Opinion: Pentagon security is becoming a joke.

Editor's note: P.W. Singer is director of the 21st Century Defense Initiative at the Brookings Institution and author of "Wired for War: The Robotics Revolution and Conflict in the 21st Century," which is being published in paperback on December 29.

(CNN) -- It sounds like the plot of a Hollywood blockbuster: A group of insurgents hack into American military drones, using software they got off the Internet, according to The Wall Street Journal. But, for the benefit of that screenwriter likely pounding away right now to get his idea in first -- as well as for the general public -- what actually happened?
Essentially, three trends are coming together in war.

First is the growing use of unmanned systems, something I explore in my book "Wired for War." Just a few years ago, the U.S. military had no interest in unmanned systems. Indeed, when the U.S. invaded Iraq, we had only a handful of unmanned systems in the air and zero on the ground in the invasion force, none of them armed.

Today, we have more than 7,000 in the air, ranging from the 48-foot-long Predator to tiny ones that can fit in a backpack, and 12,000 on the ground, such as the Packbot and Talon systems that hunt down roadside bombs. Many of these systems are armed, giving new meaning to the term "killer app."

This 180-degree turn to robotics, however, often came in an ad-hoc manner. The back-end networks didn't perfectly fit with the wide variety of unmanned systems that were being plugged in.
Even more, the pressure was on to push the systems out as rapidly as possible, for very good reason. There was a war on, and these unmanned systems were proving to be far more useful to our troops than what the regular Pentagon acquisitions process had been providing.
One robotics company executive described how he couldn't even get his phone calls returned a few years ago. Now, he was told, "Make them as fast as you can."

Second, though, was a dash of arrogance. In not coming through the regular planning and purchasing system, many of the systems used proprietary software as well as commercial, off-the-shelf hardware. So many of the communications feeds going back and forth were poorly protected, and, in some cases, not even encrypted.

This was the case, for example, for some of the overhead surveillance video feeds that the unmanned systems were collecting and, in turn, beaming back both to command posts as well as to American patrols on the ground, who watch the feed off ROVER. (Akin to Dick Tracy's watch, this is a rugged video monitor a soldier can strap onto his or her arm or gear.)

The problem of the relatively open video feeds has been known for a while. Indeed, back during our operations in the Balkans, it was discovered that just about anyone in Eastern Europe with a satellite dish could watch live overhead footage of U.S. Special Operations forces going out on raids of suspected war criminals. One joker commented that it was harder to tap into the Disney Channel.

But the Pentagon assumed that foes in the Middle East wouldn't be smart enough to figure this out, and underestimated how quickly the technology to tap in to the feeds would advance, becoming cheaper and widely available. The problems were not fixed, and more and more of these relatively open systems were deployed.

Unfortunately, we all know what happens when we "assume" our enemies are dumb (they make something out of "u" and "me.").

Using a $26 software package called Skygrabber, originally designed to allow customers to download movies and songs off the Internet (none of them pirated, of course), insurgents were able to tap into the various U.S. military video feeds, The Wall Street Journal reported. U.S. forces became aware of it after they captured a Shiite militia member in Iraq, whose laptop had files of the pirated footage saved on it.

READ THE FULL STORY HERE AT CNN

WALL STREET JOURNAL: Seized weapons from North Korea were bound for iIan

By DANIEL MICHAELS and MARGARET COKER

A plane loaded with weapons from North Korea that was recently impounded in Bangkok was bound for Iran, according to documents obtained by arms-trafficking experts.

The destination of the Ilyushin-76, which Thai authorities have said carried 35 tons of armaments, has been unknown. Thai officials said the plane flew to Pyongyang via Bangkok two weeks ago to collect its cargo, then returned to Bangkok to refuel on Dec. 11. It was seized during that stop and its five crew members were detained by police.

