national air intelligence center“yosemite sam” represents 480th intelligence group w the 480th...

August 199714

National Air Intelligence Center

eadquartered at Wright-Patterson Air Force Base, Ohio,

broad range of integrated, tailoredassessments and information opera-tions products and services.

These services and products di-rectly support Air Force operationalunits, national decision makers, aswell as the research and develop-ment sustaining the acquisition ofUnited States air and space weaponssystems. The combat effectivenessand survivability of advanced weap-ons and support systems, both in thefield and in development, dependson the accuracy of NAIC intelligence.

The National Air IntelligenceCenter develops its products by ana-lyzing all data available to the U.S.intelligence community on foreign airand space forces and weapon sys-tems to determine performance char-acteristics, capabilities, vulnerabilitiesand employment.

NAIC assessments are also an im-portant factor in shaping our nationalsecurity and defense policies. As theDepartment of Defense experts on for-eign aerospace system capabilities,center members have historically beeninvolved in supporting U.S. weaponstreaty negotiations and verification.

Center responsibilites cover thefull range of air and space systemsand technologies including:

Q aircraftQ missilesQ space systemsQ radarsQ electronic and electro-optic

countermeasuresQ integrated air defense systemsQ command, control and

communication systems

Sophisticated data processing, en-

NATIONAL AIRINTELLIGENCE CENTER

The National Air Intelligence Center’s Electronic Warfare Signals Laboratory.

Hthe National Air Intelligence Center,a component of the Air IntelligenceAgency, is the Air Force’s single, in-tegrated intelligence production cen-ter and is the primary Department ofDefense producer of foreign aerospaceintelligence.

The NAIC assesses current andprojected foreign forces, threat andweapon system capabilities and em-ployment, develops targeting andmission planning intelligence materi-als and evaluates evolving technolo-gies of potential adversaries.

NAIC products and services playa key role in assuring that Americanforces avoid technological surpriseand can counter the foreign air andspace threat. NAIC and constituentunits provide center customers a

15


gineering and modeling techniquesenable NAIC analysts, technicians, sci-entists and engineers to fulfill thecenter’s mission.

Another core NAIC mission areais the processing and exploitation ofMeasurement and Signature Intelli-gence. NAIC serves as the Nationaland Department of Defense executiveagent for processing, exploitation, in-tegration, reporting and dissemina-tion of MASINT data collected fromradar, electro-optical and infra-redtechnical sensors.

NAIC prepares spectral, spatialand temporal signatures of threat tar-gets in support of air and space forces,develops analytical tools for technicalanalysis and provides technologytransfer of these techniques for fusionof MASINT data in the operationalenvironment.

NAIC is the nation’s only exploi-tation organization for imagery col-lected under the Open Skies Treaty.It serves as the exploitation agencyfor Signals Intelligence collected forthe RC-135 Rivet Joint and CombatSent missions and is the Departmentof Defense organization for the devel-opment of machine translation tools.

HQ NAIC traces its roots back tothe Foreign Data Section of the Air-plane Engineering Department,formed in 1917, atMcCook Field inDayton, Ohio.The section stud-ied foreign air-craft, translatedforeign languageaerospace publica-tions and main-tained a technicallibrary.

During WorldWar II, the Army designated the unitthe Technical Data Laboratory anddepended upon it for information on

enemy aircraft technology. By theend of 1945, nearly 750 people wereat work at the unit, then known as“T-2 Intelligence,” evaluating cap-tured foreign aircraft and translating,indexing and microfilming technicaldocuments.

In 1951, theS&TI mission fellupon the AirTechnical Intelli-gence Center, itsprimary focusSoviet technol-ogy. In July1961, the AirForce deacti-vated ATIC, yet activated another unitto take over its manpower, missionand facilities.

The Air Force SystemsCommand’s Foreign Technology Di-vision was the organizational begin-ning of today’s National Air Intelli-gence Center. Since the beginning ofits organizational lineage in 1961, theunits mission and resources have ex-panded to meet the challenges ofworldwide technological develop-ments and the accompanying nationalneed for aerospace intelligence.

In recent years, the emphasis hasincreasingly shifted toward evalua-tion of worldwide aerospace systemsand the production of “tailored,” cus-

t o m e r - s p e c i f i cproducts.

NAIC wasformed Oct. 1,1993, with the in-tegration of theForeign Aero-space Science andTechnology Cen-ter and the 480thI n t e l l i g e n c eGroup.

Headquarters NAIC employsmore than 1,600 people. Subordinate

units at Langley Air Force Base, Va.,and Offutt Air Force Base, Neb., formthe 480th IG, and provide support toNAIC operational customers.

The five divisions of the Director-ate of IntelligenceAnalysis, locatedat the Pentagonand Washington,D.C., area, pro-vide tailored,substantive mili-tary intelligenceto the Air ForceChief of Staff, theSecretary of theAir Force, Air

Staff and other Department of De-fense and national customers.

Besides their commitment to themission, the 2,059 people that workfor NAIC are actively involved inmany community projects helpingpeople. Tutoring children at a localschool, coaching youth sports teams,working with Habitat for Humanityin building houses for the less-fortu-nate, working with kids that havemental and physical challenges,adopting a highway, organizing localfood and blood drives and sponsor-ing the Wright-Patterson Air ForceBase Annual Sports Day.

