Operational Security in the Digital Age: Who is Being Targeted?
Abstract
Although not deliberate, a significant risk to Army’s operational security is the current use of mobile telephony by senior Army leaders. Senior Army leaders use mobile telephony to receive and provide information that is distilled, timely and accurate, offering an enemy force or a strategic competitor high value information for little effort. Conversely, significant investment has been made to secure Army’s tactical communications, where information is mostly disaggregated and short- term. Some basic actions can be taken to reduce the risk.
Bin Laden’s voice was never heard on cell phone conversations intercepted by the National Security Agency during surveillance.
- Senior United States official1
The use of mobile telephony by Osama bin Laden’s aides may have eventually compromised his location in Pakistan prior to his death, but there is strong evidence that bin Laden and his supporters were exceptionally cognisant of the vulnerabilities associated with using mobile telephony and internet communications, employing extensive operational security measures. There is now a litany of evidence describing the ease with which mobile telephony can be exploited, amid warnings from pre-eminent military forces such as the United States (US) Army that the use of mobile telephony entails significant risk.2
Australian political, bureaucratic and military leaders rely extensively on mobile telephony to manage the most important affairs of state. While this growing reliance is not isolated to senior Army leaders, the evolving nature of the Army’s command and control must be continually examined to ensure best practice and to avoid unnecessary risk to national security.
Significantly, despite many warnings concerning the vulnerabilities associated with mobile telephony, there has been little apparent curiosity about the threats posed by reliance on such technology. Indeed, there is a mismatch between the apparent necessity for the communications security offered to tactical forces by projects such as Land 200, and senior Army leaders’ use of highly vulnerable commercial communications to pass information. While a key aim of electronic surveillance is to obtain the highest value information using the least possible effort, the desire for efficient command and control through the use of mobile telephony has resulted in the presentation of a consistent target to potential threat forces and strategic competitors.
Concurrently, the relative importance and value of information is changing. Information proliferation and the commercial and military desire to manage ‘big data’ continue unabated. While the value of information has diminished as it can be obtained from many sources and can often be accessed by anyone, information gained from senior Army leaders has retained or increased in value because such information is distilled, accurate and timely, and is consistently available. When such attractive information is disseminated over mobile telephony, the priority for the assignment of scarce electronic surveillance assets of an enemy force or a strategic competitor is easily decided. Despite this, Army investment in security for command and control has focused on the lower tactical level, where information is comparatively less valuable.
This article contends that the primary risk to the Army’s operational security lies in the use of mobile telephony by senior Army leaders to enable command and control. Where bin Laden and his supporters made the decision to apply extensive operational security measures to ensure effective command and control, the Australian Army has taken the opposite approach. This article will highlight potential areas for Army focus so as to mitigate this ever-present risk.
Mobile-only
A summary by Deloitte of the most disruptive current and future technology trends reveals that the movement towards ‘mobile only’ has replaced the previous trend of ‘mobile first’. ‘Mobile first’ refers to the trend for companies, organisations or projects to favour the inclusion of a mobile telephony component in their business practices. The trend towards ‘Mobile only’ reflects a belief that mobile telephony should not just be a component, but rather the fundamental basis of communications for organisations.3
This trend has also influenced the Australian Army, an organisation reliant on mobile communications for expeditionary operations and for rapid responses to highly dynamic circumstances. Almost all the Army’s command and control systems rely on commercial or non-secure components including the new liaison officers’ briefcase system, tactical satellite, INMARSAT and the Battle Management System. However, two commercial systems are particularly pervasive: Global Navigation System for Satellites (GNSS) and mobile telephony. GNSS vulnerabilities across almost all sophisticated military capabilities have attracted some analysis in the US military context,4 and the risk is also worthy of more detailed examination in the Australian Army context (although such treatment is beyond the scope of this article).
