HTML5 the new desktop operating system?

The Defence CTO is reported to be interested in thin client computers linked to database applications hosted in data centres, but able to be used offline for mobile users. This would allow expensive, difficult to manage, power hungry desktop computers to be replaced with low cost units. The data could be in remote data centres under careful management, which appeals to Defence's needs for security.

Building thin client applications is easy: it is what we used to call "client server". I was part of a defence-industry project to build such applications in the early 1009s (I even published a scholarly letter about it: "Remote Presentation Client-Server More than Just Screen Scraper", Worthington T., Australian Computer Journal, Volume: 27 Issue: 1 Pages: 16-16 Published: FEB 1995). However, just as we got the graphical user interface to work for the remote client, along came the web and made such an interface a commodity item.

Using the web as the user interface for a remote database application is now an everyday application of technology. However, allowing the client to function while disconnected from the central database is very much more difficult. This requires having part of the application running in the client, along with some form of database.

Having an offline application would have required a complex bespoke software setup in a desktop computer and would have not been feasible in something which could be called a "thin client". However, in a review of the new HTC Desire Android mobile phone, I noticed that it used the Android 2.0 operating system, which has improved support for HTML5, including:

• Database API support, for client-side databases using SQL.
• Application cache support, for offline applications.

This is what is needed for building offline applications. It should be noted that this is in a mobile device, so building the same support into low cost desktop devices should be feasible.

The Defence CTO's desire for offline thin client applications now does not look that difficult: Use HTML5 for the user interface and provide local database and cache support. This will require as much hardware as a $400 netbook computer, running some sort of cut down Linux operating system, such as Google Android.

However, there are still some difficult issues for designers of such applications. Not all data can be made available "offline" as this would require each thin client computer to have as much storage as Defene's largest data centre. Security considerations would also limit access to offline data. One of the benifits of a thin client computer without offline storage is that when it is offline it contains little or no sensitive data. Thin clients with offline storage will have to be protected the same way as other computers holding sensitive data. Defence issues very detailed instructions on how to protect data, including how to destroy the devices (including what type of hammer to use when the enemy is at the gates).

Also with offline data there is the issue of synchronising with the central database. There is no foolproof what to solve this problem and each application will have to be designed accordingly.

Lastly a thin client computer is "thin" because it is not as powerful as a "thicker" one. There will therefore be some applications not suited to these devices.

Defence thin client computers

The Australian Department of Defence is reported to be planning to deploy 500 thin client computers by the end of 2011. Defence CTO Matt Yannopoulous mentioned thin clients in his talk at the ACS Canberra branch conference recently. Thin clients also feature in the "Defence Next Generation Desktop Project" (issued 22 April 2010).

It should be noted that thin client computing is not new to defence. Melbourne based electronics manufacturer Labtam, produced advanced thin client workstations (then called "X terminals") in the 1990s. These were sold to the Department of Defence and the ANU. The business was later sold to Tektronix Inc. IBM had a contract to supply Defence with hardware, but the Australian made units were superior. I was working in HQ ADF at the time and recall I recall writing a speech for the then Minister for Defence Support, about these terminals being made in Victoria (which the Minister's office liked).

Defence Next Generation Desktop Project

The Australian Department of Defence has issued a request for Expression of Interest for the "Defence Next Generation Desktop Project" (CIOG 198/10, 22-Apr-2010). The NGD Project aims to provide a simplified desktop interface for defence users and lower costs. Companies have to respond to the EoI to be considered for the RFT. A briefing on the RFI will be conducted in Canberra 5 May 2010.

There are three PDF documents provided via the government tender system:

1. ITR Conditions (515Kbytes)
   
2. Information provided to Requestors (860Kbytes)
   
3. Information to be provided by Requestors

Part 2: Information provided to Requestors, describes what Defence wants from the system:

Table of Contents
1 INTRODUCTION ..... 2
1.1 Purpose ....2
1.2 Background...2
1.3 Document Structure......3
1.4 Acquisition Objective ....4
1.5 Acquisition Process ......4
2 EXISTING ENVIRONMENT .... 5
2.1 Overview...5
2.2 Desktop Delivery ......5
2.3 Virtualisation .....6
2.4 Applications ......6
2.5 Desktop Security Environment .....6
2.6 Existing Network...7
3 APPENDIX I – STATEMENT OF REQUIREMENT ..... 8
3.1 Intent.....8
3.2 Contracting Model ....8
3.3 Requirements ...9
3.4 Desktop Delivery ....10
3.5 Application Presentation.....12
3.6 Desktop Security Environment – Multi-Level Security ...13
3.7 Integration...14
3.8 Implementation ...15
3.9 Project Management ......17
3.10 Support ...18
3.11 Commonwealth Activities ...18
4 APPENDIX II – APPLICATION LISTING... 19
5 APPENDIX III – ADDITIONAL ENVIRONMENT INFORMATION...... 20
5.1 Existing Thick -Client Specification ....20
5.2 Existing Server Specification ......20
5.3 Current End-User Devices......20
5.4 Current Peripherals ....20
5.5 Current Capacity Profile .....20 ...

2 EXISTING ENVIRONMENT ...
2.2 Desktop Delivery
2.2.1 The current Defence desktop delivery method uses two alternative mechanisms to deliver a desktop to a user:
(a) traditional PC thick client environment; or
(b) server-based computing (SBC) using Citrix XenApp 4.5.

2.2.2 The majority of Defence Information Environment (DIE) users across Defence connect via traditional PC-based technology using the SOE 125 desktop platform. The SOE 125 platform uses the Windows 2003 server back-end and Windows XP desktop solution.

2.2.3 Presently SBC users on the DIE equate to approximately ten percent of the user base.

These users fall into four categories:
(a) remote access users (DREAMS);
(b) Defence thin-client system (DTCS) users;
(c) users of point solutions for applications (such as the Defence Estate Management system and Aircraft Inventory Management System); and
(d) users who support non-Windows-based systems, for example Linux and Sparc.

2.2.4 The sites using the DTCS are based on a use case scenario. DTCS technology is used in almost all locations outside Australia as the delivery system of choice.

2.2.5 Defence has implemented a roaming system so that a user’s desktop environment is not associated with a specific hardware device. A user can access their desktop environment from any machine, provided it meets minimum requirements for physical and other security issues for both security networks (Defence Restricted Network [DRN] and Defence Secret Network [DSN]).
: : : : PART 2: Information for Requestors

2.3 Virtualisation

2.3.1 The use of virtualisation technologies is mainly contained within Defence’s Central Data Centre (CDC). The CDC is operated by the Defence Computing Bureau (DCB). Server virtualisation is currently managed using VMware and Citrix products and application virtualisation is managed via Citrix technology. There are up to 1,000 server infrastructure devices within Defence facilities and an additional 700 virtualised servers on this infrastructure.

2.4 Applications
2.4.1 Local
2.4.2 The majority of Defence users have a desktop or laptop running Microsoft Windows XP.

These users are provided with standard Microsoft Office 2003
applications, file and print services and most users access at least one corporate application hosted in the CDC. In addition, these users may require access via the DRN and/or DSN to other systems hosted either in the CDC or a variety of locations around Australia.

2.4.3 Other applications presented locally may include, but are not limited to, Adobe Acrobat, Apple QuickTime and Macromedia Flash Player.