NAIC people are leading the way,making the community better.

As our nation enters the informa-tion age of the 21st century, the needfor tailored air and space intelligenceand information operations productsand services will continually increase.

As information operators on theAIA team, NAIC will continue to pro-vide the nation’s military forces thetailored intelligence products essen-tial to precision employment and in-formation-based warfare, expandingthe Air Force’s capability to conductinformation operations and achieveinformation superiority.

The National Air Intelligence Center’s 24-hourWatch Area.

Ray Austerman, NAIC, removes large printsfrom an IRIS printer.

August 199716


ith headquarters located atLangley Air Force Base, Va.,

480th provides the deployed warfighter direct access to the compre-hensive assets of the NAIC.

The unit is organized into threesubordinate squadrons:

� 20th Intelligence SquadronLocated at Offutt Air Force Base,

Neb., was assigned in 1992.

� 27th Intelligence SquadronLocated at Langley Air Force Base,

Va., was assigned in 1990.

� 36th Intelligence SquadronLocated at Langley Air Force Base,

Va., was assigned in 1990.

Also, the 123rd IntelligenceSquadron, an Arkansas Air NationalGuard Unit, located at Little Rock AirForce Base, is gained during wartime.

Subordinated squadrons provideboth scheduled and ad hoc intelli-gence tailored to the unique, immedi-ate needs of air warfighters. Theyemploy the concepts and processes ofvirtual production, application utiliz-ing a myriad of state-of-the-art infor-mation processing and productionsystems and on-line databases.

The unit has committed itself tobeing ever vigilant of the constantadvances in information processing,storage and dissemination technologies.It is also recognized throughout theintelligence and operational commu-nity as a leader in the testing, evalu-ation and application of new tech-nologies to meet the needs of current

and emerging weapons systems andtheir employed munitions.

The unit has been instrumental inrecent innovative programs andprojects that included the develop-ment of digital target materials, pro-duction of digital materials for AirForce Mission Support Systems, vir-tual production and providing aircombat units with near-real-time im-agery information for mission plan-ning and execution.

Since its origination in 1969, the480th has been awarded five Air ForceOutstanding Unit Awards.

20THINTELLIGENCE SQUADRON

EMBLEMThe patch was approved in 1958.

The cloud and sky are symbolic ofthe squadron’s historic flying mission.

“Yosemite Sam” represents

480TH INTELLIGENCE GROUP

Wthe 480th Intelligence Group is a com-ponent of NAIC.

Langley is a long standing estab-lishment on the lower peninsula ofVirginia. It is a major contributor tothe entire community known as theTidewater area, which is locatedwithin minutes of several majorcities including Norfolk, Hampton,Newport News and ColonialWilliamsburg. The capital, Richmond,is only an hour away.

The 480th, formerly an Air Com-bat Command organization, providesconventional mission planning sup-port and target materials, multi-sourceintelligence analysis and operationalintelligence required to train, prepareand support in-garrison and deployedcombat air forces.

MISSIONThe 480th’s specific mission is to

process and apply intelligence andother information using state-of-the-art capabilities to provide timely, rel-evant and accurate products and ser-vices for the operational air forces.

VISIONThe unit’s vision is “Center of

Excellence,” providing imagery-fo-cused multidisciplined intelligence forglobal information superiority, com-mitted to vigilance.

Through sophisticated communi-cations and computer systems, the

Supporting the operational forces by providingtimely intelligence information

17


squadron personnel carrying on theactivities of the unit, map reading,target location and visual reconnais-sance. Sam’s gun is symbolic oftarget-making weapons and devices,and the camera system indicates pho-tographic reconnaissance.

The lightning bolt represents di-rect destruction from the air, artilleryadjustment and fighter strikes.

The 20th IS provides missionplanning support primarily to bomberunits in support of U.S. Strategic Com-mand. It maintains liaison betweenNAIC and U.S. Strategic Commandon nuclear targeting, weaponeeringand battle damage assessment issues.

MISSIONThe mission of the 20th is to pro-

vide prompt, precise intelligence en-abling warfighters to safely engageand achieve global objectives.

The 20th processes and analyzesraw electronic intelligence data, andprepares both operational and tech-nical ELINT reports and studies.

The 20th is organized into threeflights:

� Target Materials� Combat Applications� Operations

The Target Material Flight pro-duces precise coordinated measure-

ments and mission-support materialsfor Air Force bomber, fighter andother airborne platforms engaged inexercise, training or actual combat op-erations.

It provides graphics, coordinatedmeasurements and aim point selec-tion assistance supporting nuclear,conventional and humanitarian reliefoperations. It also performs distri-bution of maps and charts support-ing short-notice mission planning andflying requirements Air Force wide.

The Combat Applications Flightactivities entail providing direct ap-plication support for specified com-bat customers. This includes an AIAnode for operational dissemination ofnear-real time imagery to Air Forceand Department of Defense usersworldwide; and is Air CombatCommand’s point of contact for pre-mission survivability and threat as-sessments, target analysis, wea-poneering support and post-missioncombat assessments for the Conven-tional Air Launched Cruise Missileprogram.

Additionally, it performs model-

ing and simulation survivabilityanalysis studies for requesting cus-tomers and is the executive managerfor the Integrated Air Defense sys-tems efforts.

