Thursday, December 17, 2009

Encryption? Whatever.

Seems that Achmed the terrorist has been playing "hi mom!" with the unencrypted video feeds from Predator drones.

"But Borepatch," I hear you say, "Isn't encryption the first thing any security n00b adds to the system?" Why yes it is, and full marks to you. It looks like the DoD needs a higher caliber n00b for their security. Or something might go wrong:
U.S. military personnel in Iraq discovered the problem late last year when they apprehended a Shiite militant whose laptop contained files of intercepted drone video feeds. In July, the U.S. military found pirated drone video feeds on other militant laptops, leading some officials to conclude that militant groups trained and funded by Iran were regularly intercepting feeds.
[Headdesk]
A senior defense official said that James Clapper, the Pentagon's intelligence chief, assessed the Iraq intercepts at the direction of Defense Secretary Robert Gates and concluded they represented a shortcoming to the security of the drone network.
Ya think?
"There did appear to be a vulnerability," the defense official said. "There's been no harm done to troops or missions compromised as a result of it, but there's an issue that we can take care of and we're doing so."
I have to call Bravo Sierra on this. The Bad Guys are watching your recon feeds, and this doesn't impact any missions?

Sadly, this doesn't seem to be a new problem:
The U.S. government has known about the flaw since the U.S. campaign in Bosnia in the 1990s, current and former officials said. But the Pentagon assumed local adversaries wouldn't know how to exploit it, the officials said.
Because our adversaries are all morons. Good thing we don't ever fight any of those smart adversaries. Or someone might get hurt.

So how did this happen? The usual way:

Fixing the security gap would have caused delays, according to current and former military officials. It would have added to the Predator's price. Some officials worried that adding encryption would make it harder to quickly share time-sensitive data within the U.S. military, and with allies.

"There's a balance between pragmatics and sophistication," said Mike Wynne, Air Force Secretary from 2005 to 2008.

Mike Wynne you lying SOB. You failed in your mission, which was to run the shop at least arguably in a competent way. You saved $80 on a $12M drone by not including encryption. There's no way to spin this, so just STFU.

[That sound is the sound of steam coming out my ears.]

Via Slashdot, where the comments are pungent:

Turns out the drones use bluetooth. Just the other day my laptop asked me to sync to one when I was put a pringles can on the antenna.

"Windows has found a MQ-9 Reaper, would you like to connect?"

At this point I was (a.) terrified and (b.) glad that somebody with some clout was going to do something about the increased crime in the area.

2 comments:

NMM1AFan said...

Wow. Just, wow.

You know some of the engineers brought that up at the start of the program, too. But I'm sure they were overruled by the program manager or somebody.

Borepatch said...

NMM1AFan, I expect you're right.

"There's never time to do it right, but there's always time to do it over."