Giving it Away On-Line?—Dissecting an OPSEC Case Study

The F-22 Raptor in flight. Did a veteran fighter pilot disclose sensitive data about the Air Force's newest fighter, or simply discuss information that was already available in the public domain?

Part I of II

By Nate Hale

Asked to justify restrictions on certain forms of internet activity by military personnel—on government computers—DoD officials invariably cite concerns about operations security (OPSEC). In an increasingly wired world, the Pentagon is worried that adversaries can glean sensitive or even classified information from blogs, chat rooms and other on-line forums.

Noah Shachtman (who runs the widely-read defense blog, The Danger Room) has written extensively about this issue; his most recent post on the topic (which contains quotes from this blogger) can be found here. Mr. Shachtman’s reporting confirms what many already suspect; the Air Force—and other military organizations--see little value in blogs, and are moving aggressively to limit access through its IT network:

"The Air Force is tightening restrictions on which blogs its troops can read, cutting off access to just about any independent site with the word "blog" in its web address. It's the latest move in a larger struggle within the military over the value -- and hazards -- of the sites. At least one senior Air Force official calls the squeeze so "utterly stupid, it makes me want to scream."

And sure enough, retired Air Force Colonel Tom Ehrhard (now a senior fellow at the Center for Strategic and Budgetary Assessments) invoked the OPSEC issue in defending the crackdown. As he told Noah Shachtman:

"It is increasingly clear that active exploitation could take advantage of airmen and civilians who want to inform and correct the often outrageous, false assertions on these blogs. In doing so, it is easy for well-meaning insiders to violate operational security (OPSEC) tenets, either directly or tangentially. We are in a different world today when it comes to sensitive military information, and foreign intelligence operatives surely understand this and will exploit it. As a former member of Strategic Air Command, where OPSEC was (rightly) an obsession, this has been obvious to me for some time in reading aerospace-oriented blogs. This policy strikes me as a timely reminder to Air Force professionals that they should be on guard when blogging, because someone is watching."

Underscoring the potential threat, the Air Force is now circulating a PowerPoint presentation entitled “CyberOPSEC: An F-22 Case Study,” detailing information about the service’s state of the art fighter that appeared “on a popular public website about military and civilian aircraft.” Apparently, the source for much of the data was a Raptor pilot, who posted under the handle “dozerF22.” A copy of the briefing was obtained by In From the Cold.

The implication of the study--reportedly compiled by the Air Force Office of Special Investigations (AFOSI), the Navy’s Criminal Investigative Service (NCIS), the FBI and the Department of Homeland Security—is clear. By participating in the forum, answering questions about the F-22 and providing personal information, “Dozer” displayed questionable judgment and might have disclosed valuable information about the nation’s newest stealth fighter. The referenced assessment is “Unclassified/Open Source,” so discussion in public forums does not betray any classified or sensitive information.

Discovering Dozer’s identity wasn’t very difficult, according to the presentation. The pilot’s public profile listed both his name and military e-mail address. And, if that weren’t enough, another poster on the forum quickly testified to Dozer’s reputation as a fighter jock:

"For those who don't know, Dozer is one heck of a fighter pilot.

Then-Capt Dozer, a flight leader with the 'Grim Reapers' of the 493rd FS RAF Lakenheath, UK, on night one of Operation Allied Force led a package of four F-15Cs and four F-16CJs protecting the first wave of F-117A Night Hawks flying over Serbia. Engaging a charging MiG, he launched missiles through the formation of F-117s, ending in the MiG exploding about 1,000 feet off the nose of one of the Night Hawks. The pilot ejected safely out of the MiG-29 fireball.

Dozer encountered some more MiGs later in the conflict and scrambled the night the F-117A, callsign Vega31, Col Zelko, was shot down and rescued (More details and Dozer's photo in the hard-to-find book "Stealth Down," by Ross Simpson).

An honor to be able to chat with a pilot that has been there and done that.

Kevin

Aero-engineer

The pilot’s on-line profile also included his picture in a flight suit (name and rank clearly visible), with an F-22 in the background.

Over the months that followed, postings by Dozer and other forum participants attracted quite an audience, according to the OPSEC analysis. The board’s F-22 discussion logged over 700 posts, which were read more than 68,000 times. New users “came out of the woodwork,” the study claims, creating new accounts and posting questions for the F-22 pilot. The queries covered a broad range of technical, tactical and performance issues for the Raptor. Some sample questions:

· “That rocks…so is a JHMCS (Joint Helmet-Mounted Cueing System) or equivalent going to be included in the upgrades along with the AIM-9X (air-to-air missile)?
· “With the upgraded air to ground capabilities, will this allow the Raptor to attack mobile/moving targets in addition to autonomously identifying ground targets?“
· “What are your opinions regarding the effectiveness of the 20mm cannon on the F-22?”
· “It has been said that 2-3 RAF Eurofighters have been sent to Nellis AFB for testing and training…might you confirm this information and tell us some details about the result of Raptor versus Typhoon up to now?
· “You mentioned you are moving up north. Where are you heading?”
· "It is said that Raptor nowadays can supercruise with the speed of around Mach 2. Could you make a confirmation or comment for this declaration?”
· “I just want to know if that was the fastest pitch the Raptor can achieve?”
· “If the Raptor was to carry external stores would it loose its ability to supercruise straight away?”

One participant even asked about a specific feature on the F-22’s fuselage, posting a photo of the area in question with the query: "Dozer, what does this picture show?

Over the months that followed, the F-22 pilot responded to scores of questions, offering general information on the radars carried by Raptor variants; the location—and function-- of engine bleed air and bypass doors; the accuracy of aircraft weight numbers published in another aviation forum, and the date when his new unit (located in Alaska) would receive its last jets. A few of his replies are listed below:

· “I think the fuel numbers are not classified.”
· “The F-22 is not sitting alert in Alaska; however, we occasionally pulled a very tiny amount of alert at Langley.”
· “The pace will really pick up in August, both aircraft and pilots (in Alaska)
· “No they aren’t modified, and they have the older generation radar. The AK and beyond tails (although Langley does have three Lot 5 tails) are the ones with the next generation radar.”

According to the study’s authors, months of on-line questions and answers revealed a number of details about the F-22, ranging from its basing status, to the function of specific flaps and doors, and details on how various weapons systems operate. Other responses “confirmed and denied performance rumors,” discussed the status of radar upgrades, and covered “issues with thrust vectoring.”

Judging from the OPSEC presentation, readers would think that the on-line forum provided a veritable treasure trove of information on the Air Force’s newest fighter. But a closer examination of the study--and its conclusions--reveals that much of the information “disclosed” on the discussion board had been circulating for months—even years—before Dozer and other participants weighed in.

Tomorrow: A look at earlier discussions and media reporting on F-22 capabilities, deployments and operational issues. Did Dozer’s on-line comments represent a genuine OPSEC violation—or was it largely a rehash of information already available to the public and potential adversaries? And, what does the incident say about existing military policies on information disclosure and on-line activities?