The Operations Flight providesthe day-to-day operating support tothe other flights within the 20th. Theseactivities are dispersed throughbranches who perform the activitiesof planning, requirements manage-ment, systems maintenance, logisticssupport and resource management.

The 20th IS began its origins asthe 20th Photographic MappingSquadron in 1942. In these earlyyears, the unit worked under manydifferent names and was stationed allover the world from Sydney, Austra-lia, to Newark, N.J., to Yokota, Japan.They participated in the Pacific airoffensive and the occupation of Japanuntil inactivation in 1946.

The 20th was back in service forthe Korean War as the 20th TacticalReconnaissance Squadron until 1967.In 1992, it was reactivated and desig-nated the 20th Air Intelligence Squad-ron under the newly formed Air Com-

Staff Sgts. Anthony Turner and AbigailFigueroa, both with the 20th IS, researchstatistics and trend analysis.

Senior Airman Kerry Crossley with the 20th IS, uses NIMA’s Dewdrop workstation tomensurate coordinates.

August 199718

Senior Airman Jermaine Jones, with the 27thIS, removes a print from the printer.


bat Command, operating out of OffuttAir Force Base, Neb.

A year later, it was redesignatedas the 20th Intelligence Squadron un-der the Air Intelligence Agency.

Offutt Air Force Base, Neb. wasestablished in 1896 as Fort Cook, andis currently the oldest “fort” west ofthe Mississippi River.

Fort Cook was named after Gen.George Cook, who was famous formore than 20 years of service duringthe Indian Wars.

In 1924, they added a runwayand the base became Offutt Air Fieldafter Lt. Jarvis Offutt, Omaha’s firstair casualty. It became Offutt AirForce Base, Neb., in 1948 when theArmy and Air Force became separateservices.

Offices of the 20th IS are locatedin the Martin Bomber Building, thesame building that manufactured B-26 Marauders and B-29 Super-fortressess.

Both the “Enola Gay” and “Bock’sCar,” the B-29s which dropped atomicbombs on Hiroshima and Nagasakiwere built here. The Martin BomberBuilding, or Building D, is one-thirdthe size of the Pentagon.

27thIntelligence Squadron

The 27th Intelligence Squadron’smission is to expertly serve the 480thIG and other Department of Defenseorganizations using skilled profes-sionals and leading edge technolo-gies and to develop, provide andmanage systems and production in-frastructures and services.

The 27th IS is responsible for sus-taining the 480th’s daily operations.It operates and maintains automatedproduction support systems, a sec-ondary imagery dissemination sys-tem and photographic and litho-graphic facilities for the group.

Their vision is to become an unri-valed source of information warfaresupport and achieve a virtual basedinfrastructure to fuse multimedia ap-plications and products throughemerging technologies and state-of-the-art facilities in anticipation of cus-tomer needs for information domi-nance and operational supremacy.

The 27th provides the communi-cation, photographic, disseminationand facility, security and logisticsmanagement necessary for the 480thto deliver high-quality, time-sensitive,imagery based intelligence for dis-semination to U.S. and allied war-fighters around the globe.

The 27th Intelligence Squadron iscomprised of two flights:

� Production Services� Systems/Data Base Management

The Systems and Database Man-agement Flight provides state-of-the-art communications and computingand the Production Services providesa broad range of essential services.

The Visual Information Branchprovides digital and wet imagery pro-cessing, still photography and 35mmslide production, high-speed, large-volume reproduction and graphicdesign.

The Dissemination Branch distrib-utes and tracks all outgoing prod-ucts, maintains a chart library withworldwide coverage and the basictarget and training graphic reposi-tory.

Also, the Security Branch man-ages the group’s programs and main-tains unit and visitor security clear-ances and facility security devices.The Facility Branch manages the en-tire facility and grounds includingupgrades and construction. The Lo-gistics Branch manages the group’ssupply and equipment accounts.

The unit was active during WorldWar II when it won seven campaignstreamers, a Distinguished Unit Cita-tion and the French Croix de Guerrewith Palm. The 27th was inactivatedin December 1945 then reactivated inSeptember 1990.

EMBLEMBat outa hell: red cloaked batman

with oxygen mask and headsetAerial Cameras: model K-17, 18,

22, 24 in various formatsMap Section: connecting the twin

fuselageWhite cloud formation: highlight-

ing the batman and representing thesky

P-38 Lightning: unique twin-boom airframe, fastest long-rangefighter

19


Lightning Bolts: Representing theaircraft’s name, and the crew’s flyingstyle

Bare metal: flyingwithout paint shaved anextra 300-4000 pounds,given it more speed

Blue: as camouflageto hide form gunnersas they made highspeed runs over de-fended targets

Normandy stripes: oftenleft to keep our gunners fromshooting down single or small groupsof P-38s

Nose art: Like most WWII flyers,F-4 and F-5 crew often personalizedtheir aircraft. They often painted smallswastikas on the nose for each mis-sion over enemy territory.

36thIntelligence Squadron

The 36th IS provides tactical tar-get materials, special targeting andweaponeering analysis, and tailoreddigital data bases to support U.S. AirForce weapons systems, mission plan-ning and aircrew training.

