Good thing I did not invest much in Bitcoin...

...and by that, I mean either my money or my self-esteem.

Today, BTC China, China's largest bitcoin exchange, was shut down by the Chinese government. And this is after the government already announced on December 5 that its financial institutions were no longer allowed to deal in Bitcoin, its first attempt to regulate the currency. As of today, the People's Bank of China has informed 10 of the PRC's largest third-party payment processing companies that they were required to cease all Bitcoin transactions, or else.

Not surprisingly, Business Insider's Joe Weisenthal is delighted that he now gets to gloat in front of all the people who sent him death threats and made fun of his sexuality. He's happy to point out that since BTC China announced it would no longer be accepting deposits, the value of a Bitcoin has more than halved, from $1000 to $500.

The first time I ever posted about Bitcoin, one of the questions I asked myself was whether Bitcoin would really prove to be immune to government control and currency manipulation. I subsequently wondered what it meant that the Chinese had embraced Bitcoin, since they're the most notorious currency-manipulators in the world. Well, here are some reasons another author has suggested that Bitcoin took off in China in the first place:

• They’ve already done the whole virtual currency thing—with Q Coin.
• As a medium of exchange, Bitcoin could help Chinese people evade currency controls.
• Insane speculation schemes aren’t so crazy to many Chinese people. 
• PCs abound.
• Chinese techies are used to spending an ungodly amount of time mining virtual coins in online games.
• The government can’t track it, can’t block it, and can’t crack down on it.

All of these are, of course, very good reasons why venture capitalists in China would be happy to throw a ton of money behind Bitcoin. Then there's the possibility that by investing in Bitcoin, China is boosting Bitcoin's potential to displace the U.S. dollar as the reserve currency - a goal that the Chinese government shares with Bitcoin's founders and fanboys.

But remember that in China, the purpose of economic growth (along with almost any other government initiative, like defense modernization) is to maintain social stability and the legitimacy of the Communist Party, as we are constantly reminded by the party's own leadership. When a currency's biggest public selling point is that it's immune to government control, it should figure that the Chinese government is going to start getting nervous once reality sets in and they realize that yes, in fact, Bitcoin might in fact be something even they can't control. What's happening is that the need to make money is not always compatible with the need for control, as Quartz's Adam Pasick points out:

"Ultimately China had little choice but to crack down on bitcoin, because it made it all too easy for Chinese investors to evade already- porous currency controls and anonymously move their funds out of the country. More generally, Beijing had an aversion to a volatile, decentralized and possibly destabilizing digital currency that it could not control...By shunning bitcoin, China...may be passing up the chance to leapfrog the rest of the world by fostering the growth of bitcoin-esque digital currencies and the secure, efficient payments that they may enable. But when a country is simultaneously trying to grow, reform, and maintain tight control of its economy, something’s gotta give."

But...this is where things get a whole lot more interesting. As I was sitting down to write this blog post, I saw some new articles pop up in my Twitter feed. It seems that Bitcoin hackers have retaliated by launching DDOS attacks against the People's Bank of China web site. So just in case we (and the CCP) forgot, take note: Bitcoin isn't just an Internet currency; it's also an Internet movement with a cyber-army of hacktivists that don't take kindly to Chinese au-thor-i-tah. Now, let's see what the Bitcoin army is capable of doing; presumably, Joe Weisenthal is relieved that they've got someone to hate more than himself.

20 years of DOOM!

I'm still trying to overcome my continued posting drought and motivate myself to write again. My job/internship search is really difficult right now, so I spend more time checking Indeed.com and the Brad Traverse Group than writing (and that's when I'm not watching funny videos to ease the anxiety of being on the job market). But let me indulge in my nerd side and reminisce about Doom, which celebrated its 20th birthday this month - on December 10, to be exact. I might have forgotten about this momentous occasion had I not read an interesting little Ars Technia article in which the editors reflected on how Doom changed video gaming forever. Most people who were playing games on their personal computers in the 1990s became addicted to first-person shooters (FPS) after playing Doom, and that includes myself.

Actually, I didn't start getting into Doom until the release of the sequel in 1994, which I first played at a friend's house. Previously, I had once watched one of my Dad's graduate students playing Wolfenstein 3D, but had never been allowed to play, because this student wasn't sure I should be playing something so violent*. So one of my earliest and fondest gaming memories was when I took control of the keyboard and mouse in Doom II and scored my first chainsaw kill against a zombie. It only got more exciting once I got my hands on the game's shotgun and started capping Imps. At the time, I had seen nothing like it, and the semi-3D graphics engine seemed amazing to me back then (The Division be damned!) Unfortunately, back then, nobody I knew had even a 28.8 bps modem, so I never got to experience the online play, which is undoubtedly the single greatest contribution that Doom made to gaming (its significance was not that it was the first FPS, or even the Id Software team's first FPS.) I did try Doom online, about a decade later, but by that point, I had been playing Counter-Strike for so long that there was no way I'd ever enjoy it.

There's another, military/political science-y reason I'm reflecting on Doom: I wonder how many young men from my generation would have ever even considered serving their country had they not spent years playing FPS descendants of Doom? I know I can attribute my own interest in the military to the years I spent playing the aforementioned Counter-Strike, as well as DoD's own FPS recruitment tool, America's Army, during my teen years. There are already political scientists who have studied the effects of war toys and war movies on the militarization of the United States: See, for instance, the ironically-named Patrick Regan's groundbreaking 1994 study on this topic for the Journal of Peace Research. Personally, I'm still waiting for them to update Waltz' Man, the State, and War to think about where the popularity of FPS games falls into IR theory (I would imagine that it affects both the second-image and third-image factors in Waltz' theory). This article in the European Journal of American Studies is the closest thing I've seen to an attempt, but the journal seems a bit too Euro-lefty to be credible. I also found this article by two professors at Fordham University to be interesting, but not theoretical enough for my purposes. And that's all that Google Scholar has found for me; I guess I'll have to check out DTIC next to see what's been published.

Hopefully, Doom's next major anniversary (25th, 30th?) will provide occasion to re-visit this topic and see new scholarship on FPS games, cultural militarism, and IR theory, because I imagine there is a lot of good work to be done on this topic. When even the PLA starts getting into the gaming biz, I think it's time to regard FPS popularity as a cultural factor that can't be ignored.





*Interesting tidbit: The student in question, who was then getting his Ph.D in my Dad's research group at Duke, was none other than Carl Schnurr, who eventually became a gaming pioneer himself as the lead designer for Rainbow Six, the first "tactical shooter" FPS.

Getting back into action

I know, I know...I've been gone for way too long. I had intended to write a blog post for Veteran's Day, but I backed off, mostly because I wasn't satisfied with how it was turning out or what I had to say on the topic (here comes my perfectionist side again). Then I got really busy with my hopefully soon-to-be-published paper for work, and then I was off on Thanksgiving break. I told myself I'd catch up on reading and writing over the break, but I lied to myself. There was a lot I wanted to cover during my hiatus. But for now, I am going to briefly touch on the debate over force readiness.

