@War: The Rise of the Military-Internet Complex (4 page)

For someone who grew up using many different modes of communication—phone, e-mail, text messaging—on many different devices, this method of intelligence analysis was intuitive. Stasio and the members of his platoon trained for two and a half years before they finally headed out to Iraq. He took four of the Korean linguists in his platoon and sent them to a one-year crash course in Arabic. He didn't need them to be fluent, but with some language proficiency they could work with local translators to write intelligence reports. The rest of the linguists he sent to learn intelligence analysis.

Stasio arrived in Iraq in April 2007—without the Prophet in tow—as part of a new “surge” of American troops. He might have wondered if they arrived too late. Stasio and his team found US forces under relentless assault from insurgents, roadside bombers, and mortar attacks. Iraq was collapsing amid an escalating civil war. Foreign fighters were pouring into the country from neighboring Syria and Iran, and a ruthless terrorist network, known as al-Qaeda in Iraq, ran a brutal campaign of attacks against US and coalition forces, the Iraqi government, and Iraqi Shiites—fellow Muslims and innocent civilians. The terror group aimed to break the back of the fledgling government with a theocratic dictatorship.
Maybe
, Stasio thought to himself,
I should have spent more time learning to fire my rifle.

But he didn't know—couldn't have known—that his ideas about intelligence-supported warfare were about to be tested on a massive scale. US forces were going to attack their enemy in a way they'd never attempted. And Stasio would be on the frontlines.

 

Mike McConnell had one hour to sell a war.

In May 2007, as Lieutenant Stasio was taking in the parlous situation on the ground in Iraq, the newly appointed director of national intelligence sat down in the Oval Office with President Bush and some of the top members of his National Security Council.
In addition to the president, McConnell faced Vice President Dick Cheney, Defense Secretary Robert Gates, Treasury Secretary Henry Paulson, and the president's national security adviser, Stephen Hadley. Rarely did this much political firepower gather in one room. But for the plan McConnell had in mind, their presence was required.

The last of the five additional brigades Bush had sent to combat the insurgency in Iraq was deploying that month to an area southeast of Baghdad. There were now thirty thousand additional troops on the ground. McConnell wanted to give them a new weapon. He told the president about particular capabilities the National Security Agency had developed that would allow a team of highly skilled computer hackers to penetrate the communications systems the Iraqi insurgents were using to coordinate their attacks and plan roadside bombings. Once inside those communications networks, the American hackers would use powerful software to spy on the enemy and obtain vital intelligence, such as who was leading a particular cell and where they intended to strike. This information could help forces on the ground target their enemies, tracking their location and, hopefully, interceding before they could set off a bomb or mount an ambush.

But the hackers could also manipulate the insurgents, controlling their cell phones, sending misleading text messages or fake calls that would appear to come from fellow fighters. They could wave insurgents off targets or even direct them into the sights of awaiting US forces. Once inside the insurgents' computers, they might be able to find out who was uploading gruesome videos of beheadings, which had become a cheap and effective way of attracting followers and terrifying the Iraqi public. The American hackers would implant spyware on the enemies' computers and copy any e-mail addresses and cell phone numbers being used by other fighters. They could track every word their enemy typed, every website visited, every e-mail sent. And they could capture all the passwords the enemy used for logging in to web forums where fighters planned attacks.

McConnell was proposing to subvert the insurgents from the inside, using their own resources against them. In principle, it may have sounded like straightforward espionage, hardly the kind of operation that needed the president's personal authorization. But this mission would rely on hacking techniques and tools, including malicious computer viruses, that were considered some of the most innovative and unpredictable weapons in the American arsenal. Once a piece of malicious software, or malware, was unleashed against a computer, there was always a risk that it wouldn't stay on that machine. Worms are self-replicating programs designed to burrow into other machines to which their hosts are connected. And viruses, as their name implies, could spread rapidly from host to host. In the months leading up to the 2003 invasion, military leaders had called off a planned cyber strike on Iraq's banking system for fear the malware might migrate from Iraqi computer networks to those used by banks in France. Owing to the interconnected architecture of the Internet, the two countries' financial systems were linked. American officials imagined front-page news stories of cash machines shutting down across France, the result of errant US strikes.

The risk of collateral damage from cyber weapons was great. And under McConnell's plan, the NSA would have to infect not just insurgents' phones and computers with malware but potentially many other innocent Iraqis' devices, too. The plan called for providing total awareness of the battlefield, and that meant distributing spyware widely, and capturing as many Iraqi communications as possible, to see with whom the terrorists and insurgents were communicating. Because the malware had to be distributed so widely, there was even a chance it could come back to infect their own forces.

Though they were not lethal in the sense that traditional weapons were, cyber weapons could be very dangerous and disruptive far beyond the intended target. In this way they had a lot in common with nuclear weapons. And like nukes, cyber weapons required presidential “release authority” before they could be used. That's what McConnell had hoped to get in his hourlong meeting with Bush and the top members of his national security team. It was a momentous request, and a politically sensitive one. Only eighteen months earlier, in December 2005, the agency had been pilloried for monitoring the communications of Americans inside the United States without a court's permission. Now the NSA would be breaking in to communications networks and gathering information not just on insurgents but on tens of millions of innocent people as well. Some of these networks were privately owned, and the NSA wouldn't be asking the companies for permission to siphon their data. Now the agency would be spying on an entire country and unleashing cyber weapons against it. The president had to sign off.

McConnell knew that Bush was not technically savvy; this was the man who'd once said he used “the Google” on occasion, mostly to look at satellite pictures of his ranch in Texas. Not that Bush's predecessor was a technophile. Bill Clinton sent only two e-mails during his eight years in office, a period that witnessed the birth of the contemporary Internet and a telecommunications revolution.

