When the Enemy Has Better Tech

Maj Nick Brunetti-Lihach is a communications officer currently assigned as a Faculty Advisor to the U.S. Marine Corps Expeditionary Warfare School in Quantico, Virginia. He has deployed to Iraq and Afghanistan.

During the Vietnam War, the Viet Cong and North Vietnamese Army exploited unsecure American radio communications using commercial Sony transistor radios compatible with U.S. military radios. By taking advantage of vulnerabilities in U.S. communications, spoofing voice communications through fake transmissions, and eavesdropping in advance of operations, the enemy misled American forces, disrupted operations, and avoided greater casualties. Commercial equipment and innovative tactics were used to degrade or compromise American command and control.

Adaptation and innovation have long been a hallmark of warfare. History is replete with examples of new tactics combined with technology to counter an adversary.¹ From Alexander’s improvement of the Greek phalanx to the Higgins boats of World War II, adapting through innovation has been a harbinger of victory on the battlefield. Today’s adversaries are no different in their desire to harness any means to gain advantage. For terrorists and non-state actors, in particular, the ability to employ widely-available commercial technology and modern IT (information technology) has degraded traditional western technological advantage. Modern technology in the hands of the enemy has enabled effective command and control, information sharing, strategic messaging, and kinetic attacks. It has also degraded traditional U.S. overmatch in combined arms, ISR (intelligence, surveillance, and reconnaissance), and air superiority. As the 9/11 hijackers exploited free and ubiquitous air travel with box cutters, terrorists and others are using smartphones, software, commercial encryption, and drones to mitigate the power of U.S. weapons and intelligence systems.

… a technology revolution that exceeds in speed and scope anything we’ve seen in modern history. The last century was driven by physics and engineering—which led to air power, improved mobility, and nuclear energy ... This finds expression in phenomena such as the so-called Internet of Things, a world of unprecedented connectivity—one that holds advantages but also vulnerabilities for the United States. Here's the key point: this technology revolution has brought a truly revolutionary and unprecedented devolution of asymmetric power to individuals and small groups through things like social media and easy access to knowledge. This is power they can exert for good ends or ill.²

Thus states,  terrorists and non-state actors blend weapons with widely available technology, to include sophisticated sensors, and surveillance systems.³ Meanwhile, most U.S. military personnel rely on low-bandwidth line of sight VHF/UHF voice communications at the tactical level. While U.S. military communications assets are more secure than commercial technology (for now), American forces are largely unable to securely send and receive networked high definition video and data on the battlefield today (with the exception of a small subset of elite troops). Military radios in the field were designed over 10 years ago. These radios are larger and heavier than a cellular phone circa 1990. While military radios offer strong encryption, reliability, and battery life, they were designed for secure voice and low data rate (8-16k) communications. Today’s conflicts require a wide array of real time persistent information, to include picture, video, chat, email, and other sensor data. The inability of these radios to effectively send and receive data fails to meet many mission requirements and pales in comparison to bandwidth provided by commercial 4G LTE networks for a decade. To make matters worse, troops carry additional specialized equipment such as pocket laser range finders, ISR receivers, handheld GPS, and position location beacons. Compounding the bulk, all of these devices require their own power source and cables.

Meanwhile, adversary smartphones have become all-in-one command and control nodes, with apps to zero a rifle, range a mortar, and provide GPS, navigation, even infrared or thermal imagery. Non-state actors use VPN (Virtual Private Network) software and encrypted messaging for security. For ISR, a commercial quadcopter with a 4K video camera and range of 2,000 meters can be purchased for less than $1,000. This is striking compared to the (much older) AeroVironment Raven, widely fielded to the Army and Marine Corps at a cost of $30,000 per aircraft.⁴

The U.S. military has enjoyed technological superiority for decades and counts on technological dominance on the battlefield. Yet that dominance is in jeopardy today as U.S. forces have not realized many advances in modern technology. Worse, military networks, especially at the tactical level, are over-reliant on satellite communications for basic connectivity, largely due to the low-performance of existing line-of-sight radios and waveforms. Meanwhile, over half the people on earth own a smartphone capable of streaming high-speed video and data. According to an Ericsson report⁵, 70 percent of the people on the planet will have smartphones by 2020, and 90 percent will be covered by mobile broadband networks. Significantly, 80 percent of new smartphone subscriptions by 2020 will come from Africa, the Middle East, and Asia Pacific, all areas of U.S. national interest.

