Air University Review, May-June 1983

Computers—America's Achilles' Heel?

Colonel Thomas L. Volkmann

Computer technology has permeated every facet of the public and private sectors of the United States. The benefits of this technology are well known, and its sophisticated applications are so commonplace that they have generated an attitude of expected availability among the people who use them. This confidence in the availability of computer support has provided a fertile environment for expanding the technology and its associated application. The proliferation of applied computer technology has brought with it, however, a dependency that may prove to be America’s Achilles’ heel. The more dependent we become on computer support for accomplishing our daily affairs, the more vulnerable we become to the chaos that would ensue if we were denied such support. The nature of this vulnerability and the potential threat that could capitalize on it should be considered as well as aspects of computer technology that can substantially reduce the vulnerability.

It is readily evident that computer technology has eliminated the need for many skills that were once used in the management of this nation’s business affairs. I use the term business affairs in its broadest sense to represent the daily routines that in the aggregate comprise activities associated with business and industry in both the private and public sectors. The computer has replaced the stubby pencil that was used in the collection, manipulation, and analysis of information essential to the successful conduct of business affairs. Consequently, the number of people whose skills and knowledge were used in these processes is diminishing rapidly. Presumably, the skills will diminish to a point from which they can no longer be recovered without a substantial investment in time and effort. Under normal, peacetime conditions, this situation would be of little consequence. To assume that such conditions will prevail without interruption is to underestimate the intent and resolve of the forces that oppose our free capitalistic society.

To fully comprehend the significance of our vulnerability, look briefly at two historical events in which an aggressor exploited technology to gain a substantial military advantage. These two events involve the Maginot Line and Pearl Harbor.

Following World War I, French military leaders were determined to be well prepared for hostilities should they erupt again between Germany and France. They analyzed the deficiencies of World War I trenches and designed and constructed a massive fortification, the Maginot Line, that stretched along the French eastern frontier; they felt secure that it was impenetrable. In May 1940, the Germans, in a combined tank, artillery, and aircraft attack, dashed through the Forest of Ardennes to surprise the French Army. The Germans concentrated their tanks on a narrow front; the French dispersed theirs. In essence, the French "used" their tanks and were overwhelmed; the Germans "exploited" tanks and achieved victory.

In December of the following year, exploitation versus use was demonstrated even more emphatically at Pearl Harbor. As early as 1921, General Billy Mitchell had demonstrated that aircraft could use bombs to sink a battleship. The Japanese exploitation of aerial bombardment succeeded in destroying a large part of the United States fleet in the Pacific. Interestingly enough, the War Department, and especially the Navy, had earlier rejected the concept. A Pearl Harbor mentality is, in some ways, worse than a Maginot Line mentality. The latter addresses the problem, however inadequately. The former does not even recognize that there is a problem— until it is too late. Such historic irony should not be ignored. Computer technology, despite its recognized benefits, can be exploited to our detriment.

The object of citing the Maginot Line and Pearl Harbor episodes is not to draw a parallel with today’s situation but to illustrate a very important lesson. With astute analysis and planning, an aggressor can exploit his opponent’s apparent strength to his own advantage. The superior computer technology of this country must be judged as one of its strengths. Embedded in this strength, however, is a weakness that can be exploited—our dependence on the computer.

vulnerability

For an aggressor to exploit our consolidated computer facilities, he would need to know what facilities are important to our conduct of affairs and where these facilities are located. Fortunately for the aggressor, the innovators of computer technology in this country have an enormous sense of pride. They rush to publishers who help them spread news of their achievements to anyone willing to read. Interestingly enough, Russia ships tons of business periodicals and professional journals from the United States to their analysts each month. Nor are publications of this type limited to the private sector alone; every public sector activity has access to a publication in which to extol its genius. Not only is access available, contributions are strongly encouraged. Articles about efficiencies through applied computer technology make good copy and are welcomed. An aggressor who is willing to plan and execute a military operation should have little difficulty identifying his targets if he considers computer facilities high on his list.