But McConnell knew that he had the trust of the most important people in the room. Six months earlier, Cheney had called McConnell in his personal office at the government contractor Booz Allen Hamilton to say that he and the president wanted McConnell to take the intelligence director job, a position that had been established only two years earlier, paid a fraction of McConnell's seven-figure salary, and was still ill defined and lacked bureaucratic muscle. And it was Gates, McConnell's longtime friend and bureaucratic ally, whom McConnell had called first for advice, and who pledged his personal and political backing for whatever decisions the would-be spymaster made. McConnell also had an important ally in General Keith Alexander, current director of the NSA. It would fall to Alexander to execute the plan in Iraq.

Alexander relished the opportunity. He was building an intelligence empire at the NSA, the country's largest spy agency, with 35,000 employees working at sites across the United States and in allied countries around the world. Alexander had amassed an unrivaled set of intelligence-gathering authorities and astonishing technical capabilities to spy on phone calls, text messages, e-mail, and Internet traffic on the world's communications networks. The NSA was the single largest contributor of intelligence to the president's daily briefing about national security threats, which gave it tremendous political clout. It was also the only agency coming up with reliable and consistent leads on the whereabouts of wanted terrorists. The CIA, by contrast, had practically no human sources capable of providing information from the inner circles of al-Qaeda. The war on terror was driven mostly by surveillance. The Iraq operation was a chance for the NSA to show the power of cyber warfare, which was inextricably linked to surveillance. To manipulate or disable a computer or a phone, one had to locate it on the network and then get inside it. Alexander had spent his two years in office building up his spying forces. Now they'd finally be unleashed for war.

Bush was a quick study. Despite his own lack of familiarity with technology, he seemed to immediately grasp the relationships between computers and people, how surveillance would help manipulate not just machines but the humans using them—and how it could be used to track and capture or kill someone. The president had already okayed a separate, covert effort to infect the computer systems that regulated an Iranian nuclear plant with a worm that would cause its enrichment centrifuges to break down.
Faced with few viable options for halting Iran's progress in building a nuclear bomb, Bush's intelligence advisers and some of his top generals had offered up an idea. Why not disrupt Iran's ability to enrich uranium—the key ingredient of a weapon—by sabotaging the mechanical process? They suggested a target: the enrichment facility at Natanz. And they proposed a weapon: a complex computer program that would commandeer the electronic equipment regulating the facility's thousands of centrifuges, the tall, tubular machines that spin gaseous uranium at incredibly high speeds and turn it into weapons-grade material. Centrifuges were the heart of Iran's nuclear program. Without them, the country couldn't enrich nuclear material to put into a bomb or a warhead.

Bush approved the mission, and the United States' top hackers and security experts set out to create a first-of-its-kind cyber weapon. It would come to be known by a single name, a combination of words contained in its thousands of lines of code—Stuxnet. But the operation, which began in earnest later that year, was designed for stealth, not total destruction. The Americans, working with Israel, wanted to slowly degrade and frustrate Iran's ability to build a bomb, all the while giving no hint that a cyber weapon was the cause. Stuxnet was designed to close valves that regulated the flow of gas inside the centrifuges. The more pressure was increased, the closer the centrifuge was brought to its breaking point. Such a tiny failure could be attributed to any number of causes, including faulty equipment or the ineptitude of engineers and workers at the plant who could be blamed for improperly installing and operating the centrifuges. The computer systems that regulated the centrifuges sat behind an “air gap,” meaning they weren't physically connected to the outside Internet, so a human spy or some other remote means of insertion would have to be employed to deliver Stuxnet inside the plant. This was to be a quiet and delicate operation.

What McConnell was proposing now in Iraq was something very different. It would involve the widespread use of viruses, spyware, and hacking techniques. And its purpose was to kill people, not stymie mechanical processes. Stuxnet was an act of sabotage. This was an act of war.

Bush was also growing to trust McConnell implicitly, asking him to deliver the daily briefing in the Oval Office every morning, a task that previous spymasters had relegated to subordinates. The two had hit it off when they met at Bush's ranch shortly before the president announced McConnell's nomination, in January. The ex-spy and retired navy admiral found the president's down-home demeanor both affable and familiar. McConnell had grown up in South Carolina, and he never shed his aw-shucks charm. Sitting on Bush's porch, the two men watched a thunderstorm gathering in the distance. Not a good omen, they said, laughing.

Now McConnell had asked for an hour of the president's time to make the case for cyber war in Iraq. Bush gave the green light after only fifteen minutes.

 

Stasio arrived in Iraq at Forward Operating Base Taji, a flat, dusty expanse in a rural area north of Baghdad that once served as a Republican Guard base and a chemical weapons production facility. Taji was nestled in the violent Sunni Triangle, the epicenter of resistance to US forces. The base and its troops were hit with mortars and improvised explosive devices, or IEDs, about 150 times a day. Every time the troops went on patrol, a thatch of fighters or a roadside bomb awaited them. And Taji was not unique. Across Iraq the violence was reaching a zenith. The prior year had been one of the bloodiest yet for coalition forces, with almost 900 killed, and 2007 was on track to break the record.
The month Stasio arrived saw the most fatalities since January 2005. Nearly all the dead were Americans. Iraqi civilian deaths, which were more difficult to track, were also at all-time highs, by one reliable estimate approaching 30,000 per year from 2006 to 2007, more than double what they'd been at the start of the war.

The new surge troops were to secure Baghdad and the most violent surrounding areas, freeing up additional forces to go after the insurgent fighters and protect the civilian population. General David Petraeus, the man whom Bush had tapped to implement the last-ditch effort, envisioned a two-prong plan of attack: forge alliances with those fighters who could be persuaded to help the Americans, or at least lay down their arms, and capture or kill the rest. Petraeus called that latter group “the irreconcilables.”