The squadron also provides fo-cused and tailored intelligence to meetthe specific requirements of Air Forceunits preparing for deployment, whilethey are deploying, and during thetime they are deployed.

The 36th is organized into fourflights:

� Digital Materials� Intelligence Applications� Targeting/Recognition Materials� Requirements Management

The Digital Materials Flight pro-vides accurate digital maps, charts,elevation data, detailed geocodedimagery and other digital productssupporting automated mission plan-ning needs and unique requirementsfor advanced weapon systems.

It serves as the Air Force’s soleproducer of multi-spectral imagery.

The Intelligence Ap-plications Flight supportscombat air forces, train-ing units, the NAIC andAIA staffs by producingmaterials, targetinganalysis and specialized

target studies.

The Targeting/RecognitionMaterials Flight produces ad hoc

and scheduled general military intel-ligence to support exercise, trainingand combat operations of the AirForce and other Department of De-fense aircrew members the same typeof target materials they will be usingin operational conditions as well asproducing prototype target materialsfor future and developmental weaponsystems.

The Requirements ManagementFlight assigns and tracks all ad hocand scheduled production require-ments. They also submit, track andmonitor associated all-source intelli-gence collections.

The 36th was originally calledthe 28th Observation Squadron July1942 and activated at Goodman Field,Ky.

The 28th held many different des-ignations including the 28th Recon-naissance Squadron, April 2, 1943;the 28th Tactical ReconnaissanceSquadron in August; the 36th Photo-graphic Mapping Squadron in Octo-ber; and the 36th Photographic Re-connaissance Squadron, March 1944.

In those early years, the unitserved in the United States, NewGuinea, Philippines, Okinawa andChofu, Japan.

The 36th PRS was inactivated inFebruary 1946. In September 1990,the unit was redesignated as the 36thTactical Intelligence Squadron at Lan-gley Air Force Base, Va., and assignedto the 480th.

In November 1991, the 36th TISwas redesignated as the 36th Air In-telligence Squadron and in October1993, it was redesignated as the 36thIntelligence Squadron.

Senior Airman Dwayne Russler, 36th Intelligence Squadron’s Target Materials Flight, con-ducts a test to quality control an operating instruction.

August 199720

Air Force Information Warfare Center

he Air Force Information War-fare Center, collocated with the

enemy information systems duringDesert Storm led to the realizationthat the strategies and tactics of com-mand and control warfare could beexpanded to the entire informationspectrum and be implemented as in-formation warfare.

In response, the AFIWC was acti-vated Sept. 10, 1993, combining tech-nical skills from the former AFEWC,the Air Force Cryptologic SupportCenter’s Securities Directorate and in-telligence skills from the former AirForce Intelligence Command.

AFIWC’s team of 1,000 militaryand civilian personnel are skilled in

the areas of operations, engineering,operations research, intelligence, ra-dar technology, communications andcomputer applications.

The members are dedicated toproviding improved C2W/IW capa-bilities to the warfighting U.S. AirForce major commands.

MISSION

The mission of AFIWC is to ex-plore, apply and migrate offensiveand defensive information warfare ca-pabilities for operations, acquisitionand testing; and provide advancedIW training for the Air Force.

The AFIWC provides IW servicesto the warfighter in contingencies andexercises through quantitative analy-sis, modeling and simulation, data-base and technical expertise in com-munication and computer security.

The AFIWC is divided into eightdirectorates:

� Advanced Programs� Communications-Computer Systems� C2W Information� Engineering Analysis� Mission Support� Systems Analysis� Operations Support� Information Warfare Battlelab

The newest directorate, the Infor-mation Warfare Battlelab, supportsthe full spectrum of Air Force opera-tions by rapidly identifying innova-tive and superior ways to plan andemploy IW capabilities; organize,

AIR FORCE INFORMATIONWARFARE CENTER

TAir Intelligence Agency, was createdto be an information superiority cen-ter of excellence, dedicated to offen-sive and defensive counter informa-tion and information operations.

AFIWC was originally activatedas the 6901st Special CommunicationCenter in July 1953. The followingmonth the 6901st was redesignatedas the Air Force Special Communica-tions Center. It was then redesig-nated as the Air Force ElectronicWarfare Center in 1975.

Air Force successes in exploiting

Air Force Chief of Staff, Gen. Ronald Fogleman (right), discusses the mission of the Informa-tion Warfare Battlelab with Col. James Massaro, AFIWC commander.

Photo by Boyd Belcher

21


train, and equip Air Force IW forces;and influence development of IW doc-trine and tactics.

Advanced Programs foster thedevelopment and employment of ad-vanced IW capabilities using a multi-disciplined approach. They exploreand advance technologies, techniques,talents and tactics for IW applica-tions. Developing multi-disciplined(scientific, technical, intelligence andoperation) solutions, they providesupport for emerging warfare tech-niques.

Communications-Computer Sys-tems provides the command, control,communication, computer and infor-mation systems infrastructure to sup-port all AFIWC mission areas. SCdevelops C4I systems architecture andinitiates programs for their implemen-tation or acquisition.

Using all-source data, C2W Infor-mation develops, builds, extracts andintegrates standardized C2W data intothe Air Force Extended IntegratedData Base architecture. DB addressesthe issues of control, quality assur-ance planning, training, development,deployment, technical support andimplementation of new databases.