Army Chief of Staff General Ray Odierno has been lamenting for quite some time that the Army is at "the lowest readiness levels I’ve seen within our Army since I’ve been serving for the last 37 years", as he did again earlier this month. This warning comes on top of the Army's move towards Progressive/Tiered Readiness earlier this year, which was itself controversial.

Some of my immediate thoughts on this topic:

1. Readiness is based upon fulfillment of troop strength, budgetary allocation, and training (among other things). As the article cited above mentions, Larry Korb over at the Center for American Progress has blamed the mechanism of sequestration for the Army's financial difficulties: "The Pentagon’s problems are not caused by the amount of money that is available under sequestration but by the process that requires them to cut all items in the budget, other than military personnel, by an equal amount."
2. Defense News had a really interesting article pointing out that this is not the first time we've heard the force readiness siren from top brass; indeed, I recall that in 2006, the Democrats even tried to use the detrimental effect on readiness to argue against the wars in Iraq and Afghanistan.
3. Gauging force readiness is not the same now that the Brigade Combat Team replaced the division as the primary deployable unit in the Army; this makes me wonder whether we should  re-visit the criticisms of Lt. Col. Stephen Melton from 2005 during the force transformation process. Among other things, Melton complained about the larger staffing/C2 requirements for BCTs; one can imagine how much readiness will suffer in an austere fiscal climate if there are more people to train/mentor, more technology to master, and fewer resources by which to do it all. And since, as Larry Korb points out, the budget cuts do not affect actual military personnel, it should follow that BCTs have created more soldiers who get more entitlements - which leaves less money for equipment and training and anything else that a BCT needs that might affect its readiness for combat.
4. Bottom line: Yes, the Army might very well have far lower readiness on paper, and it might even be the "lowest in 37 years". But from where I'm standing, the real issue here is that the Army is suffering from an unanticipated side effect of the modular force transformation, rather than budgetary constraints per se.

A different kind of Bitcoin war

Two days ago, Business Insider's Joe Weisenthal published an article in which he argued that Bitcoin is actually a bubble that will eventually burst. See that article here. Salient points:

• Yes, a Bitcoin is now gaining value rapidly (the last report as of this writing is that it's now worth over $300). Folks as respected as the Washington Post's Timothy Lee are now asking whether Bitcoin critics who called it a bubble need to admit that they were wrong.
• Weisenthal's insistence: This doesn't matter in the long run. "Bitcoin is not the currency of the future. It has no intrinsic value."
• Unlike the dollar, "If people lose faith in it, it's over. Bitcoin is fiat currency in the most literal sense of the word." And worse: It's a "speculative vehicle."

The response from the Internet? Scorn. Weisenthal has written another piece demonstrating some of the most amusing reactions to his original article:

 

Whoa, chill pill, buddy.

OK, so this one is actually pretty funny and inspired.

It's never a good sign when advocates of a person or thing start investing their self-esteem into it, which means that they become hostile whenever somebody questions it. When something attracts those types of people, it says a lot about the thing itself: It means that the thing isn't just a person or a product, it's a way of life.

It's official: The administration is considering splitting up the NSA and CyberCom

At this point, I've already devoted two entries to the question of whether the NSA and Cyber Command should be split up once Gen. Keith Alexander retires next year (see my posts here and here). Now, however, it look as though the debate is heating up on the Hill:

"No formal decision has been made yet, but the Pentagon has already drawn up a list of possible civilian candidates for the next NSA director, the former official told The Hill. A separate military officer would head up Cyber Command, a team of military hackers that trains for offensive cyberattacks and protects U.S. computer systems.

The administration might also decide to have two military officers lead the two agencies. 

The fact that the administration is considering whether to split the commands isn’t a direct response to the revelations about the NSA’s surveillance operations, but it does reflect growing concern over the power of the NSA director and a shortage of oversight of the position."

I'm pretty skeptical about the last part: As I argued in my last post, it is preferable to allow Cyber Com to flourish without being tainted by the same controversy that surrounds the NSA and Gen. Alexander himself. But, one cannot expect the administration to admit that they share this perspective. And anyway, keeping Cyber Com free of controversy isn't the best (let alone the sole) argument for separating it from the NSA: I think Jason Healey has the right perspecitve:

"[Cyberspace] is too important to grant one person have a near-monopoly on threat intelligence while simultaneously conducting active espionage, directing military force, and advising on policy...Yes, General Alexander is a cyber expert and an intelligence hero whose work has saved hundreds of American lives. But this does not make him irreplaceable. The U.S. military has had generals in charge of combined offensive and defensive joint cyber commands since 1998; fifteen years should be enough time to develop a sufficient bench."

All things considered, there are still some larger issues at stake here, and the biggest is whether cyberspace is truly a military domain at all. Making it a separate combat command means that we are acknowledging that cyberspace is already a domain of warfare, and there are plenty of people prepared to argue against that assumption. Indeed, cyber espionage and IP theft are arguably the most exigent concern for policymakers right now, and those are not military concerns.

Questioning the "big scary number" approach to Somali piracy

After all the cyber talk that permeates this blog, it's time for me to turn my attention to something else. Arbitrarily, I choose...Somali piracy.

Actually, not so arbitrarily: The World Bank and the United Nation Office of Drugs and Crime have just put out a brand-new and eye-opening report on the financial costs of Somali piracy to the world economy. Much like recent reports on the cost of Intellectual Property theft in cyber space, this report provides policymakers with some enormous dollar values to quote in Congressional/Parliamentary testimony: According to UN data, pirates operating off the coast of Somalia and the Horn of Africa received $400 million USD in ransom payments between 2005 and 2012, and the total costs of piracy to the global economy (in terms of trade costs and countermeasure spending) so far have reached $18 billion USD. Those are the kinds of "big scary numbers" that are meant to spur action, and naturally imply that anything and everything we're doing to stem the "piracy tide" right now is inadequate. In other words, garden-variety alarmism.

This fellow here earned $10 million USD by capturing this beached ship, armed only with his trusty (and rusty) AK. Oh, and tourism on this beach decreased 60% by the following month.

The problem with studies like this - and numbers like the ones quoted above - is that one must always have a good idea of how the costs were calculated, and be ready to ask hard questions about where those numbers really originated. Whenever someone attempts to put a solid dollar value on the economic costs of some type of transnational criminal activity that's blowing up news headlines and Twitter feeds, it's not uncommon to find that there's a serious attribution problem going around. For instance, the Obama administration has been fond of claiming that cyber-crime costs the global economy $1 trillion USD, with intellectual property theft taking $250 billion USD out of the U.S. economy. As it turns out, those numbers came from misinterpreting a 2009 McAfee report whose authors have denied that they ever intended to make such an unsubstantiated claim. (And now an obscure cybersecurity consulting firm, which I discussed in another post, is playing the "big scary number" game in a desperate publicity stunt by claiming that cyber theft costs us $5 trillion per year.)

