The Great Wall

Forget the military secrets-Chinese hackers might really be after logistics data from the Pentagon's unclassified computer network.

When revved up, today's U.S. military is just about unstoppable in a conventional war. Foreign nations with a yen to compete against the United States know this, and wars against governments in Iraq and Afghanistan offer plenty of evidence (insurgencies are another story).

Still, military giants are vulnerable. Achilles' weakness was his pride. The United States' flaw could be penetrable computer networks containing logistics information necessary to set in place the military machine.

Logistics information literally is the bread and butter of the military. Track the supply lines of materiel and personnel and you'll know where troops are headed. Disrupt that supply line, and you will have created a barrier to getting there quickly. Amateurs study tactics, professionals study logistics, goes the Pentagon cliché. Yet great chunks of logistics information flow across the unclassified Defense Department system, the Nonsecure Internet Protocol Router Network, or NIPRNet. The Pentagon maintains a separate network for secret information, but the NIPRNet is its daily workhorse.

"Most logistics is on the NIPRNet," says John Gilligan, a former Air Force chief information officer, now deputy director of Fairfax, Va.-based SRA International's defense sector. The network isn't open to just anybody-it connects to the Internet via protected gateways-but it is vulnerable, Gilligan says. About 700,000 Air Force desktop computers hook up to the NIPRNet, and finding a vulnerable machine and exploiting that hole "is certainly within the realm of a nation-state," he adds.

For Americans today, war evokes images of roadside bombs and hidden snipers in the Middle East. But Defense Department planners who are paid to think about future wars worry about the People's Republic of China. Rising powers long have challenged dominant countries for primacy-it's an old story. And now, nobody is more powerful than the United States.

A more immediate threat is a Taiwanese declaration of statehood, which could move China to react militarily, dragging the United States into conflict. Taiwan rests about 80 uneasy miles across water from China, neither an independent state nor part of Beijing's communist government, in most of the world's eyes. But ever since defeated Chinese nationalists fled the mainland for the island in 1949, Taiwan's security has mattered to the United States.

In March 1996, China fire-tested nuclear-capable missiles in the Taiwan Strait; in response, President Clinton sent in two aircraft carrier groups.

Chinese military analysts know they probably can't successfully invade Taiwan or defeat the United States in direct combat. But they're betting they don't have to, says James Mulvenon, director of Falls Church, Va.-based Defense Group Inc.'s Center for Intelligence Research and Analysis. Instead, a rapid blow aimed at Taiwan's will to fight might do the trick. A key part of such a coercive strategy would be to delay likely American military response to the area, he says.

Taiwanese national self-confidence is weak, says Toshi Yoshihara, a visiting professor at the U.S. Air War College in Montgomery, Ala. When China lobbed missiles into the Taiwan Strait, "Taiwan's stock market basically crashed; there were people rushing to leave the island," he says. If the Taiwanese could be convinced early in a conflict that American military help wouldn't be forthcoming, it could further damage their resolve, according to Yoshihara.

Which is where hacking into the NIPRNet comes in. Chinese military theorists believe the way to delay American response is to crack the logistics systems, Mulvenon says. The Chinese think the United States is most vulnerable as it deploys, Mulvenon says, as it fuels and revs up the military engine. Though hackers couldn't stop military action, they could slow it down. Hackers already have been "burrowing into really boring logistics networks," which suggests those perpetrators are state-supported, he adds. Those hacks could be preparation for a future crisis. In its latest annual assessment of Chinese military power, the Pentagon reports that China considers computer network operations "as critical to seize the initiative and 'electromagnetic dominance' early in a conflict."

In general, foreign disruption of military information technology networks would have a potentially major, even catastrophic impact, SRA's Gilligan says. Still, the military is in no position to simply shift everything onto its secret network. Classified networks are expensive-and the military needs to communicate with the outside world, especially for logistics. For example, before Operation Iraqi Freedom, the Pentagon relied heavily on airplanes lent and piloted by commercial carriers for soldier transport to the Middle East. "United and Delta . . . don't have classified processing facilities," Gilligan notes.

Deteriorating geopolitical situations don't materialize instantaneously, so the United States would have time to prepare for any adversary's tactics. Chinese hacking "is a concern, but I don't see our strategy becoming unraveled because of it," says Stuart Johnson, a research fellow at National Defense University in Washington.

Especially in the early stages of a showdown with China, "We should be able to cope with work-arounds," he adds. Says Gilligan, "It's not like we're just sitting around, waiting for a potential adversary to attack."

Also, a Chinese strategy of hacking or coercing Taiwan is not risk-free. A rain of missiles and bombs from the mainland could end up galvanizing the Taiwanese populace; analogous tactics boosted the resolve of native populations in Great Britain during World War II and North Vietnam in the 1960s. "It could really piss people off and make them more inclined to hold out," says Michael O'Hanlon, a senior fellow in foreign policy studies at the Brookings Institution.

And while network exploits can be plausibly denied, they still "usually get discovered and there's blowback," Mulvenon says. Plus, the Chinese underestimate the ability of logistics personnel to compensate, should their systems be hacked. But as those systems become increasingly automated, the danger rises, he says.

"If there's any good news here, it's that computers are getting attacked all the time," O'Hanlon says. Like an immune system made stronger in the wake of a disease, the military's network system should emerge stronger from a wave of foreign probes, he says.

The NIPRNet will become better protected through more secure enclaves for subsets of especially sensitive information, Gilligan says. Still, the job of shoring up computer security never ends. Computer networks were built to be open. Security requires steady monitoring and attention as hackers exploit new holes when old ones are sealed. Defense Information Systems Agency officials say they "are constantly increasing our vigilance to ensure the free and secure flow of information."

The world's largest network once was one built from flagstone-paved roads extending 53,000 miles in Roman antiquity. The roads were designed as a tool for policing an empire, and also for trade and communications. Unfortunately for the Romans, barbarians found them equally useful for their own purposes-attacking legionnaires-and eventually the Roman Empire was no more.