In the 20th century, most adversaries could not approach western military might in any real sense without a Russian or Chinese proxy sponsor. Now well into the 21st century, commercially available hardware and software has become an equalizer in some areas. Software is king, fueling entirely new sectors of entertainment, social media,  and mobile communications, and software is predicted to lead the next tech revolution.⁶ The modern smartphone today is orders of magnitude more powerful than the computer which took man to the moon in 1969, and it is far cheaper, smaller, and energy efficient. Cyberspace has also provided adversaries with an entirely new domain to probe or attack commercial, government and military networks.

Yet American troops are “choking on old technology” given  the slow pace of development, lack of mobile military networks, and inability to resolve concerns about operational security.⁷ In the cyber realm, Americans are further constrained by authorities to engage adversaries. Current trends are not promising. A recent Heritage Foundation report pointed out the pace at which commercial innovation has begun to outstrip traditional defense technology, and how “the fruits of this commercial innovation are available equally to U.S. competitors and adversaries without significant investment on their part.”⁸ Even more worrisome, the report notes “advanced microelectronics, IT breakthroughs, mobile devices, and commoditized connectivity are the foundations on which America’s adversaries are building their technology advantage.”

Lagging development, ability to leverage commercial technology, and bureaucracy are bad enough. Worse, perhaps, are the trend lines in education, particularly STEM (Science, Technology, Engineering and Math). Many observers have suggested the U.S. is losing its innovation edge to China.⁹ The chairman of the congressional U.S.-China Economic Security Review Commission recently reported 350,000 Chinese students in the U.S. are “systematically stealing U.S. technology.”¹⁰ By most metrics, Americans are losing ground in STEM education, other countries are gaining ground in both education, and ability to innovate.

Hence competitors and adversaries are closing the technological gap while U.S. servicemembers wait for DoD program managers to deliver mobile networking to the battlefield decades after the first Android phone hit the market. In a recent probing article, Michael Horowitz asked if the U.S. military is ready for war:

The ongoing general proliferation of precision strike capabilities, cross-domain threats from cyber, space, and beyond, rising operational competence in potential adversaries, and the anticipation of rapidly diffusing new commercial technology with military relevance is placing American conventional overmatch at risk. 

We are approaching a period where commercial markets will cause bleeding edge technologies to spread faster than the key technologies of the past generation, such as stealth or precision guidance. Here, I am talking about technologies that are part of the third offset strategy—artificial intelligence, robotics, 3D printing, cyber, directed energy, and others.¹¹

From a technological perspective,  adversaries are approaching or have attained parity on a number of fronts. TheU.S. budget and calendar-driven program objective memorandum cycle is not conducive to innovation, or keeping pace with industries which pride themselves on new gadgets annually, and new apps weekly. Even with funds available in a budget to purchase new technology, the RMF (Risk Management Framework) process to employ new technology is typically a years-long process, except for the intervention of a general officer. The result is reliance on rigid, tightly controlled hardware and software to minimize risk, as the military calculus for approving commercial-grade hardware and software places a premium on caution and security over capability. Yet cutting-edge innovative companies prize speed, modeled on planning frameworks such as Agile, which sets timelines in weeks and months, not years. As the Heritage report noted, “commercial software uses agile methodologies and lean start-up principles, while the Defense Department often attempts to acquire software using outdated waterfall methods.”¹² Hence it is not uncommon for even established technologies to require up to 15 years of development time within DoD.¹³

Acting Secretary of the Army Robert M. Speer summed up the flaws within government procurement of information technology observing that “by the time the decision’s finally made, let alone implemented, the Army is often locked into a proprietary solution that’s already obsolete.”¹⁴ To reinforce the point, a recent article in the U.S. Naval Institute magazine, Proceedings, characterized the defense acquisition process itself as the enemy:

It is routine for a [D]efense procurement, including acquisition of information technology, to take five or more years from the establishment of requirements to down-select of the provider and contract start. During those years, the underlying technology will evolve significantly. Sensor technology will have evolved at least one cycle. The information technology that undergirds nearly every system we build will evolve at the speed of Moore’s Law, one generation every 18 months. Worse, it is common for the affected military service or agency to suspend security and technology updates on existing systems during the procurement cycle, believing it is better to wait until the new contract is available.

