On a lighter note...

It's Halloween, and the office mood right now is not conducive to productivity. So, instead of working, here are some stories that have made me laugh recently:

• President Obama's Twitter feed (as well as his Facebook page) got hacked by the Syrian Electronic Army on Monday, and I should have posted about this back then. To be clear: It wasn't really the account that got hacked, just a URL shortener, contrary to SEA's own claims. Since at this point, it's become obvious that SEA are a comedy act rather than a serious group of dedicated hacktivists intent on exposing the Western media's lies intended to cover up the Assad regime's inevitable victory in the Syrian Civil War, I shall rate this act accordingly: 4 out of 10. Sorry, dudes, but this prank lacks the inspiration and good comedic timing behind your campaign against The Onion. Step your game up, and better luck next time.
• To engage in some self-criticism: I need to step up my game, too. I only just found out about the Domestic Surveillance Directorate web site, which apparently went online back in June, during the Snowden affair. Oh, well, glad I've seen it now.
• The Duffel Blog is reporting that an NSA analyst struggling to make ends meet was forced to try and sell secrets to the Russians, but he learned the hard way that Edward Snowden has effectively put him - and everyone like him - out of business. Tragic.
• On a Halloween-related note, here are some of my favorite costumes that I have seen on Imgur today (and yes, they're mostly references to 90s pop culture):

 

Launch of the Zumwalt!

Cue the theme music from Jason and the Argonauts: The USS Zumwalt (DDG-1000) has set sail! Its commission and launch were delayed earlier this month by the government shutdown, but alas, it's finally on the water. Read up on the launch, and then check out HowStuffWorks.com for more on the ship's design and capabilities.

Every time a new weapons system goes operational, my inner 13-year old boy comes out and starts drooling over pictures of the system, especially computer images rendered in Maya (what can I say - when I did 3D modelling and animation as a hobby, it was because I wanted to work on mil sims). Enjoy:

The Zumwalt and its sister ship take out the Liaoning at port. Some day, right?

Short list of cool features: radar-deflecting and absording "tumblehome" hull, latest-generation Long-Range Attack Projectiles and Sea Sparrow missiles, ability to strike from 100 miles offshore, the quiet all-electric drive system, and a power system that may eventually allow installation of magnetic rail guns. But the really neat thing about the Zumwalt is that its bridge is run entirely on Red Hat Linux-based operating systems and commercial off-the-shelf software. (Read this awesome Ars Technica article for more on the software powering this beast's networking systems as well as its guns; the author calls the ship a "floating data center".)

Only a couple problems: The ship is technically only 87% complete (it's not going to start patrolling until next year), and the doubling of the cost (from $3.8 billion to $7.9 billion) means that only three Zumwalt-class destroyers will ever be built. I'm also going to be reading up on potential software vulnerabilities stemming from COTS reliance in the Zumwalt; God knows that they must be out there (DoD's move to COTS has already been ripped a new one by everyone from RAND to Richard Clarke).

And now: The rebuttal from Gen. Alexander!

Recent calls for an NSA-CyberCom divorce, championed by Foreign Affairs and former NSA Chief Michael Hayden, have irked NSA Chief General Keith Alexander himself. The National Interest just put out a brand-new op-ed which Gen. Alexander co-authored with Emily Goldman and Michael Warner. Being that Gen. Alexander is constrained in what he can say and therefore must be subtle, the entire piece reads at first like a policy statement mixed with a history of DoD's role in cyberspace and a few noteworthy historical analogies (he briefly touches on the oft-debated subject of whether cyber weapons represent a revolution in military affairs - RMA).

However, by the time one gets to Page 3 of the article, Gen. Alexander's true intentions in writing this op-ed become crystal clear:

"At the heart of our national-scale capability for defending the nation in cyberspace is the set of relationships for intelligence, analysis, and information security and assurance. The NSA makes that team work....Through these decisions, the department leveraged the similarities and overlaps between the capabilities needed for the conduct of the NSA's core missions-signals intelligence and information assurance-and those of USCYBERCOM: to provide for the defense and secure operation of Defense Department networks and, upon order by appropriate authority, to operate in cyberspace in defense of the nation... The evolution of USCYBERCOM has reinforced the imperative for a close and unique connection with the NSA...USCYBERCOM's defense of U.S. military networks depends on knowing what is happening in cyberspace, which in turn depends on intelligence produced by the NSA and other members of the intelligence community on adversary intentions and capabilities.

