A clear and present danger

It is vital for the RAAF to be fully engaged in this program.

The RAAF’s commitment to ‘multi-domain’ operations – to becoming a genuine 5th Generation force – will make it utterly reliant on information and networks, which in turn means the associated systems must be protected.

If a military force is to fully understand its capabilities, it must first fully understand its vulnerabilities. In this instance, Air Force needs to be aware of the entire spectrum of network vulnerabilities and how an adversary might exploit them.

Conventional methods for countering cyber attacks provide the foundation for dealing with these threats to platforms and their networks and involve a three-tiered response.

First, engineers should build protection into those systems that have an interface with the ‘open world’ (for communications or maintenance purposes, as well as electronic flight purposes). It is an understatement to describe this challenge as complex: it requires, for example, the involvement not simply of cyber security specialists, but also of electrical engineers, industrial engineers and computer scientists who understand cyber security. It also means that the ADF needs the capability to test the cyber defences of existing and emerging systems.

Second, a ‘deep defence’ level must be constructed that can both detect when an attack has pierced the first layer of protection, and then guarantee redundancy.

Finally, a dedicated, expert team is needed to monitor threats and to continually update software programs.

Military networks are usually air-gapped systems, meaning that they do not have an internet connection, mainly to protect sensitive data from being unlawfully accessed. This means that the only way to attack them is to infiltrate the networks using infected USB drives, or through espionage, or by attacking the network’s local Wi-Fi capabilities from somewhere near its vicinity. It is noteworthy that USAF engineers recently modified an EC-130H Compass Call electronic warfare aircraft to conduct cyber attacks against ground-based enemy military networks; we can be sure that other (hostile) agencies will not be far behind developing a similar capability.

Even more vulnerabilities and a significantly expanded threat footprint is being created by social networks, the emergence of the so-called ‘Internet of Things’, and the sheer amount of code – and therefore of opportunities for cyber infiltration – in 5th Gen aircraft.

Those devices will become a de facto part of the cyber battlespace.

By 2020 there will be between 50 and 100 billion devices that are networked to each other across the world, creating an ‘IoT’. It seems likely that the majority of devices in the marketplace in the near future will be internet-aware, making it difficult for government agencies, including Defence, to find non-computerised alternatives. This will leave Defence with a difficult choice to make regarding the trade-off between either accepting the risk or paying the costs associated with the cyber security of these networked devices.

If we accept that in the future a much higher percentage of devices, infrastructure and systems will have computer networking capabilities that are either a permanent part of military installations or that will regularly enter military installations (such as smart watches and self-driving cars), then those devices will become a de facto part of the cyber battlespace. And they will have the potential to reach into platform networks.

Increasingly, airborne platforms and weapons systems are dependent on networked targeting information, digital satellite communication to GPS networks, and digital command operating pictures. Any person who plugs an unauthorised device into a network or circumvents a security control on a maintenance or administrative system must understand that they are creating vulnerabilities for an adversary to exploit that can potentially reach into mission systems.

Each of the RAAF’s capabilities fits into the broader ADF system-of-systems and must be strategically and operationally integrated into this multi-domain force. Thus, the greatest challenge is to envision how the RAAF can use new and emerging technologies in innovative ways to maximise the advantages inherent in generating joint effects.

Defence needs to be able to protect its networks, and the Air Force needs to determine how it operates in a digitally contested, congested and degraded environment. Cyber defence thinking must shift away from trying to prevent every attack towards how the RAAF can accomplish its mission while being under cyber attack.

For Air Force to achieve and maintain information dominance and multi-domain integration, then cyber security must become integral to its institutional DNA.