Engineering Analysis providestechnical guidance in the areas of com-puter security during the develop-ment of information, sensor andweapon systems including in-depthanalysis and electromagnetic mea-surements of aircraft.

The Air Force Computer Emer-gency Response Team is the AirForce’s global command center forhandling worldwide networked com-puter system security issues. TheAFCERT is the single point in the AirForce for reporting networked com-puter intrusions and problems.AFCERT responded to 47 computersecurity incidents in 1996 and ex-panded its internal security database

connectivity and capabilities. Theyeducated worldwide Air Force andDepartment of Defense customers oncomputer security topics and pro-vided assistance to other computersecurity organizations.

Mission Support maintains theresearch library that provides ana-lysts, engineers and scientists withvital information for projects andstudies. They also promote aware-ness of AFIWC capabilities throughmarketing and business developmentand provide a centralized educationand training activity for the center.Additionally, they manage AFIWCsafety, security, facilities and contract-ing functions.

The scientists and engineers ofSystems Analysis provide quantita-tive analysis through modeling andsimulation of offensive and defensiveIW systems capabilities and vulner-abilities. SA develops and operatesengineering, platform, mission, andcampaign models for analysis of in-formation, sensor and weapon sys-tems. Evaluating vulnerabilities ofUS Air Force radar, communications,

navigation, and IW systems; SA helpsthe warfighter to understand the po-tential vulnerabilities of friendlyweapon systems, C2W systems andspace systems. This understandingallows the warfighter to develop tac-tics and procedures to counter cur-rent, future and reactive threats.

Operations Support trains,equips and deploys personnel to pro-vide IW and intelligence to thewarfighter during contingencies, spe-cial operations and exercises.Deployable information warfare sup-port teams provide planning supportfor operations security, military de-ception, command and other opera-tions to Air Operations Centers andJoint Force Air Component Com-manders.

In addition to these directoratesare staff support. Intelligence Require-ments, Management Support andTechnology Management Supportcomplete the infrastructure, allowingAFIWC to strive for informationdominance and supply the warfighterwith the services needed in contin-gencies and exercises.

Left, Maj. Byron Thatcher, chief of AFCERT Operations, discusses an Automated SecurityIncident Measurement incident with Tech. Sgt. Kenneth Taylor, ASIM analyst.


August 199722


he Air Force Computer Emer-gency Response Team is the Air

� expanding its internal security da-tabase connectivity and capabilities

� educating worldwide Air Forceand Department of Defense custom-ers on computer security topics andproviding assistance to other com-puter security organizations

The AFCERT uses an automatedcomputer intrusion detection systemcalled the Automated Security Inci-dent Measurement.

The ASIM is a hardware and soft-ware system that sits on Air Forcenetworks “listening” for “suspiciousactivity” that is characteristic of in-truder techniques.

It processes what it deems suspi-cious and reports once every 24 hoursto the AFCERT.

The ASIM is the workhorse of theAFCERT and is extremely effective at

detecting and reporting intruder ac-tivity, the first two steps necessary tomount an effective response.

At the beginning of 1996, the AirForce had only 26 bases covered byan ASIM. By the end of 1996, theASIM covered 52 bases and three jointsites. Now the AFCERT monitors107 Air Force and three joint ASIMsites. The AFCERT estimates theASIM now detects over 100 millionsuspicious Internet connections amonth.

Plans were in the works at theend of 1996 to enhance ASIM soft-ware to provide the AFCERT withnear real-time intrusion detectionalerts and a “connection denial” ca-pability.

NRT alerts give the AFCERTtimely notification of an attempted oractual intrusion so it can work withthe affected base’s computer security

TForce’s global command center forhandling worldwide networked com-puter system security issues.

The AFCERT is the single pointin the Air Force for reporting net-worked computer intrusions andproblems.

It performs three broad missions;remote security assessments, auto-mated intrusion detection and secu-rity incident response.

The AFCERT’s accomplishmentsin 1996 include:

� improved worldwide Air Forceautomated intrusion detection cover-age and capabilities

� remote security assessments

� responding to 47 computer secu-rity incidents

AIR FORCE COMPUTEREMERGENCY RESPONSE TEAM

Graphic Illustration by Tim Johnson Jr.

23

personnel to reduce or prevent dam-age to Air Force computer systems.

The AFCERT established formalASIM training and conducted coursestoward certification for computer se-curity personnel in 1996. TheAFCERT teamed up with the AirForce Communications Agency toquickly provide this training to AirForce and Department of Defense per-sonnel through contract courses.

The AFCERT wrote “rules of en-gagement” for the use of ASIMs. Theywere accepted by Air Staff who ap-plied them Air Force wide. Theserules were also added to the draft AirForce Instruction 33-208, InformationProtection Operations.

The AFCERT performs remotesecurity assessments on worldwidenetworked Air Force computer sys-tems through its On-Line Surveyprogram. Through the OLS, theAFCERT employs intruder tech-niques, tools and capabilities to “at-tack” unsuspecting Air Force com-puter systems.

The OLS’s goals are to measurethe Air Force’s networked computersecurity posture (by seeing if systemscan be penetrated using well-known,simple vulnerabilities and checkingto see if anyone noticed and reportedthe attack on their system), to showthe Air Force what an attack lookslike and to operationally exercise theAir Force’s ability to protect its com-puter resources.

