STUXNET Creators Claim Can't Keep up With Cyberwarfare Developments due to Pentagon Procurement Process

The United States invented the Internet, but we may not rule it any more.

“We are certainly behind right now. We are chasing our adversary, for sure,” one of the Air Force’s top cyber warriors, Col. Dean Hullings, told an audience of about 350 here at the National Space Symposium‘s one-day cyber event.

Hullings, chief of Air Force Space Command’s cyber superiority division, said the US is behind countries he declined to name when I asked him later (OK, we all know it’s China and Russia and Israel and…) both in defense and in offense. This may be part of the reason recently retired Gen. Keith Alexander, former head of the National Security Agency and Cyber Command, poured so much money and passion into offensive cyber capabilities.

Hullings was not alone in his assessment of the state of the US government’s cyber capabilities. The US government lags far behind the private sector, Tina Harrington, head of the NRO’s Signals Intelligence Directorate, said later at the conference.

“This is an area where we are following you guys. We have been behind you guys for most of the last two decades,” Harrington said. Her comments are especially striking, given the bleeding edge technology the NRO traditionally deploys and its supposed strong commitment to ground stations and its communications networks over the last decade.

Part of the NRO’s problem, Harrington told several reporters after her talk, is that its DNA is building the best satellites in the world and they hire the best satellite builders — not the best networks or cyber experts. So there’s the cultural hurdle to overcome. The NRO also tends to work with the biggest defense companies — especially Lockheed and Raytheon — who build most of its satellites and its ground stations. Harrington made clear both satellites and the ground need to be secure from cyber intrusion or supply chain infection, but she kept coming back to the ground as the more pressing vulnerability. That would be Raytheon’s ground network, bearer of the wonderful acronym MIND (Mission Integration and Development).

But one of the major obstacles to improving our cyber security is the Pentagon’s fabled acquisition system. Just getting through the budget system takes about two years. Add the requirements process and you’re talking another two years. That means you are about three years behind the latest technologies, thanks to Moore’s Law. As Harrington put it succinctly: ”Two years to get it is two years too late in the cyber industry.”

link.