Defense Information and Electronics Report Recent restrictions placed on access to some Army Web sites are drawing criticism from security experts and military personnel who say the service's application of varying degrees of access criteria on previously public information is inconsistent and illogical.
October 26, 2001
reposted with permission
Security Concerns Prompt Army To Review Web Sites, Access
A handful of Army sites have been restricted to a smaller number of users or simply taken down in recent days. The Army cites operational security and force-protection concerns during Operation Enduring Freedom as reasons for the restrictions.
In some cases, site access has been limited to those using a "dot-mil" server to access the Internet. This is the case with the Web site of Ft. Gordon, GA, home of the Army Signal Center. Almost all online information about Ft. Gordon is now off limits to anyone not using a military server for Web access.
In another case, access to the Web site of the General Officer Management Office (GOMO) has been restricted to users of Army Knowledge Online (AKO), the Army's enterprise Web portal that provides multiple levels of access for different Army users. The GOMO site contains updates on the promotions of officers, officer resumes, and other general information.
"The GOMO public Web site has been moved to the Army Knowledge Online Portal," a message posted at the former Web site address now reads. In order to access the site, "Active Army, Reserve, National Guard, DA Civilian, or Retired Army personnel" are invited to sign up for an AKO account, it states.
In other cases, sites have simply been removed from the Web altogether, making them unavailable to anyone who tries to access them. The Web site of the Deputy Chief of Staff for Combat Developments at the Army Training and Doctrine Command, Ft. Monroe, VA, has been taken down since Sept. 11.
"Contents of this Web site are currently under review," a message on the site reads. A sampling of the hundreds of Web sites that fall under TRADOC, including several artillery schools, training facilities, and subordinate agencies, failed to reveal another Web site that had been taken off line.
Most agree with the decision to take down some Web sites featuring sensitive information. For example, Navy Web sites that tracked the movements of aircraft carriers now being deployed in the war on terrorism are no longer doing so. The Navy has removed the tracking feature from the site for the carrier Kitty Hawk, and other Navy Web sites that contained similar information have simply not been updated since Sept. 11.
In addition, public access to the Web sites of the eight Army chemical weapons stockpiles in the United States have been taken down since Sept. 11 (see related story).
But experts see most of the restrictions as unnecessary and arbitrary.
"The disappearance of Web sites is, unfortunately, totally random and within the discretion of the local commander or major command," says William Arkin, an Army veteran, consultant and author of "The U.S. Military Online: A Directory for Internet Access to the Department of Defense."
"This is the equivalent of some local commander capriciously deciding what is secret and what is not," Arkin told Defense Information and Electronics Report via e-mail Wednesday (Oct. 24).
Other observers also believe the restrictions are being applied inconsistently.
"It's a knee-jerk response on the part of many dot-mil webmasters," said Steven Aftergood, head of the Federation of American Scientists' Project on Government Secrecy. "Regrettably, these sites are simply following the instruction of Deputy [Defense] Secretary [Paul] Wolfowitz."
The instruction to which Aftergood refers is an Oct. 18 memo sent by Wolfowitz to DOD officials. The memo warns against releasing or discussing any information about DOD work in public.
"If in doubt, do not release or discuss official information except with other DOD personnel," the memo states.
This is "a very far-reaching instruction," Aftergood said. "The net result is that a vast quantity of information that has nothing to do with the war on terrorism is getting revoked."
But an Army spokesman said the Web site reviews and restrictions are the service's reaction to real force-protection concerns.
In the new environment, even the most benign information is seen as potential fodder for terrorists, said James Hudgins, Ft. Gordon spokesman. The presence of "maps, personal information, things that may or may not be useful to terrorists" on the Ft. Gordon Web site prompted the new restrictions, Hudgins said.
"I'm sure it's going to be reviewed," he added. "A lot of us are kind of feeling our way along in this new environment."
Army officials and others at the affected Army components would not detail what information on their sites was deemed potentially sensitive. A DI&ER review of many of the relevant pages stored in caches on the Google search engine did not turn up any information that obviously pertains to current operations.
The absence of some information is causing even some Army personnel to question whether certain kinds of information could possibly pose a threat.
"You can get all the maps of [Army installations] you want off MapSource, Yahoo, take your pick . . . along with other branch specific information," one Army officer told DI&ER. While the officer agreed that some information, like the home addresses of officers, should not be put on the Web, he said the new restrictions were "a policy of curing a headache by chopping off the head."
"My issue and the issue of many other officers regardless of active or reserve is access to unclassified doctrinal information on our jobs," the officer said.
Restricting a Web site to dot-mil users still has the affect of denying information to many of those who need it, the officer said. "There are many organizations out there in the active Army and the reserves that either are not recognized as dot-mil or, in the case of reserve and [National Guard] units, are not dot-mil at all," he said. "We have completely blown off the reserves and National Guard."
Other Army sources expressed similar concerns. Some agree that restrictions are reasonable and necessary but see flaws in the authentication methods the Army is employing.
Using Army Knowledge Online to authenticate users would make sense if the system worked better, said a recently retired Army National Guardsman now working in the technology sector. In what sources say is a common scenario, he had to wait three months to get his AKO account. When many Army personnel -- especially in the National Guard and Reserves -- do not already have access to AKO, using it for authentication is problematic.
Few Army reservists and national guardsmen have AKO accounts, according to a report on AKO registration among all Army major commands. Just 35 percent of personnel at the National Guard Bureau, 33 percent of the Army Reserve, and 11 percent of the National Guard as a whole have AKO accounts, according to the report. This compares with an average rate of about 70 percent in other areas of the Army.
Arkin sees important functions that are lost when Web sites are taken down or restricted. "Because so much of the Web is used for public affairs, and for communicating with the families of service members and reservists, exactly the opposite approach to classification is needed," Arkin said. "The maximum amount of unclassified information that is needed to inform should be present on all Web sites, and all other information should be treated just in the same way that printed material is; that is, it is either classified and compliant with [executive orders] and regulations, or it is not."
The Army and the other services have been through Web security reviews before. Guidelines governing Web site information that were issued in the fall of 1998 by then-Deputy Defense Secretary John Hamre caused the Army to remove all of its nearly 1,000 Web sites from public view while their content was reviewed (DI&ER, Oct. 2, 1998, p2).
Some sites remained down for weeks.
The 1998 guidelines warned that information on Web sites, "especially when combined with information from other sources," increases the "vulnerability of DOD systems and may endanger DOD personnel and their families." The Army's reaction was seen by many as stronger than the other services', which engendered some criticism at the time.
The idea that the Web is a "potent instrument to obtain, correlate and evaluate an unprecedented volume of aggregated information regarding DOD capabilities," as Hamre wrote in 1998, is echoed in the recent Wolfowitz memo. This notion -- that unclassified, seemingly benign information becomes dangerous when aggregated -- may account for recent concerns about the Internet, which is particularly suited to gathering large amounts of information quickly.
"Unclassified information may likewise require protection because it can often be compiled to reveal sensitive conclusions," the Wolfowitz memo reads. -- Hampton Stephens
Copyright 2001 Inside Washington Publishers