By Susan Crabtree, the Washington Free Beacon
U.S. special operators and other troops have been using advanced war-fighting applications for hand-held devices that contain software weaknesses that render them vulnerable to hacking by hostile actors, a non-public U.S. Navy Inspector General investigation found earlier this year.
The mapping applications at issue are known by their acronyms KILSWITCH and APASS and have been widely disseminated and used in training and combat among special operators and other forces across the military for several years, beginning with the Navy and Marine Corps in approximately 2012.
The apps are used to accelerate precision targeting and facilitate situational awareness and data-sharing between ground forces and overhead aircraft.
Navy leadership, along with top Pentagon officials, were alerted to the security problems in the Spring of 2017 but continued to allow frontline troops from multiple military branches, including special operators, to use them without issuing sufficient warnings or attempting to pull the applications back from use.
The IG report that faulted the programs is non-public, but its findings are cited in a Marine Corps force-wide message that warns commanders and officers in charge of cybersecurity for their units to ensure that the applications are only used in a manner consistent with explicit guidelines set by the top USMC information officer.
Using KILSWITCH and APASS in an unauthorized way “could present a significant vulnerability in compromising Marine Corps data,” the message states.
The message, dated June 22, warns that inappropriate use of the apps could amount to a violation of “Marine Corps orders and/or the Uniformed Code of Military Justice.”
(Learn More. Understand how Strava’s online exercise-tracking map unwittingly reveals remote military outposts — and even the identities of soldiers based there. The situation shows how data collection can lead to unintended consequences. Courtesy of the New York Times and YouTube. Posted on Jan 30, 2018.)
The Navy has not issued a similar force-wide alert.
The mapping apps with the cybersecurity weaknesses, which were developed by civilian software engineers working for the U.S. Navy, have spread to U.S. allies who are also widely using them, according to several special operators and service members who requested anonymity out of fear of reprisal.
The USMC force-wide message alludes to this problem, ordering commanding generals and officers to notify “mission partners, to include foreign military, that are operating with or under their command of the appropriate implementation of this system to mitigate potential cybersecurity vulnerabilities.”
Although the message does not identify the terms of the appropriate use of the apps, a 2015 article on KILSWITCH and APASS states that the programs are intended for use on secure, DOD-issued Android devices that are “wirelessly connected through an encrypted internal Wi-Fi network.” The article appeared in a Department of Defense publication.
Several service members the Washington Free Beacon interviewed say the hacking weaknesses derive from the widespread downloading of both programs by soldiers onto personal, unencrypted devices because of their ready availability and the apparent indifference or tacit approval of many military commanders to the practice.
Despite seeing the apps regularly used in training and combat, none of the service members interviewed said their commanding officers had warned them about the hacking vulnerabilities the apps pose, nor did they tell them to delete the application from any personal devices.
The service members expressed alarm that the Navy and other branches have yet to make any apparent efforts to alert frontline troops to the problem.
“I don’t think people know it’s making them vulnerable,” said one special operator. “It’s not something that is being said widespread, the word hasn’t gotten out, and if it has, it’s not something people are talking a lot about.”
Reached for comment about the cybersecurity weaknesses of the mapping apps and their continued widespread distribution, a Navy official said the inspector general investigation into the matter is still open so it would be “inappropriate” to comment.
What are KILSWITCH and APASS?
KILSWITCH is an acronym that stands for Kinetic Integrated Low-cost Software Integrated Tactical Combat Handheld. APASS stands for the Android Precision Assault Strike Suite.
The apps provide satellite views of a warfighter’s surroundings similar to Google Maps that help pinpoint locations. They also enable forces to talk to each other and share updates in real time like instant messages to provide better situational awareness.
Engadget noted in a 2015 blog post that the KILSWITCH app can help forces devoted to calling in airstrikes, known as Joint Terminal Attack Controllers (JTACs) deliver airstrikes in four minutes, faster than ever before.
Before the development of sophisticated satellite-mapping software programs, requests for airstrikes and other close air support were done using radios and paper maps. After the initial request, there would be a long lag time for the airstrikes to arrive.
Careful coordination between JTACs and the inbound aircrews is necessary in order to avoid friendly fire. In intense combat situations, such constant coordination can take place in the middle of a firefight with opposing forces.
While some special operators in the Navy and conventional Marines readily embraced the KILSWITCH/APASS applications, critics aware of the hacking weaknesses point to a preferred and more trusted geo-spatial program that provides up-to-the second situational awareness whose software has been rigorously tested and doesn’t have the cybersecurity vulnerabilities.