The AFCERT conducted 62 OLSsat 52 different bases in 1996, survey-ing 4,309 systems. Of these, only 433(10 percent) resulted in successful lim-ited intrusions and 48 (one percent)resulted in full access intrusions, orroot access.

These values showed continuedimprovement from 1995, when theAFCERT penetrated 15 percent of thetested systems at the user level andthree percent at root.

The continued downward trendin the AFCERT’s ability to penetratesystems shows a satisfactory improve-ment on the part of Air Force com-

puter systems to repel unauthorizedintruders and demonstrates the worthof the Computer Security AssistanceProgram, the AFIWC’s program tohelp the Air Force defend its com-puter resources.

The AFCERT would like to seedetecting and reporting at 95 percentor higher, however, only 14 percentof the attacked systems detected andreported the OLS activity to theAFCERT, down from 16 percent in1995.

The Air Force’s poor performancein adequately reporting attacks isthought to be the result of inadequatetraining and the high workload ofsystem administrators.

Despite the AFCERT’s many at-tempts to raise human detection andreporting levels, it continues to lan-guish in the sub-20 percent level, add-ing increased credence for investingin more ASIMs, other intrusion de-tection tools, and continued researchand development to help balance theodds against intruders.

The remote computer assessmentscapability was expanded in 1996 bythe AFCERT training and certifyingsome major commands’ computersecurity personnel and providingthem with the OLS tools and “rulesof engagement” for their use.

The AFCERT opened 47 intru-sion detection incidents in 1996. TheAFCERT worked with base person-nel, major commands, the Air ForceOffice of Special Investigations andAir Force leadership to resolve eachof those incidents. When needed,AFCERT personnel deployed alongwith CSAP deployable personnel toassist bases in recovering andreconfiguring computer systems in asecure manner.

Out of the 47 incidents, the AFOSIlaunched 21 substantive investigations



August 199724

during 1996. The investigations iden-tified 10 suspects, including three for-eign individuals. Five cases wereconsidered serious enough to pursueprosecution and three are pending.Prosecutions usually take a long timeto bring to trial and the punishmentsare usually light because the laws inthis area are nonexistent or have notadequately kept up with technologi-cal advances.

The AFCERT plans to continueworking with law enforcement andthe legal community to bring aboutchanges in the law that adequatelyaddress computer intrusions.

The AFCERT uses the CSAP Da-tabase System to track and correlateAir Force vulnerability and intrusiondata. In 1996, the CDS was improvedto incorporate historical OLS andASIM data.

This action provided a more com-prehensive database to search for re-lated intrusion detection activities andbase vulnerabilities, resulting in dra-matic support information improve-ments for OLSs, hacker incidents, vul-

nerabilities, malicious logic, and otherAFCERT activities.

The AFCERT continues to edu-cate the world on Air Force computersecurity operations, techniques, toolsand procedures.

The AFCERT plans to grow froman 8-hour, five-day a week functionto a 24-hour, seven-day a week func-tion. The plan was to go from ap-proximately 25 personnel at the be-ginning of 1996 to approximately 65personnel, starting 24-hour operationson Oct. 1, 1997. This required newbillets, personnel and the training pro-gram to ready them for duty.

The AFCERT also provides com-puter security education and aware-ness through AFCERT advisories.AFCERT advisories are issued any-time the AFCERT recognizes a secu-rity situation that could apply to us-ers across the Air Force and providesa convenient way to easily dissemi-nate the word.

In 1996, the AFCERT published15 advisories. They ranged from mak-

ing IP personnel aware of commonpoor security practices to providinginformation on known vulnerabilitiesand recommended preventive mea-sures.

The AFCERT’s home page wascreated in 1996 to provide Air Forceand other customers with voluminousinformation on computer security.From the AFCERT web page, AirForce organizations can download acomputer security tool kit or gaininformation on a wide variety of IPtopics (e.g. viruses, hoaxes, anti-viralsoftware, etc.) There is a security so-lutions section which organizes linksto other web sites by operating sys-tems, network types, tools, checklists,encryptions and many other IP re-lated topics.

The AFCERT Daily OperationsReport, the AFCERT’s defensive pic-ture of Air Force network activityrequested by the Air Staff, was cre-ated in 1996 and made available onthe Intelink, a classified intelligencenetwork.

The AFCERT has worked withother organizations to assist them inestablishing computer security opera-tions of the same high caliber. TheAFCERT assisted the AIA Informa-tion Operations Center with definingrisk conditions and information con-ditions.

They assisted the Air MobilityCommand and AETC in beginning toset up Regional Information Protec-tion Centers. The AFCERT workedwith the Pacific Air Forces in 1995 toestablish the prototype for the re-gional centers and has extended thatin 1996. AFCERT personnel also as-sisted the 609th Information WarfareSquadron in defining, and implement-ing deployable computer security op-erations.

The AFCERT has assumed a ma-jor leadership role within the Depart-


Master Sgt. John Volk, noncommissioned officer in charge of AFCERT Operations, reviews aslide show presentation.


25

ment of Defense and federal govern-ment in helping other organizationsstand up CERT operations; determin-ing community computer securitystandards, terms, definitions, toolsand operational procedures; bringingin legal authorities to deal with anti-quated laws governing computer se-curity; and providing technology in-sertions and concepts to quickly ad-vance capabilities and responses.

