Jun 16 2008

If USAF can’t get a high-level policy directive right…

No Gravatar

I recently took a quick glance at Air Force Policy Directive 13-3 signed by the now-fired Secretary Michael Wynne. Then I did a double-take. And then I took a long, hard look at it.

This important product lays out some bureaucratic groundwork for USAF’s new cyberspace mission. These documents usually exhibit a banal quality and this one proves no exception … but AFPD 13-3 concerns me for a very important reason. In a word: “grammar.”

It’s a bad sign when you find multiple grammar errors in a short document with overarching policy certified by a three-star general and signed by the Secretary of the Air Force.

It’s a bad sign when you find mul­tiple grammar errors in an over­arching policy docu­ment certi­fied by a three-star general and signed by the Secre­tary of the Air Force.

Of lesser note, I noticed the inconsistent use of a comma to separate the final item in a series (e.g. “strategic, operational, and tactical” in paragraph 1.1 vs. paragraph 1.2). I found the incorrect use of “which” instead of “that” (e.g. paragraphs 2 and 4.1.1). I noticed an overly passive voice in all paragraphs 4.x. And let’s not overlook the inconsistent second sentence in each subparagraph under 4.1.

These all qualify as lesser grammatical problems—

—but history warns us to distrust any bureaucratic policy that suffers from multiple noun-verb disagreements. AFPD 13-3 includes an obvious “the I-NOSCs directs” in paragraph 3.3; an obvious “for each AFNetOps organizations” in paragraph 4.1; and a subtle plural/singular discord between the first two sentences in paragraph 4.1.3.

Then there’s the problem of the “interchangeable” abbreviations “AFNet” and “AF-GIG.” For such a short document, you’d think the Secretary of the Air Force could at least pick one abbreviation and use it consistently. But, no.

My first Air Force mentor, the late Jay Gowens, summed it up best circa 1983 when he revealed how he tackled the problems our office faced deep inside NATO. “Memorize any policy that serves a mandate and was written by a craftsman. Forget any policy that survived a consensus and was pencilwhipped by a committee.” (Not a verbatim quote but it’s accurate in spirit.) I believe Gowens would forget he ever saw AFPD 13-3.

“Waitaminit, Rob! How can you complain about the use of commas when you refuse to follow correct grammar to use one after ‘e.g.‘ in the fourth paragraph?” You ask a very valid question. The answer is: I don’t write overarching policy for the U.S. military. I’m just one critic with an established personal writing style — and I’m widely regarded as a craftsman who follows a mandate to save a pompous computer security industrial complex from its own incompetence.


This policy directive hints at a subtle-yet-fundamental problem in the race between the U.S. military services to codify a DoD-centric cyberspace mission. I describe this problem as a “hot project syndrome.” Let’s talk about the notion of a hot project so you can see the problem for what it is.

I’ve said it before (in so many words). USAF needs a new docu­ment called Fifty Cyber­space Questions Every Airman Can Answer.

The F-117 stealth fighter grew out of a very hot project in its day. It attracted the best design engineers, the best Air Force maintenance crews, and of course the best pilots. It attracted the best logistics officers, the best avionics technicians, and the best administrative personnel. If you flew the F-117 in its “black” phase, or worked on it, or supported it, then you were one of the elite. You belonged to a very hot project.

Likewise, the SR-71 reconnaissance aircraft grew out of a very hot project in its day. It attracted the best design engineers, the best Air Force maintenance crews, and of course … well, you get the hint. If you flew the SR-71 in its “black” phase, or worked on it, or supported it, then you were one of the elite. You belonged to a very hot project.

The Air Force “cyberspace” mission has grown (devolved?) from a hot project that has attracted the best career-minded officers, the best on-verge-of-retirement senior NCOs, and of course the best entrenched civilians. That’s the real problem.

When it comes to things like the F-117 and SR-71, bureaucrats end up serving the needs of the hot project. But when it comes to cyberspace, the hot project ends up serving the needs of the bureaucrats. That’s the real problem.