USCYBERCOM's planning and operations also rely on the NSA's cybercapabilities. No one entity in the United States manages or coordinates all this activity on a strategic scale. It requires cooperation across government agencies and with industry."

So, I guess it's official...we may be seeing the first shots fired in a debate about the future of CyberCom in which Gen. Alexander will represent one side and Gen. Hayden will represent the other side. The question now is how dedicated Gen. Alexander is to this debate and whether it will define the final six months of his tenure as NSA Chief.

More on ending Gen. Alexander's dual-authority

Following up the Washington Post article I discussed in my last post: It seems that Foreign Affiars is now following suite in advocating a separation of the NSA and Cyber Command after General Keith Alexander retires. Check out the aptly-titled "Divide and Conquer: Why Dual Authority at the NSA and Cyber Command Hurts U.S Cybersecurity" by James G. Stavridis and Dave Weinstein.

Their key argument is this: Bureaucratic squabbling naturally exists between any two agencies, even when they have the same mission, and higher-ups are supposed to be impartial arbiters in disputes over who gets priority in operational planning and execution. They argue that this is NOT what happens when someone like Gen. Alexander is running both organizations:

"Given his often conflicting obligations to cyberspace operations under Title 10 of the U.S. Code and signals intelligence under Title 50, he is compelled to arbitrate in favor of one or the other, rather than advocate on behalf of either side. This is an unprecedented phenomenon that has created a dizzying conundrum for his staffs in both organizations, who find themselves having to read between the lines to ascertain which hat their boss is wearing at any given time...The practical result has been that the NSA has ended up dominating Cyber Command in domain-related arbitrations. This should come as no surprise: The NSA is a significantly older, more established institution -- it was founded more than 60 years ago, whereas Cyber Command is still shy of its fourth birthday -- and consequently has a stronger gravitational pull in Washington. In the absence of a high-level advocate offering a full-throated argument on behalf of Cyber Command’s interests, the military organization is likely to find itself on the short end of appropriations, personnel, intellectual capital, and technical capacity."

Stavridis and Weinstein will never make this argument, but I'd also say that the function that CyberCom serves right now is far too important to neglect, but subordinating CyberCom to the NSA can only be to CyberCom's detriment following the Snowden-inflicted controversy that now affects the NSA. Regardless of how one views Snowden's revelations, the short- (and possibly long-term) damage to the NSA's reputation is undeniable, and I'd rather CyberCom be free to act unsullied by the same reputation. The Snowden affair has made Alexander a bogeyman in the hacking community (witness the heckling he received at Black Hat this year), while anything associated with him has negative connotations. And this comes at a time when CyberCom needs cyber operators more than ever. It would be nice to keep CyberCom a little more distanced from the controversy surrounding the NSA.

Another point to consider: Gen. Alexander is an Army general, even though the Army is way behind the Air Force when it comes to cyber operations doctrine and education. The Air Force already leads the other services in terms of cyber operations and security spending, and it also has a head start on forming the equivalent of "Top Gun" training schools for cyber operators. And this summer, when I studied up on cyber Joint Professional Military Education across the services for a research project, I found that Air University and the Air War College had far more courses and far better syllabi than their equivalent institutions in the other services. So right now, I'd say that if anyone's going to get CyberCom off the ground as a new branch of the intelligence community, it should be an Air Force officer. Not that anyone would listen to me, of course, but I'd suggest Major General Suzanne M. Vautrino of the 24th Air Force or Col. Jonathan Sutherland of 50th Network Operations Group as the first CO for the newly independent CyberCom.

(To be clear, I do not think the USAF should lead all of the military in all things cyberspace; that idea was already proposed, considered and rejected under SecDef Gates, and for good reason. But I do think that if CyberCom does become its own entity and I were given the chance to pick its leader, I'd be looking in the direction of the USAF.)

So much cyber-related news!

