Loose Lips Sink Ships: are fresh military domain names dangerous?
In this post, Joseph Peterson questions if fresh .navy, .army and .airforce domain names could be a security issue for the U.S. military.
This little article of mine may make me some enemies at Rightside, the registry behind the recently released TLDs .ARMY, .AIRFORCE, and .NAVY. Still, I have no ax to grind. Far from being opposed to the fresh TLD initiative per se, I personally invest in nTLD domains on occasion; and I see strong commercial potential in some of Rightside’s offerings. In this case, I simply want to voice a concern that goes beyond domain industry politics. And it’s just that — a tentative concern rather than a definite conclusion.
I ought to explain that my perspective on these 3 military TLDs comes from nearly a decade spent in the U.S. Navy. My military career did not involve me in policy decisions or even IT; so my experience is only indirectly relevant. Yet, for any submarine officer, information assurance was paramount. Classroom notes were shredded into dust. Armed guards ensured we didn’t bring cell phones in or classified papers out. Safes could only be opened in pairs. The military needs its boundaries airtight.
So what does this have to do with .NAVY, .ARMY, and .AIRFORCE? Well, nobody in the domain industry needs me to explain how much more notable the internet is today than it was 20 years ago. Just like everybody else, the U.S. military operates a fleet of its own official websites. Many of them are public, although you’re unlikely to have visited them. Others require login and are meant to be secure. In other words, the military has an online perimeter to patrol. With these 3 fresh TLDs, that military border will likely be compromised. It is by now blurred.
Unlike .MIL and .GOV websites, which the Department of Defense (DoD) can regulate, .NAVY, .ARMY, and .AIRFORCE domains can be registered by anybody and used for unsanctioned activities. That’s free speech, and that ought to be perfectly fine.
But what regarding phishing? What if someone clones a military website to gain passwords and infiltrate a secure site or network? Many fresh TLDs give phishermen an edge. They’re a sizable supply of shorter plausible representations of your bank, your credit card, or your employer.
The U.S. military is especially vulnerable. Take the Navy, for instance. Most of its sites are built on subdomains like public.Navy.mil. Shortening this to public.Navy by dropping the .MIL could easily go unnoticed or (if noticed) look equally official. In general, military personnel are too busy to pay attention to URLs. Internet awareness matters very little in that line of work. So unless the U.S. military emphatically distances itself from .NAVY / .AIRFORCE / .ARMY as part of an ongoing training program, military personnel will fall for impostors.
Does this matter? Prior to general availability, each of the 3 fresh TLDs had less than 50 registered domains; and it’s unclear how many will be registered, by whom, and for what mixture of purposes, tomorrow or 10 years from now. Also, I can’t really comment regarding the nature or extent of the military’s online risk. Phishing could expose personal information at the very least. At worst, it could access classified material.
During World War II, the Navy had a saying: “Loose Lips Sink Ships”. The suggestion that spies are all around and listening in probably strikes most of you as paranoid or antiquated. Nevertheless, military-versus-military espionage is part of a government’s day-to-day activity. Even following the Cold War, rival militaries vie with each other for tactical and technological supremacy. During peacetime, a relentless battle continues to discover what the other guy is up to and how they do things. Spies within the military have been prosecuted as recently as 2013. Submarines, satellites, and aerial drones are all instruments partly designed for espionage. These days, so are hackers.
Cyber warfare isn’t just regarding installing viruses to destroy Iranian centrifuges or government-sponsored Chinese hackers. Much of it is low tech and makes use of run-of-the-mill online resources. For instance, Facebook has proven to leak ships’ movements like a sieve, despite admonitions to sailors not to disclose deployment dates. Social media can be a security problem for the military, and so can the domain industry.
Motive exists. Does opportunity? Could a phishing expedition using .NAVY gain information on, say, submarine systems, tactics, or nuclear missiles? Maybe not today. But phishing could interfere with military personnel in smaller ways — for instance, diverting pay away from bank accounts.
Crucially, nobody knows how the U.S. military might choose to use URLs built on .MIL or .GOV domains in the future. The world relies on the internet more and more year following year; so I’d expect the military to follow suit. Regardless of how .MIL and .GOV sites are deployed, any military website can now be impersonated more easily with a .ARMY / .AIRFORCE / .NAVY knockoff. That means ongoing elevated risk.
Although I do see the appeal of .ARMY, .AIRFORCE, and .NAVY for personal or civilian use, I keep returning to one basic idea: A blurred boundary is harder to police. For the military, much more than for your bank account, secure access matters. The stakes are high.
Do the benefits of free speech — of allowing private citizens to register their own .ARMY — outweigh potential risks to the actual Army? I personally think the U.S. military missed the boat when it chose to allow these domains to be scattered on the wind. The right hand doesn’t know what the left hand is doing. If the issue was neglected, that is hardly surprising, given what pressing concerns the DoD has had on its plate. Who in the U.S. military could afford to pay attention to the domain industry and hypothetical web-based chinks in the DoD’s armor while mired in multiple, actual overseas wars?
Back in 2012, Politico ran an article with the provocative headline: “U.S. cries foul over .army, .navy and .airforce”. Did it really, or was that nothing more than anti-nTLD propaganda? That article referenced a formality, in which the registry was alerted to the fact that “The string is confusingly similar to the name of a specific agency”. Beyond that, I don’t know if the government raised much of a fuss or seriously evaluated the repercussions. Truly, if the U.S.A. (which still oversees ICANN) had wanted to take possession of .ARMY / .NAVY / .AIRFORCE, then it could have overpowered ICANN and Demand Media (now Rightside) with a flick of its little finger.
Perhaps discussions between Demand Media and someone within the DoD took place, and perhaps the government was satisfied to relinquish control of its 3 armed services as dots. But I would recommend that the United States government re-evaluate that risky long-term decision. The military may find that it’s worthwhile to buy out Rightside’s 3 military TLDs in order to safeguard them for official military purposes and protect its own personnel and classified information against phishing.
The time for a buyout is now — ahead of widespread private ownership, ahead of civilian development, and ahead of security breaches. Frankly, Rightside might do well to sell off its 3 assets to the best-funded organization on the planet. Certainly, the DoD could put .ARMY, .AIRFORCE, and .NAVY to good use, streamlining its clunky, acronym-filled URLs.
Once again, these are just my own private and tentative musings. I’m quite aware that no flag officers from the Pentagon are reading Reglike. And equally aware that nobody at ICANN or Rightside asked for my opinion. This is one guy’s gut reaction rather than an involved study. Time may prove me wrong, and I might change my mind tomorrow.
