That might be the question a year from now, as Third World dictators arrest those identified in diplomatic cables as talking to representatives of the U.S. government. See Joshua Keating's summary of the state of play. He notes that two Zimbabwean generals and an Ethiopian journalist already are in the hot seat.

So yeah, I think Wikileaks has been wildly irresponsible. And people who helped it should probably be ashamed of themselves. Maybe tithe 10 percent of your income to Amnesty International as penance.  

This here is one of the best studies I've ever read on the subject. I learned a lot. Also, I think, a model of what a think tank study should do.

Meanwhile, here is Monsieur Bruni's take. Personally, I think the French should stick to regulating champagne or impressionism. "French internet regulation" is a phrase that just don't work for me, kinda like "French rock music."  

I asked Jay Holcomb what he made of the big article about Stuxnet that ran in Sunday's New York Times. Here is his response.

By Jay Holcomb
Best Defense infowar article critic

I enjoyed reading the New York Times article, "Israeli Test on Worm Called Crucial in Iran Nuclear Delay" published Jan. 16. Everyone seems to agree that this was by far the most complex cyber event ever seen in the wild. By complex I'm referring to the number of technical features, such as zero-day exploits, industrial control system expertise, intelligence on target configurations, number of cyber exploits used on the target, such as root kits, botnet-type command and control, user view manipulation, etc.

I believe that the more media exposure we can generate from complex cyber events like this one, the better. However, I still believe we are missing the bigger picture with regard to these types of complex events. While I realize many folks really want to know where the Stuxnet package originated, I propose that we should be spending as much (or more) time looking around at what these events mean today, and in the near future, with regard to our cyber exposure -- federal/state/local government resources, critical infrastructure, civilian industries, and even our own personal exposure.

I agree with Mr. Langner's quote in the article, referring to the Stuxnet package, that, "It's like a playbook.... Anyone who looks at it carefully can build something like it." Langner makes an important statement that I have not seen many people outside the industrial control system and cybersecurity industries mention or highlight. We can assume it is not only nation-states that are looking at events like these; terrorists and common criminals are most likely very busy right now looking at this too!

Many of the items highlighted in the article potentially read like a fortuneteller's glass ball: "The vulnerability of the controller to cyberattack was an open secret. In July 2008, the Idaho lab and Siemens teamed up on a PowerPoint presentation on the controller's vulnerabilities that was made to a conference in Chicago at Navy Pier, a top tourist attraction." This is not unusual, as significant vulnerabilities in software will often be publicly known. The vulnerabilities often are not addressed until (what seems like) enough public pressure is applied for a fix/patch to be produced and/or applied. While I have no specific information on "Smart Meters," recent articles which point out potential security concerns related to the deployment of "Smart Meters" make me wonder whether we're not looking into a fortuneteller's glass ball. I'll include some reference links about this at the bottom of this note.

One final thought: While the Stuxnet event and associated reports have generated some public media exposure on complex cyber events, I find myself looking back on a report released by the U.S.-China Economic and Security Review Commission, dated Oct. 9, 2009, which does a great job explaining a very complex cyber intrusion -- I wonder if that was a cyber building block to our current Stuxnet discussion?

Read on

Tom R.: For a long time I thought "infowar" or "cyberwar" was nonsense, mainly a gambit to make money in the defense consulting complex. But expert comments like this one on Stuxnet have me reconsidering. 

By Jay Holcomb
Best Defense infowar columnist 

I believe this event should be looked at from a much wider view … the Stuxnet worm (threat vector) certainly should be considered a "game changer" … the folks who are conducting the forensics analysis have been somewhat successful in gaining high level public/government attention to this issue.

While most folks seem to unofficially agree this worm likely targeted Iranian facilities -- if we look wider -- this "attack" … or perhaps a better classification "sabotage" … contains so many complex cyber elements combined into one package that it is absolutely fascinating. I do not believe it is hyperbole to say the Stuxnet worm is "revolutionary" in terms of what we should be expecting to see in future high quality cyber threat vectors.