Then there are the methodology issues. Ostensibly, this is where my previously used cyber espionage cost analogy falls apart: It is, after all, much easier to count ships hijacked by pirates and tally up the cost of each ransom paid, whereas the costs of cyber IP theft is far, far more difficult to quantify for a whole litany of complicated reasons. But actually, calculating economic costs of piracy poses it owns challenges: Witness, for example, last year's report by Oceans Beyond Piracy, which has been harshly rebuked by analysts at SomaliaReport. As SomaliaReport points out, OBP already revised their scary number for the costs of Somali piracy twice: First they estimated the cost at $7 to $12 billion USD, and then revised that figure down to $6.6-$6.9 billion. And this was deduced by lumping together government costs for security (a bill footed by taxpayers), elective insurance costs (passed on to consumers), and opportunity costs (i.e. declining tourism in neighboring countries like Kenya). SomaliaReport points out that this approach has serious flaws:

• The counter-piracy industry, which includes the hiring of private security contractors and installation of safety counter-measures on ships, is now an industry that brings in $52 million per month. Talk about economic stimulus; that's money going into local economies that OBP is ignoring!
• OBP's estimates of the insurance costs are just that...woefully inaccurate estimates, which is a huge problem given that insurance brokers do not tend to give out this kind of information.
• The tourism costs claim is just flat-out wrong; SomaliaReport points out that in the case of Kenya, which was OBP's most specific example, tourism increased by 32% in 2011 alone.
• There's also a lack of contextualization in OBP's report: They ignore, for example, the fact that $10-$15 billion was stolen from U.S. ports in 2003 alone, and 10,000 shipping containers get lost at sea every year due to stormy weather - losses that far outstrip Somali piracy.

"Captain, we've got a huge problem!""You mean the fact that we're listing to starboard and about to dump $20 million worth of cargo in the drink?" "No, sir, worse than that: there's a Somali pirate ship approaching from port!"

Given the controversy surrounding the Oceans Beyond Piracy report, I am inclined to approach this new study by the World Bank and UN with an equally skeptical eye, especially when I see their big scary numbers. Reading the methodology section of the report makes me suspicious about their findings because, as they admit, data is scarce, and their sources don't appear credible: Among others, they interviewed (1.) former Somali pirates, (2.) local law enforcement and military, (3.) piracy victims, (4.) local officials, and (5.) local banks. These are not sources I would expect to be either reliable or honest. They also use event data on piracy that also comes from the UNODC Counter-Piracy Programme, but I wouldn't trust them, either; they have motive to exaggerate the problem, given that the program reportedly has a budget of only $55 million.

Better analysts than myself will have to consider the new report on its merits, but as a rule, I think it's time that we admitted that big scary number studies of complex security issues are, by their nature, untrustworthy. Alas, we live in a policy-making world where sources are often not vetted for credibility, so I am expecting to hear some Senator or high-ranking military officer mention the $18 billion number in a future Congressional testimony within the next couple months. If I ever have a career as a management consultant or think tank analyst who puts out studies for government and public consumption, one of the cardinal rules of my work will be: "Thou shalt not make any preposterous claims backed by dubious big scary statistics."

Another thought for today...

I'm rarely inspired to "pursue greatness" (or whatever) by the self-help/inspirational articles I see circulated by people on my LinkedIn network, but there are occasionally diamonds in the rough. In today's feed, "Why Being a Perfectionist Can Harm Your Productivity" was one of those few articles that spoke to me. The title says it all: Perfectionism becomes a disorder when it becomes an impediment to completing a task. In my case, I have found that perfectionism often gives me a natural anxiety about even getting started. It's the reason that my professional journal contains countless ideas for paper topics that I have yet to pursue, and why I have often been unable to finish any project that doesn't have a deadline attached (i.e. papers for classes). I cannot count the number of times that I've done an examination of scholarship on a given topic in foreign policy, and I find myself obsessing over whether I am including enough (or all) of the most important preceding journal articles on the subject, lest I come across as ignorant of the debate. The single scariest thought to me in writing a paper is that I might not sound like an expert on something because I haven't read everything ever written about it, and I am not sure why I feel this way.

So, in my own (endless) pursuit of perfection, I suppose that I would do well to mull over this quote from David Burns quoted at the end of the aforementioned piece:

"There are two doors to enlightenment. One is marked, 'Perfection' and the other is marked, 'Average.' The ‘Perfection’ door is ornate, fancy, and seductive… So you try to go through the 'Perfection' door and always discover a brick wall on the other side… On the other side of the 'Average' door, in contrast, there’s a magic garden. But it may have never occurred to you to open the door to take a look."

And because I haven't quoted Shakespeare in a while...

"All lovers swear more performance than they are able, and yet reserve an ability that they never perform; vowing more than the perfection of ten, and discharging less than the tenth part of one."

Consider this blog my attempt at making peace with my inability to be perfect: It's better for me to be writing something rather than absolutely nothing.

Letting slip the dogs of cyber-war?

Once again, I have missed out on cyber-related news that is of interest and possible importance: Mojtaba Ahmadi, the commander of the Cyber War Headquarters, was found shot dead outside of Tehran on October 3. Revolutionary Guard Corps investigators are warning regime supporters and hacktivists not to jump to conclusions about who was responsible, and the Israelis themselves (the inevitable target of ire) are also denying involvement. It's not exactly impossible to believe that such killings are below the Israelis, given Mossad's alleged involvement in the deaths and kidnappings of Iranian nuclear scientists. But as former Shin Bet intelligence chief Yaakov Peri has pointed out, these kinds of killings are also common in Iran due to internal disputes amongst rival politicians and military commanders.

This news has me reflecting upon two different speaking engagements that I attended this year:

• Earlier this year, the release of the Tallinn Manual on International Law Applicable to Cyber War made major waves when some journalists and scholars pointed out that the manual justified the killing of hackers in wartime. However, when I was at Georgetown's International Engagement in Cyberspace conference back in April, Professor Wolff Heintschel von Heinegg, one of the Tallinn Manual's authors (see an after-action report on that discussion here) pointed out that they did not seek to legitimize killing hackers under just any state of conflict. Rather, the Tallinn Manual requires evidence that the hacker participated in an attack causing death and destruction on a massive scale - as per Article 51 of the UN Charter. Whatever one thinks about Iran's cyber forces, there isn't any evidence yet that Ahmadi is a legitimate target under the criteria laid out by the Tallinn Manual for kinetic action.
• That being said, there is sentiment on K Street right now that Iran is not a "rational actor" in cyberspace. In July, I attended an Atlantic Council panel discussion on the threat that Iran poses in cyberspace. While I was there, I listened to folks such as the Council's Jason Healy and Crowdstrike's Dimitri Alperovitch make the argument that while the Iranians currently have low capability in cyberspace compared to the U.S. (though Alperovitch disputed the claim that they are merely a "third tier" cyber-power), they have high intent to cause major damage and (it was implied) death through catastrophic cyber attacks. And like Israel's PM Benjamin Netanyahu, none of the folks at this event seemed terribly optimistic that the election of Hassan Rouhani as the new Iranian President would significantly de-escalate tensions in cyberspace (Barbara Slavin said that the group's attitude was "cautious optimism" at best). As if one looks to the Pentagon, DoD's sentiments are pretty clear and have been expressed in the least subtle terms possible.