Great military doctrines and policies evolve from a focused single vision, not a muddled groupthink consensus. The grammar in AFPD 13-3 tells us too many people inserted themselves into the writing & approval chains and then exercised their right to pencilwhip it into consensus. So, if the Secretary of the Air Force can’t get a high-level policy document right…

Listen to me, folks. USAF has no focused single vision for cyberspace — only a bunch of poorly mouthed self-promoting videos. Indeed, Defense Secretary Robert Gates pointed out their muddled vision in a different core mission area when he explained his reasons for firing his top two leaders. Let’s modify Gates’ quote from “nuclear” to “cyber” and see if it doesn’t ring a bell:

“The Air Force does not have a clear, dedi­cated autho­rity respon­sible for the nuclearcyber enter­prise who sets and main­tains rigorous stan­dards of operations.”

USAF has failed for fully twenty years to solve their virus woes despite throwing (by my guess) upwards of $100 million at that single problem. If they ever had a clear, dedicated authority with responsibility over cyberspace, he/she would have long ago recognized USAF’s real virus problem — and his/her focused single vision would have reverberated throughout the Pentagon by now.

If USAF ever had a clear, dedi­cated autho­rity with respon­si­bility over cyber­space, he/she would have long ago recog­nized USAF’s real virus problem.

USAF’s muddled groupthink has turned a “hot project” into a cancerous quest for an Einstein-ish unification theory that homogenizes Military Intelligence with Communications under a single major command. But hey, that’s what you get when consensus steers the Air Force in some new direction.

And it’s a nail in the coffin every time a pencilwhipping committee leave multiple grammar errors in an overarching Air Force policy document. (Did you catch the noun-verb disagreement?)


Groupthink encourages its participants to assert themselves outside the group structure. They’ll preface their opinions with phrases like:

  • “I’m deeply involved with the standup of Headquarters Cyberspace Command, and I believe we should…”
  • “I was picked by the Chief of Staff to be a founding member of the Air Force Cyberspace Task Force, and it’s obvious that…”
  • (my favorite) “I have an SCI clearance and it pains me to say ‘I know a secret,’ but you just aren’t fully aware of…”

I’ve been amazed consistently since 1996 at blue suiters who brag about their intimate familiarity with cyberspace doctrine & policy — yet who stare at you like a deer in the headlights when you ask them something as simple as “what is the title of Air Force Doctrine Document 2-5?” You can safely ignore any flyboy who doesn’t know the two words splattered on the cover of USAF’s Cyber Bible.

“Okay Rob, you’ve babbled long enough about the past & present. Time for you to predict the future.” Cyberspace Command loves to brag about their itchy trigger finger. Read up on the root causes for the Bay of Pigs debacle. Then imagine Barney Fife with a loaded gun — twice.

Okay, now it’s time for you to do me a favor: print a copy of this column and mail it to USAF’s newly selected Chief of Staff. Defense Secretary Gates told him right to his face that “none of the services easily accept honest criticism from outside their branch, or scrutiny that exposes institutional shortcomings. This is something that must change across the military.” That change can begin with this column. Be anonymous if you must, but mail it to the new USAF Chief of Staff. Tell him “USAF needs a focused single vision for cyberspace.”

(For the record: I do not have a focused single vision for cyberspace. I’m just a critic who realizes USAF needs such a person. And it’s not Major General William T. Lord.)

Apr 28 2008

AFCYBER seeks fat Airmen with criminal records

No Gravatar

The council on Foreign Relations held a roundtable with Major General William T. Lord, the top digital pilot at Air Force Cyberspace Command. The press gave him some ink over the following quote:

“Perhaps we need a different kind of warrior in this domain. Today, all of our armed forces have a physical fitness test… Perhaps that’s not the right construct for these kinds of kids in the future… How do you attract the brains of some of this crowd that you might not want to wire up to a polygraph, but yet use their wonderful innovative ability. But they’re not the same kind of folks that perhaps you want to march to breakfast in the morning.”

It sounds like the general subscribes to a Hollywood version of hackers who’d be declared “4F” if not for their amazing criminal minds. This, my friends, is just one more thing I find wrong with today’s “cyberspace” leadership.

Lord wants you to think the Air Force only just started to look at hackers. Bah! When I enlisted as a “3C0X2″ (computer programmer) in 1982, I was surrounded by socially inept hackers with acceptable physical standards who started off the day with a can of soda back when coffee was the only acceptable morning beverage. Computer programmers were a unique species even back then, having been specifically trained at Tech School to ask “why?” whenever someone told them to do something a certain way.