2.4.4 Defence uses a wide range of applications; an indication of which is provided at APPENDIX II – .

2.4.5 Corporate
2.4.6 The DCB currently delivers a large number of enterprise applications hosted centrally to users across the DIE. Some applications use the Citrix Published Application and Citrix Application Streaming mechanisms to deliver these applications.

2.4.7 Most applications are delivered by a traditional client server model. These may include, but are not restricted to, ADFPAY (in-house), OpenPlan Professional, PMKeys (PeopleSoft), Roman (SAP) and SDSS/MIMS (logistics management).

2.4.8 Defence uses a wide range of applications; an indication of which is provided at APPENDIX II – .

2.5 Desktop Security Environment
2.5.1 Services are delivered primarily through two major network environments: the DRN being the largest and the DSN being the second largest. To meet the requirements of the Protective Security Manual (PSM), Information Security Manual (ISM) and Defence Security Manual (DSM), using traditional technology solutions, these two environments are physically separated and consist of a wide variety of information systems, communication equipment, hardware, software and application components. Both networks utilise a Microsoft Windows Server 2003 Active Directory (AD) for user authentication.

2.5.2 There are approximately 75,000 users of the DRN. Approximately 20 percent of these are also users of the DSN. The majority of Defence ICT users can be put into three groups:

(a) those who use only the DRN;
(b) those who use both the DRN and the DSN; and
(c) a limited numbers of users who use only the DSN.

2.5.3 The current architecture requires users of both networks to have individual desktops for accessing each network, resulting in duplication of hardware for those users.

2.6 Existing Network
2.6.1 The Defence Wide Area Communications Network (DWACN) is a major sub-system of the Defence Strategic Communications Network (DSCN) and provides core transport services for the majority of Defence electronic communication nationally and internationally. It provides voice and data communication services to over 300 sites. Services include the carriage of some 31 IP Virtual Private Networks (VPNs) and voice communications to 150 sites. The DRN and DSN represent two VPNs. Figure 1 shows the DWACN within the context of the broader Defence Strategic Communications Network (DSCN).

2.6.2 Defence utilises the TCP/IP suite of communication protocols.
2.6.3 The current bandwidth of the Defence network for the DRN and DSN across all locations ranges between 512kB to 1GB.

PART 2: Information for Requestors

3 APPENDIX I – STATEMENT OF REQUIREMENT
3.1 Intent
3.1.1 The Commonwealth’s intention in undertaking this NGD project acquisition process is to identify the most suitable Contractor/s capable of supporting the NGD project. In order to support the NGD project, the successful Contractor/s will need to provide:

(a) technical design, supply and installation of a solution which covers desktop delivery, application presentation and a single desktop security environment;
(b) implementation of the pilot and proposed solution;
(c) integration of the solution with Defence’s current environment;
(d) implementation and project management of the pilot and solution; and
(e) support of the system components and pilot.

3.1.2 Key to this will be the Contractor/s:
(a) capability to provide a solution which meets the requirements of the project;
(b) experience in providing a similar solution in a similarly complex environment;
(c) ability to deliver a complex project within tight timeframes, to a high level of quality; and
(d) assessed level of risk in delivering the solution.


From: Part 2: Information provided to Requestors, Defence Next Generation Desktop Project, CIOG, Department of Defence, 198/10, 22-Apr-2010

The "Glossary of Terms and Acronyms" in part provides an insight into the thinking on Defence:

Term: Meaning
ABN: Australian Business Number
ACN: Australian Company Number
ADO: Australian Defence Organisation
APS: Australian Public Service
ARBN: Australian Registered Body Number
C4I: Command, Control, Communications, Computers and Intelligence
CDC: Central Data Centre
CIOG: Chief Information Officer Group ...
Confidential ITR: Confidential information pertaining to this ITR ...
Criminal Code: Division 137 of the Criminal Code available from http://www.comlaw.gov.au
CV: Curriculum vitae
Data Centre Consolidation: Project to reduce Defence’s data centre numbers to less than ten...
DCB: Defence Computing Bureau
Defence: The Department of Defence
DIE: Defence Information Environment
DOSD: Defence Online Services Domain
DPPM: Defence Procurement Policy Manual (1 April 2010 edition) available from
: http://www.defence.gov.au/dmo/gc/dppm.cfm
DREAMS: Defence Remote Electronic Access and Mobility Service
DRN: Defence Restricted Network
DSCN: Defence Strategic Communications Network
DSM: Defence Security Manual
DSN: Defence Secret Network
DTCS: Defence thin-client system
DTSN: Defence Top Secret Network
DVN: Defence voice network
DWACN: Defence wide area communications network
FedLink: Secure communications network between Australian Government agencies
Fair Work Act (Cth) 2009 Fair Work Act (Cth) 2009 is available from www.deewr.gov.au/fairworkprinciples
ICT: Information and communication technology
ILSP: Integrated logistics support plan ...
IP VPN: Internet protocol virtual private network
ISM: Information Security Manual
ITR: Invitation to Register Interest ...
JORN: Jindalee Over-the-horizon Radar Network
KPI: Key performance indicator.
LAN: Local area network
L2 VPN: Layer 2 virtual private network
NGD: Next Generation Desktop ...
OGO: Other government organisations ...
PSM: Protective Security Manual
PSTN: Public switched telephone network ...
RFT: Request for tender
SBC: Server-based computing ...
SOE: Standard operating environment
SRP: Strategic Reform Program ...
TACINT: Tactical interface
TCP/IP: Transmission Control Protocol/Internet Protocol ...
VoATM: Voice over asynchronous transfer mode
VPN: Virtual private network
VTC: Video teleconferencing.

From: Part 1, Defence Next Generation Desktop Project, CIOG, Department of Defence, 198/10, 22-Apr-2010

Engaging the Defence Sector with Open Source

OpenSA have invited me to speak on "Engaging the Defence Sector with Open Source: Commons for Collins or GPL for Growlers?" in Adelaide, 19 April 2010. Defence programs have traditionally used custom designed computer systems with custom programming tailored to each new defence system. However, there is now more use of commercial off the shelf equipment, which includes scope for more use of open source software. The subtitle of the talk refers to the Collins Class Submarine follow-on project and the acquisition of 12 F/A-18G "Growler"electronic warfare aircraft by Australia. These systems have the potential to use open source software.

Engaging the Defence Sector with Open Source
Tom Worthington

5pm 19th April 2010
“The Thinking Space” Science Exchange, 56 Exchange Place, Adelaide SA 5000

Free for member companies, up to 2 reps; $10 for additional reps. $20 for non-members; membership may be applied and paid for at the event.

Free and open source software has obvious benefits, but it can be difficult to explain these to organisations such as the Department of Defence. A brief guide to technology in the defence organisation will be given by a former senior ICT policy advisor. Tips on what to say to who and how to contact defence IT personnel and decision makers will be provided.

Tom Worthington took a temporary six month posting at the Defence Department and stayed for nine years, with time in both the military Headquarters Australian Defence Force and the civilian Defence Material Organisation. During that time he got to fly in military aircraft and occasionally wear a borrowed uniform at wargames, but spent most time advising on restructuring IT projects, including incorporation of Unix into the Defence computing environment.

Tom provided technical leadership and represented Defence at interdepartmental and industry committees. He was prepared the first Defence policy on Internet information services and managed the first Defence web site and and Ministerial site. He advised on technologies and products for the Defence Common Operating Environment.