That more rigorously tested and widely trusted program across the military branches, according to interviews with active-duty troops, is the Android Tactical Assault Kit (ATAK), which was developed and fully vetted and tested by the Air Force Research Laboratory, or AFRL.
(The Android Team Awareness Kit (ATAK), a Finalist in the 2018 ‘ASTORS’ Homeland Security Awards Program, is a gps communications tool that runs on a mobile device and improves situational awareness by allowing users to know where their mission partners are located, regardless of affiliation. It also improves communications through a variety of applications. Courtesy of DHS Science and Technology Directorate and YouTube. Posted on Nov 17, 2017.)
Created in 2010, ATAK appears to be the program of record for the U.S. Special Operations Command (SOCOM), according to ATAK’s website.
A program of record designation means a new technology has been subjected to such rigorous testing that it’s part of an approved budget line for the Future Years Defense Program, an annual catalogue summarizing resources and programs associated with Department of Defense operations.
There is also a civilian version of ATAK that has fewer features than the military’s, which is widely used and trusted by the U.S. law enforcement agencies.
Anger among war fighters
Since its introduction, the use of KILSWITCH/APASS has proliferated among special operators and other forces across the military who have shared the easily downloadable application among themselves without knowing about the serious dangers they pose.
Warfighters often express anger when they discover that top Pentagon officials have known for more than a year about serious cyber security risks that were not sufficiently vetted prior to distributing the software to frontline troops.
One active duty combat veteran who is currently serving as a JTAC said his job sometimes involves such precise airstrikes as “putting a bomb through a [particular] window on a second story.”
“That’s where the risks come in because [the apps] are buggy,” he said. “It’s scary stuff, knowing that we are going to be pushing down range here and potentially using it and potentially making mistakes that could kill us.”
“In an operational situation, I wouldn’t personally use it or be around anyone that is using it,” the service member said.
Another special operator who has served as a JTAC for 10 years with multiple deployments in the Middle East said warfighters trust the military and civilian Pentagon leadership to test the systems they provide, not hand them technology that could endanger them.
“As warfighters, we trust the military is going to provide for us. They get the money and the funding, and it’s very transparent to the operator, to the pilots, and the JTACs, that we’re going to use this product, and this is accredited and certified,” he said. “The guy at the pointy end of the spear—we have to trust the system to provide for us. We are the people who are putting our lives on the line.”
One pilot said he has ordered teams and aircrew flying with him not to take the KILSWITCH or APASS applications on board in any capacity.
“I told them they have to take it off [their devices]. These guys are carrying around something that has a vulnerability. … I told my guys, ‘[ATAK, the program of record for SOCOM] is what you will use—don’t even try to use that other software.'”
Still, the pilot said, he’s worried that the apps have been so widely distributed that it will be difficult to convince some special operators to give them up.
“If you stick a shiny object in front of somebody, they’re going to use it,” he said.
Whistleblower Complaint
The Navy inspector general investigation began after a whistleblower filed a complaint about the apps’ software development problems.
Anthony Kim, a civilian program analyst assigned to the Naval Air Warfare Center Weapons Division (NAWCWD) located at the Naval Air Weapons Station in China Lake, Calif., in March 2017 reported the security issues he discovered up his chain of command to the station’s civilian leadership.
Kim’s 28 years of military service and experience as a Navy JTAC, who orders combat airstrikes and other close air support, made him acutely aware of the dangers the applications could pose to warfighters in combat situations.
He has spent two years as a major in the Washington state Air National Guard where he serves as an air liaison officer and JTAC and previously served 26 years in the Navy where he was a pilot and JTAC.
Reached for comment, Kim’s attorney Sean Bigley faulted a team of software developers who work for the Digital Precision Strike Suite, DPSS, located at the China Lake air station and their failure to rigorously test the KILSWITCH/APASS applications.
China Lake’s civilian leadership had promoted the apps as safe for combat operations and “studiously ignored” Kim’s warnings, said Bigley.
When Kim continued to raise concerns to China Lake leadership, Bigley says he was admonished and expressly instructed to “stop discussing DPSS in any disparaging way”.
His civilian superiors then began a process of retaliating against him, Bigley argues. First, they reduced his pay as a warning—a reduction that occurred after Kim had earned high marks on his yearly performance ratings.
Kim then reported his concerns to senior Pentagon officials and ultimately filed a formal complaint that launched the Navy Inspector General (IG) investigation into the software development and testing problems.
Exactly one month after the Navy IG substantiated Kim’s concerns, China Lake security officials suspended his security clearance and his pay, placing him on unpaid leave based on vague “threatening statements” he purportedly made at an unidentified time and place up to one year prior, Bigley said.
Those actions constitute “prima facie evidence of retaliation,” Bigley argues.