Long story short: There is definitely a lot of sentiment in DC right now that Iran is one of the most threatening actors in cyberspace that we face, but if Ahmadi's death really were one of the shots fired in the cyberwar, it would be a pretty scary precedent to set. That's why I am skeptical that he really was killed by Mossad - unless the U.S. and Israeli intelligence found evidence that Ahmadi had intent and capability to do something so horrible and drastic that they were able to make some sort of convoluted legal justification for killing him.

On a lighter note...

It's Halloween, and the office mood right now is not conducive to productivity. So, instead of working, here are some stories that have made me laugh recently:

• President Obama's Twitter feed (as well as his Facebook page) got hacked by the Syrian Electronic Army on Monday, and I should have posted about this back then. To be clear: It wasn't really the account that got hacked, just a URL shortener, contrary to SEA's own claims. Since at this point, it's become obvious that SEA are a comedy act rather than a serious group of dedicated hacktivists intent on exposing the Western media's lies intended to cover up the Assad regime's inevitable victory in the Syrian Civil War, I shall rate this act accordingly: 4 out of 10. Sorry, dudes, but this prank lacks the inspiration and good comedic timing behind your campaign against The Onion. Step your game up, and better luck next time.
• To engage in some self-criticism: I need to step up my game, too. I only just found out about the Domestic Surveillance Directorate web site, which apparently went online back in June, during the Snowden affair. Oh, well, glad I've seen it now.
• The Duffel Blog is reporting that an NSA analyst struggling to make ends meet was forced to try and sell secrets to the Russians, but he learned the hard way that Edward Snowden has effectively put him - and everyone like him - out of business. Tragic.
• On a Halloween-related note, here are some of my favorite costumes that I have seen on Imgur today (and yes, they're mostly references to 90s pop culture):

 

Launch of the Zumwalt!

Cue the theme music from Jason and the Argonauts: The USS Zumwalt (DDG-1000) has set sail! Its commission and launch were delayed earlier this month by the government shutdown, but alas, it's finally on the water. Read up on the launch, and then check out HowStuffWorks.com for more on the ship's design and capabilities.

Every time a new weapons system goes operational, my inner 13-year old boy comes out and starts drooling over pictures of the system, especially computer images rendered in Maya (what can I say - when I did 3D modelling and animation as a hobby, it was because I wanted to work on mil sims). Enjoy:

The Zumwalt and its sister ship take out the Liaoning at port. Some day, right?

Short list of cool features: radar-deflecting and absording "tumblehome" hull, latest-generation Long-Range Attack Projectiles and Sea Sparrow missiles, ability to strike from 100 miles offshore, the quiet all-electric drive system, and a power system that may eventually allow installation of magnetic rail guns. But the really neat thing about the Zumwalt is that its bridge is run entirely on Red Hat Linux-based operating systems and commercial off-the-shelf software. (Read this awesome Ars Technica article for more on the software powering this beast's networking systems as well as its guns; the author calls the ship a "floating data center".)

Only a couple problems: The ship is technically only 87% complete (it's not going to start patrolling until next year), and the doubling of the cost (from $3.8 billion to $7.9 billion) means that only three Zumwalt-class destroyers will ever be built. I'm also going to be reading up on potential software vulnerabilities stemming from COTS reliance in the Zumwalt; God knows that they must be out there (DoD's move to COTS has already been ripped a new one by everyone from RAND to Richard Clarke).

And now: The rebuttal from Gen. Alexander!

Recent calls for an NSA-CyberCom divorce, championed by Foreign Affairs and former NSA Chief Michael Hayden, have irked NSA Chief General Keith Alexander himself. The National Interest just put out a brand-new op-ed which Gen. Alexander co-authored with Emily Goldman and Michael Warner. Being that Gen. Alexander is constrained in what he can say and therefore must be subtle, the entire piece reads at first like a policy statement mixed with a history of DoD's role in cyberspace and a few noteworthy historical analogies (he briefly touches on the oft-debated subject of whether cyber weapons represent a revolution in military affairs - RMA).

However, by the time one gets to Page 3 of the article, Gen. Alexander's true intentions in writing this op-ed become crystal clear:

"At the heart of our national-scale capability for defending the nation in cyberspace is the set of relationships for intelligence, analysis, and information security and assurance. The NSA makes that team work....Through these decisions, the department leveraged the similarities and overlaps between the capabilities needed for the conduct of the NSA's core missions-signals intelligence and information assurance-and those of USCYBERCOM: to provide for the defense and secure operation of Defense Department networks and, upon order by appropriate authority, to operate in cyberspace in defense of the nation... The evolution of USCYBERCOM has reinforced the imperative for a close and unique connection with the NSA...USCYBERCOM's defense of U.S. military networks depends on knowing what is happening in cyberspace, which in turn depends on intelligence produced by the NSA and other members of the intelligence community on adversary intentions and capabilities.

USCYBERCOM's planning and operations also rely on the NSA's cybercapabilities. No one entity in the United States manages or coordinates all this activity on a strategic scale. It requires cooperation across government agencies and with industry."

So, I guess it's official...we may be seeing the first shots fired in a debate about the future of CyberCom in which Gen. Alexander will represent one side and Gen. Hayden will represent the other side. The question now is how dedicated Gen. Alexander is to this debate and whether it will define the final six months of his tenure as NSA Chief.

More on ending Gen. Alexander's dual-authority

Following up the Washington Post article I discussed in my last post: It seems that Foreign Affiars is now following suite in advocating a separation of the NSA and Cyber Command after General Keith Alexander retires. Check out the aptly-titled "Divide and Conquer: Why Dual Authority at the NSA and Cyber Command Hurts U.S Cybersecurity" by James G. Stavridis and Dave Weinstein.

Their key argument is this: Bureaucratic squabbling naturally exists between any two agencies, even when they have the same mission, and higher-ups are supposed to be impartial arbiters in disputes over who gets priority in operational planning and execution. They argue that this is NOT what happens when someone like Gen. Alexander is running both organizations:

"Given his often conflicting obligations to cyberspace operations under Title 10 of the U.S. Code and signals intelligence under Title 50, he is compelled to arbitrate in favor of one or the other, rather than advocate on behalf of either side. This is an unprecedented phenomenon that has created a dizzying conundrum for his staffs in both organizations, who find themselves having to read between the lines to ascertain which hat their boss is wearing at any given time...The practical result has been that the NSA has ended up dominating Cyber Command in domain-related arbitrations. This should come as no surprise: The NSA is a significantly older, more established institution -- it was founded more than 60 years ago, whereas Cyber Command is still shy of its fourth birthday -- and consequently has a stronger gravitational pull in Washington. In the absence of a high-level advocate offering a full-throated argument on behalf of Cyber Command’s interests, the military organization is likely to find itself on the short end of appropriations, personnel, intellectual capital, and technical capacity."