Maybe it's just because I follow too many cybersecurity analysts and cyber threat intelligence firms, but seriously: This week has been pure social media cyber-madness. Blogging once a day will never do it justice, but let me try with tonight's update:

• First up, Google finally put out the Digital Attack Map, and it's really neat, though Slate's Will Oremus is skeptical that Google's motives are entirely altruistic. At work, the reaction was a bit different: There was a lot of talk along the lines of, "Google can put this out, but the federal government can't make a function healthcare exchange web site after shelling out hundreds of millions of dollars?"
• Alert Logic just put a new report which found that energy firms are at an all-time high risk of brute force attacks and malware/botnet threats. Big finding: 67% of energy companies experienced brute force attacks, compared to 34% of the entire customer set. And, furthermore, 61% of energy companies experience malware/botnet infiltration attacks, compared to 13% of the entire customer set. So in case anyone doubted that securing our energy infrastructure is now one of the top national security priorities of the decade, this news, combined with ICS-CERT's disclosure that brute force attacks for the first half of FY2013 surpassed the total for 2012, should be the final word that galvanizes action. But...it probably won't be, for reasons that I have discussed elsewhere.
• At work, we are currently delving into research on the economic costs of Intellectual Property Theft through cyber espionage, which makes the timing of this new article rather convenient. One of the things that sucks about figuring out losses from IP theft - which can be quantified as either total monetary losses or job losses - is that there is almost no reliable way to measure it, as a really good CSIS/McAfee study on the topic points out. This article, however, discusses new claims by Black Ops Partners Corporation, a consulting firm that specializes in advising large companies on IP protection. In contrast to the estimates by the Office of the National Counterintelligence Executive that we lose between $2 billion and $400 billion to cyber espionage, Black Ops claims that "$500 billion is covertly stolen from U.S. companies every year", while"[the] economic effect...equates to over $5 trillion in trade secrets, IP, technology, revenue, and jobs removed from the U.S. economy every year." Is Black Ops exaggerated? Maybe, though as the article points out: "BlackOps is in a unique position, however, since working with numerous major companies directly on counterintelligence gives them insider knowledge on corporate losses." I will need to read more about their methods, but it should certainly not be news that cyber theft has serious economic costs.
• The National Institute of Standards & Technology framework, which President Obama called for in an Executive Order this past February, has finally been released. Although the hyperlinked article includes a quote from someone at McAfee praising the framework as being "beyond rhetoric", I'm still skeptical. Developing a "framework for people working together" is not the same thing as spurring them to action, and the private sector has been notoriously reluctant to work with the federal government.
• The Washington Post had an article which pondered whether the NSA and Cyber Command should be split up after Gen. Keith Alexander steps down next year. They quote Alexander's predecessor, Gen. Michael Hayden, who claims that they're now "indistinguishable."
• And, in totally non-cyber related news, I have concluded that Blackmill is five hundred kinds of awesome. Case in point: Blackmill's dubstep remix of Ellie Goulding's "Your Song".

Becoming a freelancer + Frank Hoffman's review of "Breach of Trust"

I just finished reading this article by J.T. O'Donnell that appeared on one of my LinkedIn groups. I like the way that she describes the modern freelancer:

"Lisa is tired of working 'for' employers. Now, she isn't ready to start her own company, but she does want to find a way to feel in control of her career. So, she decides to build a more flexible career gameplan. Lisa identifies she wants to solve a particular type of problem within her industry and focuses on becoming a subject-matter expert in her field. She researches potential employers where she can gain some valuable experience to help her become more knowledgeable. The pay is lower than what she could be making, but Lisa doesn't plan to be at this company forever. Perhaps it will work out and she'll be able to grow at this firm over several years, but she's not holding her breath. Instead, she sets a 2-year goal for herself. In that time, she learns as much as she can at the job, but also invests in some online courses to help her supplement her learning. And, she volunteers to do a project pro bono for a colleague over at a start-up as a way to get additional experience....

Sometimes, Lisa ends up staying for an additional 2 years at the firm she is at because the opportunity to grow is there, but other times she knows she needs to move on. By now, she has a huge network of colleagues she's amassed through her efforts. From former co-workers to networking acquaintances, Lisa is able to tap into the power of her connections and reputation to easily learn of new opportunities as they arise. In fact, she gets calls frequently from people looking to hire her based on recommendations they received from folks in her network. Lisa is professionally emancipated. She is never underemployed. And best of all, she is satisfied with the results...

Yes, Lisa's career gameplan takes a bit more effort, but the dividends are worth it, aren't they?"


It's a viewpoint that is, I suppose, of novel value to the chronically underemployed. That being said, I hate it when people giving career advice use hypothetical stories like this instead of their own experiences, whether it's themselves or someone in their network. (It's implied that Ms. O'Donnell is talking about her own career, but it's hard to tell for sure.)

