Loki's Net

The National Security Risks of Gov 2.0 and the Social Web

by Jeff Carr | comments: 16

Every culture has its Trickster myths because Trickster lives on the edge of what the rest of us perceive as "real." He crosses boundaries so often and with such ease, not to mention panache, that our own boundaries expand because of him. Trickster is “the doorway leading out, the spirit of the road at dusk” (Lewis Hyde) that doesn't belong to any town but is in-between all towns; the province of thieves and spies.

Here's an updated version of an old Trickster tale that I think is particularly relevant to the topic of this post--the national security risks associated with a more open Government in general and social software in particular.

Loki, the Norse God of mischief and mayhem, had taken to the mountains for refuge after angering the other Gods with his latest antics. The first thing he did was build a house with four doors; one on every side so that he could see in all directions. With his Intrusion Detection System in place, Loki spent the rest of his time playing in the water as a salmon, leaping waterfalls and negotiating mountain streams.

One morning, Loki sat by a fire and considered how the gods might capture him. Since he spent much of his time as a fish, Loki grabbed some linen string and fashioned a fishing net of a size and weight sufficient to snare him. Unfortunately, just as he finished, the other Gods rushed in. Loki threw the net into the fire, transformed into a salmon, and swam away. Acting quickly, the Gods extracted the ashes of the net from the fire and, from the remnants, rebuilt Loki’s net, eventually ensnaring him in it.

Like Loki, we construct through our Twitter posts, Facebook Wall entries and LinkedIn profiles our own unique “net” that sets us up for a social engineering exploit, a financial crime, or an act of espionage.

The Trickster archetype aptly frames this discussion about the risks and benefits of bringing Government into a Web 2.0 world because the classic Trickster is neither good nor bad, but encompasses elements of both. Too often, the debate surrounding Gov 2.0 becomes polarizing. Critics are frequently grouped together as Gov 1.0 thinkers struggling against a 2.0 world, while advocates sometimes embrace Gov 2.0 as a holy quest, refusing to acknowledge any significant risks whatsoever.

I cannot emphasize enough that the surest way to slow our progress toward a more technologically open Government is to try to craft this debate in dualistic terms. Indigenous Trickster tales teach us that a more valuable approach is to substitute utility for morality. Loki and Coyote (a famous Trickster in Native American lore) both understand how to trap a fish because they have swum as fish. Hyde writes in his book Trickster Makes This World that “nothing counters cunning like more cunning. Coyote's wits are sharp precisely because he has met other wits.”

There are serious and significant risks associated with Government 2.0 and the use of Social Software from a national security perspective that need to be talked about and addressed. It is a topic that is both complex and far-ranging and deserves much more coverage than I can provide in this post, although I hope to at least start the conversation at a new and edgier level. To give some perspective to the problem, there are 22,000,000 employed by the U.S. government, not counting government contractors. That fact alone makes Gov 2.0 a very significant technological evolution.

There is ample evidence that state and non-state actors are engaged in finding ways to exploit vulnerabilities in the U.S.'s critical infrastructure as well as the Department of Defense's secure (SIPRNET) and non-secure (NIPRNET) networks. Many of these attacks have been well-documented by Inspectors General (IG) and Government Accountability Office (GAO) investigations as well as through Congressional committee testimony by experts. One of the easiest ways for an attacker to gain access to those protected networks is not through the firewall, but through the user. In any secure system, the human element is always the weakest link. As Tim Thomas wrote in his excellent "Cyber-Skepticism" article for IO Sphere, the mind has no firewall but skepticism. The attack vector that best takes advantage of that vulnerability is known as social engineering.

Do you recall how Matthew Broderick's character cracked the password for the DOD computer Joshua in the 1983 movie “War Games?" He studied details about the life of its creator. That's the same strategy that David Kernell used when he allegedly hacked into Governor Palin's Yahoo account, except he had the benefit of a Web 2.0 invention known as Wikipedia.

How did the individuals behind the GhostNet espionage ring manage to entice so many people (1300 computers in 103 countries) to open an infected document which loaded a Chinese trojan named ghostRAT onto their system? They crafted an enticing email and document that was tailor-made for their audience -- supporters and/or employees of the Office of His Holiness the Dalai Lama. It was such an effective social engineering campaign that 30% of the infected computers were in sensitive government offices. And to make matters worse, most anti-virus programs failed to identify the Trojan.