Senior Army leaders are now completely reliant on mobile telephony such as Global System for Mobile (GSM) communications for their work and personal communications. Almost all senior Army leaders are allocated Research in Motion Blackberry devices for voice and email communication. Apart from domestic personal and work use, senior Army leaders rely on mobile telephony when conducting offshore activities such as international engagement, and also while on operational service. For example, the Roshan network in Afghanistan was heavily used by Australians during Operation Slipper, the vast majority of these information exchanges concerning operational matters or personal communication.
This is not to say that senior Army leaders are knowingly or willingly compromising sensitive information of national importance. However, the mere regular use of mobile telephony could produce just such an outcome. If using mobile telephony for any length of time, it is almost impossible to adhere to doctrinal communications discipline requirements which include avoiding unnecessary or long transmissions, engaging in unofficial conversation, identification of individual or unit names, and ensuring that transmissions are logged to allow reference to information previously transmitted.5 Indeed, volumes of doctrine and procedures have been dedicated to ensuring that tactical users do not compromise security and comply with secure practices, yet many of these time-proven security measures are discarded when mobile telephony is used. The informality of mobile telephony communications may also make inadvertent compromise far more likely.
The threat
Recent intelligence compromises, such as those by former US National Security Agency contractor Edward Snowden, demonstrate the extensive nature of national collection occurring on commercial communications systems.6 It would be naïve to assume that the US and its closest partners were alone in the collection of intelligence from commercial communications systems or in the targeting of senior political and military leaders from countries of interest.
The US Computer Emergency Readiness Team has produced many unclassified documents describing the threats to mobile device users. One of these documents highlights criminal (or enemy, as is equally applicable) threats to mobile device use. Enemy forces can listen to telephone calls, secretly read Short Message Service texts, use a handset as a remote bugging device, view the handset Global Positioning Service location, or automatically forward emails to another address.7 A 2007 International Security Assistance Force (ISAF) report highlighted the fact that ‘every GSM provider in the world has the ability to locate and track a GSM phone as soon as it is turned on’, specifically referring to the risk that senior ISAF leaders could be tracked by Roshan and locational information passed to threat forces. The report also referred to the concern that Pakistan’s intelligence service (ISI) collected and databased all Roshan calls and telephone numbers from Afghanistan.8 The common argument that Afghanistan presents an ‘uncontested electronic environment’ is naïve in the extreme.
It is fair to say that none of these potential threat capabilities would be a surprise to most mobile device users. However the common response by the large number of Army mobile device users is often surprisingly apathetic. Furthermore, while technical weaknesses that allow for intelligence collection may be addressed or mitigated by commercial companies or by security agencies, new techniques used to compromise communication devices appear rapidly and regularly, including one recent example known as ‘WireLurker’.9 Use of mobile telephony is clearly an operational security risk.
Target-rich environment
The availability and value of information has changed immensely in recent years, with specific information decreasing in value. The significant focus on ‘big data’ analysis10 is indicative of this, as organisations such as the Australian Army find information available from many different sources, but face major challenges in the analysis of this data to convert it to useful information. Furthermore, the importance of specific collection platforms or capabilities has diminished, as other platforms or capabilities can easily fill the information void. The large number of collection platforms currently proposed in the Defence Capability Plan (both those that are specifically designed to collect and those to which collection is incidental to the primary mission), compared to the low number of planned capabilities that support the analysis of data, highlights the reduced value of specific collectors.
To emphasise this point on the availability of information, the Army now has many means at its disposal to locate a land-based enemy headquarters. It may use unmanned aerial vehicles, electronic warfare, human intelligence, reconnaissance troops or satellite imagery. It could rely on air platforms such as the AP-3C, Joint Strike Fighter or Growler, or maritime platforms such as a Collins Class submarine. Strategic agencies and effects, such as cyber capabilities, could also locate the headquarters. Many internet products and applications and commercial tools could do the same. If operating in a US-led coalition, the means to locate the enemy headquarters increase exponentially. It is only on rare occasions, such as during the search for bin Laden, that such extensive information collection options take a long time to bear fruit, although ultimately they still achieve the desired effect. Importantly, the Army would not have to defeat or detect the entire spectrum of enemy communications, physical or non-physical signature or personal information to locate the enemy headquarters. Indeed, a single indicator, such as a commander’s mobile phone, may be all that is necessary. Alternatively, a small number of minor indications could be fused or analysed to accurately determine the location. Quite clearly, specific sources of information are less important because there are many others that could be used to achieve the same effect.
