Above And Beyond Promotion

Archive for May, 2011

By SIOBHAN GORMAN And JULIAN E. BARNES

WASHINGTON—The Pentagon has concluded that computer sabotage coming from another country can constitute an act of war, a finding that for the first time opens the door for the U.S. to respond using traditional military force.

WSJ’s Siobhan Gorman has the exclusive story of the Pentagon classifying cyber attacks by foreign nations as acts of war. Photo: THOMAS KIENZLE/AFP/Getty Images

The Pentagon’s first formal cyber strategy, unclassified portions of which are expected to become public next month, represents an early attempt to grapple with a changing world in which a hacker could pose as significant a threat to U.S. nuclear reactors, subways or pipelines as a hostile country’s military.

In part, the Pentagon intends its plan as a warning to potential adversaries of the consequences of attacking the U.S. in this way. “If you shut down our power grid, maybe we will put a missile down one of your smokestacks,” said a military official.

Recent attacks on the Pentagon’s own systems—as well as the sabotaging of Iran’s nuclear program via the Stuxnet computer worm—have given new urgency to U.S. efforts to develop a more formalized approach to cyber attacks. A key moment occurred in 2008, when at least one U.S. military computer system was penetrated. This weekend Lockheed Martin, a major military contractor, acknowledged that it had been the victim of an infiltration, while playing down its impact.

The report will also spark a debate over a range of sensitive issues the Pentagon left unaddressed, including whether the U.S. can ever be certain about an attack’s origin, and how to define when computer sabotage is serious enough to constitute an act of war. These questions have already been a topic of dispute within the military.

One idea gaining momentum at the Pentagon is the notion of “equivalence.” If a cyber attack produces the death, damage, destruction or high-level disruption that a traditional military attack would cause, then it would be a candidate for a “use of force” consideration, which could merit retaliation.

The War on Cyber Attacks

Attacks of varying severity have rattled nations in recent years.

June 2009: First version of Stuxnet virus starts spreading, eventually sabotaging Iran’s nuclear program. Some experts suspect it was an Israeli attempt, possibly with American help.

November 2008: A computer virus believed to have originated in Russia succeeds in penetrating at least one classified U.S. military computer network.

August 2008: Online attack on websites of Georgian government agencies and financial institutions at start of brief war between Russia and Georgia.

May 2007: Attack on Estonian banking and government websites occurs that is similar to the later one in Georgia but has greater impact because Estonia is more dependent on online banking.

The Pentagon’s document runs about 30 pages in its classified version and 12 pages in the unclassified one. It concludes that the Laws of Armed Conflict—derived from various treaties and customs that, over the years, have come to guide the conduct of war and proportionality of response—apply in cyberspace as in traditional warfare, according to three defense officials who have read the document. The document goes on to describe the Defense Department’s dependence on information technology and why it must forge partnerships with other nations and private industry to protect infrastructure.

The strategy will also state the importance of synchronizing U.S. cyber-war doctrine with that of its allies, and will set out principles for new security policies. The North Atlantic Treaty Organization took an initial step last year when it decided that, in the event of a cyber attack on an ally, it would convene a group to “consult together” on the attacks, but they wouldn’t be required to help each other respond. The group hasn’t yet met to confer on a cyber incident.

Pentagon officials believe the most-sophisticated computer attacks require the resources of a government. For instance, the weapons used in a major technological assault, such as taking down a power grid, would likely have been developed with state support, Pentagon officials say.

The move to formalize the Pentagon’s thinking was borne of the military’s realization the U.S. has been slow to build up defenses against these kinds of attacks, even as civilian and military infrastructure has grown more dependent on the Internet. The military established a new command last year, headed by the director of the National Security Agency, to consolidate military network security and attack efforts.

The Pentagon itself was rattled by the 2008 attack, a breach significant enough that the Chairman of the Joint Chiefs briefed then-President George W. Bush. At the time, Pentagon officials said they believed the attack originated in Russia, although didn’t say whether they believed the attacks were connected to the government. Russia has denied involvement.

The Rules of Armed Conflict that guide traditional wars are derived from a series of international treaties, such as the Geneva Conventions, as well as practices that the U.S. and other nations consider customary international law. But cyber warfare isn’t covered by existing treaties. So military officials say they want to seek a consensus among allies about how to proceed.

“Act of war” is a political phrase, not a legal term, said Charles Dunlap, a retired Air Force Major General and professor at Duke University law school. Gen. Dunlap argues cyber attacks that have a violent effect are the legal equivalent of armed attacks, or what the military calls a “use of force.”

“A cyber attack is governed by basically the same rules as any other kind of attack if the effects of it are essentially the same,” Gen. Dunlap said Monday. The U.S. would need to show that the cyber weapon used had an effect that was the equivalent of a conventional attack.

James Lewis, a computer-security specialist at the Center for Strategic and International Studies who has advised the Obama administration, said Pentagon officials are currently figuring out what kind of cyber attack would constitute a use of force. Many military planners believe the trigger for retaliation should be the amount of damage—actual or attempted—caused by the attack.