Thai officials say the plane was due to fly next to Sri Lanka, but Sri Lankan officials say they had no knowledge of the flight.
Read More

* NZ Man Unaware of Korean Weapons

A flight plan for the IL-76, obtained by researchers in the U.S. and Belgium, shows that after Bangkok the plane was due to make refueling stops in Sri Lanka, the United Arab Emirates and Ukraine before unloading its cargo in Tehran. Iranian officials didn't respond to requests for comment.

The flight plan also indicates that en route to Pyongyong the plane stopped at an air force base in Azerbaijan, although the nature of that stop is unclear. Azerbaijani officials couldn't be reached for comment.

The new information is presented in a joint draft report by analysts at TransArms, based in Chicago, and the International Peace Information Service, or IPIS, based in Antwerp, Belgium. Both organizations conduct research on conflicts around the world, including how they are financed and supplied with weapons. A draft copy of the report was provided to The Wall Street Journal.

The report hasn't been independently confirmed.

It remains unclear where the weapons would have gone from Iran. Western governments have accused Iran of supporting militants in Lebanon, the Palestinian territories and Iraq. Thai officials have said the weapons found are unusual in Southeast Asia.

Thai officials say they have received little information from the plane's crew, who come from Kazakhstan and Belarus. The crew members say they were told the cargo was oil-drilling equipment. The crew members have denied knowledge that there were weapons on board.

The flight documents obtained by TransArms and IPIS state that the cargo is "oil industry spare parts." The flight's planners appear to have worked hard to maintain appearances. A packing list includes eight categories of equipment, such as "Geothermal rigs spare parts -- model MTEC6" and "Bespoke mineral exploration machine -- spare parts". Each category includes the number of boxes on board, the weight of each box, the gross weight and dimensions in millimeters.

Thai officials have said the actual cargo included shoulder-launched missiles, large rockets, parts for surface-to-air missiles and electronic systems to control weapons.

Arms-trafficking specialists have puzzled over the plane's stop in Bangkok, an airport that is heavily policed because of the drug trade in Thailand. "This is an unusual flight plan for general cargo, but if it's for an arms flight, it doesn't make any sense," said Peter Danssaert, an arms-trade researcher at IPIS involved in preparing the report. He said the flight plan and detailed cargo list suggest the crew may have been unaware of what they were carrying.

A major question that remains unanswered is who organized the weapons shipment, but it appears the planners went to great lengths to hide their identities. The plane is registered in the Republic of Georgia to a Georgian company, Air West Ltd. Air West on Nov. 5 leased it to another company, SP Trading Ltd., according to an Air West manager and a contract seen by The Wall Street Journal. SP Trading is registered in New Zealand and appears to be only a shell company owned by other companies.

In another contract dated Dec. 4, discussed in the report by TransArms and IPIS and seen by the Journal, SP Trading leased the plane to another company, based in Hong Kong. The Hong Kong company is owned by a second Hong Kong company, which is owned in turn by a third company, based in the British Virgin Islands, according to company registration documents. These companies appear to have organized the cargo.

An Air West manager said the company had leased the plane to SP Trading and he knew no more. Officials from SP Trading couldn't be located.

In addition, the Georgian-registered Ilyushin-76 cargo plane is actually owned by a company based in the United Arab Emirates, according to information in the draft report and confirmed by Georgian aviation officials. The company, Overseas Cargo FZE, is based in Sharjah, one of UAE's seven emirates. A spokeswoman for the UAE General Civil Aviation Authority said the agency had no record of the plane being owned by a Sharjah company, although aviation specialists say this isn't unusual.

A U.A.E. official confirmed that the Ilyushin-76 landed in the country on the evening of Dec. 9. The plane refueled and took off just over two hours later with an empty cargo hold, the official said. The plane didn't return to the U.A.E. before it was seized by the Thai authorities, the official said. The stop agrees with the flight plan in the arms-trafficking report.