However, an enemy surveillance force or a strategic competitor will always seek to gain information of the highest value for the lowest possible effort or cost. Such intelligence collection will be concentrated on where information is most important, where it is distilled, and where it is timely. Collection is easier if information is being passed on a reliable network that is not easily disrupted, and collection is even more attractive if valuable information is being passed on a non-secure or poorly secured network.
This explains why senior Army leaders present such valuable targets. Within the dross of information that is now available to all military forces, targeting the mobile telephony use of senior Army leaders is of immense value to an enemy surveillance force or a strategic competitor. The use of mobile telephony for military purposes and often also for personal communication means that it is almost impossible for senior Army leaders to achieve the operational security goal of a military communication user to ‘remain anonymous’ in an effort to mitigate electronic targeting.11
Administration only
It could be argued that senior Army leaders do not use mobile telephony for sensitive purposes and that such devices are used for ‘administration only’. This is to misunderstand the nature of the communications under discussion. Even if senior leaders use mobile telephony solely for personal reasons, it is a simple matter to develop an accurate intelligence picture of the individual, of the network of friends and colleagues that he or she maintains, and of the locations he or she visits. For example, when a senior leader and a subordinate communicate via mobile telephony, the first spoken word will almost inevitably be ‘Sir’ or ‘Ma’am’, immediately indicating seniority to an electronic surveillance element. The leader’s personal traits and attitudes may be determined after only a few conversations. If the individual has a confidant, the identity of this person may be sought to allow further targeting. Finally, when the inevitable discussion of operational matters occurs, sometimes because ‘extreme’ circumstances exist where immediacy of reporting is essential, this information can be corroborated with other sources. It is notable that doctrine such as allied communications publications define extreme circumstances as when the ‘speed of delivery is so essential that time cannot be spared for encryption and the transmitted information cannot be acted upon by the enemy in time to influence current operations.’12 With the ease of modern encryption, such circumstances should be rare.
Furthermore, the use of ‘veiled speech’, code words or cover terms is permitted under allied and Australian doctrine to mitigate security risks when non-secure systems are used. The optimum use of code words occurs when they are applied only once.13 However, veiled speech is far from the security panacea that it is often considered. The context of a conversation is very important when using veiled speech and it may only take one or two instances of the same veiled speech or cover term before the term is compromised. There are many poor examples of veiled speech and cover terms in Army use. For example, when Australian soldiers make the common declaration that they are ‘deploying to the sand pit’, few interested parties would be deceived into the belief that a Timor-Leste deployment was imminent. If veiled speech or cover terms are compromised at a later date, such as through some of the Snowden cover term disclosures, all previously recorded use of the veiled speech or cover terms may be retrospectively understood and contextualised.14
The seventeenth-century French statesman Cardinal Richelieu once said, ‘If one would give me six lines written by the hand of the most honest man, I would find something in there to have him hanged.’15 While this quote may lead some to argue the value of privacy over the pervasive nature of state surveillance, equally this can be related to the targeting of the communications of senior Army leaders. Eventually, and probably sooner rather than later, sensitive and useful information from mobile telephony use will be accessed by an enemy force or a strategic competitor.
Misplaced investment
Defence projects such as Joint Project 2072 and Land 75 were established in part to provide greater security to land tactical communications. The $2.75 billion assigned to the tactical communications digital backbone and the BGC3 Battlefield Command System has provided excellent content security to tactical land force transmissions.16 Yet, such an investment, while almost impossible to question as an essential modernisation of land communications and command and control infrastructure in the Australian Defence Force, may be misplaced from a security point of view. Investment in other aspects of tactical communications security, such as the assignment of personnel and resources to ‘Communications Security Monitoring Teams’, may also be misplaced, because they are focused on an area of operational security that is of low relative value.