Since leaving Defence, Tom has been an independent IT consultant and teaches at the Australian National University. He is an honorary life member, fellow and former president of the ACS, as well as a member of ACM and IEEE-CS. He designed the ACS/ANU/OUA Green Technology Strategies course.

RSVP by COB Friday 16th April 2010 to Angela Anderson at Loftus, either by phone 8304 8888, or by email
rsvp(a)opensa.org.au

http://opensa.org.au

Open Source for Submarine Sonar

I am giving a talk on in Adelaide 19 April, tentatively titled "Engaging with Defence on Open Source: Commons for Collins or GPL for Growlers?". So I found of interest the article
Open season: submarine sonars build on commercial imperatives (Janes, March 2010), about the use of commercial off the shelf equipment by US companies. This discusses the U.S. Navy's ARCI Program for upgrading old sonar systems.

This might be applied under the new Australian defence strategic reform initiative. There is already a Collins Submarine Communication Replacement (SEA1439 Phase 5B2). These could make use of low cost, off the shelf computer equipment and open source software.

Ongoing Innovation: Modernization and Incorporation of Technology

The Submarine Force is making significant, rapid improvements in acoustic sensors and processing by using commercial technology implemented through innovative system design and acquisition processes. In real-world exercises and operations, both the TB-29 towed array and Acoustic Rapid COTs Insertion Sonar system (ARCI) demonstrate the ability to restore a remarkable acoustic advantage to U.S. submarines. Use of COTS in ARCI (and in a modified TB-29 array) results in substantially reduced costs with significantly improved processing capability. For example, each ARCI shipset costs about 20% of the price of its predecessor, yet improves processing power by an order of magnitude. A key advantage of ARCI is the Advanced Processor Build (APB), which uses improved processing capability to provide new tactical capabilities and powerful new algorithms that have resulted in much improved towed array detection ranges in testing and actual fleet operations to date. Additionally, the ARCI program improves the commonality/interface among submarine systems while enabling future upgrades to be installed significantly quicker. An aggressive phased installation plan will provide continuously improved versions of ARCI across the entire submarine force by FY06.

Connectivity with other naval and joint forces is essential to effective decision-making, operations, and warfighting with submarines. Consequently, another major priority for the Submarine Force is the modernization of submarine communications capabilities. The submarine High Data Rate (HDR) antenna is the top C4I initiative and is the Navy's first multi-band dish antenna. The HDR antenna will provide worldwide high data rate satellite communications capability and enable access to a variety of systems including the secure, survivable Joint Milstar Satellite Program in the Extremely High Frequency (EHF) band and the Global Broadcast Service (GBS). All SSNs will have HDR antennas by FY04, thereby greatly enhancing SSN connectivity with the Battlegroup. Another development, the Multi-element Buoyant Cable Antenna (MBCA), will enable UHF transmit and receive capability while submerged at speed and depth. These initiatives are key to providing the data throughput necessary for network-centric operations in the 21st century.

From: Submarine Themes: Submarine Innovation, Submarine innovation, including an aggressive long-term technological development and insertion program, promises to dramatically improve submarine capabilities in the 21^st century, Submarine Warfare Division, OPNAV Staff, 2001

Collins Submarine Communication Replacement

The Defence Materiel Organisation has issued a Request for Expression of Interest for replacement of the COLLINS Class Submarine External Communication Systems.

SEA1439 Phase 5B2 Communications and Electronic Warfare Improvement Program
ATM ID ITR D08051/CEWIP
Agency: Defence Materiel Organisation
Category: 43190000 - Communications Devices and Accessories
Close Date & Time: 23-Apr-2010 12:00 pm (ACT Local time) ...
ATM Type: Expression of Interest

Description
The Commonwealth, as represented by the Submarine Combat System SPO, has a requirement to gather information in relation to Export Controls, ITAR requirements, Defence Security and WGS certification from potential suppliers for the replacement of the COLLINS Class Submarine External Communication Systems. ...

From: SEA1439 Phase 5B2 Communications and Electronic Warfare Improvement Program, Defence Materiel Organisation,Department of Defence, 29-Mar-2010

Redesigning Government IT 2010

Greetings from the 2010 ACS Canberra Branch Conference at the historic Canberra Hyatt. This is a one day conference with four streams: Data Management, Service Management, Personal Development and Enterprise Architecture. The conference traditionally concentrates on professional skills, rather than technology. This year the emphasis is on developing the young professional (with university students milling around nervously, obviously in their best clothes and on their best behaviour).

There also seems to be a defence flavour running through much of the conference. Topics this year which stand out to me were: ITIL V3, "The Virtuous IT Professional" Data developments at the ABS and the UNSW@Canberra Robotics Tournament.

The conference is as usual opened with government heavyweights. This year it is the Jon Stanhope, Chief Minister of the ACT, John Sheridan, from AGIMO. Bruce Lakin, the new CEO of the ACS and Matt Yannopoulos, CTO, Department of Defence.

The Chief Minister started by admitted he doesn't have a Facebook page or Twitter, but does have a Blackberry. He then gave examples of how technology has changed our lives. He worried about loutish behaviour online and extremism, but hoped that norms of behaviour will emerge (a refreshing change from politicians calling for Internet censorship). He mentioned the ACT Government was working on using social networking and a cluster of small local companies working at NICTA (something I hadn't heard about before). He explained that the NBN was the most costly Australian investment in decades and comparable to transport infrastructure in the past.

The Chief Minister then highlighted Transact's success at delivering broadband in Canberra, including to all schools (unfortunately ACT may therefore miss out on federal funding because it was a pioneer). He pointed out that the federal government was the largest Australian ICT customer. He made a comment about one IT vendor being woken from lethargy by the Gershon Report (I have no idea which he was referring to). The Chief Minister had to rush off as the Assembly is sitting today. This seemed to negate much of what the Chief Minister said, as if the ACT Government was an effective user of IT, then it would not be necessary for people to assemble in person in the room for the "Assembly".

John Sheridan, from AGIMO, then did the "Vision Thing". He argued for business credibility for IT people. In support of this he talked about AGIMO benchmarking of federal government IT: 2007-08 on business as usual, and now for 2008-09 on progress. The later study has more credible data. IT expenditure is flat, which is a good result in the
global financial crisis. Contractor expenditure reduced by 6% and staff expenditure increased, in accordance with government policy to reduce the use of contractors.

Applications account for 36% of total government IT spend and is the largest single amount. This is something I raised with the new government data centre policy, which could do relatively little to reduce costs, unless the applications run in the centres and changed: . John argued that there is work to do with delivering economies of scale with small servers being wasted serving small agencies.

John claimed that reliability will be addressed with the Agency Capability Assessment (P3M3). With COTS/GOTS bespoke applications will be reduced and government processes standardised. However, this sounded more like wishful thinking than a plan. What was not clear was how to overcome the usual reluctance of separate bodies to work together.

The BAU Budget Reductions are claimed to have saved $1B over 2009-13. Examples were the Microsoft VSA, Telecommunications, Desktops and Data centres. However, these are easy and low hanging fruit, relatively modest initiatives with modest savings. Saving money by using buying power on procurement of Microsoft products, desktop PCs and data centres is relatively easy and obvious, but will deliver relatively small savings. What this does not address the difficult questions of alternatives to Microsoft software, eliminating desktop PCs and replacing the applications running in data centres. These changes could
deliver savings of 75% to 90% on IT costs.

