« it has come to this | Main | Tick, tock, tick, tock . . . »

what did i tell you?

A crowd, not a mob. Way to go.

Why? Why do you make me hurt you?

Without a doubt SITE is justified in feeling like the gov’t screwed things up. While it is tough to point a finger at the exact leaker, the phenomenon of every swinging Richard - people who should know better - rushing to download the associated files is a problem that has long plagued those of us who dealt with these issues. It got to the point that we would stop providing URLs and other identifying information in reports because some wingnut from a gov’t IP would go to the target site and voila! It would suddenly disappear. Indication #1 that the adults are not working the INFO-X problem.

This also reinforced my earlier statements about the sophistication of our adversary and the value of these sites. One reason they’re not big on “cyber” terrorism: they derive more benefit from the ‘Net being up than being dark. Note the tight OPSEC and INFOSEC regime. JTF-GNO should have it so good. Paranoia was thick before, now it is worse. Control and authentication will get more strict and penetration will become more difficult. Strangers will need more bona fides. Loose lips and all that; indication #2 that the adults are not working this mission.

It would be nice to think that this was an organized effort by our Uncle to disrupt AQ online, but given the relative ease associated with monitoring ‘Net comms over, say, anonymous and constantly changing throw-away mobiles or tracking a courier in a sea of guys all dressed and acting alike, it runs against an age-old intelligence tenant: you drive people to the medium you are best suited to exploit, you don’t drive them to use mechanisms you cannot. Indicator #3.

Without a modicum of adult supervision, some glue, and some serious sense of the reality about the online environment, this fiasco and others like it are going to be repeated over and over again.

Welcome to the playground.

TrackBack

TrackBack URL for this entry:
http://haftofthespear.com/cms/refer.cgi/773

Comments (18)

Colin [TypeKey Profile Page]:

Mike,

I am in no way defending the way whoever it was in the government handled this, since, from what I’ve read (and admittedly, most of the information out there right now about this is probably flawed to some extent), this was handled very poorly, but what do you think of a private entity trying to place limits on how and to whom information provided to the IC is disseminated? Once information is placed in the hands of intelligence professionals, shouldn’t they be the ones to decide how to utilize and disseminate the information, whether the F it up or not?

uni [TypeKey Profile Page]:

http://formerspook.blogspot.com/2007/10/al-qaida-goes-dark.html

Someone disagress with you. Frankly…I really have a hard time seeing this being done as part of some larger operation. Looks like someone screwed the pooch to me…

Michael Tanji [TypeKey Profile Page]:

You hit on a key issue: there is no ORCON (originator controlled) for private information. Unless the independent information provider has set up a contract that clearly stipulates how the gov’t can use the information – and I doubt the gov’t would sign such a contract – once the information is cut loose, that’s it, you’ve lost control. This is on top of the risk of some tool leaking to his journo pals.

cicerosghost [TypeKey Profile Page]:

Mike,
Agree with Colin. IC is not blameless in this, but SITE should share as well.
I’m assuming that SITE continues to seek bona fides with the IC and particularly the WH. In that light, doesn’t this seem like a calculated risk on their part? Rita can’t be faulted on patriotism, but political savvy, perhaps. A WH with very little good news re OBL and very few experienced hands remaining, is going to run with this.

Michael Tanji [TypeKey Profile Page]:

Here is my problem with all the private outfits that are doing this work: to what end?

If you are feeding the gov’t then you live with the fact that you might get bit once in a while. You don’t get to complain about what they do (or don’t); honest mistake or blatant gaff. If you don’t like it, don’t renew the contract.

If you are feeding private concerns for their defense, fine, but lock down the site and stop pretending you’re a public service.

If you are doing this for the peeps, then stop the pay-to-play and let the chips fall accordingly.

Here it the trick with that last part – and all you Freepers and the like who want to go vigilante keep this in mind – you try to take down a Tango site you’re committing a crime. Ends and means you say? That’s interesting logic from “counter” terrorists.

THIS IS AN INTELLIGENCE PROBLEM. That does not mean that the IC should have dominion over it (clearly not possible/desirable since they’ve contracted the work out/can’t get past the mid-90s in their thinking) but it does mean that there should be some order and discipline brought to the process. I’m sure SITE has it methods, so do Internet Haganah and the like, but how truly effective are they? Who is deconflicting so that there is no duplication of effort? Whose got strengths that others do not? Who is testing to see that they’re not being drawn into a D&D campaign? I’m all for citizen participation here (I’m looking in your direction Canonneer 4) but while our Uncle can benefit greatly from the “amateur” pool, he has also got a lesson or two to share that all engaged in this work could benefit from. The problem of course is that there clearly is not serious outreach or effort to coordinate the disparate undertakings.

Until then, it’ll always be a goat-rope.