If a hypothetical near-peer threat force was to challenge the Australian Army, the electronic surveillance element of the threat force may seek to target tactical communications systems. As previously mentioned, this may be secondary to targeting the more valuable command use of mobile telephony. However, at certain points, targeting tactical Australian forces will be necessary for an enemy, such as to clear an Australian element from a key geographical feature. Even with the $2.75 billion investment in command and control modernisation, tactical elements still demonstrate vulnerabilities that an enemy electronic warfare element can effectively target.
Through the Land 200 investment, tactical forces now have highly sophisticated secure communications. Apart from the risk of insider threat, it is highly unlikely that a threat force could easily or rapidly understand the information contained within tactical voice and data communications if the system is used as intended. Furthermore, the value of information is diminishing, and information from a tactical element is short-term, disaggregated (most transmissions only emanate from a single force element) and takes significant time to translate and contextualise. This is not to say this information is unimportant; however there is comparatively far less value for an electronic warfare element in targeting company or battalion command and control than in focusing higher up the chain.
Apart from the content of specific transmissions, however, two other aspects of the Australian transmissions remain highly vulnerable — the location of their point of origin, and disruption of those transmissions through electronic attack.17 Protecting the unit location and ensuring an immediate message reaches its intended recipient without disruption are arguably far more important for the tactical Australian force than any compromise of the low-level and short-term information that is almost always contained in tactical transmissions.
Through an understanding of radio power output or terrain, or through processes such as triangulation, an enemy force could gain immediate information on an Australian element’s location and react with force. Denial or disruption of communication may see immediate command and control measures, such as reinforcement of an Australian force under attack, delayed or misunderstood. These clear tactical vulnerabilities are far more critical than the relatively low value of the content of the transmission which, even if the cryptography could be broken, would then require translation and contextualisation, processes that take significant time.
An Army Headquarters ‘Building on Beersheba’ discussion paper challenges the reader to debate the threats and risks associated with digitisation, and expresses concern over the effect on command and control if the digital network was contested. Furthermore, the discussion paper acknowledges that the Army’s ‘understanding of threats, risks and vulnerabilities is immature’.18 While the paper anticipates that the Army’s new digital centre of gravity will be subject to ‘vigorous attempts’ to defeat the network, it is far more likely that a threat force or strategic competitor would see little need for this. The higher level information being passed over less secure commercial systems presents a more logical target. However, if the threat force did seek to target tactical communications, it could effectively locate and disrupt such communications using basic electronic warfare equipment, and this would probably achieve the tactical effect required. The essential digitisation initiative undertaken by the Australian Defence Force has done little to enhance security to what has historically been the most vulnerable elements of tactical communications, and the regular claims and widespread belief that digitisation projects have provided greater ‘security’ to the Army’s tactical communications have arguably established a false belief in the protection of command and control.
In summary, the level of investment in communications security has been skewed towards tactical users, rather than towards the senior Army leaders who provide the most important source of intelligence to an enemy force or a strategic competitor. Furthermore, the investment in tactical command and control is weighted towards the arguably unnecessary high-level encryption of short-term, disaggregated, low-level data, rather than towards protecting the location of the transmission or the assurance that the necessary information will arrive in a timely manner without being affected by enemy electronic attack.
Know the threat
There are a number of ways to ensure that the command and control actions of senior Army leaders do not compromise national security. Most of these solutions are not expensive, but require education, advice and consistency. Leaders appear to exhibit a natural tendency to revert to the easiest means of command and control, particularly if there is no immediate feedback from a threat force or a strategic competitor when information is gained through the use of mobile telephony.