Suspension of normal upgrades to systems during the acquisition cycle results in a ‘trough of stagnation,’ during which the affected systems become more vulnerable to failure or attack. This degradation of readiness likely makes the delta between  ‘current state’ and  ‘needed state’ more substantial than specified in the initial requirements. As a result, when the systems are delivered, because the starting point degraded while technology evolved over the course of the acquisition cycle, disappointment is certain. Either cost to close the gap causes the allocated budget to be missed, or since our enemies are not constrained by the same byzantine processes, insufficient capability is delivered to protect the warfighter.

While much attention is paid to preventing  ‘contractual risk’ by adhering to a strict set of guidelines intended to ensure fairness in the acquisition process, there is no countervailing attention paid to the risk imposed on soldiers, sailors, airmen, Marines, and national security, by the years of delays and billions of dollars spent unnecessarily.¹⁵

In the absence of available technology, and in light of the development cycle for new technology, operational necessity places front-line troops in a dilemma to weigh operational security with operational necessity. A risk-averse approach to technology means being perennially stuck in the past. Government and military C4ISR (command, control, communications, computers, intelligence, surveillance, and reconnaissance) systems are typically several generations behind available technology, and worse - lack interoperability with military communications networks.

As military technological development lags, the same is true for common sense training and education in the use of IT on unsecure commercial networks. A determined advanced persistent threat can hack most Americans today given the ubiquitous use of chat, email, text, and social media profiles. Even a secured mobile network opens up new vulnerabilities, described in a recent paper for the Center for a New American Security: Wi-Fi enabled devices on troops will provide new threat vectors for enemies to target. Troops fooled by fake or spoofed signals polluting their sensors may target friendlies, be exposed to attack, or compromise their location and other data.¹⁶

The threat from unsecure mobile devices is myriad: devices can be jammed; geo-located; are susceptible to spoofing, radiate energy and RF signals; and possess vulnerabilities inherent to its operating system or software. Pictures taken by a mobile device are geo-tagged, providing a valuable breadcrumb trail. Today’s global economy is built upon the open and free exchange of commerce and ideas. The Internet of things has far exceeded its original intended purpose. This is evident in the lack of built-in security requirements for most protocols and applications. For good reason, cyber security experts will tell you the most secure computer is disconnected from the Internet, locked in a steel box in a basement, and guarded 24/7. In today’s Internet, the only true security is disconnection.

Global connectivity has expanded soft targets exponentially. The commercially driven networking of households (e.g., Alexa) has spread threat vectors to every laundry room and garage. Couple the damage done to government and quasi-government entities in recent years (the Democratic National Committee, Office of Personnel Management, etc.) with growing interconnectivity of mobile devices and home appliances, and the implications are daunting.

Congress and think tanks fret over a dearth of naval vessels and stealth aircraft. These weapons may prove indispensable in great power war, but if enemies consider America’s critical vulnerability, an unsecure computer in every pocket is difficult to overlook. Our adversaries may decide it is more advantageous to strike electronically from a distance.

The use of unsecure devices introduces risk in basic principles of operational security, information security, and communications security. Yet, there is also risk in denying forces a capability due to potential vulnerabilities. Perhaps as debilitating, the inability to communicate with coalition and partner forces utilizing mobile technology on the battlefield places U.S. forces at a disadvantage to coordinate and exercise command and control.

Personal devices have become an enormous threat to individuals, their family, and friends. Yet we are more worried today about physical threats than the virtual environment which has questioned concepts of physical borders and evolved into capabilities with real-world effects (Estonia, Georgia, Stuxnet, etc.). The modern American economy is a knowledge economy and this principle applies to overseas operations. Information is currency, and there must be an ability to access, leverage, send, receive, and view the range of digital voice, video, and data. To make that a reality, practical, useful, and effective guidance on the use of modern technology is essential.