Overseas Cargo's registration documents, reviewed by The Wall Street Journal in Sharjah, describe it as both an aircraft-leasing and -handling firm as well as an oil-services consulting company. The documents say it has one shareholder, Svetlana Zykova, who lists a permanent address in Almaty, Kazakhstan.

Two women at Overseas Cargo's office in Sharjah referred inquiries to Ms. Zykova. Ms. Zykova was contacted on a U.A.E.-listed mobile phone. The woman who answered identified herself as Svetlana Zykova, confirmed she was the owner of Overseas Cargo, and then hung up when she was asked about her company's connections to the plane seized in Thailand.

If Overseas Cargo or other companies in the UAE are linked to the shipment, it could mark a setback for local officials, who say they have been cracking down on shell companies located in the country's multiple free-trade zones. The crackdown is aimed at hindering the flow of weapons and dual-use technologies to Iran that have been forbidden under United Nations sanctions. Objects that indirectly could aid Iran in building a nuclear weapon, such as state-of-the-art computer equipment, are considered dual-use technologies.

UAE officials have boasted of their tight regulation at the Dubai port, one of the world's largest. Earlier this summer, authorities there seized a shipment of military hardware from North Korea aboard a vessel bound for Iran. The cargo was labeled "oil boring machines" but actually contained detonators and ammunition.

Write to Daniel Michaels at daniel.michaels@wsj.com and Margaret Coker at margaret.coker@wsj.com

War game set to send Iran a message

Washington (CNN) -- The U.S. military's Missile Defense Agency will practice protecting the United States from a simulated Iranian missile attack next month in an exercise using the agency's newest missile-killing technology, Pentagon officials said Friday.

Previous tests have been focused on a missile trajectory that mimics an attack from North Korea, but the January test will have a trajectory and distance resembling an intercontinental ballistic missile launch from Iran.

At the same time, the agency will be testing its new "Capability-2" technology, with upgraded software and sensors loaded inside an interceptor missile that will be fired at the fake Iranian missile.

The Capability-2 technology is designed to eventually replace the existing hardware the United States has in its two missile defense bases in California and Alaska, according to Rick Lehner, a spokesman for the Missile Defense Agency.

While intelligence assessments of that country's capabilities now suggest an Iranian ICBM threat is as far away as 2020, this test was planned more than three years ago, when the threat seemed much closer, Lehner said.

In the January test, the fake ICBM is slated to originate from the Missile Defense Agency's launch facility in the Marshall Islands in the South Pacific while the interceptor missile will be launched from Vandenberg Air Force Base in California, according to Lehner.

Missile defense tests have been likened to hitting a bullet with a bullet. This test will be even more difficult: It will be like hitting a bullet head-on with another bullet, because any launch from Iran would have a trajectory that would require a U.S. interceptor missile hitting the target directly, Lehner said.

The missiles will be flying at speeds of between 17,000 and 18,000 miles per hour, according to Lehner, about 3,000 mph faster than tests involving mock North Korean missiles. The speed will reduce the strike window, meaning the interceptor, also known as the "kill vehicle," will have to work even faster at identifying and striking the target missile.

The United States has only two missile defense bases, one at Vandenberg, with three missiles, and the other at Fort Greely, Arkansas, with 20 interceptor missiles at the ready.

Lehner said that if Iran were to launch an ICBM attack against the United States, the most likely defense option would be firing a missile from Alaska, because of the shorter distance around the globe.

The United States was prepared to put a third missile defense site in eastern Europe, but the Obama administration scrapped that option because of the reduced ICBM threat from Iran. In its place, the administration said it will move ships with the capability of shooting down short- and medium-range missile from Iran which, they say, pose a greater threat to Iran's neighbors and U.S. bases in the Middle East.

North Korean hackers may have gained access to war plans.

SEOUL, South Korea - Computer hackers who may be from North Korea have gained access to a secret U.S.-South Korean plan to defend the peninsula in case of war, the defense ministry said Dec. 18.

The hackers used an IP address in China to access some military data related to Operation Plan 5027, a spokesman told AFP.