John claimed to have delivered on Green IT with "quick wins". Some of my Green ICT students wrote their agency green IT plans as part of the course.

An IT procurement kit is ready but delayed awaiting sustainability issues to be resolved (this was due December 2009). A workforce plan will be released later this year.

John argued that Web 2 could be used for cross agency collaboration. I don't see that Web 2 is needed (old fashioned Web 1 would do). He also gave the new Australian Government web site as an example. However, it is about six months since I last used Australia.gov.au. In a way the service needs to be disaggregated so the services are diffused through the community, without the community having to come to the government web site.

Finance has turned on access to Twitter and Facebook to staff, indicating that the senior executive are comfortable with the technology. They are also considering Creative Commons licensing for government reports (which will be welcome, if it happens). A good
complement to this would be to provide documents in web based and ebook
format instead of the inefficient, poor quality PDF documents currently
produced. This is an example of where application changes can achieve efficiencies: changing to a web format would reduce web serving costs by about 90%.

Bruce Lakin, the new CEO of the ACS, thanked the sponsors. Interestingly the major sponsor is the UNSW Canberra Campus, the confusing new branding for the Australian Defence Force Academy (ADFA). It seems UNSW wants to distance itself from its association with the military (which does not seem a productive strategy to me). Bruce continued one of the emerging themes of the conference by talking about being able to measure what the ACS does and so have evidence of its success. He also continued
the theme of developing younger professionals. ACS has a new mentoring program, which I had not heard of before and which I hope makes use of the online mentoring techniques developed by ACS's education area.

Bruce outlined the new certification process for ACS. This is now internationally recognised by IP3. The new Certified professional (CP) with CT (Certified Technologist) and CS (Certified Specialist) will be recognised in the UK, USA and other countries. This has required alignment with the SFIA, including for the Green ICT course I designed.

The keynote as Matt Yannopoulos, CTO, Department of Defence. Before his presentation I chatted with Matt, who confessed to me he wasn't a blogger, but the Chief of Army was. I suggested he not rush into blogging as there are downsides (I wrote Defence's first policy on the use of the Internet). Matt is leading the development of the Defence ICT architecture. This fits with the "Defence White Paper 2009", "Defence Capability Plan 2009" and "Defence Reform Program 2009". There are ICT plans and military specific ones, such as for network centric warfare. The interesting part in all this is that Matt was taking about the business of the organisation, which is defence, and how IT supports this. The CTO is only responsible for about half the IT in Defence, with the other half being embedded in military systems. The aim is to integrate these more. Matt then mentioned "thin client" in particular as a way to save money and get control of desktops. One of my jobs when at HQADF was to look at thin clients and it is interesting to see this is still an issue, more than a decade later. If Defence can work out the difficult task of integrating thin clients, that could make a good model for the Australian Government generally.

Matt pointed out that Defence is the this largest telco in Australia, behind Telstra and Optus. He confessed Defence has a printer for every three people and many thousands of applications to be rationalised. Defence created a "technology stack" (defence people love such diagrams). Matt made a brave assumption that people were prepared to change the way they work and use technology to help and use enterprise wide systems. He mentioned problems with the defence pay system last year (when at Defence I helped cancel two successive pay system projects).

The plan for the future is that the CTO will provide the communications and processing infrastructure. Applications can then be run over the top. The previous practice was that each defence project would purchase and run its own network and hardware. In my view the divisions between military services and claims for secrecy make it much harder to
integrate defence systems, but it is not impossible.

Matt pointed out that defence has about 90,000 desktop PCs, but also 10,000 trucks. In the future each truck will also have a screen in it and be potentially part of the system.

In terms of integration, Matt gave the example of a desk at the new Australian Defence Force "Headquarters Joint Operations Command (HQJOC) ", with a desk for one person having five monitors and four telephones on it. He mentioned that most staff have at least two computer son their desk for security reasons. In the logistics area paper is mostly used and the most advanced application in common use is a
spreadsheet (I recall seeing one defence logistics base where forms were faxed from one building to another). He pointed out that military operations depend on logistics.

A term Matt kept using was "composite applications". This seemed to be similar to a "mashup". He argued that in many cases small, quick and simple integration would provide benefits to the user. He said he did not want to buy heavily coupled integrated applications, but services.

The JSF project is paying for a secret level backbone for their own use, but which can also be used across the organisation. Matt used the example of the stove-pipe systems limiting access for military purposes in the middle-east. He also mentioned silos stopping reuse.

Matt said he was looking at the possibility of using cloud based services like Google apps, initially for personnel on deployment to use to communicate with their family (not for military purposes). This could be a good way to introduce military personnel to new ways of working. Obviously cloud systems within the Defence network can be used for security.

The Government announced the defence strategic reform initiative yesterday.

One area the Defence CTO might usefully explore is the use of embedded IT in military systems. In the past electronics were added to military ships, aircraft and vehicles to make them more effective. The military hardware would be designed and then the electronics added. If the electronics development as delayed then the hardware would be less
effective, but still work. However, modern ships, planes and vehicles depend on computer systems and those IT systems represent most of the cost. Several recent defence weapons projects have recently had problems, or completely failed, due to IT problems. This may require a change of approach for Defence procurement projects, where weapons
systems are treated as IT systems with some specialised hardware (I am giving a talk on this in Adelaide next month, tentatively titled "Engaging with Defence on Open Source: Commons for Collins or GPL for Growlers?").

Australian Robot Aircraft Launched from US Stealth Warship

The Australian developed Aerosonde UAV has been succesfully launced and recorved from the US stealth warship M80 Stletto, according to Janes International Defence Review ("Aerosonde Mark 4.7 UAS proves shipborne capability", March 2010). The AAI Aerosonde Mk 4.7 is one option for the US Navy/US Marine Corp's Small Tactical UAS (STUAS)/Tier II programme. The Aerosone carries visable and infrared sensors and a laser range finder/pointer. The Aerosonde is small enough to be lifted by one person but can fly for 12 hours and an earlier model flew accross the Atlantic Ocean.

Web 2 War

In "Using Web 2.0 as a Weapon" (Professional Notes, Proceedings of the US Naval Institute, February 2010), Lieutenant Randal T. Jones discusses how RSS feeds, blogs, Wikis and mash ups are being used by the military. The Lieutenant points to the US Army Knowledge Online (AKO) as an example of a secure intranet with RSS feeds and blogs. He cites the US intelligence Intellipedia as an example of a successful classified Wiki and the Army's Tactical Ground Reporting Network (TiGRNET) as a mash-up. I could not find any publicly available references to TiGRNet, but it may be similar to the Tactical Ground Reporting System (TIGR).

However, this use of technology is not all one sided. Later in the same journal, Norman Friedman ("Stealing Signals") reports that from 2004 insurgents in Iraq were intercepting video from US Predator UAVs and have been doing so in Afghanistan as late as 2009. What is not clear is why these signals were being transmitted unencrypted or if they were of any practical value to the insurgents. A few fleeting images from a UAV would be of little value. But Web 2.0 technology is now available to anyone with a smart phone and this could make scattered images of far higher intelligence value.

Military presentations and social media

Two publications on better presentations caught my eye in the NLA reading room today. One on how to use Twitter during presentations, the other on how military personnel can prepare better presentations.