For example, a few of the well publicized items used by the Stuxnet worm include:

• At least four zero-day vulnerabilities were used. Remember, these were classified as "zero-days" once we found out about them back in June/July -- which means the folks that discovered the vulnerabilities could have been using them/testing them for 12-24 months(?) before we even knew they existed. Discovering a single previously unknown vulnerability and using it successfully against a target is impressive!
Read on

We had a formatting problem yesterday that inadvertently made it impossible to post comments on two items. I apologize for this. The problem has been fixed.

Here's a promising new blog on "lawfare" by three smart guys. All you LOAC freaks will love it, but the rest of you need to pay attention, even if it does get boring sometimes. ("The R-O-E/ Helps you and me.") I think these guys need a new graphics/photo editor, though -- I've seen livelier graphic presentation in constitutional law textbooks.

At any rate: Wittes, Goldsmith & Chesney -- don't go to war without them.

Ethan Guttman has a fascinating piece in World Affairs Journal about China's efforts to track and quash dissidents through computer surveillance. The centerpiece of the article is an interview with Hao Fengjun, a former Chinese government surveillance expert from the secret "6-10 Office" who defected and now lives in Australia.

When he joined that security office in 2000, Hao was surprised to find extensive files on Falun Gong members. "Every person's specific details -- including family member information, everything of everything, how many practitioners in each district, how many coordinators, et cetera... These things are not something that can be done and collected in just one or two years."

Following the 1999 official crackdown on Falun Gong, Guttman writes, its members

were isolated, fragmented, and searching for a way to organize and change government policy, they jumped online, employing code words, avoiding specifics, communicating in short bursts. But like a cat listening to mice squeak in a pitch-black house, the ‘Internet Spying' section of the 6-10 Office could find their exact location, having developed the ability to search and spy as a result of what Hao describes as a joint venture between the Shandong Province public security bureau and Cisco Systems.

The defector also tells Guttman that the "6-10 Office" also sent out false refugees to track overseas activity and undermine dissident organizations. These phonies were

young, trained to mimic Falun Gong behavior, and holding paperwork confirming time spent in laogai, China's penal system. ‘No matter how clever the Australian or the American government is,' Hao told me, ‘they have no way to distinguish the real [Falun Gong refugees] and the police officers.'

If you are going to read one magazine article today, let it be this one.

Meanwhile, the State Department is giving $1.5 million to an internet freedom group with ties to Falun Gong.

By Matthew Irvine
Best Defense cyber security correspondent

The proliferation of internet accessibility and use has exposed the world's core systems to heightened danger of attack, according to a panel of cyber security experts in Washington. However, the private sector controls much of the domain and government regulations to date are not sophisticated enough to guarantee security.

Douglas Raymond, head of monetization at Google Asia-Pacific, and Rob Knake, a fellow at the Council on Foreign Relations, discussed the cyber security challenges facing the public and private sphere at the Center for National Policy on Wednesday.

Read on

Building Peace, AKA Reach 364 -- who is just your typical Air Force pilot who is blogging on movies, learning Arabic and writing a novel -- offers this smart comment on Google's recent denunciation of Chinese hacking:

"We're seeing low-level warfare between a state and a corporation."

There's a good war college or SAMS paper to be written exploring that thought. I'd like to know more about precedents of states vs. companies, such as the British East India Company, and the merchant princes of Renaissance Italy, who seemed to have one foot in each camp. 

We're also seeing states hiring corporations (the United States using Blackwater instead of Marines to protect its diplomats) and corporations hiring states (Maersk contracting a Tanzanian warship to protect its vessels from Horn of Africa pirates). Reminds me a bit of the 30 Years' War in which bands of contracted fighters just roamed around endlessly devastating chunks of Germany.

Both of these look worth tracking:

This one tracks jihadist rhetoric: http://www.jihadica.com/

and this one focusses on Yemen: http://www.islamandinsurgencyinyemen.blogspot.com/

Flickr user: austinevan

The new issue of Army contains a thoughtful set of exchanges from the CompanyCommand website between a mother wanting to help her son as leaves active duty and others who have been through similar experiences.