Another update for today: I just read Frank Hoffman's (NDU's) review of Andrew Bacevich's Breach of Trust: How Americans Failed Their Soldiers and Their Country, which can be found at War on the Rocks. I've been meaning to take a look at Breach of Trust for a while, and Hoffman's review has piqued my curiosity even more. Bacevich is a longtime Iraq War opponent (and, some might argue, axe-grinder, since he lost a son in the conflict), and Breach of Trust continues Bacevich's penchant for writing books with provocative titles like The New American Militarism: How Americans Are Seduced by War and Washington Rules: America's Path to Permanent War.

Bacevich has also advocated a return to conscription and doing away with the All Volunteer Force (see for example this 2010 article he wrote for The Nation), and he does so again in Breach of Trust. It is this prescription for "curing American militarism" that Hoffman finds most reprehensible, especially since it's a solution that is discussed in only two pages of the entire book! Hoffman tries to envision what such a modern-day conscript force might look like, and it's not a pretty picture at all:

"A conscripted force would presumably be less adequately prepared for major combat, since the force would be largely concentrated on individual training of each year’s influx of trainees.  Such a force certainly would not be more efficient, as a larger number of trainers and a larger infrastructure would need to be established to manage a larger training pool of trainees conscripted for two-year enlistments, compared to today’s longer term force.  No doubt the force could be trained in individual skills, but it would lack proficiency in higher order, collective tasks.  Such a force would be hardly competent in the environment posed by the complex character of contemporary conflict."

Overall, Hoffman criticizes Bacevich for promoting the idea of an American military that "would consign both allies and our own forces to a more unstable world and increased risks" and trying to "to provoke rather than promote a serious debate." Although I am generally sympathetic to Bacevich's views on the need to keep the American military adventurism in check, the idea of a conscript force is one that I find too absurd. I also hate it when someone as intellectually and rhetorically gifted as Bacevich delves into polemics.

Also, Bacevich appeared on The Colbert Report last month to promote Breach of Trust. See video here.

The Army is angry about budget "uncertainty" + Quantum Dawn 2

From Defense News. Choice quotes:

"Army Chief of Staff Gen. Ray Odierno...complained that his two-year tour as head of the service has 'been nothing but budget uncertainty. No budgets, continuing resolutions, no planning, wasteful programs because we can’t predict what budgets we’re going to have as we move forward.'"

"McHugh also pointedly took issue with how the Army’s decreasing budgets have been reported in the press, complaining that some reporters portray future Army budgets as merely being a reversal to peacetime 2002 or 2003-era budgets...'This isn’t 2002. Or 2003,' he said during a late morning press conference. 'The costs we pay for things have gone up significantly. … Obviously the needs of our soldiers and our families are much more extensive' now than they were a decade ago, before tens of thousands of soldiers were wounded in Iraq and Afghanistan."

As someone who hopes to join the Army (I am planning to go before the officer board next month), and who works on an Army base (which meant I was furloughed for a week this month), I understand their frustrations: It affects me personally, and almost all of my close friends in DC.

In other news, Quantum Dawn 2, the financial industry's most high-profile cyber attack exercise, has wrapped. The consulting firm Deloitte, which coordinated the exercise with the Securities Industry and Financial Markets Association (SIFMA), has just released the after-action report. I haven't looked at it yet, but the Business Insider article linked earlier has this choice quote:

"One key lesson from the drill was that the private sector and government authorities must share information more freely and quickly, said Ed Powers, the national managing principal of Deloitte & Touche's security and privacy practice. While firms have detailed information about individual attacks, authorities can help prevent a crisis by sharing information about broader threats when appropriate, he said."

Sharing information about threats is, of course, what the National Institute of Standards' and Technology's cyber security framework is supposed to promote. I'm getting a little bit worn out by all of these warnings that don't seem to be heeded, because right now, it looks as though Wall Street, like most sectors of the economy, is paying good money to consultants to prove again and again what is intuitive at this point. On a side note: I wonder how many Deloitte consultants worked on this contract and felt a sense of ennui: "Why are we putting all these hours into this damn report if nobody is ever going to listen to us?" Then again, maybe this is why every Deloitte consultant I know can drink me under the table, and all on their company tab.

Keep the military out of cybersecutiy?

