A Markoffian Muddle on Microchips?
Last Updated on Thursday, 5 November 2009 06:56 Written by alexklimburg Tuesday, 3 November 2009 08:16
Written by Alexander Klimburg, a Fellow at the Austrian Institute for International Affairs (OiiP).
John Markoff has been one of the most informed observers of the US Cybersecurity scene for a number of years; however the tone and direction of a recent article seem to me suggestive of something other than objective journalism. Without wanting to impugn Markoff’s journalistic credibility, there does seem (to the suspicious mind) a whiff of special-interest misdirection in his most recent article.
In an article in the October 26th edition of the New York Times (“Old Trick Threatens the Newest Weapons”) Markoff highlights the dangers of compromised semiconductor chips to classified systems. He makes the point, as so often, that the US covers only 2% of its semiconductor chips in its “Trusted Foundry Program”, and that “only” 20% of all chips used in US are also built in the US. He goes on to illustrate the horrors associated with compromised chipsets. A number of problematic assertions pop up at this point.
Let me first state that yes, “Hardware Attacks” are probably one of the most serious and potentially debilitating attacks that can brought against a Network. Yes, there is a serious concern as to fake and compromised COTS being installed in highly sensitive systems. The US government is not the only one concerned about it – the Chinese went so far as to develop their own national “Chip”, “Godson”. Is the West in general and the US in particular highly vulnerable to these types of attacks? Hell yes.
The problem is more the examples Markoff quotes to support his argument.
Firstly, the rumored 1982 Siberian pipeline attack that Markoff relatively states as fact is far from a confirmed case. This attack supposedly involved the planting of a logic bomb (not a “Trojan Horse” as Markoff says) within a Soviet SCADA System controlling a critical Siberian gas pipeline. The logic bomb “was programmed to go haywire, to reset pump speeds and valve settings to produce pressures far beyond those acceptable to the pipeline joints and welds. The result was the most monumenta non-nuclear explosion and fire ever seen from space.” (according to wiki) The case of the “CIA Pipeline bomb” is disputed by at least one writer (who calls it a hoax). Perfectly plausible, after all remember the “Gulf War Iraqi Printer attacks” hoax that we (or at least I) believed for years?
Secondly, Markoff claims that the balances of evidence points indicates that the Israeli attack on the alledged Syrian nuclear installation in 2007 was supported by a hardware attack. Most open sources would not agree with this, and I have heard quite different stories myself. Overall these attacks were supposedly supported through the deployment of an Israeli version of the “Senior Suter” system, one of the USAFs most potent Cyberweapons. Senior Suter “centrally manages and controls the analysis and attack of threat networks, to identify exploitable vulnerabilities susceptible to available network warfare techniques.”(source) According to the source, Suter “became the first initiative delivered to meet the specific mission requirements of the new Air Force Cyber Command.” Indeed it is speculated in some sources that the 2007 Israeli air attacks on the alleged Syrian nuclear faculty was made possible through the deployment of an “Israeli Suter” that shut down the Syrian Integrated Air Defense Network.
So what is going here? Fighting for having secured chipsets is an old cause – remember the 3Com deal that was blocked due to concerns that the foundry would end up in Chinese hands (to the glee of the Heritage Foundations)?. And obviously having “clean, bone-fide American chips” will go some away to fight this ultimate subversion. All it requires is money. Lots, and lots, of it. A very suspicious soul might even say that an expansion of the US Trusted Foundry program was being lobbied for.
The Trusted Foundry Program does have its critics – not being a sufficient instrument for the problem is the most common (see “like a band-aid on a bullet-hole” ). The biggest problem however is not the TFP, it is that some recently panicked defense contractors don’t feel they make enough money from it.
A recent report by the National Defense University says it all
“We have heard repeatedly from companies participating in the trusted foundry program that they need more volume to be profitable. The requirements in this category will never be large enough to establish high volume.”
The solution? Expand the category, evidently. Is this however really the best way to deliver protection against hardware attacks?
Markoff is one of the important observers of the scene. Using dodgy examples to support his argument in public casts some doubt as to his intentions and sources. I do very much hope he can keep to the high standards we have become acustomed to.
[...] A Markoffian Muddle On Microchips? – Alex K. Limburg, IntelFusion [...]