Stavridis and Weinstein will never make this argument, but I'd also say that the function that CyberCom serves right now is far too important to neglect, but subordinating CyberCom to the NSA can only be to CyberCom's detriment following the Snowden-inflicted controversy that now affects the NSA. Regardless of how one views Snowden's revelations, the short- (and possibly long-term) damage to the NSA's reputation is undeniable, and I'd rather CyberCom be free to act unsullied by the same reputation. The Snowden affair has made Alexander a bogeyman in the hacking community (witness the heckling he received at Black Hat this year), while anything associated with him has negative connotations. And this comes at a time when CyberCom needs cyber operators more than ever. It would be nice to keep CyberCom a little more distanced from the controversy surrounding the NSA.

Another point to consider: Gen. Alexander is an Army general, even though the Army is way behind the Air Force when it comes to cyber operations doctrine and education. The Air Force already leads the other services in terms of cyber operations and security spending, and it also has a head start on forming the equivalent of "Top Gun" training schools for cyber operators. And this summer, when I studied up on cyber Joint Professional Military Education across the services for a research project, I found that Air University and the Air War College had far more courses and far better syllabi than their equivalent institutions in the other services. So right now, I'd say that if anyone's going to get CyberCom off the ground as a new branch of the intelligence community, it should be an Air Force officer. Not that anyone would listen to me, of course, but I'd suggest Major General Suzanne M. Vautrino of the 24th Air Force or Col. Jonathan Sutherland of 50th Network Operations Group as the first CO for the newly independent CyberCom.

(To be clear, I do not think the USAF should lead all of the military in all things cyberspace; that idea was already proposed, considered and rejected under SecDef Gates, and for good reason. But I do think that if CyberCom does become its own entity and I were given the chance to pick its leader, I'd be looking in the direction of the USAF.)

So much cyber-related news!

Maybe it's just because I follow too many cybersecurity analysts and cyber threat intelligence firms, but seriously: This week has been pure social media cyber-madness. Blogging once a day will never do it justice, but let me try with tonight's update:

• First up, Google finally put out the Digital Attack Map, and it's really neat, though Slate's Will Oremus is skeptical that Google's motives are entirely altruistic. At work, the reaction was a bit different: There was a lot of talk along the lines of, "Google can put this out, but the federal government can't make a function healthcare exchange web site after shelling out hundreds of millions of dollars?"
• Alert Logic just put a new report which found that energy firms are at an all-time high risk of brute force attacks and malware/botnet threats. Big finding: 67% of energy companies experienced brute force attacks, compared to 34% of the entire customer set. And, furthermore, 61% of energy companies experience malware/botnet infiltration attacks, compared to 13% of the entire customer set. So in case anyone doubted that securing our energy infrastructure is now one of the top national security priorities of the decade, this news, combined with ICS-CERT's disclosure that brute force attacks for the first half of FY2013 surpassed the total for 2012, should be the final word that galvanizes action. But...it probably won't be, for reasons that I have discussed elsewhere.
• At work, we are currently delving into research on the economic costs of Intellectual Property Theft through cyber espionage, which makes the timing of this new article rather convenient. One of the things that sucks about figuring out losses from IP theft - which can be quantified as either total monetary losses or job losses - is that there is almost no reliable way to measure it, as a really good CSIS/McAfee study on the topic points out. This article, however, discusses new claims by Black Ops Partners Corporation, a consulting firm that specializes in advising large companies on IP protection. In contrast to the estimates by the Office of the National Counterintelligence Executive that we lose between $2 billion and $400 billion to cyber espionage, Black Ops claims that "$500 billion is covertly stolen from U.S. companies every year", while"[the] economic effect...equates to over $5 trillion in trade secrets, IP, technology, revenue, and jobs removed from the U.S. economy every year." Is Black Ops exaggerated? Maybe, though as the article points out: "BlackOps is in a unique position, however, since working with numerous major companies directly on counterintelligence gives them insider knowledge on corporate losses." I will need to read more about their methods, but it should certainly not be news that cyber theft has serious economic costs.
• The National Institute of Standards & Technology framework, which President Obama called for in an Executive Order this past February, has finally been released. Although the hyperlinked article includes a quote from someone at McAfee praising the framework as being "beyond rhetoric", I'm still skeptical. Developing a "framework for people working together" is not the same thing as spurring them to action, and the private sector has been notoriously reluctant to work with the federal government.
• The Washington Post had an article which pondered whether the NSA and Cyber Command should be split up after Gen. Keith Alexander steps down next year. They quote Alexander's predecessor, Gen. Michael Hayden, who claims that they're now "indistinguishable."
• And, in totally non-cyber related news, I have concluded that Blackmill is five hundred kinds of awesome. Case in point: Blackmill's dubstep remix of Ellie Goulding's "Your Song".

Becoming a freelancer + Frank Hoffman's review of "Breach of Trust"

I just finished reading this article by J.T. O'Donnell that appeared on one of my LinkedIn groups. I like the way that she describes the modern freelancer:

"Lisa is tired of working 'for' employers. Now, she isn't ready to start her own company, but she does want to find a way to feel in control of her career. So, she decides to build a more flexible career gameplan. Lisa identifies she wants to solve a particular type of problem within her industry and focuses on becoming a subject-matter expert in her field. She researches potential employers where she can gain some valuable experience to help her become more knowledgeable. The pay is lower than what she could be making, but Lisa doesn't plan to be at this company forever. Perhaps it will work out and she'll be able to grow at this firm over several years, but she's not holding her breath. Instead, she sets a 2-year goal for herself. In that time, she learns as much as she can at the job, but also invests in some online courses to help her supplement her learning. And, she volunteers to do a project pro bono for a colleague over at a start-up as a way to get additional experience....

Sometimes, Lisa ends up staying for an additional 2 years at the firm she is at because the opportunity to grow is there, but other times she knows she needs to move on. By now, she has a huge network of colleagues she's amassed through her efforts. From former co-workers to networking acquaintances, Lisa is able to tap into the power of her connections and reputation to easily learn of new opportunities as they arise. In fact, she gets calls frequently from people looking to hire her based on recommendations they received from folks in her network. Lisa is professionally emancipated. She is never underemployed. And best of all, she is satisfied with the results...

Yes, Lisa's career gameplan takes a bit more effort, but the dividends are worth it, aren't they?"


It's a viewpoint that is, I suppose, of novel value to the chronically underemployed. That being said, I hate it when people giving career advice use hypothetical stories like this instead of their own experiences, whether it's themselves or someone in their network. (It's implied that Ms. O'Donnell is talking about her own career, but it's hard to tell for sure.)

Another update for today: I just read Frank Hoffman's (NDU's) review of Andrew Bacevich's Breach of Trust: How Americans Failed Their Soldiers and Their Country, which can be found at War on the Rocks. I've been meaning to take a look at Breach of Trust for a while, and Hoffman's review has piqued my curiosity even more. Bacevich is a longtime Iraq War opponent (and, some might argue, axe-grinder, since he lost a son in the conflict), and Breach of Trust continues Bacevich's penchant for writing books with provocative titles like The New American Militarism: How Americans Are Seduced by War and Washington Rules: America's Path to Permanent War.

