Our Bases In US Will Be Attacked: Army

WASHINGTON: With Google going haywire this morning, and news reports that a Russian hack of network firm SolarWinds could have compromised the Pentagon and other federal agencies, we’ve all gotten a sharp reminder of how vulnerable our high-tech world can be. That includes the US Army.

So just imagine the worst day in the life of an Army base commander. In the midst of an international crisis, while his troops rush to train up, kit up, and deploy abroad – suddenly the lights go out. A cyber attack has fried the power plant in the small town outside the base, and the base itself doesn’t have enough back-up generators to keep functioning at full capacity.

The nightmare doesn’t stop there. The signals at the local rail yard are all glitching, so you can’t ship out your heavy equipment, and the nearest seaport is shut down. Oh, and someone spread rumors online that the real reason the base is so busy is that the Army is coming to confiscate private citizens’ guns, and they doxed all of your contractors and civilian employees, so now your cybersecurity chief can’t come into work because heavily armed protestors have surrounded her house.

And the best part: The bad guys didn’t have to hack a single military system to do this – just the independent civilian services your base depends on.

Preventing this worst-case scenario is the purpose of the new Army Installations Strategy, released this morning. At just 16 pages (plus six pages of acronyms and official definitions), the strategy doesn’t give specific recommendations on what base commanders should do – those details are still being worked out. But it lays out a clear vision for what Army bases in the US need to become: resilient, adaptable, connected, and above all, not complacent.

(The Army may end up shouldering an increasing responsibility for protecting the Air Force’s bases as well. A three-star Air Force general said recently the other services owed a “tax” to help defend US airpower on the ground).

Central to this vision is an embrace of technology – networks, big data, artificial intelligence. Yes, networked tech is increasingly a source of vulnerabilities, but the new strategy clearly sees it as part of the solution as well. It’s just not practical to disconnect military installations from vulnerable civilian networks and create an insular, isolated system, the strategy warns. And pulling the plug will only get more impractical in the future. “Internet of Things (IoT) technologies will become embedded, pervasive, and ubiquitous.” the strategy says. “It will be impossible to buy or build infrastructure that is not ‘connected.’”

But if the Army leans into technological change, picks the right innovations and fully exploits them, the strategy says, it can make its bases much less vulnerable. Today’s bases were largely built during the World Wars and Cold War, following Industrial Age organizational principles that – by modern standards – embody “centralization,” “specialization” and “rigidity.” An Information Age design could give base commanders real-time data on problems and needs, analyze that information using big-data and machine-learning techniques, swiftly simulate alternative solutions and then help them reconfigure multi-use facilities to meet changing demands.

What does this mean on a practical level? Army installations will need “the latest generation wireless communication,” using 5G networks or similar technologies to move large amounts of data in real time – creating what’s called a Common Operational Picture (COP) shared not just across a given base but among all bases. They’ll need extensive cybersecurity upgrades and surveillance systems. And, “to the maximum extent feasible, each installation will have resilient power, water, and communications systems.”

Of course, what’s “feasible” depends largely on what’s affordable, and historically, installation upgrades have repeatedly gotten pushed to the back of the line. It’s always easy to argue that training exercises, equipment maintenance, or new weapons are more important – right up to the point where base housing starts falling down or munitions factories explode.

“We have advocated for another round of BRAC [Base Realignment And Closure] to reduce yearly installation support costs, but there doesn’t seem to be a good political coalition interested in making that happen,” said Tom Spoehr, a retired Army three-star now with the Heritage Foundation. “Even the Pentagon has stopped requesting authorization for a BRAC in the last two years.”

Will a Biden administration change that? It’s an open question. But even under what are likely to be tight budgets, Spoehr told me, “I think there is a good chance that the most pressing installation needs will be met, assuming they make a good case. Power resiliency and tools to maintain a common operational picture seem the most likely to get support.”

Why? “There is a new emphasis on resiliency and protection,” he said, a part of the strategy well-grounded in larger Pentagon priorities. “That is reflective of great power competition where competent adversaries will have the capability to create challenges for the US within our own borders,” he said.

“The National Defense Strategy (NDS) states the ‘homeland is no longer a sanctuary,’” the Army strategy says, invoking the current holy writ of the entire Defense Department. “Army activities in the homeland and on our installations are at increasing risk of disruption and attack, [and] adversaries will use sophisticated intelligence, surveillance, and reconnaissance (ISR) networks to target both military installations and soft targets associated with friendly forces, including private sector organizations, civilian infrastructure, institutional Army and joint targets, communication networks, and service members’ families.”

So what is the Army doing about all this? Well, not much – yet. “Currently, the Army does not have a comprehensive capabilities development effort underway to ensure the survivability and resilience of installations in the emerging operational environments,” the strategy admits. But going forward, it says, “the Army will develop comprehensive risk-based assessments for installations [to] inform a prioritized list of protection capabilities.”

What those priorities look like – and how many of them will be funded – is, of course, a multi-billion question still in need of an answer.