Colin [TypeKey Profile Page]:

It seems like MEMRI has the best approach. They really do provide a public service, they never run the risk of “screwing the pooch” if that’s what happened here, and everything they do is out in the open. It’s just a news service, like FBIS translations made available to the general public. Reading foreign media outlets and letting the western world know what they are saying in an unvarnished way seems like a great way to bring perspective to the American public.

I can think of a few good reasons for groups like SITE to exist. One is the shortage of qualified translators in government employ. Another is the fact that it’ll take about 20 years for the government to hire, train, and develop analytic competency skills in enough qualified translator/analysts to review the mountain of data that’s being collected. A third is that private firms can purchase and implement the latest technology much more rapidly then government agencies, who are still struggling to implement the ISE framework.

Michael Tanji [TypeKey Profile Page]:

I don’t question the need for such entities per se; I decry the lack of a coherent strategy to harness their power. We need the skills, speed, flexibility; we just can’t expect the strongest effort from random actors. AQ is doing it right, we are not.

How do you duplicate efforts that aren’t being made, or that really are being made but are not perceived? Whatever lessons Uncle can’t share on open sources are imperceptible.

If there was any reason to have warm and fuzzies that .gov had everything under control, the only reason for the private sector to involve themselves would be profit.

Computer Network Attack is way outside of my lane, but it seems to me that the IC is just going to have to live with “patriotic hackers” shutting down sites you’d rather leave up, OR conduct a viable strategic communications campaign to convince people their help is not helpful. If any islands of Strategic Commuications competence exist in the Intelligence Community, they are imperceptible to me and millions of other Americans, thus our relunctance to go back to the mall and let the pros handle everything.

The FAS blog Secrecy News just put up a relevant post to this discussion with some valuable links:

http://www.fas.org/blog/secrecy/2007/10/managing_intelligence_contract.html

Michael Tanji [TypeKey Profile Page]:

Not gov-duping-private, but private-duping-private. Willing to bet that SITE, IH, etc. efforts have serious overlap, but I’d be pleased to be wrong.

Again, we are in violent agreement: our Uncle needs to step up.

Duplication of effort can be a feature, not a bug. Redundancy, alternative approaches, competition can be good.

The enemy is mostly non-state actors. “Friendly” non-state actors are going to make their presence known, often to the dismay of Regular control freaks. In chaos there is opportunity. Conventional chains of command and control do not apply to non-InterAgency players. Blue Force can herd friendly Brown Force cats only so far.

Irregular Restrictive Measures — Blogospheric Computer Network Attack

Davod [TypeKey Profile Page]:

There is no duplication of effort when you are translating foreign information. In fact having different groups translate the same documents provides a degree of checks and balances which might be misssing from the government efforts (remember the lady working for the FBI after 9/11 who testified that the Arab linguists were not providing truthfull interpretations).

http://mypetjawa.mu.nu/archives/189768.php

Inshallashshaheed Outted: North Carolina Jihadi in the News (UPDATED)

Vigilantes or Volunteer Irregular Information Operators?

Michael Tanji [TypeKey Profile Page]:

“Vigilantes or Volunteer Irregular Information Operators?”

Disrupted domestic Jihadist or blown US Intel source?

Hence the need for some federation glue and adult leadership. Not that it is forthcoming any time soon, just stating the need.

- Common Aim
- Vetted Method and Practice
- Deconfliction
- Distributed Effort

Anything less is just contributing to the chaos.

So how do the Regulars convince the Irregulars that sites are being monitored and not ignored?

If the “vigilantes” thought .gov had it’s stuff together, they’d trust .gov to get it done without help.

Michael Tanji [TypeKey Profile Page]:

You’re reading but not comprehending:

“Again, we are in violent agreement: our Uncle needs to step up.”

and

“there should be some order and discipline brought to the process.”

and

“the need for some federation glue and adult leadership.”

While monitoring and penetration continues, begin to lobby the gov’t to extend their relationship with independents/irregulars to go beyond exchanging public affairs-type data. Your functional peers on the inside know and see the value; you have friends and advocates (and peers). You need to get past the old school and the luddites. This could be very successful if you crack the code.

If the best effort is made and no hand is extended, by all means continue, but just understand that you run the risk of gumming up the few activities on the inside that are engaged (and there are some).

Post a comment

(If you haven't left a comment here before, you may need to be approved by the site owner before your comment will appear. Until then, it won't appear on the entry. Thanks for waiting.)

About

This page contains a single entry from the blog posted on October 9, 2007 7:02 AM.

The previous post in this blog was it has come to this.

The next post in this blog is Tick, tock, tick, tock . . ..

Many more can be found on the main index page or by looking through the archives.

   subscribe

Creative Commons License
This weblog is licensed under a Creative Commons License.
Powered by
Movable Type 3.35