While already behind in employment of modern technology, policy and best practices are further behind. There must be a balance between security and flexibility to leverage available modern technology and all available local telecommunications infrastructure. Ten years removed from the first iPhone, troops from the country that led the smartphone revolution have limited access to real-time data during military operations. The few authorized mobile tablets/smartphones either can’t be networked, are not interoperable with other program of record systems, or are only capable of low bandwidth line of sight communications. Take the Army’s recently canceled WIN-T program, a $9.1 billion investment in mobile intranet for soldiers.¹⁷ The system is plagued with significant cyber vulnerabilities and inherent defects, such as poor battery performance. Just prior to the Army’s cancellation of WIN-T, the House of Representatives wrote a letter to the U.S. Army Chief of Staff concerned about scheduling WIN-T fielding through 2038 or beyond. Stating the obvious, the letter remarked, “Considering the pace of technological development, even if upgrades are made over time, the system would be obsolete.”¹⁸

Multiple open source interviews of senior uniform and military leadership have noted the inability to provide persistent and reliable on-the-move communications as a leading capability gap hindering command and control and ISR. The Army Chief of Staff is on record stating he does not believe WIN-T would have been survivable in combat.¹⁹ The most recent annual report from the Pentagon’s office of developmental test and evaluation warned the system was overly complex and presented usability problems. The “land-based line-of-sight would not meet the Army’s operational needs.”²⁰

The example of the Army’s WIN-T program illustrates how far development of mobile military networkslags behind modern technology, and heightens the need to demand better from the uniform and civil servants running these programs.  Another example illustrates just how slow military IT systems development can be. When Microsoft stopped supporting Windows XP in 2015, so many U.S. Navy and Army systems were so far behind in upgrades, the Services had to pay Windows to continue patching for specific weapons systems.²¹

The news is not all bad. There has been some progress, albeit slow. DISA (Defense Information Systems Agency) is piloting what it calls a “gray network” to secure connectivity to classified networks using the public Internet or commercial cell towers, according to Alfred Rivera, director of the Development and Business Center at DISA.²² Even more promising, the Air Force recently reduced its certification and accreditation timeline down from 18 months to 30 days by using the Agile Framework methodology.²³ Marines are also experimenting with hive UAVs.²⁴ The Corps is arguable also leading the way with 3D printing.²⁵ On the material side, every Marine infantry squad will also soon possess its own quadcopter.²⁶ Many of the recent commercial technology acquisitions by the Marine Corps are driven from the top, in a concerted effort by senior officers. However, the Marine Corps Strategy for Assured Command and Control document recognizes many existing management practices and processes are “outdated and obsolete.”²⁷ Faster acquisition of some commercial tech is a good thing, but integration into existing systems and platforms requires a faster, more agile development bureaucracy.

Despite these efforts, at the tactical level the Marine Corps has not yet realized the mobile data revolution of the past two decades, or enabled disparate ground and air systems to communicate. To address this, DoD needs secure solutions for mobile communication without compromising portability, survivability, and compatibility with existing systems. There should be a “menu” of data-in-transit and data-at-rest solutions personnel can download or access on hand-held devices. This may be a VPN solution to access secure services in the cloud, or a list of approved and vetted applications for messaging or encryption. The solution should be predicated on the ability to communicate securely around the world regardless of transmission medium. Vulnerability analysis, built upon the RMF, will only maintain relevance by vetting hardware and software in weeks and months, not years.

The perfect cannot become the enemy of the good. Several steps can be taken in the near term to enable U.S. forces to leverage mobile networks at the forward tactical edge. First, to mitigate security risks, publish approved/sanitized apps and tactics, techniques, and procedures for unclassified smartphone use by the area of responsibility if necessary. Conversely, there should be a list of prohibited apps. Re-assess the cultural need to “secure everything as if they were diamonds” to the Type-1 MIL SPEC standard, at least for threshold requirements.²⁸ Additionally, delegate more IT purchasing power and flexibility to commanders, mitigate onerous RMF and accreditation requirements, promote interoperability, and require any system now in development be interoperable with any device or software available in the General Service Administration catalog, a practice broadly known as reciprocity. This will optimize the ability for commands and commanders to flexibility employ various technologies.

