America’s most capable foreign intelligence adversaries will welcome the Pentagon’s embrace of telecommuting as a response to the coronavirus pandemic. It means new avenues for its cyberintelligence operations.
Unfortunately, it is far easier to observe, intercept, or otherwise engage with protected communications when one party involved is away from the physical workplace. And while it is possible for Pentagon employees to log in to their various intranets and email systems from their homes, doing so creates significant additional risk that their communications will meet prying eyes.
The exception here is those most senior Pentagon officials who have secured communication facilities at or near to their residences. But beyond this tiny cadre, telecommuting poses opportunities for America’s adversaries. This is particularly true of the Russian GRU and SVR, the Chinese Ministry of State Security and Peoples Liberation Army, and Iran’s Islamic Revolutionary Guard Corps and Ministry of Intelligence. Oh, and the French Directorate-General for External Security and Israeli Unit 8200 — close allies that like to spy on us. (We do the same to them.)
The key here is that telecommuting provides cyberadversaries and frenemies new access points to U.S. communications. Consider that a Defense Department employee must use the internet to access the intranet from his or her home address. So even if the endpoint of the intranet is secured from intrusion and constantly monitored by counterintelligence teams, the data stream across the home residence server is vulnerable.
Yes, the Pentagon will say that it can monitor hidden eyes even at the residence point of the connection. But only imperfectly. And yes, the Pentagon will say that those civilian employees working on the most sensitive issues don’t fall under this guidance.
Still, foreign adversaries have significant interests in Pentagon communications even where they involve issues such as human resources that are unrelated to the U.S. military’s central mission. There are ways to guard against the risks here, but only imperfectly. Reflecting as much in its coronavirus telecommuting guidance to employees, the Defense Department offered mainly platitude-centric jargon. Take the gem on page 14 of 37 — the Pentagon cannot do anything simply — which observed:
Seamless bureaucratic rhetoric, but rhetoric detached from the threat reality.