The U.S. Army hired consultantsto build its Army CERT and defineits operational procedures. These con-sultants were tasked to build a facil-ity modeled after the AFCERT, andthe AFCERT was tasked to providethe consultants with advice, copies ofits concepts of operation, and to hostnumerous visits, with which theygladly complied.

The key to the future of Depart-ment of Defense CERT operations isto fight jointly, share the same stan-dards and cooperate. The AFCERTsupports this notion and is a full part-ner with its sister service and Depart-ment of Defense CERTs, hosting thefirst Joint Information AssuranceOperations Working Group meetingand keeping it going through leader-ship and support.

The AFCERT plans to improveAir Force computer security opera-tions by expanding the RIPC conceptof moving more responsibilities andcapabilities to the major commandand base levels; and improving theASIM’s near-real-time capabilities;and later implementing a connectiondenial capability.

The ability to electronically in-ventory Air Force networked com-puter assets and tie them to a data-base filled with critical informationabout them, a concept known as vir-tual battlespace, is a priority for 1997as well.

Having this information when Air


Force systems are attacked is vital todecision makers, allowing them tomake the correct decisions in times ofcrisis. The AFCERT could advise acommander on what warfighting ca-pabilities are lost if certain attackedsystems cease functioning.

The AFCERT will continue tosupport AFIWC efforts to build aconceptual system known as“CSAP21.” The CSAP21 conceptembodies the AFCERT of the futureby automating its functions and dis-playing worldwide computer secu-rity information on large wall screendisplays for decision makers. TheCSAP21 system would feature com-mand center hardware and courses-of-action-determining software pow-ered by modules incorporating riskmanagement, intelligence, andmodeling.

Air Force computer security isglobal in nature, yet defies geographi-cal limitations. Implementation ofcomputer security tools crosses tradi-tional organizational boundaries.Policies and procedures are needed

to define roles and responsibilitiesbetween AFCERT, major commands,bases and the information warfaresquadrons.

The ASIM works. Hackers havebeen caught and prosecuted. ASIMcontinues to identify poor securitypractices, as well as real intrusions.Research must continue to identifyways for eradicating both, with theresult being fewer or no intrusions.With each report or advisory issued,someone in the Air Force communityis educated on how to implementbetter computer security practices.

Although analyzing ASIM datadaily reveals possible intrusion activ-ity, fielding a reliable NRT ASIM iscritical to providing alert notificationsin a timely manner. Improvementsto the NRT ASIM, in particular theconnection denial capability, will en-hance this capability. Once NRTASIM alerts a possible or actual in-trusion, the AFCERT needs to pro-vide the commander the option ofdenying that connection to preventdamage to Air Force computer systems.

sources


August 199726


C2W Analysis &Targeting Tool

The mission of theSystems Analysis Direc-torate is to provide

analysis through modeling andsimulation of offensive and defensiveU.S. Air Force command and controlwarfare/information warfare systemscapabilities and vulnerabilities.

This requires automated toolswhich can be used by analysts, op-erations personnel and combat com-manders to train for exercises, andassess the impact of various C2Wactions that may be used. They mustprovide a computer environment inwhich the modern warfighter canquickly apply real-time intelligenceto decision making.

The C2W Analysis Division whichis the C2W Analysis and TargetingTool can provide commanders withthe ability to more effectively selectthe correct mix of C2W techniques toexpand and corrupt his adversary’sdecision cycle. It provides accuratesimulation capability of adversarysystems and the capability for ana-lysts to do what-if analyses.

CATT is a computer model of anoperational Integrated Air DefenseSystem. CATT uses UNIX-basedgraphical user interfaces and high-resolution map displays to make themodel user-friendly. It includes end-to-end modeling of IADS processessuch as detection, tracking, commu-nication, decision making and engage-ment.

An understanding of the enemy’sIADS can be achieved by examiningthe processes in detail and how theyfunction together.

The CATT model has a controlscreen and at least one IADS com-mand screen. The control screenshows the ground truth for the IADSscenario with the flight paths over-laid. The IADS command screens de-pict what a red (hostile) operatorwould see in the IADS structure.

CATT is currently a prototypemodel and is being expanded tomodel the IADS of several countries.Analysts will be able to examine anycountry of interest by incorporatingthe country’s tracking algorithms andIADS structure. Another upgrade willallow current intelligence data to befed directly into the database, so themodel will use the latest intelligencedata from a variety of sources.

The CATT point of contact is Lt.Col. Ross Ziegenhorn, AFIWC/SAA,102 Hall Blvd, Suite 338, San Anto-nio, TX 78243-7020. DSN: 969-2427,Commercial: (210) 977-2427.

AFIWC TOOLS OF THE TRADE

“PATHFINDERS” FosterTechnology Exchange

U.S. military forces now operatein an information age where the needfor precise and instantaneous intelli-gence is increasing and expandingacross the entire spectrum of militaryoperations.

One of the Air Force InformationWarfare Center’s primary missionsremains that of channeling all elec-tronic battlefield information towardthe objective of gaining informationdominance over any adversary. TheAFIWC’s Office of Technology is ac-tively pushing forward to put intoplace the processes, measurement cri-teria and programs necessary to en-sure that the AFIWC has the techno-logical lead necessary to maintain

mission effectiveness into the 21stcentury.