Marines at the tactical level are flush with good ideas. There is more need to foster innovation at the ground level, and ensure there is a mechanism to rapidly disseminate gaps or shortfalls in capabilities into new technologies or techniques up the chain of command, than there is a need for a Rapid Capabilities Office to experiment. This is easier said than done and perhaps no more difficult in an institution such as the Marine Corps which values and prides itself on the chain of command. Yet anyone who has spent time at the tactical level has an appreciation for the real or perceived disconnect between the rank and file and higher headquarters. In the realm of innovation, the lack of capability is more acutely felt by front-line troops with a greater sense of urgency for solutions. The Innovation Challenge is a great step in the right direction, but is not a final solution. Higher up the chain of command, priorities do not always align, and often come into conflict with resources, especially time and money. This makes it all the more important to not only challenge existing culture, but to avoid the persistent desire among program managers to consolidate and protect programs.²⁹

Long term, all systems must be interoperable, survivable against electronic attack, and capable of taking advantage of a wide range of the electromagnetic spectrum. There is also a need to develop apps and network architecture with built-in security that is operating system agnostic. The Marine Corps has already stated its desire to see joint standards for applications so “they don’t need to reverse-engineer apps used by other service branches when they conduct joint operations.”³⁰ The Marine Corps should reform or cancel any existing program that is not or cannot be networked to existing or emerging information systems. Systems are in development today within DoD that either cannot be networked with existing systems. This defies the purpose behind distributed forces sharing information in real-time, but is emblematic of thestovepipe process by which program managers fail to appreciate operational requirements or do not coordinate with their intelligence, air, and fires counterparts to ensure interoperability.

The Marine Corps should take advantage of software as a force multiplier. Devices no longer have to communicate through identical frequencies and waveforms. Software such as TRAX (Tactical Radio Application Extenstion) or JECL (Joint Effects Coordination Link) can translate disparate frequencies and waveforms in real-time. Every sensor on the battlefield does not require the same frequency or protocol with the right network architecture.

The DoD cybersecurity workforce must be reformed and incentivized to re-examine the RMF process, and require faster turn-around of accreditation and certification. This may require more cultural change among the so-called “blue and grey beards” of the bureaucracy, as the mobile innovations lead for the Army recently noted.³¹ Similarly, the Division Chief at the Army’s LandWarNet Division, Michael McCarathy recently stated, “too often, network and IT modernization programs are hampered by requirements that serve commanders or acquisition officials rather than end users.” In other words, the C4 development bureaucracy should focus more on operational requirements, not higher headquarters’ staff requirements.

Holistic change is needed in the acquisition process to keep pace with technological innovation.32 One place to start is the recent recommendations by the Defense Business Board, a Federal advisory panel of corporate executives.³³ From a “culture” perspective, the military should consider the ability of commanders to understand how technology can contribute in a multi-domain environment. For junior service members, this means crafting a culture Air Force Col Jason M. Brown calls an “innovation ecosystem” to unleash innovation potential. It will require talent management to enable service members to innovate without having to navigate the bureaucracy labyrinth, spending years in the process.³⁴ It will also require attracting and retaining uniform and civilian talent capable of keeping pace with the tempo of changing C4 systems. The Marine Corps must ensure it focuses on the right people in addition to the right technology and processes. The Defense Innovation Board is currently looking at solutions to this complex problem right now.³⁵

The third offset strategy was predicated on the ability of the U.S. to leverage industry, particularly Silicon Valley, in order to innovate more quickly. Unfortunately, as a recent analysis pointed out, “it’s not at all clear that the bet will land in favor of the U.S. and its allies.”³⁶

There must be a change in the development, acquisition and fielding of modern technology on the battlefield. Otherwise, mobile networks will enable adversaries to meet U.S. and allied technical advantages, and surpass them; in which case the technology that makes our military so great today will make it terrible for our forces on the frontlines. Access to modern technology will not single handedly win a conflict. However, faster development will result in significant improvements  to process information at the tactical level, if protected against near-peer threats.  Otherwise, “the inability of U.S. defense innovation agencies to absorb and exploit this freely available commercial technology is leading the United States down the path of innovation isolationism.”³⁷

This article appeared originally at the Marine Corps Gazette. 

Notes