The mother, whose name is just given as Judy, said that after her son's tour in Iraq, she found him "cold," and "filled with hate for the Iraqis." He shook when other cars on the road were came close. She asked, "Can we help him?"

There were several moving responses. Ryan Neely, an officer just back from 15 months in Iraq, advised:

Treat him like a man... My mother wanted to keep me in the box she felt comfortable with -- her innocent boy, clean cut and no rough edges -- but that wasn't me anymore. I felt belittled and misunderstood and underappreciated for the sacrifices I had made."

Molly Kranc, wife of an Army captain, added that in her own experience, "PTSD is a chronic condition that cannot be cured, only managed." I liked this insight, which is consistent with what I have seen. I was surprised that I hadn't seen this observation before.

Most strikingly, Ray Kimball called on his own experience to recount that after his combat tour, he was teaching at West Point and found himself irritable and short-tempered. But he didn't seek counseling, he recalled, was "when I nearly hit my now-3-year-old child because he wasn't getting dressed quickly enough. The shock of that was enough to force me to come to terms with that fact that what I was doing was not normal."

By the way, I think CompanyCommand and its sister site, PlatoonLeader, are two of the most effective and thoughtful military innovations of recent years. They are worth far more than whatever it costs the Army to operate them. (Fyi, you need a .mil address to get access to these, I think.)   

dok1/Flickr

The Pentagon's "Early Bird" (a compilation of defense news stories) yesterday carried an item from a blog. This was to my knowledge a first. The lucky blogger was Long War Journal 's Bill Roggio, who deserves the honor. There he was, item 27 of the EB of June 27, 2009. 

A salute to Price Floyd, the Pentagon's new communications czar, for the new policy. I wonder where he used to work?

Lip Kee/Flickr

I emerged from remotest Appalachia to read up on Iran. I learned far more from the blogs (especially Andrew Sullivan, Nightwatch, Juan Cole, and of course foreignpolicy.com) than I did from the newspapers. This isn't because the bloggers are smarter (though they are no chimps) but because they can aggregate material. They also can engage in full-blown speculation without pretending they aren't.

Nightwatch thinks that if the regime cracks down, it loses its mantle of righteousness. Here is his informed commentary:

A massive crackdown signifies the Iranian revolution is no more righteous than the Egyptian "revolution" or the Saudi Kingdom. The crowds are not yet calling for systemic change = revolution, but for an honest vote with the existing political architecture. If the existing political structure proves sclerotic and inflexible, the next step is to replace the people at the top. The step after that is to replace the architecture itself, meaning a revolution.

Iran, then, could be on an escalating staircase, but it is too soon to make that determination. The size of the youth vote has always been a political powder keg in a country that has too few opportunities, too few jobs for so many young people and which is led by a clerisy that is out of step with modern personal technology. 

The situation is not revolutionary yet, but something is seriously flawed when the favorite son of East Azerbaijan fails to carry his own constituency: Mousavi, according to al Jazeerah. The least credible electoral outcome and most persuasive evidence of massive voter fraud is that the Azeris of Tabriz voted for Ahmadi-Nejad by four to one, instead of for Mousavi, who hails from Tabriz. Everyone knows the Azeris are ultra-clannish and always vote for an Azeri. Mousavi is one of their own.

(Read on)

Best wishes to Fred Reed, the king of curmudgeons, who is hanging up his online column (Fred on Everything) for at least several months while he leaves his Mexican lair for an American cornea transplant.

I am bereft. Now I will have nowhere to go for well-written, pungent, political incorrectness mixed with smart military commentary and libertarian impulses, topped off with a splash of Third World sunshine and tequila. Fred is the Hunter Thompson of the right, and frankly has more street cred with me. Fred's one of those guys for whom the conversation isn't serious until you get to crew-served weapons.