Bacevich has also advocated a return to conscription and doing away with the All Volunteer Force (see for example this 2010 article he wrote for The Nation), and he does so again in Breach of Trust. It is this prescription for "curing American militarism" that Hoffman finds most reprehensible, especially since it's a solution that is discussed in only two pages of the entire book! Hoffman tries to envision what such a modern-day conscript force might look like, and it's not a pretty picture at all:

"A conscripted force would presumably be less adequately prepared for major combat, since the force would be largely concentrated on individual training of each year’s influx of trainees.  Such a force certainly would not be more efficient, as a larger number of trainers and a larger infrastructure would need to be established to manage a larger training pool of trainees conscripted for two-year enlistments, compared to today’s longer term force.  No doubt the force could be trained in individual skills, but it would lack proficiency in higher order, collective tasks.  Such a force would be hardly competent in the environment posed by the complex character of contemporary conflict."

Overall, Hoffman criticizes Bacevich for promoting the idea of an American military that "would consign both allies and our own forces to a more unstable world and increased risks" and trying to "to provoke rather than promote a serious debate." Although I am generally sympathetic to Bacevich's views on the need to keep the American military adventurism in check, the idea of a conscript force is one that I find too absurd. I also hate it when someone as intellectually and rhetorically gifted as Bacevich delves into polemics.

Also, Bacevich appeared on The Colbert Report last month to promote Breach of Trust. See video here.

The Army is angry about budget "uncertainty" + Quantum Dawn 2

From Defense News. Choice quotes:

"Army Chief of Staff Gen. Ray Odierno...complained that his two-year tour as head of the service has 'been nothing but budget uncertainty. No budgets, continuing resolutions, no planning, wasteful programs because we can’t predict what budgets we’re going to have as we move forward.'"

"McHugh also pointedly took issue with how the Army’s decreasing budgets have been reported in the press, complaining that some reporters portray future Army budgets as merely being a reversal to peacetime 2002 or 2003-era budgets...'This isn’t 2002. Or 2003,' he said during a late morning press conference. 'The costs we pay for things have gone up significantly. … Obviously the needs of our soldiers and our families are much more extensive' now than they were a decade ago, before tens of thousands of soldiers were wounded in Iraq and Afghanistan."

As someone who hopes to join the Army (I am planning to go before the officer board next month), and who works on an Army base (which meant I was furloughed for a week this month), I understand their frustrations: It affects me personally, and almost all of my close friends in DC.

In other news, Quantum Dawn 2, the financial industry's most high-profile cyber attack exercise, has wrapped. The consulting firm Deloitte, which coordinated the exercise with the Securities Industry and Financial Markets Association (SIFMA), has just released the after-action report. I haven't looked at it yet, but the Business Insider article linked earlier has this choice quote:

"One key lesson from the drill was that the private sector and government authorities must share information more freely and quickly, said Ed Powers, the national managing principal of Deloitte & Touche's security and privacy practice. While firms have detailed information about individual attacks, authorities can help prevent a crisis by sharing information about broader threats when appropriate, he said."

Sharing information about threats is, of course, what the National Institute of Standards' and Technology's cyber security framework is supposed to promote. I'm getting a little bit worn out by all of these warnings that don't seem to be heeded, because right now, it looks as though Wall Street, like most sectors of the economy, is paying good money to consultants to prove again and again what is intuitive at this point. On a side note: I wonder how many Deloitte consultants worked on this contract and felt a sense of ennui: "Why are we putting all these hours into this damn report if nobody is ever going to listen to us?" Then again, maybe this is why every Deloitte consultant I know can drink me under the table, and all on their company tab.

Keep the military out of cybersecutiy?

The Brookings Institution's Ian Wallace (who, along with Thomas Rid, is one of the foremost opponents of the term "cyber war") has just put out another piece of interest: "Cyber security: Why military forces should take a back seat." His rationale, which repeats his earlier arguments, boils down to this:

• "Cyber threats often come from overseas, which makes it difficult for law enforcement to deter or punish them, yet they rarely rise to the level that would warrant a military response."
• Using the term "cyber war", however, implies that in fact that military have a responsibility to get involved in our nation's network defense.
• Most acts of "cyber warfare" are better described as "commercial espionage", "sabotage", "subversion" or just "cyber crime". 
• CYBERCOM per se is not bad, but using it as a tool for dealing with the aforementioned cyber-societal ill carries the following risks:
• We don't want to encourage the civilian world to think that this is the military's role, when most cybersecurity experts agree that good cyber hygiene at the level of both individuals and corporations is the first big step to reducing network vulnerabilities. (Indeed, the Department of Defense's own cyber-awareness training, flawed though it might be, takes this stance.)
• There are simply too many information systems underlying our country's infrastructure and commerce; the military can't protect them all, and doing so would like require major civil liberties infringements.
• Military doctrines are inherently offensive, which is why we don't want DoD determining our cyber policy and doctrine (note that he's quoting Barry Posen to make this argument).

My thoughts:

• I think Wallace and Rid both need to retire the argument that there is no such thing as "cyber war" (even though I've heard Michael Daniel echo this rhetoric at countless cyber-related discussions on K Street, which suggests that the administration agrees with them). Referring to "trade wars", after all, does not conjure up images of Special Operations Forces and drones being used to attack foreign trade ministers in retaliation for trade barriers. And President Johnson's "War on Poverty" isn't associated with the National Guard going into the ghettos to hand out relief checks and food stamps.
• Wallace's chief concern is not semantic ("cyberwar" vs. "cyber theft"), but rather the (wholly legitimate and oft-debated) question of who should protect American interests in cyberspace. So maybe a better question to ask is how DoD became so strongly associated with cyber defense in the first place. I suspect it's pretty simple:
• The military-industrial complex gave us the Internet and programming languages, not to mention some of the first modern digital computers. It's rather difficult to shake the assumption that they'll take the lead on cybersecurity when they've always taken a leading role in the existence of computing itself.
• Whatever obvious flaws exist in their approach, the Department of Defense seems to be taking cybersecurity far more seriously than anyone else right now; they're set to spend $23 billion on it in the next five years. For comparison purposes, the energy sector is trying to reassure us that it's taking cyber seriously - despite much evidence to the contrary - because it's planning to spend $7.25 billion by 2020. And the Department of Homeland Security's ICS-CERT is still so woefully underfunded that they're regarded as a joke by almost everyone.
• To me, a more convincing argument against handing control of cyber doctrine to the military is the fact that right now, the military is struggling to educate its leadership to think about cyberspace as both a security and war-fighting domain. This was the subject of a recent Pew Center report that was discussed and debated at the National Defense University (full disclosure: my fellow at NDU was one of the panelists, and I did most of the research he presented to counter the Pew Center's argument). However, even this study still admits that "[military higher education's] efforts are commendable, especially in comparison to the much slower or nonexistent integration of cybersecurity components in non-technical graduate programs across American civilian universities".