DER SPIEGEL online has come out with a great article on “Operation Orchard” – the attack on the suspected Syrian reactor. Notice that they attribute the penetration of the Syrian IADS to “bombing and electronic warfare jamming”
http://www.spiegel.de/international/world/0,1518,658663,00.html
The “Senior Suter” source link is broken. Looks like it has an extra period at the end.
http://defense-update.com/features/2008/may08/suter_v.htm
Thanks, Technocrat. I just fixed the link.
Dear Alexander,
Ab initio, I thought John Markoff’s reporting was nothing less than stellar. He approached the subject matter with skepticism, and an unwillingness to assert as fact that which wasn’t subject to independent objectively knowable verification. Markoff does acknowledge the views and opinions of those who have written on the topic, i.e., General Wesley Clark’s recent article in Foreign Affairs, but never adopts their positions as true or as his own.
Insofar as the Syrian air strike is concerned, Markoff doesn’t claim to possess independent knowledge about any of this, but rather, permits for the possibility that the Israeli’s embedded a kill switch. I’m not certain that I understand why you believe that those who speak openly about the use of a Suter jamming system during the Syrian attack are not, themselves, engaged in misdirection and self-interest.
I recently authored a paper for In-Q-Tel (commercial branch of the CIA) on this subject. I am unaware of compelling evidence to support the notion that the Israelis used a BAE Suter system (or comparable Israeli system) when disarming Syria’s radar. That doesn’t mean that no such evidence exists. Likewise, I cannot state with absolute certainty that the Israelis successfully embedded a kill switch into Syria’s radar electronics, but I am 100% certain that it was wholly within the realm of the possible for such to have occurred at that time, and am also convinced of the probability of the kill switch scenario. That said, I am thankful that I do not have to prove such in a court of law.
John Markoff is a superb reporter, with a passion for seeking out the truth; insofar as I am concerned, any suggestion to the contrary is simply inaccurate.
With warm personal regards,
Jim Kelley
Dear James,
Thanks for your comments.
As said, I agree that Markoff has certainly been one of the most informed writers on Cybersecurity issues in the past. My personal guess is that he is morally committed to the journalistic standards of his paper, with which I well acquainted. I am therefore supposing that any misdirection that has occurred (which in my mind is possible) would have arisen by an attempt of his sources to instrumentalize him, rather than the other way around. I would not impugn his journalistic integrity, but I might think his standards have slipped a bit.
I don’t agree with your view that Markoff “approaches the subject matter with sceptism” or that he has “an unwillingness to assert as fact that which wasn’t subject to independent objectively knowable verification.” The former claim is clearly incorrect, while the later is a logical fallacy – just because he claims a single source (the IEEE paper, which is hardly objective) does not count as “objectively knowable verification”. According to such criteria he is lending equal credence to a very small minority view compared to other open sources. That is misrepresentation and unbalance. I posted a link to the SPIEGEL article and I especially draw your attention to how they describe the Israeli Unit 8200 involvement, and what Markoff implies. Given that you acknowledge that misdirection “can occur” (you rightly point out that the “Suter news” might also be such) I find it strange that you exclude the possibility in this context. Finally, Markoff does not accord the “Siberian Pipeline bombing” story the caveat that is most certainly deserves (although that is quite a debate on its own).
By the way, although it has not come up: I have also heard from my own US sources various supporting claims to all of the above “stories”. Ever since I personally experienced not one but a number of (now former) senior administrative officials hopelessly get their info confused I am a bit more careful on the value of insider information.
At the same time it is my experience that, in a world of increasing “InfoWar”, people are much more eager to instrumentalize the press then previously. This has always been true, and as you probably know in your industry, there is a strong drive to commit the US government to spend a lot more money on the trusted foundry and associated programs.
To clarify again: I do not belittle the danger of hardware attacks that you, James, are certainly familiar with (indeed I am actually quite a radical on this issue). I don’t even pass judgment on the trusted foundry program, which may well the best solution. I do however very much believe that Markoff’s article was not balanced and that it was timely in its support for what happens to be an issue with “quite a budgetary overhang”.
The issue of defending us (and I mean here “us Western liberal democracies”) from the very real danger of hardware attacks is much too serious to be diluted by unbalanced reporting. Markoff’s case can be a lot stronger than that. We don’t need FUD – the true story speaks for itself.
All the best,
AK