threat

An aggressor needs more than information about his prospective targets. He also needs the opportunity and ability to destroy them. Again, centralized facilities work to his advantage. Although access to such facilities is tightly controlled, few installations are hardened to withstand the effects of a well-placed high-explosive detonation. Although thousands of facilities would have to be destroyed simultaneously, it is not beyond the imagination to develop a scheme that could work. Thousands of illegal aliens enter this country without detection. Not all of these aliens need to be unfortunate refugees fleeing to the land of opportunity. Many such people could be well-trained, well-equipped, well-financed urban guerrillas who blend into the mainstream of our urban business society while awaiting further instructions. During this wait, they could study their targets down to the last detail. Freedom of movement throughout this country and Americans’ willingness to talk shop enhance their mission accomplishment.

Assuming that such a plan could be developed and executed, the consequences would be devastating. Not only would a crippling segment of our commerce, manufacturing, transportation, and banking industries cease to function, critical military functions would be disrupted to the point of ineffectiveness—in short, complete chaos would prevail. At that point the aggressor would be unidentified and intact while this country floundered. The aggressor would have exploited our computer strength and generated a military advantage from which we might have too little time to recover.

The intent of the preceding scenario is to generate an awareness of a serious vulnerability rather than to present a description of how that vulnerability might be exploited by an aggressor at the outset of a full-scale military offensive. Similar vulnerabilities have been exploited in the past. Fortunately, there was sufficient time to recover from the consequences. Technology has eroded the recovery time, and failure to minimize or eliminate this present vulnerability might prove fatal to our national survival. The opportunity to minimize it lies within our advances in computer technology and management skills related to the application of this technology. Corrective measures depend not so much on innovation as on a redirection of current equipment configuration strategies and management concerns.

corrective measures

The development of micro and miniprocessors affords the most significant opportunity to minimize our vulnerability. These small computers no longer require the rigid environmental controls that are required by the large-scale computers. Consequently, there is no longer a need to concentrate the equipment within the confines of a data processing installation. The centralized facilities presently in use provide for economies in floor space, interconnectivity of peripheral equipment, and supervision of operating personnel. These economies might prove to be superficial if destruction of the facility eliminates computer support at a time when it is most needed.

Dispersal. Dispersal of small computers that are linked together through networking would provide similar processing support and lessen the opportunity for an aggressor to deny the dependent activity its lifeline. Migrating existing data processing systems off of the large-scale computers would be prohibitively expensive and time-consuming. The development of replacement systems, as they become necessary, under an architecture of dispersed processors would be a reasonable alternative to wholesale migration. The dispersal of processors would in itself be insufficient in reducing vulnerability.

Critical systems. Not all processing now being performed within the military community would be critical to the conduct of war. Consequently, the preservation of total processing capability is unnecessary. Each system should be analyzed to determine precisely how critical it would be. The criticality of some systems is so obvious that measures have already been taken to ensure their protection. Systems related to strategic targeting are included in this category. A broad spectrum of systems related to financial, logistics, personnel, and resource management is neither arranged by priorities nor adequately protected. Although some effort has been made to establish priorities, few such efforts are given sufficient emphasis. Once the priorities are set, critical systems and the computers on which they are processed should be further analyzed.

Risk analysis. Measures necessary to preserve the computers on which critical systems are processed depend on the degree of protection already afforded the facility. The same concerns that apply to natural and peacetime disasters are relevant to a wartime environment. The difference is that in peacetime a disaster that occurs at one installation is unlikely to happen elsewhere. Consequently, facility managers gear their contingency plans to the ready availability of adequate backup facilities. Under wartime conditions described earlier, backup facilities would not be readily available. Each installation should be evaluated on the risk that exists under the current configuration. This risk analysis should concentrate as such on deliberate destruction as it does on destruction from natural or accidental causes. Where critical systems are considered to be at risk, deliberate action can be taken to reduce that risk.

