more 

systematic "information assurance" program to safeguard 

computers, Hamre said. The goal is to ensure DoD computer 

information is "true, reliable and has not been manipulated," he 

said. This will require continually monitoring central computer 

processors and employing software that automatically signals an 

alert. Sensitive data must be encrypted and unauthorized people 

must be kept off the net.

	So far, DoD classified networks have been secure. Firewalls 

separate them from the other networks, Hamre said. "But, 

firewalls in computers are just like firewalls in a movie 

theater. They simply slow the movement of the fire so people can 

get out of the building. A firewall in software simply slows down 

a hacker as they're working their way through it so you can take 

action."

	In the long run, DoD will have to encrypt data that goes 

from one computer to the next. "Before it leaves the computer, 

the message gets scrambled and then decoded at the other end," 

Hamre explained. Routine commercial transactions will be 

encrypted, while classified networks will have much stronger 

encryption.

	"Key recovery" will go hand-in-hand with encryption. "You 

have to encrypt the data so that it can't be read when it's going 

over public networks. Then you have to develop a system of 

electronic identification so that when you're reading that 

encrypted message, you can confirm whoever sent it to you is 

really that individual."

	DoD employees will have an "electronic dog tag," Hamre said 

Although some people fear this will enable the government to read 

their e-mail, he said, this is not the case. "Our program is 

simply going to be buying encryption and key recovery for 

Department of Defense communications so we'll be able to confirm 

who's talking to us." 

	Eventually, Hamre said he believes most people are going to 

want to adopt encryption so that when they use their credit card 

on the Internet, it's not going to be compromised. "Most business 

applications and Department of Defense applications will require 

a key recovery system so that we'll have confidence in who we're 

talking to." 

	DoD has already has negotiated a contract with Netscape to 

place an encryption and key recovery system on the web browser 

for more than a million DoD users. "This fall, we hope to have 

this encryption and key recovery system operational," Hamre said.

	Another related DoD goal is promoting computer literacy 

among the ranks, Hamre said. Young troops today have far more 

computer savvy than the previous generation, he said. "We ought 

to find ways to help soldiers, sailors, airmen and Marines who 

have an interest in computers to become more proficient." 

	Unfortunately, retaining highly skilled people is difficult. 

"As soon as our people become trained they become very attractive 

to the private sector," Hamre said. He's asked Rudy deLeon, 

undersecretary for personnel and readiness, to suggest personnel 

policy changes to ensure DoD trains and keeps highly skilled 

computer people. This may include added tuition assistance and 

training programs and bonuses in certain critical skill areas. 

DeLeon is scheduled to report his recommendations in about three 

weeks, he said.

	"I hope this generation becomes even more interested in 

computers than what they are now because we're going to need 

their help," Hamre said. "Us old buzzards don't know what to do."









##END##