And guys like me, who got to write software for NATO Intelligence? I assure you we were the weird ones in our crowd. We’d wear dickies with our fatigue uniforms just because NATO allowed it. If eight of us wanted lunch, we’d march all the way to the chow hall in formation just to screw with traffic. Naturally, our formations always crossed against the red lights.

And yes: we crashed that multimillion-dollar production NATO mainframe (twice!) to demonstrate a flaw deep within in its NSA-approved MLS OS.

As my career matured into the 1990s, I watched the same kids as me coming through the pipeline. They drank sodas in the morning just like I did and they couldn’t date a girl to save their life. They took great pride in messing around with the Air Force bureaucracy.

At the end of my career in 2003-07, I watched the new batch come through the pipeline and they’re exactly like the guys I hung out with. Sure: they can buy more toys than I grew up with, and they can type on a mobile phone almost as fast as I type on a keyboard, and they’ve racked up some “tent time” in the barren lands of Iraq & Afghanistan (just like I did). But deep down, they’re the same as always — a bunch of nerdy little dweebs who can look at the back of a malfunctioning Cisco router and instantly realize it has exceeded its bandwidth limit for serial plane zero … yet who turn into Forrest Gump whenever they bump into a cute female airman wearing pink lipstick.

Ignore General Lord and listen to me, folks. I have absolutely no doubt the Air Force will find the kids they need to wear a uniform. They’ve been putting kids like me into uniforms for decades! As for the hackers who can’t survive two months of basic training? Bah. Let them pick up a military contractor job with Microsoft or Symantec — if their rap sheets don’t stop them from getting a security clearance in the first place.


USAF RIGHT NOW is cluttered — dare I say “choked”? — with bureaucrats. Choked with people like General Lord who subscribe to the Hollywood view of what their troops should be. Choked with people like Captain Goza who don’t even know what “cyber” means. And then there are the worst of the bunch: people who drool at “cyber” as a means to pad their officer evaluations and civilian performance reports. They don’t have a clue how to bring it all together but hey, the Chief of Staff told them to stand up a cyber mission and they’re going to be the ones who get a Meritorious Service Medal for doing it!

I’ve bumped into heaven-knows-how-many idiots who claim they were the first ones to kick-start the Air Force cyberspace mission in some obscenely obscure fashion. “Well, not to brag, but I’m the guy that wrote that classified ‘just thinking outside the box’ email to JJ (that’s retired chief of staff John Jumper, back then just the commander of 9th Air Force) asking him why his folks were doing X instead of Y, and I’m happy to say that JJ wrote me back to say that was a great idea and he’d put one of his best light-birds right on it…”

The Air Force suffers from too many shallow thinkers in cyberspace. You can identify them by the way they answer a single question. “What does USAF mean by ‘sovereign options’ in cyberspace?” The shallow ones will start off with a bunch of hemming & hawing, followed by gobbledygook. “Well, you see, um, the Air Force cyberspace operations give us the ‘pointy end of the spear,’ helping us to synergistically complement and coalesce all kinetic and non-kinetic weapon systems at our disposal…” Try not to smirk when you identify them. It ruins the mood of the moment.

But when you do identify these people, I implore you to drive a knife into their egos. “That’s very interesting! You know, security critic Rob Rosenberger argues that USAF will all but lose its first cyberwar due to a fundamental flaw in its ‘sovereign options’ doctrine. What’s your opinion of that flaw?” Again, try not to smirk. It ruins the mood of the moment.

Mark my words. We’re going to pay life insurance for some people in uniform in a real cyberwar. We’re going to lose lives tomorrow thanks to today’s shallow self-serving bureaucrats — and if you recall my prediction from 2002, I said we’ll lose lives twice thanks to those very same self-serving bureaucrats. I want those bureaucrats to get out of the way so the real cyber warriors can reshape the Air Force.

“Okay Rob, who are the real cyber warriors and who are the fakes?” Excellent question. I’ll paraphrase George Carlin. If you’re in cyberspace and you feel like you’re part of the solution, then you may very well be part of the solution. But if you run around in public telling people “I’m in cyberspace and I’m part of the solution,” then you’re part of the problem. Get out of the way.