"Authorities are trying to find whether North Korea was involved," he said, adding the leaked data contained crucial information such as slide and power point displays explaining the plan.

OPLAN 5027 was drawn up jointly by South Korea and the U.S., which stations 28,500 troops in the South. It allows for the dispatch of nearly 700,000 U.S. troops to the peninsula should a full-scale war break out.

The plan also sets wartime operational guidelines for the troops of the two countries. South Korea has technically remained at war with the North since the 1950-53 war ended in a truce, not a peace treaty.

"A probe is underway to figure out how much the leakage will affect our military plan," the spokesman said. "The officer concerned will be disciplined."

Chosun Ilbo newspaper said the officer with the Combined Forces Command had used an unsecured USB memory stick to download the plan.

South Korea believes the North has military personnel who specialize in overseas hacking and will set up its own military cyber command Jan. 1.

South Korea's spy chief has blamed North Korea's telecommunications ministry for cyber attacks that briefly crippled unclassified U.S. and South Korean government and commercial Web sites in July.

Editorial: More fact than fiction: On Predator Hacking...

I read with great interest the many articles detailing how Iraqi insurgents were able to intercept Predator UAV downlink video and was both amazed and aghast.

Recently, I had just finished a re-write on my novel "The Interceptors Club & the Secret of the Black Manta" which (as its' McGuffin)centers around a rag-tag gang of hackers who manage to steal an advanced, stealthy prototype UAV known as the Black Manta.

Almost everything in the novel is loosely base on my true "interceptor" experiences, except for the part about then theft of a UAV. I've never done that.

Although the hacking of a fictional UAV (in my book) is what the action is centered around, I was worried that it might be a bit far-fetched for the reader to buy and required a good amount of the suspension of disbelief - but not anymore.

The revelation that Iraqi insurgents are intercepting UAV video downlinks just pushed my fiction from "could it happen?" to well inside the "that's not so far fetched at all" zone.

Although by all accounts, there is no-possible-way a UAV could be commandeered by insurgents, the fact that by employing "skygrabber" software (combined with a C/KU band antenna and receiver) enables them to easily intercept video feeds is very disturbing indeed.

Despite what the DOD may say, not only is there a distinct possibility that anti-insurgency operations could (and probably have) been compromised by what an enemy may have learned from watching the feeds, the fact they could detect the feeds at all) is a major breech of military security

As a result, you can bet the farm that somewhere in some secret sub-committee, techs are being called on the carpet and heads are going to roll.

Just as a small example, by watching the feeds an enemy could not only deduce which areas were being surveilled by the Predators but could ascertain where the Predators were based, aerial images of those bases, standard UAV operational procedures as well the limits of what a Predator or other drone can or cannot see at altitude.

Not to mention, even with the Pentagon's (now urgent, since the cat has been let out of the bag) program to encrypt the video-downlinks of all its UAVs, the mere fact that the enemy could detect (even if they couldn't view) the Predator downlinks is still a major problem.

In the future, the insurgents may not be able to tune in and watch "The UAV Channel" but the detectable presence of even an encrypted digital downlink will be enough to tip off the enemy that they are being watched, therefore it is imperative the whole downlink system be revamped to employ LPI (Low-probability of intercept) narrow-band microwave frequencies or (optical modulated laser) transmission techniquesto render the downlinks undetectable and only receivable by friendly forces.

In the meantime, U.S. forces should flood the airwaves with real and faked and easily intercepted video downlink feeds, which could be accomplished by several COMMAND SOLO C-130Es. That way the insurgents wouldn't know which feeds were live and which ones were Memorex.

In any event all drones will require an expensive and extensive retro-fit, requiring testing, field-testing and re-testing of an entirely new (satellite-based) UAV command control and communications system which wouldn't have been necessary if Pentagon planners would stop underestimating the technical savvy of what they perceive is an unsophisticated enemy.

-Steve Douglass