So long as the military doesn't have a crippling image problem regarding its activities and efforts in cyberspace*, it seems pretty natural to expect most Americans to look to the Pentagon as the most willing and capable actor in cyberspace. I don't like the idea of cyberspace becoming "militarized" any more than Ian Wallace and Thomas Rid, but if we don't want to assume the cyber-soldier and lay aside the cyber-citizen (to butcher a quote by a certain someone), then perhaps it's best to consider how DoD came to dominate the discussion about cyber security strategy in the first place.



* Obviously, this claim depends on how the Snowden affair affects one's perspective. But even Snowden is still complaining about the "indifference" of Americans to the NSA's efforts to "control" the Internet.

Quick insights (now that I have started blogging)

Some additional thoughts about this blog and yesterday's piece:

• Aside from discussing war, peace, grad school, careers, and dating, I need to write about stuff like health and arts and entertainment (which was what I did when I wrote for my undergrad newspaper).
• In my post about Bitcoin yesterday, I failed to ask a question that seems relevant: If Bitcoin is really a currency that will free us from the tyranny of currency-manipulating governments, why have the Chinese - AKA the world's most notorious currency manipulators - embraced it? I would like to look into this for a future post.
• After not writing anything since my grad school master's thesis (nearly two years ago), and not having a regular online outlet for my writing, I'm already starting to feel a lot more energy and enthusiasm for my work, now that I have this blog. So maybe I won't ever be able to quit my day job and make a living writing, like some people whom I have met and admire greatly, but right now, it just feels good to remind myself how fulfilling it used to be whenever I sat down, organized my thoughts, and had product to call my own. I read so much stuff on Twitter, but when I don't write about it, I don't feel as though I am benefiting myself or anyone else.

"Flopping fish" - China's underperforming carrier-based fighter

I'm severely late on this story, but I feel an urge to write about it regardless: Last month, the Sina Military Network, otherwise known as the covert media arm of the Chinese People's Liberation Army (PLA), did a story on the the People's Liberation Army Navy (PLAN)'s new J-15 Flying Shark, which recently completed carrier trials on the Liaoning. The tone of the media coverage has astonished outside observers: The aircraft was openly and harshly criticized for inadequate performance, and even described as a "flopping fish."

For those not in the know, the J-15 is a naval carrier fighter that is meant to be a clone of the Sukhoi Su-33, except that it's actually based on the T-10K, the prototype version, which the Russians left in the hands of the Ukrainians after the Soviet Union fell apart. Of course, the Russians hate it when the Chinese reverse-engineer and manufacture their weapons without permission, but so far, that doesn't appear to outweigh their need to keep selling to their largest defense customer: Witness the recently-signed - albeit oft-delayed - deal to purchase Su-35s. Then again, maybe the reason the Russians don't care so much is that they long ago suspected what the Chinese just admitted - that the J-15 isn't going to live up to the absolutely absurd levels of hype that we saw in the Chinese media last year. Lest we forget, we are talking about a clone of a fighter that the Russians themselves decided to abandon in favor of the smaller and more carrier-friendly MiG-29K.

Among the criticisms of the J-15 aired in the Chinese media:

• Inability to carry adequate weapons payload and achieve carrier takeoff: “[A weapons] load exceeding 12 tons will not get it off the carrier’s ski jump ramp.” This means that weapons such as the PL-12 medium-range air-to-air missiles aren't likely to be deployable - let alone deliverable - on carrier missions. And thus, the J-15's air superiority/intercept capabilities will be limited (meaning that the Liaoning itself may be more vulnerable to air attack).
• At best, the J-15 will have an anti-ship capability consisting of YJ-83K missiles, plus shorter-range PL-8 air-to-air missiles for self-defense.
• Roger Cliff at the Center for Strategic and Budgetary Assessments is quoted pointing out an aberration: The PL-12 is a lighter missile than the YJ-83K, so the J-15 should be able to take off with the former but not the latter. This implies that, in fact, the J-15 cannot take off with either type of missile - meaning that it's even less capable than PLAN is willing to admit.
• Due to fuel requirements, the attack range will also be limited to 120 kilometers.
• To get an idea of how paltry the J-15's capabilities really are: The smaller U.S. F/A-18E, itself an expensive disappointment in many respects, is at least capable of carrying AIM-120 AMRAAMs and AGM-84 Harpoon missiles on carrier deployments with a ferry range of 1,800 knots.

The post from Defense News linked above contains a number of quotes from Vasily Kashin from the Center for Analysis of Strategies and Technologies, whom I met when he was at NDU last month. He isn't quite as critical of the J-15 as the PLAN themselves appear to be. He points out that (1.) the bigger issue than the J-15's weaknesses is the fact that the Liaoning itself is not a very good platform for carrier fighter operations (it doesn't even have catapults yet), and (2.) it's possible that the J-15 has airframe improvements that were not available at the time of the Su-33. But even he admits that fundamentally, the J-15 is, like the Su-33, a carrier version of the Su-27, a fighter that is inherently ill-suited to operating from carriers.

What we are seeing is that the Chinese government is unbelievably pissed off that China's military-industrial complex has once again failed to uphold national pride, which is - let's face it - its most important purpose (actually fighting and winning a war against would-be adversaries is secondary).

Nice chart showing how Syria has become a proxy conflict

 See here.

Bitcoin Wars: For I can raise no money by vile means

This year, there's been an awful lot of media coverage on cyber criminals and their favorite tools of the trade fo' gettin' paid: Tor and Bitcoin. Some recent examples:

• The big Deep Web story of the month: Ross William Ulbricht, the founder of Silk Road, was arrested on October 3 on drug trafficking charges. Considering that Ulbricht had reportedly accumulated a fortune of 600,000 Bitcoins, or $85 million USD for his services, it looks like we just witnessed a major precedent in the history of crime and punishment: the downfall of the first cyber drug kingpin. (At $85 million, Ulbricht would displace Frank Lucas for the #20 spot on Celebrity Net Worth's 20 Richest Drug Dealers list.)
• Not that Silk Road's demise is going to leave an unfilled void, of course: The Daily Beast just put out a story about the "Hitman Network". Hitmen paid in bitcoins: Yes, it is a reality. So is the ability to purchase firearms, including .50-caliber Barrett long-range rifles, without a background check.
• Edward Snowden also revealed this month that cracking Tor is one of the NSA's biggest priorities right now. So much irony here on all sides, starting with the fact that (1.) Tor was a U.S. Navy project that has been funded by the State Department for the sake of assisting dissidents in authoritarian countries everywhere, and (2.) Snowden himself may have inadvertently shined the spotlight on Tor. And in related news: WikiLeaks raised the money to pay for Snowden's defense in Bitcoins.
• Simon Johnson at M.I.T. recently proclaimed that backlash from the government and financial institutions will likely scare off investors, especially since Ulbricht's arrest.
• In response to the above, Slate just put out a piece noting that the value of a Bitcoin dropped from $145 to $110 after the Silk Road was taken down, but then returned to $140 as of this weekend.