Software portability. If computer processing is dispersed and some systems are left at risk, every opportunity should be taken to ensure that surviving computers are compatible. Software designed for one system should be operable on other computers. Much of the advantage gained by operating on small computers would be lost if software portability is not an inherent feature of the processors selected for support of critical systems.

Secure backup data storage. Comprehensive risk analysis should be applied to offsite storage of backup data. Nearly every facility has provisions for storing backup data at a location separate from the facility itself. Selection of the site is often based on the likelihood that a natural or accidental disaster would not engulf both the facility and the storage site. Risk analysis should also include an assessment of the survivability of the storage site if the building or complex of buildings in which the computers are housed should be deliberately destroyed. Backup storage too close to the computers should be relocated. Attention should also be given to the security protection afforded the backup data storage site.

Physical security. Physical security is possibly the most essential and least costly element in the protection of computer resources. Elaborate methods are employed to limit access to centralized computer facilities. As computers become dispersed among the offices that are supported, personnel access to those offices must be tightened. Penetration of a military installation would not be difficult during periods of rush hour traffic. In today’s environment, people who have penetrated an installation would have almost unlimited access to offices in which small computers are located. Although some people might be inconvenienced, controlled access should be enforced in any building in which a small computer is used for processing a critical system. Visitors to such buildings should be escorted at all times, and regular employees should wear identification badges. Measures should be taken to enable us to arm key personnel when circumstances warrant. A vigorous security awareness program should be initiated and maintained so that all assigned people within an office are aware of and alert to anyone new in the area.

Contingency planning. All measures suggested thus far are likely to prove inadequate unless contingency planning is developed and exercised. Contingency planning today centers primarily on the ability of the computer facility manager to restore interrupted support to the dependent offices. Planning should be expanded to prepare for widespread loss of computer resources through the use of alternative means of performing critical activities in the event computer support is denied for prolonged periods. Exercises must include functions that are dependent on computers and the people who perform these functions. Exercises, to be effective, must be more than a simulation of situations and responses. They should be real-world, real-time experiences on which competent alternatives can be built.

The ideas expressed here are admittedly brief and incomplete. This article is not intended to serve as a critical analysis or research study. It is intended to stimulate concern for our growing dependence on automated data processing, the computers on which it is accomplished, and the vulnerability of these computers to a well-planned, large-scale attack. An imaginative aggressor could exploit this vulnerability without warning and without disclosing his identity or whereabouts. Such a tactic could paralyze large segments of the private and public sectors, including the military. The aggressor could capitalize on the ensuing chaos to gain a significant and perhaps fatal military advantage over this country.

The threat can be reduced by minimizing the vulnerability, and the opportunity to minimize the vulnerability lies within the evolving technology and management practices. Unlike many aspects of our national defense, the solution to this problem does not depend on innovation. It depends on a logical redirection of hardware configuration architecture toward dispersed facilities and on strengthened security measures and contingency plans. To be effective, impetus for such a program should come from the Air Staff. The following recommendations come to mind:

Simultaneously, a task force of leaders in the public and private sector data processing community should be convened to determine effective measures for safeguarding computer resources nationwide.

Wright-Patterson AFB, Ohio

Contributor

Colonel Thomas L. Volkmann (B.S., Utah State University; M.A.O.M., University of Southern California) is Director of Automatic Data Processing Resources, Headquarters Air Force Logistics Command, Wright-Patterson AFB, Ohio. He has served as Commander, 3900th Computer Services Squadron (SAC); Deputy Director, War Plans Programming, Headquarters SAC/DCS Data Systems; and Director, Office of Data Systems, Defense Fuel Supply Center (DLA). Colonel Volkmann is a graduate of Squadron Officer School, Industrial College of the Armed Forces, and the Professional Military Comptroller School.

Disclaimer

The conclusions and opinions expressed in this document are those of the author cultivated in the freedom of expression, academic environment of Air University. They do not reflect the official position of the U.S. Government, Department of Defense, the United States Air Force or the Air University.

Air & Space Power Home Page | Feedback? Email the Editor