Bigley also stressed that his client followed the rules and reported the hacking weaknesses he discovered up his chain of command but was still retaliated against, a by-the-book process National Security Agency leaker Edward Snowden said he didn’t follow because he feared severe retaliation and a cover-up.
“Unlike Edward Snowden, Major Kim did everything right reporting his whistleblower complaints up the chain of command, yet the government still screwed him,” Bigley said. “Snowden recklessly compromised our national security, and his behavior should never be condoned. But he was right that the legal protections for government whistleblowers are woefully inadequate and remain so to date.”
Defense Department officials in Washington, D.C., have subsequently reinstated Kim’s security clearance and authorized his return to work. There is also an ongoing DOD Inspector General investigation into what Bigley argues were unlawful whistleblower reprisals against Kim.
Bigley views Kim’s case as part of a pattern of problems at the DOD regarding retaliation against whistleblowers’ security clearances. He represents several other DOD officials, including Adam Lovinger, whose security clearance revocation case has been chronicled extensively in the media and has garnered support in Congress.
In response to that case, Rep. Louie Gohmert (R., Texas) recently introduced legislation to establish, for the first time, mandatory penalties for government officials who abuse the security-clearance system to unlawfully punish whistleblowers.
Sen. Ted Cruz (R., Texas) earlier this year successfully inserted a provision into the National Defense Authorization Act that requires DOD to report to Congress each time the department revokes a security clearance outside the established periodic re-investigation process.
Original post https://freebeacon.com/national-security/mapping-apps-endangering-special-operators/
DHS S&T ‘ATAK’ Android Team Awareness Kit Named a Finalist in the 2018 ‘ASTORS’ Homeland Security Awards Program
AST focuses on Homeland Security and Public Safety Breaking News, the Newest Initiatives and Hottest Technologies in Physical & IT Security, essential to meeting today’s growing security challenges.
The 2018 ‘ASTORS’ Homeland Security Awards Program, is organized to recognize the most distinguished vendors of Physical, IT, Port Security, Law Enforcement, Border Security, First Responders, (Fire, EMT, Military, Support Services Vets, SBA, Medical Tech) as well as the Federal, State, County and Municipal Government Agencies – to acknowledge their outstanding efforts to ‘Keep our Nation Secure, One City at a Time.’
As an ‘ASTORS’ competitor, the DHS S&T ‘ATAK’ Android Team Awareness Kit is competing against the industry’s leading providers of Federal Government Security Solutions.
To Learn More about the ‘ASTORS’ Homeland Security Awards Program, see 2017 ‘ASTORS’ Homeland Security Award Winners Honored at ISC East.
Over 100 distinguished guests from National, State and Local Governments, and Industry Leading Corporate Executives from companies allied to Government, gathered from across North America and the Middle East to be honored from disciplines across the Security Industry in their respective fields which included representatives from:
- The Department of Homeland Security (DHS) Science and Technology Directorate (S&T)
- U.S. Customs and Border Protection
- The Department of Justice
- The Security Exchange Commission
- State and Municipal Law Enforcement Agencies
- The Royal Canadian Mounted Police
- Leaders in Private Security
The highlight of the 2018 AST Homeland Security Awards Season will be the 2018 ‘ASTORS’ Awards Presentation Luncheon to honor Nominees, Finalists and Winners on November 14, 2018 at ISC East 2018 at the Jacob Javits Exhibition Center in New York City.
Good luck to DHS S&T on becoming a Winner of the 2018 American Security Today’s Homeland Security Awards Program!
To Learn More about the DHS S&T ‘ATAK’ Android Team Awareness Kit, please visit https://www.dhs.gov/science-and-technology/android-team-awareness-kit-atak-video.
Join us in Recognizing these Industry-Leading Firms for their Outstanding Product Development Achievements, Exciting New Technologies and Innovative Education Programs to address the growing Homeland Security Threats our Nation is facing.
Take advantage of this exclusive luncheon opportunity to Invite your Guests, Clients and Show Visitors to a lovely & affordable plated meal event in the heart of New York City, for a Fabulous Networking Opportunity!
ISC East is the Northeast’s largest security industry event and your ‘ASTORS’ Awards Luncheon registration includes complimentary attendee access to the show.
Already Exhibiting and/or Attending the 2018 ISC East Conference?
Join us to meet the 2018 ‘ASTORS’ Award Winning Company Executives & Government Agency Representatives.
Register today for the ‘ASTORS’ Homeland Security Awards Luncheon on November 14th, in New York City and give yourself & your clients a break from the show!
Gourmet luncheon choices available per person, or reserve a table – make an Impression on your Guests and Receive an Exclusive Discount Opportunity.