The Brookings Institution's Ian Wallace (who, along with Thomas Rid, is one of the foremost opponents of the term "cyber war") has just put out another piece of interest: "Cyber security: Why military forces should take a back seat." His rationale, which repeats his earlier arguments, boils down to this:

• "Cyber threats often come from overseas, which makes it difficult for law enforcement to deter or punish them, yet they rarely rise to the level that would warrant a military response."
• Using the term "cyber war", however, implies that in fact that military have a responsibility to get involved in our nation's network defense.
• Most acts of "cyber warfare" are better described as "commercial espionage", "sabotage", "subversion" or just "cyber crime". 
• CYBERCOM per se is not bad, but using it as a tool for dealing with the aforementioned cyber-societal ill carries the following risks:
• We don't want to encourage the civilian world to think that this is the military's role, when most cybersecurity experts agree that good cyber hygiene at the level of both individuals and corporations is the first big step to reducing network vulnerabilities. (Indeed, the Department of Defense's own cyber-awareness training, flawed though it might be, takes this stance.)
• There are simply too many information systems underlying our country's infrastructure and commerce; the military can't protect them all, and doing so would like require major civil liberties infringements.
• Military doctrines are inherently offensive, which is why we don't want DoD determining our cyber policy and doctrine (note that he's quoting Barry Posen to make this argument).

My thoughts:

• I think Wallace and Rid both need to retire the argument that there is no such thing as "cyber war" (even though I've heard Michael Daniel echo this rhetoric at countless cyber-related discussions on K Street, which suggests that the administration agrees with them). Referring to "trade wars", after all, does not conjure up images of Special Operations Forces and drones being used to attack foreign trade ministers in retaliation for trade barriers. And President Johnson's "War on Poverty" isn't associated with the National Guard going into the ghettos to hand out relief checks and food stamps.
• Wallace's chief concern is not semantic ("cyberwar" vs. "cyber theft"), but rather the (wholly legitimate and oft-debated) question of who should protect American interests in cyberspace. So maybe a better question to ask is how DoD became so strongly associated with cyber defense in the first place. I suspect it's pretty simple:
• The military-industrial complex gave us the Internet and programming languages, not to mention some of the first modern digital computers. It's rather difficult to shake the assumption that they'll take the lead on cybersecurity when they've always taken a leading role in the existence of computing itself.
• Whatever obvious flaws exist in their approach, the Department of Defense seems to be taking cybersecurity far more seriously than anyone else right now; they're set to spend $23 billion on it in the next five years. For comparison purposes, the energy sector is trying to reassure us that it's taking cyber seriously - despite much evidence to the contrary - because it's planning to spend $7.25 billion by 2020. And the Department of Homeland Security's ICS-CERT is still so woefully underfunded that they're regarded as a joke by almost everyone.
• To me, a more convincing argument against handing control of cyber doctrine to the military is the fact that right now, the military is struggling to educate its leadership to think about cyberspace as both a security and war-fighting domain. This was the subject of a recent Pew Center report that was discussed and debated at the National Defense University (full disclosure: my fellow at NDU was one of the panelists, and I did most of the research he presented to counter the Pew Center's argument). However, even this study still admits that "[military higher education's] efforts are commendable, especially in comparison to the much slower or nonexistent integration of cybersecurity components in non-technical graduate programs across American civilian universities".

So long as the military doesn't have a crippling image problem regarding its activities and efforts in cyberspace*, it seems pretty natural to expect most Americans to look to the Pentagon as the most willing and capable actor in cyberspace. I don't like the idea of cyberspace becoming "militarized" any more than Ian Wallace and Thomas Rid, but if we don't want to assume the cyber-soldier and lay aside the cyber-citizen (to butcher a quote by a certain someone), then perhaps it's best to consider how DoD came to dominate the discussion about cyber security strategy in the first place.



* Obviously, this claim depends on how the Snowden affair affects one's perspective. But even Snowden is still complaining about the "indifference" of Americans to the NSA's efforts to "control" the Internet.

