10 Years Ago Today - Another Build-up to War on Bad Intelligence?

10 years ago in October 2002, a National Intelligence Estimate (NIE) was produced whose findings concluded that Iraq had Weapons of Mass Destruction. In February, 2003, SECSTATE Colin Powell addressed the U.N. Security Council on that same subject. His remarks were based entirely on source material vetted by intelligence analysts. That speech was the U.S. case - and his case - for going to war against Iraq. On March 19, 2003, the U.S. invaded Iraq for reasons that later proved false.

It didn't take long for the U.S. and the world to see that the rush to war against Iraq was a colossal error in intelligence and good judgment. Colin Powell to this day regrets the speech he made before the U.N. An investigation into the intelligence failures leading up to war with Iraq - "Report of the Select Committee on Intelligence on the U.S. Intelligence Community's Prewar Intelligence Assessments on Iraq" - laid out the many analytic failures that informed Powell's speech and the Bush Administration's position in minute detail.

Now we seem to be laying the political groundwork for yet another war in the Middle East - this time against Iran. While there's no doubt that Iran wants to acquire nuclear weapons, there's a lot of doubt regarding how close that is to happening. Iran has only been successful at enriching low levels of uranium at low amounts. It's certainly a serious problem and one that needs addressing but it's not in and of itself sufficient cause to go to war over yet. So let's pile on another layer of threat - Iran's capability to cause a "cyber Pearl Harbor" or the cyber equivalent of "9/11". In order to underscore those threats, Secretary Panetta pointed to two recent cyber attacks: the DDoS attacks against major U.S. banks allegedly performed by an Iranian hacktivist group that no one had ever heard of before, and the Shamoon attacks against Saudi Aramco and RasGas which the Secretary referred to as a "very sophisticated virus". In reality, Shamoon is neither a virus nor sophisticated. It was a quick and dirty piece of malware (a worm), probably reverse-engineered from the original Wiper (not Flame) that struck at Iran's oil ministry back in April. Half of its functionality didn't even work properly due to a coding error. And the DDoS attacks were most likely the work of an Eastern European criminal gang who specialize in banking attacks and decided to mask this one with an Iranian hactivist false flag.

The bottom line on Iran is that both its Uranium enrichment and its cyber warfare capabilities are not fully developed. There are lots of other countries, including the U.S. its allies, and some adversary states who are far more advanced than Iran in both of those categories. While it's certainly possible that at some point in the future the West will have no choice but to go to war with Iran, we aren't there yet and certainly not for the reasons given by Secretary Panetta. I have nothing but respect for the current Administration but I cannot in good conscience watch a repeat - or what even smells like a repeat - of the 2002-2003 build-up to war with Iraq happen a second time. Not while I have a voice and an opportunity to try to stop it by calling out errors in facts when I see them.

Add to Cart View detail

Fact-checking Secretary Panetta's Speech Regarding a Preemptive Strike

In an important speech on Thursday night, Defense Secretary Leon Panetta spoke about how the Department of Defense has improved capabilities to protect the U.S. against the threat of a catastrophic cyber attack; that if such an attack were imminent, the U.S. would strike first. While this statement was clearly mean't to deliver a message to Iran which featured prominently in the Secretary's remarks, the U.S. lacks the technical ability to deliver on that threat.

According to the Law of Armed Conflict, a nation state must be under imminent threat of an attack which will cause grievous harm to its populace before it can launch a pre-emptive strike in self defense. Rather than a traditional kinetic attack, Secretary Panetta specifically referred to a cyber attack by "an aggressor nation or extremist group [who] could gain control of critical switches and derail passenger trains, or trains loaded with lethal chemicals". The Secretary went on to say that "If we detect an imminent threat of attack that will cause significant physical destruction or kill American citizens, we need to have the option to take action to defend the nation when directed by the President".

The fact is however that neither the NSA nor any other agency has the ability to identify a malicious program that was custom-written to target an industrial control system before the attack occurs. It cannot "see" such a program traveling across the Internet backbone assuming that were the delivery method. More likely, as in the case of Stuxnet, Shamoon, and other malware, it would be hand-carried onto the target's premises and inserted via removable media into a networked computer which bypasses the capabilities of any NSA-run signals intelligence program to identify it.

Even if we had the ability to discern the purpose and target of malware in-transit, we'd also have to know which nation state was behind it. Although Secretary Panetta claimed that DoD has made "significant advances" in determining attribution, there's ample reason to doubt that statement - the most obvious being the Secretary's own words that "DoD is already in an intense daily struggle against thousands of cyber actors who probe the Defense Department’s networks millions of times per day." Anonymity has provided much of the impetus for the increasing number of automated and targeted attacks against the U.S. and other countries. Those attacks are on the rise because anonymity remains intact.

U.S. offensive cyber warfare capabilities are second to none, but in the words of General Peter Pace, the former Chairman of the Joint Chiefs of Staff, we cannot defend against what we send out, and since what we have sent out (like Stuxnet) is being reverse-engineered, we should re-think whether our being in a weak defensive state is really the best time to be running offensive cyber operations in the first place.

Add to Cart View detail