For instance, if computer sabotage shut down as much commerce as would a naval blockade, it could be considered an act of war that justifies retaliation, Mr. Lewis said. Gauges would include “death, damage, destruction or a high level of disruption” he said.

Culpability, military planners argue in internal Pentagon debates, depends on the degree to which the attack, or the weapons themselves, can be linked to a foreign government. That’s a tricky prospect at the best of times.

The brief 2008 war between Russia and Georgia included a cyber attack that disrupted the websites of Georgian government agencies and financial institutions. The damage wasn’t permanent but did disrupt communication early in the war.

A subsequent NATO study said it was too hard to apply the laws of armed conflict to that cyber attack because both the perpetrator and impact were unclear. At the time, Georgia blamed its neighbor, Russia, which denied any involvement.

Much also remains unknown about one of the best-known cyber weapons, the Stuxnet computer virus that sabotaged some of Iran’s nuclear centrifuges. While some experts suspect it was an Israeli attack, because of coding characteristics, possibly with American assistance, that hasn’t been proven. Iran was the location of only 60% of the infections, according to a study by the computer security firm Symantec. Other locations included Indonesia, India, Pakistan and the U.S.

Officials from Israel and the U.S. have declined to comment on the allegations.

Defense officials refuse to discuss potential cyber adversaries, although military and intelligence officials say they have identified previous attacks originating in Russia and China. A 2009 government-sponsored report from the U.S.-China Economic and Security Review Commission said that China’s People’s Liberation Army has its own computer warriors, the equivalent of the American National Security Agency.

That’s why military planners believe the best way to deter major attacks is to hold countries that build cyber weapons responsible for their use. A parallel, outside experts say, is the George W. Bush administration’s policy of holding foreign governments accountable for harboring terrorist organizations, a policy that led to the U.S. military campaign to oust the Taliban from power in Afghanistan.

Write to Siobhan Gorman at siobhan.gorman@wsj.com

Powered by Yahoo! Answers

Powered by Yahoo! Answers

By ANDY PASZTOR And DANIEL MICHAELS

Cruising at 35,000 feet and nearly four hours into what seemed a routine overnight flight to Paris from Rio de Janeiro, an Air France cockpit crew got a stall warning and responded by doing what even weekend pilots know to avoid: They yanked the nose of the plane up instead of pointing it down to gain essential speed.

Air France stands behind pilots of plane that crashed two years ago kiling all 228 people aboard. Video courtesy of Reuters.

Apparently confused by repeated stall warnings and reacting to wildly fluctuating airspeed indications, pilots of Flight 447 continued to pull back sharply on the controls—contrary to standard procedure—even as the Airbus A330 plummeted toward the Atlantic Ocean, according to information released Friday by French accident investigators. The June 2009 crash took the lives of all 228 on board.

Final Minutes of Flight 447

View Full Image

The pilots’ actions are likely to lead to a global shake-up in pilot training that reappraises the role of computer aids, as aviation-safety experts increasingly worry that many airlines scrimp on drilling manual flying techniques.

Still to be answered is how seasoned pilots for a top airline, flying one of the industry’s most advanced jets, violated such a fundamental rule of airmanship.

The introduction of automation has made flying dramatically safer over the years. In the U.S., for instance, fatal accident rates are at record lows. But if pilots are taught to abdicate too much responsibility to automated systems, essential piloting skills can dull and aviators become too reliant on computers in emergencies.

That’s particularly troublesome if onboard flight-control computers malfunction, disconnect or, as in the case of Flight 447, give conflicting information and warnings to pilots. “Pilots are starting to serve the automation, not the automation serving the pilots,” said Bill Voss, president of the Flight Safety Foundation of Alexandria, Va., an independent advocacy group championing enhanced training. “It’s almost like we have to train the pilots to know how to triage these situations.”

The long-awaited factual report, though it doesn’t explicitly say the pilots acted improperly, provides important new details about their actions during a dangerous loss of forward momentum that lasted more than three and a half minutes.

Investigators already concluded that except for malfunctioning airspeed probes, there were no other mechanical, electrical or system errors.

The report paints a somewhat unflattering picture of a seemingly confused cockpit, with the crew making extreme inputs to their flight controls and the engines spooling up to full power and later the thrust levers being pulled back to idle. At one point, according to the report, both pilots sitting in front of the controls tried to simultaneously put in commands.

The preliminary findings offer “a strong piece of evidence that as an industry, we need to improve upset recovery training,” said John Cox, a former airline pilot and accident investigator who now runs Safety Operating Systems LLC, a consulting firm based in Washington, D.C.

The senior captain on the flight, Marc Dubois, who was on a routine rest break in the cabin when the trouble started, rushed back to the cockpit and was present and observing the other pilots’ actions during a large portion of the descent.

Air France praised the three pilots, who “demonstrated a totally professional attitude and were committed to carrying out their task to the very end,” the airline said in a statement.

The carrier, a unit of Air France-KLM SA, noted that “the initial problem was the failure of the speed probes which led to the disconnection of the autopilot and the loss of the associated piloting protection systems.”