Quick insights (now that I have started blogging)

Some additional thoughts about this blog and yesterday's piece:

• Aside from discussing war, peace, grad school, careers, and dating, I need to write about stuff like health and arts and entertainment (which was what I did when I wrote for my undergrad newspaper).
• In my post about Bitcoin yesterday, I failed to ask a question that seems relevant: If Bitcoin is really a currency that will free us from the tyranny of currency-manipulating governments, why have the Chinese - AKA the world's most notorious currency manipulators - embraced it? I would like to look into this for a future post.
• After not writing anything since my grad school master's thesis (nearly two years ago), and not having a regular online outlet for my writing, I'm already starting to feel a lot more energy and enthusiasm for my work, now that I have this blog. So maybe I won't ever be able to quit my day job and make a living writing, like some people whom I have met and admire greatly, but right now, it just feels good to remind myself how fulfilling it used to be whenever I sat down, organized my thoughts, and had product to call my own. I read so much stuff on Twitter, but when I don't write about it, I don't feel as though I am benefiting myself or anyone else.

"Flopping fish" - China's underperforming carrier-based fighter

I'm severely late on this story, but I feel an urge to write about it regardless: Last month, the Sina Military Network, otherwise known as the covert media arm of the Chinese People's Liberation Army (PLA), did a story on the the People's Liberation Army Navy (PLAN)'s new J-15 Flying Shark, which recently completed carrier trials on the Liaoning. The tone of the media coverage has astonished outside observers: The aircraft was openly and harshly criticized for inadequate performance, and even described as a "flopping fish."

For those not in the know, the J-15 is a naval carrier fighter that is meant to be a clone of the Sukhoi Su-33, except that it's actually based on the T-10K, the prototype version, which the Russians left in the hands of the Ukrainians after the Soviet Union fell apart. Of course, the Russians hate it when the Chinese reverse-engineer and manufacture their weapons without permission, but so far, that doesn't appear to outweigh their need to keep selling to their largest defense customer: Witness the recently-signed - albeit oft-delayed - deal to purchase Su-35s. Then again, maybe the reason the Russians don't care so much is that they long ago suspected what the Chinese just admitted - that the J-15 isn't going to live up to the absolutely absurd levels of hype that we saw in the Chinese media last year. Lest we forget, we are talking about a clone of a fighter that the Russians themselves decided to abandon in favor of the smaller and more carrier-friendly MiG-29K.

Among the criticisms of the J-15 aired in the Chinese media:

• Inability to carry adequate weapons payload and achieve carrier takeoff: “[A weapons] load exceeding 12 tons will not get it off the carrier’s ski jump ramp.” This means that weapons such as the PL-12 medium-range air-to-air missiles aren't likely to be deployable - let alone deliverable - on carrier missions. And thus, the J-15's air superiority/intercept capabilities will be limited (meaning that the Liaoning itself may be more vulnerable to air attack).
• At best, the J-15 will have an anti-ship capability consisting of YJ-83K missiles, plus shorter-range PL-8 air-to-air missiles for self-defense.
• Roger Cliff at the Center for Strategic and Budgetary Assessments is quoted pointing out an aberration: The PL-12 is a lighter missile than the YJ-83K, so the J-15 should be able to take off with the former but not the latter. This implies that, in fact, the J-15 cannot take off with either type of missile - meaning that it's even less capable than PLAN is willing to admit.
• Due to fuel requirements, the attack range will also be limited to 120 kilometers.
• To get an idea of how paltry the J-15's capabilities really are: The smaller U.S. F/A-18E, itself an expensive disappointment in many respects, is at least capable of carrying AIM-120 AMRAAMs and AGM-84 Harpoon missiles on carrier deployments with a ferry range of 1,800 knots.

The post from Defense News linked above contains a number of quotes from Vasily Kashin from the Center for Analysis of Strategies and Technologies, whom I met when he was at NDU last month. He isn't quite as critical of the J-15 as the PLAN themselves appear to be. He points out that (1.) the bigger issue than the J-15's weaknesses is the fact that the Liaoning itself is not a very good platform for carrier fighter operations (it doesn't even have catapults yet), and (2.) it's possible that the J-15 has airframe improvements that were not available at the time of the Su-33. But even he admits that fundamentally, the J-15 is, like the Su-33, a carrier version of the Su-27, a fighter that is inherently ill-suited to operating from carriers.

What we are seeing is that the Chinese government is unbelievably pissed off that China's military-industrial complex has once again failed to uphold national pride, which is - let's face it - its most important purpose (actually fighting and winning a war against would-be adversaries is secondary).

Nice chart showing how Syria has become a proxy conflict

 See here.