The Backchannel: How Audiences are Using Twitter and Social Media and Changing Presentations Forever (Cliff Atkinson, 240 pages, New Riders Press, 2009) gives a step by step guide on how to use Twitter during a presentation for audience feedback. It also covers alternatives to Twitter which are better suited for discussion of presentations and how to set up a web version of your talk to allow for this. It is a very good "how to" as well as "why to" guide.

Towards better presentations (Commander Diane Boettcher, Professional Notes, Proceedings of the US Naval Institute, February 2010) is a short article urging military personnel to prepare better presentations. Having suffered from having to sit through many overly long bullet point acronym loaded PowerPoint presentations by defence personnel, I hope the suggestions are headed. I particularly like the suggestion to writing notes to accompany slide presentations. As the commander points out, slide decks tend to take on a life of their own and your presentation, or some slides from it may be widely circulated. If accompanied by some notes the presentation will make much more sense.

It would be interesting to see if the military are making use of the Twitter-type back channel for presentations. Clearly Twitter could not be used for classified presentations, but more secure systems with more limited coverage could be used.

From Research to the Real World

Greetings from the Australian National University in Canberra, where former student Kevin Moore from General Dynamics Mediaware is talking about Commercialising Research: Real-world Applications and Challenges of Digital Video. His company's applications include processing video from the US Predator UAV aircraft used by the US military in Afghanistan and sport video at the Beijing Olympics.

Dr. Moore is discussing how an idea from a research project becomes a commercial product. He pointed out that licensing the intellectual property from a research organisation may take years and require a share of the company or licensing fees . Mediaware obtained government and defence start-up grants, but even so the founders did not take salaries initially and the company started out in a very modest office. The company moved from selling consumer vdeo software to "prosumers". Customers were not just the usual home video market, but also lawyers and professionals. The company is modestly successful, with 90% of the revenue from outside of Australia. In 2008 the company was purchased by General Dynamics, but still operates out of Canberra.

Dr. Moore suggested not "chasing the market" but instead concentrate what real customers need. He used the example of the product InStream. The market was for regioanl TV broadcasters who needed to insert local advertisments into TV content for new HD TV. Existing prodycts ere designed for capital city stations and not affordable for small stations. The traditional was to implement this would be to decode the MPEG video, insert the ads and recode. Mediaware produced a software based system to insert the ads.

From prototype to product took 18 months. This was used by Prime for the Beijing Olympics and won an award. Despite this success, the product still does not have another customer. One problem is that potential customers do not believe that such a product is technically possible and therefore there is not a demand.One obvious use I can see for this technology is to insert information into the video stream from UAV surveillance aircraft.

Dr. Moore then showed examples of JPEG2000 for Wide Area Airborne Surveillance. Military manned and unmanned aircraft in Afghanistan are recording very large amounts of video data over wide areas. This is creating a large data management problem. Mediaware are working on systems to manage this. He commented on the difficulty of collecting requirements from users where the application is highly classified. Another issues is to adjust the quality of the video to suit the avialable military bandwidth.

Dr. Moore then invited the ANU students to apply for a job.

Processing Predator UAV Video

Kevin Moore from Canberra company General Dynamics Mediaware will talk at the ANU in Canberra today about how they compress video, in: Commercialising Research: Real-world Applications and Challenges of Digital Video. Applications include processing video from the US Predator UAV aircraft used by the US military in Afghanistan and the Beijing Olympics. Mediaware hires ANU students to work on software.

Seminar Details
Commercialising Research: Real-world Applications and Challenges of Digital Video
Kevin Moore (General Dynamics Mediaware)
COMPUTER VISION AND ROBOTICS SERIES

DATE: 2010-02-25
TIME: 16:00:00 - 17:00:00
LOCATION: RSISE Seminar Room, ground floor, building 115, cnr. North and Daley Roads, ANU
CONTACT: Jochen.Trumpf@anu.edu.au

ABSTRACT:
MPEG video compression and transmission standards are a major enabling technology driving the digital broadcast and distribution industries. Digital television, IPTV DVDs and Blu-ray Discs all use variants of MPEG to transmit and display content. General Dynamics Mediaware is a Canberra company that has been engaged in research and implementation of MPEG technologies for over ten years, and has emerged as a leading global developer and supplier of compressed digital video processing solutions to the Broadcast and Defence industries.

In this presentation, we will introduce Mediaware's unique compressed-domain frame-accurate MPEG repurposing technologies, whose commercial applications include

- Real-time splicing systems deployed by Prime TV across the Australia's East Coast, facilitating the HD TV broadcast of the 2008 Beijing Olympic Games;

- Stream capturing, analysing, annotation, editing software integrated in General Dynamics Multi-Int Analysis and Archive System, and in General Atomics Predator ground station.

We will describe MPEG-4 AVC/H.264, the standard used in HD TV, Blu-ray DVD and by services such as YouTube and iTunes, and present some of the technical challenges of compressed-domain editing given its computational complexity.
BIO:
Dr Kevin Moore is the Chief Technology Officer of General Dynamics Mediaware and is responsible for identifying and developing Mediaware's product and technology strategic vision.

Joining Mediaware in 1998 shortly after it was founded, Kevin was part of the engineering team responsible for the development of Mediaware's core capabilities in native MPEG and H.264/AVC editing, compressed domain scene change detection, video playback, stream capture, and helped build the first two generations of desktop editing products.

Prior to joining Mediaware, Kevin spent 7 years as a Research Scientist at CSIRO, Australia's national science agency, working on a range of image processing and scientific data visualization projects. Kevin has BSc and PhD degrees in Computer Science from the Australian NationalUniversity, and a broad background in video and image processing, high performance computing and software engineering.

Social Networking for the War on Terror

In "Exchange Rate" Tim Ripley (Jane's Defence Weekly, 27 January 2010), describes a broadband system used by coalition forces in Afghanistan. Surprisingly, while western military organisations have been using the Internet for more than a decade, this has largely been confined to particular arms of national forces, rarely linking outside the forces of one country and far from the battlefield. Tim describes the work of the NATO Communications and Information Systems Services Agency (NCSA), with its Mission Secret Network linking command centres in Afghanistan. The UK Joint Command and Control Support Programme (J2SP) was not ready so the built an interim "Project Over task". managed by the Defence Information Infrastructure Integrated Project Team (IPT). They still do not have the much heralded "Common Mission Secret Configurable Network", but have improved on previous stovepipe US systems (where each part of each service only communicated with its own headquarters). NATO have a set of applications for VOIP and Adobe Acrobat Connect. This includes NATO Joint Chat (J-Chat) for military chat rooms, Wiseweb and Joint Automated Deep Operations Coordination Systems (JADOCS). Wiseweb provides a web based interface to information. Despite all this it seems to me that NATO are a long way behind the state of the art in the implementation of web based systems, compared to commercial practice. In particular the use HTML 5, smart phone compatible formats and of e-book formats, shows considerable potential for the military. This would also allow access at lower echelons, where there are currently data rate limitations and limits due to display devices. The commander in the back of an armoured vehicle in the field will not have the big screen and broadband connection of the headquarters, but that doesn't mean they can't have the same data.

Electronic warfare and radar imaging aircraft

Professor Chris Baker talked on "Aspects of imaging radar" at The Australian National University, 28 January 2010. He pointed out that high performance computers now allow synthetic radar images to be created on-board aircraft, where previously hours of processing on a ground station would be required. It occurs to me that this could be applied to the Super Hornet EA-18G Growler aircraft the Australian government has ordered. These aircraft could then be used in conditions not suitable for the Boeing Wedgetail.