In Cyber Warfare terms, these types of hacks are a part of Computer Network Operations (CNO) known as Computer Network Exploitation (CNE). Today, over 130 countries are developing a cyber warfare capability with CNE as one component.

Social media like Twitter, Facebook, MySpace, LinkedIn, GovLoop, and many others are very attractive venues for CNE by our adversaries because they are easily accessible, target-rich environments that can be exploited with little to no risk under cover of anonymity.

According to a recent study conducted for one of the U.S. Armed Services, 60% of the service members involved in the study have posted enough information on MySpace to make themselves vulnerable to adversary targeting. And these weren’t only young recruits making bad Operations Security (OPSEC) decisions. The 60% group included officers and enlisted troops from Intelligence and Security postings as well as other sensitive positions posting such things as units they have deployed with, new duty stations, personal medical data, job duties, information about training, and pictures of themselves at deployed locations.

In their paper “Social Software and National Security," Mark Drapeau and Linton Wells discuss the use of Twitter by Colleen Graffy, formerly Deputy Assistant Secretary of State for Public Diplomacy, to “impress her personality and message on foreign media prior to arriving in their countries, and after leaving.” As the authors point out, there are positives and negatives to Graffy’s method of using Twitter. One of the negatives that they do not address is that Graffy’s Twitter usage can become a vector for a non-state hacker to exploit with a @colleen_graffy tweet containing a malicious link disguised as a tiny URL. All of a sudden, Graffy‘s public diplomacy 2.0 effort could result in a State Department computer becoming a zombie.

The Open APIs on Twitter and Facebook provide a virtually unlimited resource for building target profiles on employees of sensitive government agencies like the Departments of Defense, State, Justice, Energy, Transportation, and Homeland Security. The Twitter stream, for example, adds a timeline for tracking when you’re at work, where you’re going after work, and what you are doing right now.

Another risk category is disinformation. Twitter received a lot of coverage during the Mumbai terror attacks of November, 2008 for its role in covering the events in real time. Part of what emerged was the potential for terrorists to use Twitter to propagate disinformation about their whereabouts; i.e., to announce a new attack occurring at a wrong address, thus adding chaos and confusion to an already chaotic situation.

Finally, there is the phenomenon of online trust. If you work in a targeted industry, you will be approached, sooner or later, by someone who isn’t who she claims to be for the purpose of gaining and exploiting your trust to further her own nation’s intelligence mission. One of the quickest ways to establish trust online is by finding things you both hold in common. Both Twitter and Facebook postings excel at that discovery effort.

How do you mitigate the risks while enjoying the benefits of Gov 2.0 and the social web? You do it by thinking like your opponent; or like the Trickster. Read your post twice before you hit send; once as you and once as your adversary who is looking to exploit you. If you work for the DOD or a government contractor, start by re-reading your employer's OPSEC guidelines and edit your profile and your posts accordingly. If your office hasn’t created any OPSEC guidelines for social media yet, please let me know. My company GreyLogic is creating training for precisely that purpose. In the meantime, here are five things that you can do right now to reduce your risk profile:

1. Involve your family members. They should understand that by virtue of your employment with a department, agency, or service, their posts are prime fodder for CNE. You can start by having them read this article.

2. Make OPSEC fun by making a game of it. For example, trade Twitter or Facebook aliases among your coworkers and see how much information you can learn about each other by using publicly available search tools. Then draft two or three email topics that would entice that person to take your bait if you were an adversary running a Spear Phishing operation. I promise that you’ll be amazed at the results. In fact, you should do this same exercise with your family members.

3. Be more skeptical about anyone who contacts you as a result of your posting on a social network. See if you can find their Internet footprint by searching on their name and email address. An alias with no Internet history should immediately raise a red flag.

4. Anyone can start a DOJ, DHS, DOE or other government agency community on Ning, LiveJournal, Facebook, etc. Don’t affiliate yourself with any community that you don’t know for sure is an officially sponsored and sanctioned one. Talk about shooting fish in a barrel.

5. Facebook recently reported that 70% of its traffic comes from overseas. Become more cautious about who you friend and who is privy to reading your posts.

In myth, like in life, the Trickster relies on the instincts and appetites of his prey to spring his trap. For those of us in Government or affiliated with Government, we would do well to remember that as we engage with Gov 2.0 on the social web.