Bitcoin Wars: For I can raise no money by vile means

This year, there's been an awful lot of media coverage on cyber criminals and their favorite tools of the trade fo' gettin' paid: Tor and Bitcoin. Some recent examples:

• The big Deep Web story of the month: Ross William Ulbricht, the founder of Silk Road, was arrested on October 3 on drug trafficking charges. Considering that Ulbricht had reportedly accumulated a fortune of 600,000 Bitcoins, or $85 million USD for his services, it looks like we just witnessed a major precedent in the history of crime and punishment: the downfall of the first cyber drug kingpin. (At $85 million, Ulbricht would displace Frank Lucas for the #20 spot on Celebrity Net Worth's 20 Richest Drug Dealers list.)
• Not that Silk Road's demise is going to leave an unfilled void, of course: The Daily Beast just put out a story about the "Hitman Network". Hitmen paid in bitcoins: Yes, it is a reality. So is the ability to purchase firearms, including .50-caliber Barrett long-range rifles, without a background check.
• Edward Snowden also revealed this month that cracking Tor is one of the NSA's biggest priorities right now. So much irony here on all sides, starting with the fact that (1.) Tor was a U.S. Navy project that has been funded by the State Department for the sake of assisting dissidents in authoritarian countries everywhere, and (2.) Snowden himself may have inadvertently shined the spotlight on Tor. And in related news: WikiLeaks raised the money to pay for Snowden's defense in Bitcoins.
• Simon Johnson at M.I.T. recently proclaimed that backlash from the government and financial institutions will likely scare off investors, especially since Ulbricht's arrest.
• In response to the above, Slate just put out a piece noting that the value of a Bitcoin dropped from $145 to $110 after the Silk Road was taken down, but then returned to $140 as of this weekend.

As of right now, I'm on the fence about the economic viability of Bitcoin: There has been talk about Bitcoin's "inevitable demise" for some time - usually, this perspective comes from Keynesians like John Quiggin, who earlier this year claimed that Bitcoin was a "pure bubble" and used it to rail against the efficient markets hypothesis that he has denounced for years (ironically, he shares his pessimistic outlook with libertarian nutjobs like Alex Jones, though not for the same reasons). I think it's going to be interesting to see whether Bitcoin lives up to one of the promises of its proponents: Its supposed immunity to government control and currency manipulation. Because Bitcoin is backed by algorithms rather than precious metals, and the number in circulation is currently fixed at 21 million, inflation is supposedly fixed and immutable. But the problem is, this assumption still rests on the goodwill of the surprisingly small number of individuals who appear to control circulation (and as Richard Sylla points out, they could be modern-day incarnations of King Henry VIII, for all we know).

The more pressing issue, though, is the national security/law enforcement dimension: If the U.S. government is really trying to crack Tor, as Snowden has revealed, it's a safe bet that they're just as concerned about cracking Bitcoin (see an interesting discussion of this possibility here). And the FBI already has tried to seize Ulbricht's Bitcoin fortune, which more than irked the hacktivists of the world. Obviously, these events have highlighted - in a big way- that the Bitcoin trade just became a major concern to federal authorities this year. While economists and ideologues continue to debate whether Bitcoin has a future, the U.S. government has come to regard it as a resource that is dangerous when left too unregulated.

Either way, 2013 has been the year that Bitcoin truly became part of our lexicon - expect to hear lawmakers once again puzzle over how to handle it and drop the ball, exactly as they've done on almost all things cyber since forever. But at least Bitcoin's advocates are, for the most part, pragmatic folk who understand that being raging anti-establishment libertarians on the Internet doesn't pay off as much as playing the lobbying game on the Hill and K Street.

New piece for GlobalSecurity.org

Today, I published a piece for Global Security with my fellow at NDU. Check it out here.