As of right now, I'm on the fence about the economic viability of Bitcoin: There has been talk about Bitcoin's "inevitable demise" for some time - usually, this perspective comes from Keynesians like John Quiggin, who earlier this year claimed that Bitcoin was a "pure bubble" and used it to rail against the efficient markets hypothesis that he has denounced for years (ironically, he shares his pessimistic outlook with libertarian nutjobs like Alex Jones, though not for the same reasons). I think it's going to be interesting to see whether Bitcoin lives up to one of the promises of its proponents: Its supposed immunity to government control and currency manipulation. Because Bitcoin is backed by algorithms rather than precious metals, and the number in circulation is currently fixed at 21 million, inflation is supposedly fixed and immutable. But the problem is, this assumption still rests on the goodwill of the surprisingly small number of individuals who appear to control circulation (and as Richard Sylla points out, they could be modern-day incarnations of King Henry VIII, for all we know).

The more pressing issue, though, is the national security/law enforcement dimension: If the U.S. government is really trying to crack Tor, as Snowden has revealed, it's a safe bet that they're just as concerned about cracking Bitcoin (see an interesting discussion of this possibility here). And the FBI already has tried to seize Ulbricht's Bitcoin fortune, which more than irked the hacktivists of the world. Obviously, these events have highlighted - in a big way- that the Bitcoin trade just became a major concern to federal authorities this year. While economists and ideologues continue to debate whether Bitcoin has a future, the U.S. government has come to regard it as a resource that is dangerous when left too unregulated.

Either way, 2013 has been the year that Bitcoin truly became part of our lexicon - expect to hear lawmakers once again puzzle over how to handle it and drop the ball, exactly as they've done on almost all things cyber since forever. But at least Bitcoin's advocates are, for the most part, pragmatic folk who understand that being raging anti-establishment libertarians on the Internet doesn't pay off as much as playing the lobbying game on the Hill and K Street.

New piece for GlobalSecurity.org

Today, I published a piece for Global Security with my fellow at NDU. Check it out here.

In other news, CIO just published a list of the worst data breaches of 2013. The results are pretty alarming:

• Virginia Tech - HR server breached; 114,963 individuals' data compromised
• St. Mary’s Bank - malware infects systems; 115,775 customers' data compromised
• IRS - up to 100,000 names, addresses and Social Security numbers "mistakenly" posted on a government website
• Republic Services - laptop stolen with 82,160 employees' personal information
• University of Delaware - 74,000 individuals' data stolen by attackers exploiting a website vulnerabilit
• Northrop Grumman - unknown number of employees' data stolen; the company’s retiree health plan reported 4,305 enrollees were impacted in a paper-records data breach involving CVS Caremark
• Department of Energy - 14,000 current and former employees' data compromised
• Missouri Credit Union - exposed personal information online; all 39,000 members potentially have had data compromised
• Michigan Department of Community Health - 49,000 individuals' data compromised
• Ferris State University in Michigan - 39,000 individuals' data compromised
• Cogent Healthcare - security lapse by vendor M2ComSy lead to data access on internet; 32,000 patients' data compromised
• D.R. Horton - dumped a "large amount" of documents related to "loans, copies of checks, purchase order sand site plans" into 'large dumpsters on school campuses"

I'm seeing banks, government agencies, academic institutions, defense contractors, insurance companies. Scary.

My first blog post!

Hello everyone. I'm Matt, and I recently decided to start blogging about war, peace, graduate school, and going to graduate school to study war and peace.

I started this blog because I recently realized I have a problem - I am embarking on a career path that is undoubtedly going to involve regularly thinking and writing about issues of national security and international relations. But...I haven't been doing much writing outside of work. For me, thinking about something is useless unless it serves a higher purpose - like writing about that something. Being intellectually curious is a wonderful thing and all, but lacking fruits of my own intellectual labor is starting to feel like being devoid of a purpose.

So, I created this blog. Its foremost purpose is my own personal development, by forcing me to write about stuff that I find interesting. If it gains any attention beyond that, so be it (and I am well-aware that someday, somebody, somewhere, in the Federal government might stumble upon it while I'm applying for a security clearance). Right now, though, I just want to start a blog that allows me to get down my thoughts about my interests, personal and professional goals, and anything else that seems relevant.

First thing's first, who am I?

• I graduated from Duke University in 2012 with a Master's in Political Science/International Relations. And yes, I am also a Blue Devil basketball fan/Cameron Crazy; I have been ever since my Dad (who is a retired Duke professor) took me to Cameron stadium as a kid to watch Duke play.
• I currently live in Arlington, Virginia, close to our nation's capital.
• Since moving to DC, I have been an intern at the National Defense University in Washington, DC, a gig I hoped would only last until I joined the U.S. Air Force (which didn't go as planned). I'm still at NDU now, and still trying to figure out my career as I write.
• I suppose it goes without saying, but...I like war, and almost anything related to war. Debate amongst yourselves what that says about me. When I was in high school, the only way I motivated myself to read Shakespeare was by fantasizing about how I'd adapt plays like Julius Caesar into modern action epics starring Vin Diesel and featuring dudes blasting away at each other with modern U.S. military-issue automatic weapons. Then, tragically, Ralph Fiennes took my idea and applied it to Coriolanus.
• This blog's title comes from the lyrics of Emerson Lake & Palmer's 1971 progressive rock opus "Tarkus", which is my favorite song of all time. I'd tattoo the last verse of the song on my back, if only I weren't too old to act that rebellious...

Next question...what do I want to write about?

• Obviously...war. When I wake up every morning, my first instinct is to check my Twitter feed to see what is going on in the world. Whether it's in Syria or Somalia, there's always somebody shooting at somebody else that requires my attention.
• Even though I was never enough of an intellectual to embrace the academic lifestyle of writing 100-page papers about parsimonious theories explaining how the world works, I still remain interested in how scholars of International Relations think about the world. So, I wish to write about the debates that are taking place amongst them.
• Right now, I am taking classes at Georgetown University in programming. It's proving to be a challenge, so it gets me thinking: How does one learn how to learn? Oh, yeah, and I'm also interested in cybersecurity and cyberwarfare, too (I do research on this topic at NDU).
• As someone who is still trying to figure out my niche, I'm always interested in reading what others say about finding one's passions and making it into a lifetime career. Searching for jobs, adapting to a new boss's management style, acquiring new skills so that one doesn't become irrelevant...those kinds of topics.
• Just in case all the talk about guns and bombs gets a little wearying, I might also blog on occasion about another topic that is completely unrelated, but still of interest to me - dating in the era of Tinder and OKCupid. As with everything else, I'm not interested in approaching this topic from the perspective of, "Yo, bro, follow my program and you'll get laid in 7 days, guaranteed!" I'm just interested in what other people say about this topic.

That's all for now. Hopefully, this blog will provide a useful basis for my education. O this learning, what a thing it is!