|
On June 4, Assistant Secretary of Defense John Hamre testified to the Senate Armed Services Committee on cyberterrorism. This word is a cover for Year 2000 Problem. The effects of y2k are similar, but they will be universal rather than confined to one city.
What is very important is his identification of y2k as an aspect of cyberterrorism. In fact, he led off with y2k. This is the first time I have seen this done: y2k at the top of the list.
He emphasized the magnitude of the DoD's vulnerability:
"The Department of Defense has more than 25,000 computer systems, of which 11 percent (or 2,803 systems) are mission critical. These computer systems are not simply weapons systems, the category best prepared to meet the Year 2000, but command and control systems; satellite systems; the Global Positioning System; highly specialized inventory management and transportation management systems; medical equipment; and important universal systems for payment and personnel records."
Then he added:
"Despite these efforts, however, there is no guarantee all DOD systems will be free of risk by the immovable deadline of January 1, 2000. Systems whose risks have been mitigated through renovation and testing could fail, and the failure of one system could disrupt many others."
There are y2k skeptics who say this is no big problem. There are others who say that the important systems will be fixed; hence, no big problem. What do they know that the U.S. Department of Defense doesn't?
The Armed Services Committee has not posted his testimony. The United States Information Agency has posted excerpts.
* * * * * * * * *
Washington -- "America is now vulnerable to an electronic attack" in which enemy countries could choose "to attack the U.S. infrastructure through the nation's computers," a top U.S. Defense Department official warns. "This is not a trivial problem. It's serious and real."
Deputy Secretary of Defense John Hamre told the Senate Armed Services Committee June 4 that the United States "has moved so dramatically to the use of micro-processors to control our basic infrastructure, everything from water sluiceways to pumping stations for natural gas; to electric power switching stations; to air traffic control, to just the traffic lights in every major metropolitan area. All of these are controlled by computers." At the same time, he said most of these "are being controlled by computers where security was never designed in at the outset. We just assumed that we live in a secure and safe environment."
The defense official said a departmental exercise called "Eligible Receiver," conducted a year ago, "found that this country is deeply vulnerable to a computer attack....This is a national security threat and a national security interest, and we have to deal with this problem." . . .
In response to Senators' questions, Hamre said the Defense Department has approximately 3,000 Mission Critical Systems (systems which would cause a serious disruption if they fail to work) "and about 28,000 non-Mission Critical systems."
Following are excerpts of Hamre's testimony as prepared for delivery:
(begin excerpts)
I am pleased to have the opportunity to provide the Department of Defense perspective on the threats and challenges confronting our information systems in the future. Today I would like to speak to you about three issues that are very important to our ability to achieve and sustain information superiority for our armed forces: the so-called "Y2K" problem, information assurance and the potential sale of segments of the frequency spectrum.
RELIANCE ON INFORMATION TECHNOLOGY
Worldwide, an estimated 15 billion microchips -- most of which contain timing devices -- are embedded in appliances and machines ranging from clock radios to ATMs (Automatic Teller Machines). A new automobile today rolls onto the highway with at least 100 microchips. Microchips are embedded in thermostats, leak detectors, underground storage tank monitors, boilers, lighting systems, generators, elevators, alarms, smoke detectors, sprinklers, sewage systems, security systems and automatic locks, and all of the common office equipment, including the coffee maker.
The failure of an embedded microchip in a discrete, localized computer or machine, such as a wristwatch or the air-conditioning system in a building, can be merely inconvenient. However, failure of a microchip in a critical, large, or dangerous piece of machinery -- loss of air pressure in an F-15 or a submerged submarine -- can be devastating and even life-threatening.
Virtually every week we see more and more examples of how failure in digital technology can have unanticipated and widespread repercussions. . . .
THE Y2K PROBLEM IN DOD
One of the biggest vulnerabilities of our nation's information infrastructure is the so-called Year 2000, or "Y2K," problem described in several of the examples above. The Y2K problem results from the inability of computer systems at the year 2000 to interpret the century correctly from a recorded or calculated date having only two digits to indicate the year. The Y2K problem is an especially large, complex and insidious threat for the Department of Defense -- an organization with roughly the population of metropolitan Washington D.C.; the complexity of a small nation; resources to sustain a global reach; and an information infrastructure that relies heavily on old, legacy computer systems. The Y2K problem is particularly critical because of the DOD's dependence on computers and information technology for its military advantage. Moreover, DOD's national security role requires that extra precautions in allowing access to systems containing classified data and private sector programmers capable of working on the Y2K problem must be screened.
The Department of Defense has more than 25,000 computer systems, of which 11 percent (or 2,803 systems) are mission critical. These computer systems are not simply weapons systems, the category best prepared to meet the Year 2000, but command and control systems; satellite systems; the Global Positioning System; highly specialized inventory management and transportation management systems; medical equipment; and important universal systems for payment and personnel records.