In other news, CIO just published a list of the worst data breaches of 2013. The results are pretty alarming:

• Virginia Tech - HR server breached; 114,963 individuals' data compromised
• St. Mary’s Bank - malware infects systems; 115,775 customers' data compromised
• IRS - up to 100,000 names, addresses and Social Security numbers "mistakenly" posted on a government website
• Republic Services - laptop stolen with 82,160 employees' personal information
• University of Delaware - 74,000 individuals' data stolen by attackers exploiting a website vulnerabilit
• Northrop Grumman - unknown number of employees' data stolen; the company’s retiree health plan reported 4,305 enrollees were impacted in a paper-records data breach involving CVS Caremark
• Department of Energy - 14,000 current and former employees' data compromised
• Missouri Credit Union - exposed personal information online; all 39,000 members potentially have had data compromised
• Michigan Department of Community Health - 49,000 individuals' data compromised
• Ferris State University in Michigan - 39,000 individuals' data compromised
• Cogent Healthcare - security lapse by vendor M2ComSy lead to data access on internet; 32,000 patients' data compromised
• D.R. Horton - dumped a "large amount" of documents related to "loans, copies of checks, purchase order sand site plans" into 'large dumpsters on school campuses"

I'm seeing banks, government agencies, academic institutions, defense contractors, insurance companies. Scary.

My first blog post!

Hello everyone. I'm Matt, and I recently decided to start blogging about war, peace, graduate school, and going to graduate school to study war and peace.

I started this blog because I recently realized I have a problem - I am embarking on a career path that is undoubtedly going to involve regularly thinking and writing about issues of national security and international relations. But...I haven't been doing much writing outside of work. For me, thinking about something is useless unless it serves a higher purpose - like writing about that something. Being intellectually curious is a wonderful thing and all, but lacking fruits of my own intellectual labor is starting to feel like being devoid of a purpose.

So, I created this blog. Its foremost purpose is my own personal development, by forcing me to write about stuff that I find interesting. If it gains any attention beyond that, so be it (and I am well-aware that someday, somebody, somewhere, in the Federal government might stumble upon it while I'm applying for a security clearance). Right now, though, I just want to start a blog that allows me to get down my thoughts about my interests, personal and professional goals, and anything else that seems relevant.

First thing's first, who am I?

• I graduated from Duke University in 2012 with a Master's in Political Science/International Relations. And yes, I am also a Blue Devil basketball fan/Cameron Crazy; I have been ever since my Dad (who is a retired Duke professor) took me to Cameron stadium as a kid to watch Duke play.
• I currently live in Arlington, Virginia, close to our nation's capital.
• Since moving to DC, I have been an intern at the National Defense University in Washington, DC, a gig I hoped would only last until I joined the U.S. Air Force (which didn't go as planned). I'm still at NDU now, and still trying to figure out my career as I write.
• I suppose it goes without saying, but...I like war, and almost anything related to war. Debate amongst yourselves what that says about me. When I was in high school, the only way I motivated myself to read Shakespeare was by fantasizing about how I'd adapt plays like Julius Caesar into modern action epics starring Vin Diesel and featuring dudes blasting away at each other with modern U.S. military-issue automatic weapons. Then, tragically, Ralph Fiennes took my idea and applied it to Coriolanus.
• This blog's title comes from the lyrics of Emerson Lake & Palmer's 1971 progressive rock opus "Tarkus", which is my favorite song of all time. I'd tattoo the last verse of the song on my back, if only I weren't too old to act that rebellious...

Next question...what do I want to write about?

• Obviously...war. When I wake up every morning, my first instinct is to check my Twitter feed to see what is going on in the world. Whether it's in Syria or Somalia, there's always somebody shooting at somebody else that requires my attention.
• Even though I was never enough of an intellectual to embrace the academic lifestyle of writing 100-page papers about parsimonious theories explaining how the world works, I still remain interested in how scholars of International Relations think about the world. So, I wish to write about the debates that are taking place amongst them.
• Right now, I am taking classes at Georgetown University in programming. It's proving to be a challenge, so it gets me thinking: How does one learn how to learn? Oh, yeah, and I'm also interested in cybersecurity and cyberwarfare, too (I do research on this topic at NDU).
• As someone who is still trying to figure out my niche, I'm always interested in reading what others say about finding one's passions and making it into a lifetime career. Searching for jobs, adapting to a new boss's management style, acquiring new skills so that one doesn't become irrelevant...those kinds of topics.
• Just in case all the talk about guns and bombs gets a little wearying, I might also blog on occasion about another topic that is completely unrelated, but still of interest to me - dating in the era of Tinder and OKCupid. As with everything else, I'm not interested in approaching this topic from the perspective of, "Yo, bro, follow my program and you'll get laid in 7 days, guaranteed!" I'm just interested in what other people say about this topic.

That's all for now. Hopefully, this blog will provide a useful basis for my education. O this learning, what a thing it is!