Understanding the threat is fundamental to ensuring the security of the Army’s command and control. Training on the threat posed to the Army’s command and control in Afghanistan and Iraq was conspicuously absent from the extensive lead-up training for contingents departing for operations in those countries. This is striking because these missions entailed the most significant risk to Australian life since the Vietnam War, and there was ample warning within ISAF of the threats posed to specific communications in Afghanistan. Indeed, ISAF produced at least six reports on electronic warfare threats in Afghanistan in 2007 alone.19 It is reasonable to expect that aspects of risk and threat would be considered holistically. The lack of curiosity and awareness concerning threats to command and control should be addressed prior to future major deployments, and the remedy may include guaranteed support from organisations such as the Defence Intelligence Organisation. While there are those who will consider the issues raised in this article ‘communications’ or ‘electronic warfare’ issues, accepting them as clearly command and control vulnerabilities is also important.
Osama bin Laden’s attention to communications security proved extremely successful for him over a long period of time. Other threat forces, such as the Taliban in Afghanistan, similarly developed a refined understanding of the need for operational security when using commercial communications. For example, Taliban members avoid detection by using internet phones with Voice over Internet Protocol such as Skype. They use fake Facebook profiles. They also threaten Roshan network employees in Afghanistan who may be passing Taliban mobile telephone numbers to US forces and the Afghan government.20
Similarly, al Qaeda operatives were trained to use code words in mobile telephone communications, used encryption, sent messages embedded in graphics and audio files, imposed time limits on telephone conversations, altered their voices when speaking, relocated and changed their handsets, limited contact with families, and used couriers rather than mobile devices wherever possible.21 They also regularly swapped handset users between combatants and non- combatants. Such operational security measures are not employed by the Australian Army. In the Army context, the commonly used term ‘handing over the phone’ is synonymous with a change in command for senior positions, except that handing over the same phone provides easy, ongoing, high-level intelligence for threat forces and strategic competitors. The Taliban and al Qaeda may be an unsophisticated military enemy, but they have demonstrated far more sophistication in command and control security because they are aware of the threat.
The Army must consider precisely which element of the network requires the most security for the protection of command and control. Major investments to provide the highest level of security to the information of lowest intelligence value appear misplaced and, indeed, increase the workforce the Army must allocate to functions such as cryptography management. In some ways, leaving the lowest value information unsecured can present a dilemma to an enemy force — does the enemy dedicate scarce technical resources to collecting and translating this information, or does it focus on other parts of the network? Ensuring that the ‘red force’ for major Army exercises is assigned a sophisticated electronic warfare capability, with a wide remit to target the ‘blue force’ as it would target any enemy force, would provide valuable training. Using electronic warfare elements to support the delivery of projects such as Land 200 would also add sophistication to the Army’s command and control.
Training and educating senior Army leaders concerning the threats associated with using mobile telephony remains important, and should be an ongoing task for communications and intelligence professionals. Perhaps more importantly, further education should be provided to leaders on how quickly an intelligence picture can be developed. The common perception is that intelligence is built up over lengthy periods. In reality, a very accurate representation of networks, confidants, personalities, key information and movements can be developed within several telephone calls or emails.
Finally, if the Army is prepared to invest $2.75 billion in improving tactical command and control, policy makers should consider investing a small fraction of that to improve the security of mobile telephony used by senior Army leaders. Available technology supports this, and the ‘mobile only’ trend can remain central to Army command and control. Even through the use of commercial technology, greater security can be provided to the regular communications of senior Army leaders, and indeed to all Army users of mobile telephony.
While targeting senior Army leaders’ use of mobile telephony is far from the only way that a threat force or a strategic competitor can gain intelligence on Australia and its army, it probably offers the most return for the least investment. Similarly, the Army can achieve a high return for a low investment if mobile telephony is used more judiciously and better understood.