The EA-18G Growler is designed for electronic warfare. What the Australian Government has ordered is twelve Super Hornet aircraft to be fitted with extra wiring to allow radio transmitters and receivers to be attached to the aircraft. The receivers detect transmissions from enemy communications and radar. The transmitters then send false signals to confuse the enemy. However, Australia has not ordered any electronic warfare equipment for the aircraft, just the wiring. It is likely the USA will not permit Australia to have the most sophisticated equipment for the aircraft, nor allow Australia to modify the software and equipment for local conditions. It is likely that DSTO will develop local equipment for the aircraft.

As the EA-18G aircraft will be equipped with radar frequency transmitters and receivers, these could also be used to provide 360 degree radar coverage around the aircraft. Australia has ordered four Boeing Wedgetail Airborne Early Warning and Control aircraft with very large radars and processing capacity. But these are modified airliners and so are slow and vulnerable to attack. The EA-18G is much smaller and faster, but would not normally be considered for a flying radar picket, due to limited space for antennas and processing computers. But as Professor Baker pointed out in his talk, processing power can now be fitted into a much smaller space and can overcome many limitations of the antenna size. High performance computers can be built from video game chips and podcasting can be used to send the resulting images directly to troops on the ground.

Australia and Cyber-warfare Book on Attacks from China

The book "Australia and Cyber-warfare" is very useful for putting the new Australian Cyber Security Operations Centre (CSOC) into perspective. The section on "China’s cyber-attack capability" is relevant to Google's recent allegations of attacks from China.

There are very well formatted free web and mobile versions of the book available online, as well as a print on demand edition.

Australia and Cyber-warfare

Gary Waters, Desmond Ball and Ian Dudgeon

Canberra Papers on Strategy and Defence No. 168

ISBN 9781921313790 (Print version) $19.95 (GST inclusive)
ISBN 9781921313806 (Online)
Published July 2008

This book explores Australia’s prospective cyber-warfare requirements and challenges. It describes the current state of planning and thinking within the Australian Defence Force with respect to Network Centric Warfare, and discusses the vulnerabilities that accompany the use by Defence of the National Information Infrastructure (NII), as well as Defence’s responsibility for the protection of the NII. It notes the multitude of agencies concerned in various ways with information security, and argues that mechanisms are required to enhance coordination between them. It also argues that Australia has been laggard with respect to the development of offensive cyber-warfare plans and capabilities. Finally, it proposes the establishment of an Australian Cyber-warfare Centre responsible for the planning and conduct of both the defensive and offensive dimensions of cyber-warfare, for developing doctrine and operational concepts, and for identifying new capability requirements. It argues that the matter is urgent in order to ensure that Australia will have the necessary capabilities for conducting technically and strategically sophisticated cyber-warfare activities by the 2020s.

The Foreword has been contributed by Professor Kim C. Beazley, former Minister for Defence (1984–90), who describes it as ‘a timely book which transcends old debates on priorities for the defence of Australia or forward commitments, [and] debates about globalism and regionalism’, and as ‘an invaluable compendium’ to the current process of refining the strategic guidance for Australia’s future defence policies and capabilities. ...

Table of Contents

Abstract

Contributors

Acronyms and Abbreviations

Foreword by Professor Kim C. Beazley

Chapter 1. Introduction: Australia and Cyber-warfare

Chapter 2. The Australian Defence Force and Network Centric Warfare

Introduction

The ADF’S NCW Concept

Networks

Shared situational awareness

Self-synchronisation

Balancing risks and opportunities

The NCW Roadmap

The human dimension

Accelerating change and innovation

Defence’s Information Superiority and Support Concept

Networking issues

The ADF’s capability planning for NCW

Maritime

Land

Aerospace

ISR

Joint force

Coalition

Conclusion

Chapter 3. Information Warfare—Attack and Defence

Introduction

The value of information

Open source information

Information Warfare

How would an adversary attack us?

China’s cyber-attack capability

What should we do?

Conclusion

Chapter 4. Targeting Information Infrastructures

Introduction

The information society

Information Infrastructures: the NII, GII and DII

The National Information Infrastructure

The Global Information Infrastructure

The Defence Information Infrastructure

Information Infrastructures: Some key characteristics

Components

Connectivity

Bandwidth

Functional interdependence

Ownership and control

The Importance of Information Assurance

Targeting Information Infrastructures: who and why?

Nation-state targeting

Targeting by non-state organisations

Targeting: objectives

Targeting: capabilities required

Psychological operations

Database management

Computer Network Operations (CNO)

Other weapons and methodologies

Media

HUMINT assets

Additional capabilities

Targeting: vulnerability and accessibility

Vulnerabilities

Accessibility

Intelligence

Conclusion

Chapter 5. Protecting Information Infrastructures

Introduction

Balancing information superiority and operational vulnerability

Vulnerabilities

Balancing security and privacy in information sharing

Managing security risk

Managing privacy risk

Dangers in getting privacy wrong

Cyber-security

Critical Infrastructure Protection in Australia

Securing the Defence enterprise

Trusted information infrastructure

Addressing the national requirement

Conclusion

Chapter 6. An Australian Cyber-warfare Centre

Introduction

The relevant organisations and their coordination

Research, planning and preparation

Offensive activities

Information Warfare and the intelligence process

Command issues

A premium on ante-bellum activities

Rules of engagement, doctrine and operational concepts

Capability planning

Location of a Cyber-warfare Centre

Regional developments

Conclusion

Bibliography

Index

Imaging radar seminar

Chris J Baker will talk on "Aspects of imaging radar" 28 January 2010 at The Australian National University. Prior to becoming Dean of Engineering and Computer Science at ANU, Chris Baker held the Thales chair of intelligent radar systems at University College London.

APPLIED SIGNAL PROCESSING SERIES

Aspects of imaging radar

Chris J Baker (The Australian National University)

DATE: 2010-01-28
TIME: 11:00:00 - 12:00:00
LOCATION: RSISE Seminar Room, ground floor, building 115, cnr. North and Daley Roads, ANU



ABSTRACT:
Improving the resolving ability of a radar systems leads to an increase in information content in the received echo. Perhaps the clearest example of this is two dimensional SAR imaging which provides a map like picture of the surface of the earth. As resolution is increased still further it becomes possible to identify smaller and smaller objects. This seminar begins by exploring the concept of resolution and then goes on to examine techniques for generating high resolution in radar systems including imaging radar. Subsequently, the topic of automatic target classification is introduced very much from a practical systems perspective, reviewing techniques and outlining the current state of the art. Throughout real world examples exploiting data derived from advanced experimental systems are used to demonstrate actual radar and classification performance.

BIO:
Chris Baker is the Dean of the College of Engineering and Computer Science at the Australian National University (ANU). Prior to this he held the Thales-Royal Academy of Engineering Chair of intelligent radar systems based at University College London. He has been actively engaged in radar system research since 1984 and is the author of over two hundred publications. His research interests include, Coherent radar techniques, radar signal processing, radar signal interpretation, Electronically scanned radar systems, natural echo locating systems and radar imaging. He is the recipient of the IEE Mountbatten premium (twice), the IEE Institute premium and is a fellow of the IEE. Until 2008 he was the chairman of the IEE Radar, Sonar and Navigation systems professional network. He is a visiting Professor at the University of Cape Town, Cranfield University, University College London and Adelaide University.