DOD also operates a multitude of military bases, which are much like small towns, where the infrastructure is also vulnerable to Year 2000 problems. Power grid, heating systems, air filtration, automatic locking devices, chronometers on ships and airplanes, and any timed device, contain embedded chips that may not be Y2K compliant. The problem will also extend to ail forms of commercial communication and mass transportation systems (traffic lights, trains, subways, and elevators), which will affect our men and women in uniform. . . .
The DOD CIO (Chief Information Officer), in addition, places special emphasis on contingency planning and testing, the primary areas of emphasis of Y2K efforts in calendar year 1999. As systems approach the anticipated date for all fixes (December 1998), contingency plans for both mission critical and non-mission critical systems will mature as well. Mission critical systems receive the highest priority in contingency planning. . . .
An area of concern to DOD is the availability of the hardware needed to make fixes for Y2K compliance. DOD has identified its need for these devices, such as communications routers, servers, and hubs, and has acquisition actions underway for them. However, there is no assurance that industry can meet the demand for these items which are crucial to maintaining an effective communications network for command and control, emergency response, and day-to-day DOD operations. . . .
Testing of the Global Positioning System
As an illustration, the Air Force Global Positioning System (GPS) has three main segments/components which will be affected by the Y2K date change: the Space Segment (satellite and support systems), the Control Segment (ground control systems), and receivers.
The Air Force has analyzed satellite and satellite support systems, evaluated ground control systems, tested DOD GPS receivers, identified cost and schedules for corrective actions. The GPS Space Segment is ready for the year 2000. All GPS satellites are Y2K-compliant. However, some satellite support systems are not Y2K-compliant, but are scheduled for repair or replacement by December 1998.
GPS's Control Segment consists mostly of legacy systems, which are not Y2K compliant. However, a system-wide assessment of the problem has been completed and all corrective actions will be implemented by December 31, 1998.
All GPS Joint Program Office (JPO)-procured receivers are Y2K and EOW compliant. For non-JPO-procured receivers, test plans and procedures have been established so manufacturers and users can determine how their receivers behave on January 1, 2000.
Continuity of Operations
DOD Components are applying extraordinary efforts to meet the technical challenges associated with Y2K compliance. Despite these efforts, however, there is no guarantee all DOD systems will be free of risk by the immovable deadline of January 1, 2000. Systems whose risks have been mitigated through renovation and testing could fail, and the failure of one system could disrupt many others. . . .
To further diminish possible adverse impacts on the readiness of the Department of Defense to conduct its mission on January 1, 2000, contingency planning is critical. These plans address failure of the system, disruptions at interfaces, receipt of corrupt data, and failure of utilities and infrastructure. Specific workarounds and actions to accomplish the system functions will be addressed, including providing manual processes to replace systems that rely on information technology. . . .
Y2K Allied Interfaces
The U.S. has been aggressively pursuing solutions to the Y2K problem in "Mission Critical" systems. Mission Critical systems are systems whose loss will result in loss of a core capability. An important piece of the Y2K problem is assessing the interfaces between systems. DOD recognizes the importance of these interfaces, not only within the DOD, but system interfaces with other branches of the Federal Government, with State government and private industry, and with allied partners.
-- The first Allied Interface Workshop was held on February 18, 1998, with the member nations of the Combined Communications Electronics Board (Australia, Canada, New Zealand, United Kingdom and the U.S.). . . .
Representatives at the first Allied Interface workshop agreed to form an executive level steering committee with a senior representative from each nation. There will also be a working level group formed to ensure that progress is being made in this area. Additional interface workshops are being planned. The regional CINCs will sponsor these workshops with close cooperation from the US Embassy Security Assistance Officers. The success of a program as critical and as pervasive as solving the Y2K problem requires the support of the Executive Branch of the government. DOD is working closely with other agencies in the Federal government and seeks to establish similar ties to Allied defense ministries for critical defense systems which are jointly operated.
While our allies are aware of the Y2K problem, there is concern that the level of attention is not as great as it is in the U.S. For example, some of the energy devoted to solving the Y2K problem in Europe has been diverted to addressing the changes introduced by the transition to Euro monetary system.
Bottom Line on Y2K. . . .
The leaders in the Department respect the complexity and pervasiveness of the issue, and recognize that the Y2K challenge requires:
-- Our best leadership to motivate, educate, facilitate and interface with the myriad of other Federal, State, civilian industry, Allied and international organizations upon which we mutually depend.
-- Support, recognition, and incentives both for successful program managers and for the information technology workers who are doing the hard work. The software engineers, in and out of uniform, who must slot through millions of lines of code to repair our systems, are an important defense resource, and there is no time to replace or train more.
-- Meticulous prioritization and focus on the most important systems. We must work together to ensure that our most important and complex systems are repaired first, and provide contingencies for minor systems. Contingencies don't necessarily need to be elegant; they just need to work. Similarly, several contingencies are less elegant but very workable options.
-- Ruthless stewardship of our most constrained resource-time. Time is critical. We can't slow it down. We cannot change the deadline. The Department of Defense is like a large ship entering a harbor. Our job is to turn the ship and bring it safely to the dock, not to rearrange the deck chairs.
|