The largest trade union representing Air France pilots, SNPL, said Friday the report “describes only part of the sequence of events experienced by the crew” and it awaits the full report.

Throughout the sudden descent, according to the report, “inputs made by the were mainly nose-up,” which reduced the plane’s lift. Pilots are taught from their earliest training that if an airplane begins to stall and its wings have lost the lift to remain airborne, they should immediately push the nose down to regain speed, lift and maneuverability.

View Full Image

Agence France-Presse/Getty Images

Air France pilots pulled the jet’s nose up, losing momentum. Above, black boxes displayed in France May 12.

The report could provide ammunition for the lawsuits against Air France, though plaintiffs also are likely to pursue Airbus for how it handled airspeed-indication issues over the years.

The problems with the speed probes on the Air France plane, and others like it, were well known. They had a history of icing up and giving faulty readings. The probe’s maker, Thales SA of France, declined to comment. Airbus and regulators had established procedures to handle such situations with the probes, which are called pitot tubes. These procedures focused on maintaining sufficient thrust and avoiding extreme maneuvers.

Airbus, a unit of European Aeronautic Defence Space Co., said in a statement it is committed to continuing to provide support to the investigation “with the objective of identifying all potential lessons to be learnt.”

About three hours and 40 minutes into the flight, when the airspeed-indication issue first cropped up and the pilots received their initial stall warning at around 35,000 feet, the report shows the crew maintained control and temporarily managed to stabilize the plane at an altitude above 37,000 feet. That took just under a minute.

But then with their jet basically flying level despite airspeed-sensors that continued to display unreliable readings, the pilots started to veer away from typical procedures, the data released Friday reveals. French investigators didn’t comment on reasons for the crew’s behavior.

Upon receiving a second stall warning, the crew increased engine thrust substantially—part of standard practice to cope with such a situation. But for the next 50 seconds, the pilot at the controls did something that safety experts consider anathema: He continued to pull the jet’s nose up, despite the threat of worsening the stall.

About two minutes after the first problems—and with the captain back in the cockpit—the jet was falling at a rate of 10,000 feet a minute, comparable to dropping 15 stories a second in an elevator. Yet the plane’s nose remained pointed sharply upward as the wings rocked side to side and its forward speed hovered around 100 miles an hour, too slow for a jetliner to fly.

“I don’t have any more indications,” one of the pilots said, perhaps referring to airspeed but possibly something else. “We have no valid indications.” The report doesn’t elaborate.

At that juncture, according to the report, both thrust levers were pulled back to idle. The report also said that both engines were operating and responding normally to pilot commands.

The report goes on to describe how roughly a minute later, with the plane already dropping to around 10,000 feet altitude, there were “simultaneous inputs by both pilots on the sidesticks” that control the aircraft, with one of the pilots trying to clear up the confusion by telling the other “go ahead, you have the controls.” Pilots are trained to avoid such simultaneous commands.

The plane’s data recorders stopped four minutes and 27 seconds after the autopilot kicked off, with the plane still dropping at roughly 10,000 feet a minute, tail down and slightly rolled to the left.

Air France has had a history of safety issues over recent years. After the crash of an Air France Airbus A340 on landing in Toronto 2005 that resulted in no fatalities but destroyed the plane, the airline ordered a thorough study of its approach to safety. The airline later said most of the report’s recommendations had been implemented.

After the 2009 crash, the airline commissioned another study of its practices by a panel of leading international safety experts. That report, which was delivered to the airline in January, found a lack of “strong safety leadership at all levels of management” that resulted in lax cockpit discipline and ineffective pilot training. Air France said it was studying and implementing the report’s recommendations.

Associated Press

Brazil’s Navy sailors recover debris from the missing Air France jet at the Atlantic Ocean in June 2009.

In terms of future impacts, Friday’s report is a prelude to a broad, industrywide study likely to be released later this year, focusing on the interplay of training and automation. After analyzing more than 730 incidents, 26 accidents and thousands of flights world-wide going back to 2001, Kathy Abbott, the Federal Aviation Administration’s chief technical adviser for flight-deck design, told a safety conference last year that too many pilots rely excessively on automation.

One cross-cutting theme of the study, featuring broad participation from unions, carriers, manufactures and regulators, is that “pilots sometimes abdicate too much responsibility to the automated systems,” according to Ms. Abbott. Part of the reason, she said, are persistent messages from airline management and trainers stressing that “automated systems can do the job better than” pilots.

The final Air France report, which may be a year or more away, also is expected to provide momentum for safety experts seeking sweeping changes in all types of stall-recovery training, including low-level events. Traditionally, flight instructors and senior airline training officials have emphasized the importance of strictly maintaining altitude while powering out of a stall. But lately, regulators and airlines increasingly are embracing a new training approach emphasizing pushing down the nose of the plane to gain speed and recover control—even if it entails giving up altitude.

That technique also was highlighted by findings from the 2009 crash of a Colgan Air turboprop near Buffalo, N.Y., which killed 50 people.

Write to Andy Pasztor at andy.pasztor@wsj.com and Daniel Michaels at daniel.michaels@wsj.com

Powered by Yahoo! Answers