Defence ICT Strategy

The Australian Department of Defence have issued the "Defence Information and Communications Technology Strategy 2009". This is available as a 64 page (1.5 Mbyte) PDF file. This is very brief and readable for a Defence document, with the executive summary being less than one page.

Also Figure 13 is of interest "ICT Technology Bundling Strategy", which attempts to show the complex systems and networks in one diagram. This shows Deployed, Distributed Computing, Terrestrial Communications, Service desks, the Network Operations Centre, Tactical interfaces, Satellite terminals, Intelligence links, High Frequency Radio, the Internet, PABXs, Applications, mobile services, printers, DRN, DSN, DTSN, Encryptors, phones, the PSTN, Gateways and routers. About all it lacks is the National Boradband Network. Other diagrams are less useful, such as, Figure Eight "An Illustrative view of the Integrated Defence Architecture (IDA)".

Executive Summary

In the current environment, Defence’s information and communications technology (ICT) systems are being challenged more than ever. Australia’s Defence personnel expect to see capability improvements resulting from integrated and network-enabled platforms, administrators expect ICT enhancements to provide business process efficiencies and the ICT threat environment is becoming more hostile.

The ICT strategy has been developed to address shortcomings in governance, planning and control frameworks for ICT. Defence is also establishing clear lines of accountability and transparent management responsibilities at the most senior levels, as well as investing in critically under-funded capabilities to improve its ICT infrastructure.

Objectives
After wide-spread engagement and consultation across Defence five clear objectives regarding Defence’s future ICT environment were identified. These are:

• greater ICT scalability, flexibility and adaptability
• improved information speed and accuracy
• continued technological capability edge
• enhanced interoperability
• improved business support

Achieving those objectives will require strategic reforms, as outlined in the Defence Strategic Reform Program, as well as reform of ICT processes, systems and workforce arrangements. These reforms will enhance Defence’s ability to develop ICT capabilities by allowing stakeholders to prioritise their ICT funding, and will optimise the structure of Defence’s ICT workforce to deliver reliable, high-quality solutions.

To achieve these objectives this strategy is based on four strategic imperatives:

1. Optimise the value of Defence’s ICT investment through cost transparency, improved stakeholder communication, prioritisation of spend and efficiency in ICT activities.
2. Drive closer alignment with stakeholders through a stakeholder-centric organisation model, improving engagement and driving towards a collaborative approach to developing ICT capabilities.
3. Provide agreed, priority solutions through the establishment of a Defence-wide ICT Operating Model and Enterprise Architecture promoting standardisation and consolidation.
4. Strengthen ICT capabilities through improvements to culture, leadership, processes, skills, sourcing and resource planning.
   

From: Defence Information and Communications Technology Strategy 2009, 9 November 2009

In-flight entertainment system for military briefings

According to Flight International, the United Arab Emirates air force will equip three Airbus A330 Tanker Transport aircraft with an in-flight entertainment system for each seat. This is a result of using the same fit-out for the aircraft as used by the national carrier Etihad Airways. One consequence of this is that the entertainment system could be used for military briefings during the flight. The entertainment system would be able to provide briefings via the audio and video on demand system. The system has 10.4 inch touch-screens for economy seats.

Singapore airlines A380 airliners have OpenOffice.org's office software available from passenger seats, with plug in USB keybards. This would allow the passengers to watch powerpoint type presentations, as well as read Microsoft Word format word processing documents and spreadsheets. With th seats equipped with in-flight two way audio, this would provide the aircraft with limited capacity to be an in-flight command centre. The cost of this would be far lower than a custom military installation.

Cyberdeterrence and Cyberwar

Cyberdeterrence and Cyberwar (Martin C. Libicki) is a RAND report for the US Airforce which details the difficulties of dealing with attacks on military and civilian computer infrastructure. It argues that the traditional military doctrine of a threat of a cyber attack to deter an aggressor will not be effective in cyberwarfare. Also conventional military force will have limited value in responding to a cyberattack, due to the difficulty of identifying the attacker.

The book is available as a free e-book: Summary Only (File size 0.3 Mbytes) and Full Document (1.8 Mbytes, 240 Pages), as well as a printed paperback.

Contents

Preface iii
Figures ix
Tables xi
Summary xiii
Acknowledgements xxi
Abbreviations xxiii

Chapter One
Introduction 1
Purpose 5
Basic Concepts and Monograph Organization 6

Chapter Two
A Conceptual Framework 11
The Mechanisms of Cyberspace 12
External Threats 13
Internal Threats 20
Insiders 20
Supply Chain 21
In Sum 22
Defining Cyberattack 23
Defining Cyberdeterrence 27

Chapter Three
why Cyberdeterrence Is Different 39
Do We Know Who Did It? 41
vi Cyberdeterrence and Cyberwar
Can We Hold Their Assets at Risk? 52
Can We Do So Repeatedly? 56
If Retaliation Does Not Deter, Can It at Least Disarm? 59
Will Third Parties Join the Fight? 62
Does Retaliation Send the Right Message to Our Own Side? 64
Do We Have a Threshold for Response? 65
Can We Avoid Escalation? 69
What If the Attacker Has Little Worth Hitting? 70
Yet the Will to Retaliate Is More Credible for Cyberspace 71
A Good Defense Adds Further Credibility 73

Chapter Four
why the Purpose of the Original Cyberattack Matters 75
Error 76
Oops 76
No, You Started It 77
Rogue Operators 78
The Command-and-Control Problem 78
Coercion 79
Force 82
Other 86
Implications 90

Chapter FIve
A Strategy of response 91
Should the Target Reveal the Cyberattack? 92
When Should Attribution Be Announced? 93
Should Cyberretaliation Be Obvious? 94
Is Retaliation Better Late Than Never? 96
Retaliating Against State-Tolerated Freelance Hackers 98
What About Retaliating Against CNE? 102
Should Deterrence Be Extended to Friends? 104
Should a Deterrence Policy Be Explicit? 106
Can Insouciance Defeat the Attacker’s Strategy? 108
Confrontation Without Retaliation 109
The Attacker’s Perspective 112
Signaling to a Close 114

Chapter Six
Strategic Cyberwar 117
The Purpose of Cyberwar 118
The Plausibility of Cyberwar 121
The Limits of Cyberwar 122
The Conduct of Cyberwar 125
Cyberwar as a Warning Against Cyberwar 126
Preserving a Second-Strike Capability 127
Sub-Rosa Cyberwar? 128
A Government Role in Defending Against Cyberwar 129
Managing the Effects of Cyberwar 131
Terminating Cyberwar 135
Conclusions 137

Chapter Seven
Operational Cyberwar 139
Cyberwar as a Bolt from the Blue 143
Dampening the Ardor for Network-Centric Operations 149
Attacks on Civilian Targets 153
Organizing for Operational Cyberwar 154
Conclusions 158

Chapter eight
Cyberdefense 159
The Goal of Cyberdefense 160
Architecture 165
Policy 167
Strategy 169
Operations 170
Hardware 171
Deception 171
Red Teaming 173
Conclusions 173

Chapter Nine
Tricky Terrain 175
viii Cyberdeterrence and Cyberwar

Appendixes
A. what Constitutes an Act of war in Cyberspace? 179
B. The Calculus of explicit versus Implicit Deterrence 183
C. The Dim Prospects for Cyber Arms Control 199
references 203 ...