Conclusion
With the relative importance of specific information diminishing, threat forces and strategic competitors will be looking for ways to maximise the value of intelligence and minimise the effort required to gain that intelligence. While there is little doubt that small pieces of tactical information accumulated over time can offer something of intelligence value, targeting the use of mobile telephony by senior Army leaders (and indeed by senior political, bureaucratic and military leaders) provides the high- gain low-cost trade-off that is sought by enemy forces and strategic competitors. In this sense, there is an imbalance between the extensive operational security measures required of tactical soldiers with low-level information, and the lack of operational security measures required of (and provided to) senior Army leaders who handle information that is timely, distilled and of high relative value.
This article does not contend that tactical information is unimportant, or that senior Army leaders should not use mobile telephony. Conversely, it is a quantum leap in development for the Army to have moved towards high capacity command and control means that have a commercial component. However, this transition must be achieved with a clear understanding of the risk and the threat, and not just considered a consequence-free change in preferred communications means. Not even Australia’s most technologically unsophisticated enemies of the 2000s consider it as such.
Endnotes
1 R. Windrem and A. Johnson, ‘Bin Laden aides were using cell phones, officials tell NBC’, NBC News, http://www.nbcnews.com/id/42881728/ns/world_news-death_of_bin_laden/t/b…- aides-were-using-cell-phones-officials-tell-nbc/#.U8oShhb-IQ0, dated 5 April 2011.
2 United States Computer Emergency Readiness Team, Technical Information Paper- TIP-10-105-01: Cyber Threats to Mobile Devices, 15 April 2010.
3 Deloitte, Tech Trends 2013: Elements of Post-digital, United States, 2013.
4 For example, see D. Parsons, ‘Simple, Inexpensive Jammers Threaten GPS’, National Defense Magazine, September 2013.
5 Combined Communications-Electronics Board, Allied Communications Publication 125(F), 5 September 2001, p. 4-1, paragraph 402.
6 For example, see https://www.schneier.com/blog/archives/2013/10/code_names_for.html, accessed 23 July 2014.
7 United States Computer Emergency Readiness Team, Technical Information Paper- TIP-10-105-01.
8 ‘Afghanistan war logs: Taliban sympathisers listening in to top-secret phone calls of US-led coalition’, The Guardian, 26 July 2010.
9 See http://www.abc.net.au/news/2014-11-07/iphones-threatened-by-newly-disco…-
wirelurker-malware/5873672, accessed on 7 November 2014.
10 Deloitte, Tech Trends 2013, p. 43.
11 Combined Communications-Electronics Board, Allied Communications Publication 125(F),
p. 2-6, paragraph 207f.
12 Combined Communications-Electronics Board, Allied Communications Publication 121(I), October 2010, p. 3-17, paragraph 361.
13 Combined Communications-Electronics Board, Allied Communications Publication 125(F),
p. 2-10, paragraph 215.
14 For example, see claimed disclosures on National Security Agency signals intelligence equipment at www.schneier.com/blog/archives/2013/12/more_about_the.html, accessed on 25 July 2014.
15 J.K. Hoyt, The Cyclopedia of Practical Quotations, compiled by Anna L. Ward, Funk & Wagnalls Co., London, 1896, p. 763.
16 G. Ferguson, ‘Land Forces 2014’, Land Defence Australia Limited, 17 October 2013.
17 Combined Communications-Electronics Board, Allied Communications Publication 125(F),
p. 2-1, paragraph 201.
18 Strategic Plans Branch, Army Headquarters, ‘Building on Beersheba: The Future Army – Discussion Paper three – A digital Army’, Canberra, 2014, http://www.army.gov.au/Our-future/ Publications/Research-Papers/Building-on-BEERSHEBA.
19 ‘Afghanistan war logs: Taliban sympathisers listening in to top-secret phone calls of US-led coalition’, The Guardian, 26 July 2010.
20 S. Tindall, ‘Afghanistan war logs: Nato feared Taliban could tap its mobile phones’,
The Guardian, 26 July 2010.
21 D.D. Jessee, ‘Tactical Means, Strategic Ends: Al Qaeda’s Use of Denial and Deception’,
Terrorism and Political Violence, Issue 18, 2006, pp. 378–82.