Their recently instituted “Path-finder” effort attempts to do twothings:

1) Assist in linking the tech-nology requirements of the variousdirectorates to potential solutions

2) Foster cross-fertilization oftechnology among the various direc-torates within the AFIWC

The Office of Technology is theAFIWC’s designated focal point forinformation warfare technology. The“Pathfinder” effort assigns specific OTpersonnel to each directorate withinthe AFIWC to assist in researchingpotential technological solutions fortheir mission requirements.

This program investigates prom-ising commercial and governmenttechnology research and developmentefforts for application to missionswithin the AFIWC. The pathfindersthen facilitate the introduction or dis-semination of these promising tech-nologies.

OT provided the necessary toolsand software support to informationwarfare support teams deployed tosupport military exercises and realworld contingencies in an effort tofill the role of pathfinder. This assis-tance allowed the IWSTs to providereal-time intelligence information tothe warfighter. It became imperativethat the IWSTs maintain their profi-ciency in the use of this tool to pro-vide information to decision makersduring exercises and real world con-tingencies.

OT provided planning, technicalsupport and coordination for space-

27

SENSOR HARVESTThe new world order has changed

the way we plan to fight future warsand conflicts. The bipolar threat en-vironment has essentially disappearedand a multi-regional threat environ-ment has emerged.

The current and future battles will


related applications within AFIWC,and also operated, maintained andadapted S-band satellite systems tosupport reach-back and in-garrisoninformation operations.

The TETON system used existingnational satellites for high-speed datacommunications which supported na-tional contingencies and exercisesthroughout the year. The OT staffalso integrated the joint service Min-iature Data Acquisition System intothe AFIWC architecture.

This prototype Mini-DAS system,along with the TETON system, playeda significant role in this year’s Ex-ercise Green Flag. TheMini-DAS, deployed forthe first time, providedthe warfighter with ac-curate and timely intelli-gence data availablefor use at all lev-els and in allc o m m a n d s .Personnel at Kelly AirForce Base supportedthe deployed team withthe TETON system. The TETON pro-vided critical imagery and intelligencedata to the deployed team. This datawas then processed by the Mini-DAS.

This program pulls shared re-sources from throughout AIA, as wellas the AFIWC, to help develop anadvanced concept on IW Planning.This effort will result in refined re-quirements that can be passed to AirCombat Command for inclusion intheir mission planning process.

ners to use in understanding anadversary’s decision-making process.Planners can use this information toeffect the enemy’s observe, orient,decide and act loop to achieve theCINC’s objectives.

A nodal analysis approach pro-vides a unique aspect in targetingand enables a shift from conventionaltargeting to IW/C2W targeting. As-sessments on possible vulnerabilitiesto the elements of C2W include: psy-chological operations, deception,physical destruction, electronic war-fare and operation security. Theproduct can be utilized throughoutthe range of military operations —from peacetime to conflict.

Sensor Harvest has been used byjoint services in both operational andexercise environments. The productwas key in the target nomination pro-cess during Operation DELIBERATEFORCE. Sensor Harvest also sup-ports various joint and service-uniqueexercises, such as Unified Endeavor,Ulchi Focus Lens, Green Flag andRed Flag.

Today the program enjoys thesuccess in making commanders andplanners more aware of informationwarfare. The product has been ex-posed to many high-ranking Depart-ment of Defense officials, foreign mili-tary personnel and civilian officials.Sensor Harvest was also demon-strated to the Global Air Chiefs dur-ing the Air Force’s 50th Anniversarycelebration in Las Vegas, Nev.

It is essential to know your en-emy prior to engagement on thebattlefield; whether on a typical landbattlefield or a digital battlefield.Information is knowledge and knowl-edge provides the necessary powerto gain air, space and informationsuperiority. Sensor Harvest enablesour warfighters to come one stepcloser in achieving air, space and in-formation superiority.

not necessarily be fought physically,but may occur electronically orthrough information systems. Intelli-gence support to the warfighters willbe even greater in the 21st centurydue to emerging technology and vastaccessibility to information.

The Air Force Information War-fare Center has various products andservices tailored to support thewarfighters in obtaining informationsuperiority.

Sensor Harvest is a command andcontrol warfare and information war-fare tool designed to support strate-

gic and operational planners. Sen-sor Harvest gotits start in Feb-

ruary 1993, whenthe AIA com-

mander tasked theIWC to produce a C2W-

tailored product involvingthe five disciplines of C2W.The goal was to develop auser-friendly, computer-based C2W planning tool.

OILSTOCK is the geographical in-formation system used when display-ing information on maps and throughweb technology. The product is dis-seminated in various ways, based oncustomer requirements, however, itis primarily made available througha classified wide area network calledINTELINK.

Some of the information found inthe Sensor Harvest product include acountry’s military capability,economy, culture, geography, poli-tics and information systems. Theinformation provided in the productis critical in both deliberate and crisisaction planning. The overall goal ofthe product is to support plannersduring the operational environmentresearch stage of campaign planning.

Sensor Harvest serves as a foun-dation and starting point for plan-

national air intelligence center“yosemite sam” represents 480th intelligence group w the 480th...

Documents