Summary

The establishment of the 24th Air Force and U.S. Cyber Command marks the ascent of cyberspace as a military domain. As such, it joins the historic domains of land, sea, air, and space. All this might lead to a belief that the historic constructs of war—force, offense, defense, deterrence—can be applied to cyberspace with little modification.

Not so. Instead, cyberspace must be understood in its own terms, and policy decisions being made for these and other new commands must reflect such understanding. Attempts to transfer policy constructs from other forms of warfare will not only fail but also hinder policy and planning.

What follows focuses on the policy dimensions of cyberwar: what it means, what it entails, and whether threats can deter it or defense can mitigate its effects. The Air Force must consider these issues as it creates new capabilities.

Cyberattacks Are Possible Only Because Systems Have Flaws

As long as nations rely on computer networks as a foundation for military and economic power and as long as such computer networks are accessible to the outside, they are at risk. Hackers can steal information, issue phony commands to information systems to cause them to malfunction, and inject phony information to lead men and machines to reach false conclusions and make bad (or no) decisions. ...

Operational Cyberwar Has an Important Niche Role, but Only That

For operational cyberwar—acting against military targets during a war—to work, its targets have to be accessible and have vulnerabilities. These vulnerabilities have to be exploited in ways the attacker finds useful. It also helps if effects can be monitored. ...

Strategic Cyberwar Is Unlikely to Be Decisive

No one knows how destructive any one strategic cyberwar attack would be. Estimates of the damage from today’s cyberattacks within the United States range from hundreds of billions of dollars to just a few billion dollars per year. ...

Cyberdeterrence May Not Work as Well as Nuclear Deterrence

The ambiguities of cyberdeterrence contrast starkly with the clarities of nuclear deterrence. In the Cold War nuclear realm, attribution of attack was not a problem; the prospect of battle damage was clear; the 1,000th bomb could be as powerful as the first; counterforce was possible; there were no third parties to worry about; private firms were not expected to defend themselves; any hostile nuclear use crossed an acknowledged threshold; no higher levels of war existed; and both sides
always had a lot to lose. Although the threat of retaliation may dissuade cyberattackers, the difficulties and risks suggest the perils of making threats to respond, at least in kind. Indeed, an explicit deterrence posture that encounters a cyberattack with obvious effect but nonobvious source creates a painful dilemma: respond and maybe get it wrong, or refrain and see other deterrence postures lose credibility. ...

Can retaliators hold assets at risk?

It is possible to understand the target’s architecture and test attack software in vivo and still not know how the target will respond under attack. Systems vary by the microsecond. Undiscovered system processes may detect and override errant operations or alert human operators. How long a system malfunctions (and thus how costly the attack is) will depend on how well its administrators understand what went wrong and can respond to the problem. Furthermore, there is no guarantee that attackers in cyberspace will have assets that can be put at risk through cyberspace. ...

will third parties stay out of the way?

Cyberattack tools are widely available. If nonstate actors jump into such confrontations, they could complicate attribution or determining whether retaliation made the original attackers back off.

Might retaliation send the wrong message?

Most of the critical U.S. infrastructure is private. An explicit deterrence policy may frame cyberattacks as acts of war, which would indemnify infrastructure owners from third-party liability, thereby reducing their incentive
to invest in cybersecurity. ...

Responses to Cyberattack Must Weigh Many Factors

In many ways, cyberwar is the manipulation of ambiguity. Not only do successful cyberattacks threaten the redibility of untouched systems (who knows that they have not been corrupted?) but the entire enterprise is beset with ambiguities. Questions arise in cyberwar that have
few counterparts in other media.

what was the attacker trying to achieve?

Because cyberwar can rarely break things much less take things, the more-obvious motives of war do not apply. If the attacker means to coerce but keep its identity hidden, will the message be clear? If the attack was meant to disarm its target but does so only temporarily, what did the attacker want to accomplish in the interim?

Military Cyberdefense Is Like but Not Equal to Civilian Cyberdefense

Because military networks mostly use the same hardware and software as civilian networks, they have mostly the same vulnerabilities. Their defense resembles nothing so much as the defense of civilian networks—
a well-practiced art. But military networks have unique features ...

Implications for the Air Force

The United States and, by extension, the U.S. Air Force, should not make strategic cyberwar a priority investment area. Strategic cyberwar, by itself, would annoy but not disarm an adversary. Any adversary that merits a strategic cyberwar campaign to be subdued also likely possesses the capability to strike back in ways that may be more than annoying. ...

From: Cyberdeterrence and Cyberwar, Martin C. Libicki, RAND, 2009

Patterns for Designing Military Computer Applications

NCOIC Patterns are a set of freely guides for designing military computer applications. These would be of use in software engineering courses to teach the use of pattern languages and in building civilian emergency and security systems. NCOIC is a non-profit Network Centric Operations Industry Consortium, promoting the interoperation of computer applications and data communications used by the military.

NCOIC provide numerous technical overviews of their work. These are provided in the form of PDF documents, Powerpoint slides and synchronised multimedia presentations. Unfortunately these suffer the problem of many defence related documents being unnecessarly large and complex.

1. Technical Overview
2. Building Blocks Database
3. Mobile Emergency Communications Interoperability Report
4. Mobile Networking Overview
5. Mobile Networking Evaluation (MNE)
6. Instant Messaging Protocol Functional Collection

Robots at war

"Wired for war : the robotics revolution" (Singer, P. W. 2009) is a very readable book about the use of robots in modern warfare. It suffer from having a very US centric view of the field and providing a few too many anecdotes. But it is an easy read for someone needing an overview.

Singer starts with anecdotes about the use of bomb disposal robots in Iraq. He describes the origins and different development philosophies of the two major companies supplying the US defence department. Having attended a seminar by Professor Rodney Brooks, an Australian from Adelaide and one of the founders of iRobot, I can see that Singer's analysis is insightful.

What is missing is the discussion of the development of robotics outside the USA and the role of the scientific research community. As an example, the Aerosonde UAV, which is now being marketed to the military, was developed in Melbourne, (Australia), for taking meteorological measurements (thus the name "Aero-sonde". The aircraft was later adapted for other remote sensing and military applications.

Aerosonde pioneered small long endurance autonomous UAVs (having flow across the North Atlantic). Previously it was assumed that UAVs small enough for a person to lift would only have a range of a few hours.

One problem with innovation is having something too different from the competition. Aerosonde faced this with their early models which were controlled from an ordinary laptop computer. This removed the need for specialised control units. But rather than being seen as an advantage, this counted as a disadvantage in the logic of military procurement. With the Aerosonde Mark 4.7, released in March, there has been effort to provide compatibility with military UAV systems, such as NATO STANAG 4586 standards for UAV ground stations (also see the STANAG-4586 LinkedIn Group).

Aerosonde also pioneered the idea of UAVs being provided as a service, rather than individual aircraft purchased by the customer. This idea is yet to take off with UAV customers, but with widespread use, it appears an idea who's time has come. This concept is not discussed in Singer's book.

Earlier in the year the Australian and US Defence Departments announced the Multi Autonomous Ground-robotic International Challenge (MAGIC 2010). This is a competition researchers to build a fleet of cooperating autonomous ground vehicle systems (robots) for military and civilian emergency use. These will be tested in Australia in November 2010.