The military is an impossible place for hackers, and what to do about it (2018)

https://warontherocks.com/2018/07/fish-out-of-water-how-the-military-is-an-impossible-place-for-hackers-and-what-to-do-about-it/

by NavinF • 2 years ago

95 102 2 years ago

warontherocks.com

cdwhite• 2 years ago

2018, FWIW. I'd be curious to hear how (if) things are different now.

alephnerd5• 2 years ago

Pay has gotten better, plus the individual branches all have stronger CyberCorps now.

That said, CyberCom still has issues because it's a unified command and not a branch, which means it has limited say and will always get overshadowed by individual branches and the NSA.

Another interesting change is the rise of private sector players and public-private partnerships to help remediate the pay gap - this is what China and Russia did due to similar issues around renumeration, and most other NATO+ allies like Israel, UAE, Singapore, etc leverage this model.

Anecdotally, outside of the NSA, it appears that most what I'd term "white collar lifers" within branches prefer Intel over Cyber because it's easier to learn due to less STEM, and a significant portion of those who do Cyber will tend to leave for private sector.

That said, Cyber Reserves forces are fairly prominent now and probably the best way to remediate this gap.

I'm biased, but imo, the US needs to adopt the Israeli model of public-private offensive security capabilities plus a strong reserves component, because the pay gap and the respect gap just won't be fixed due to internal intertia in the services.

9659• 2 years ago

USAF now has Cyber Warrant Officers.

dang• 2 years ago

Year added above. Thanks!

evanjrowley• 2 years ago

It is important to learn from one's own mistakes, but if an institution is too big to fail, then does it ever really learn?

Terr_3• 2 years ago

If any entity can't fail, does it need to learn? :p

That said, some of it is a matter of perspective: To bacteria, individual humans are "too big to fail" in the same way geography is.

thaumasiotes4• 2 years ago

To bacteria, individual humans are "too big to fail" in the same way geography is.

...which is why diseases rapidly evolve away from lethality?

spiritplumber• 2 years ago

TLDR: Copy the medic track model. Makes sense to me.

hipadev234• 2 years ago

The answer to every problem cited is simply pay. When there’s unlimited DoD budget for Palantir or Anduril contracts compared to barely livable wage for enlisted personnel, it’s a no-brainer why people go work for defense contractors instead.

Enlisted or Officer, you’ll not break $200k annual earnings until at least 20 years of experience and Lieutenant General or higher rank.

NSA after a decade of experience you may approach 200k.

Anduril starts entry-level at $200k.

master_crab3• 2 years ago

Yup. 95% pay. 5% antiquated culture.

There are some aspects of the military culture that are a bit anachronistic, but it’s minor compared to the pay and the career progression problems the military creates. It forces an up and out system where you can’t continue doing what you’re good at for increasing amounts of pay.

generic92034• 2 years ago

But is that not also a common issue with many IT companies? The technical career path is short and the higher levels on that path are already supposed to work more on powerpoints and meetings than on code.

alephnerd5• 2 years ago

1. Palantir is a data store, and overstates it's "defense" credentials. A major defense customer they keep mentioning churned years ago. If Palantir is a cybersecurity company, then so is Salesforce.

2. Enlistees are bucketed based on rank and years within the service. It is almost impossible to make a case for Cyber Enlistees to get a separate payscale from other Enlistees because other enlistees can and do get pissed.

A mix of public-private offensive security partnerships plus a strong reserves component for cybersecurity related roles is the best solution - this is what Israel does.

Finally, CyberCom is a joint command, not a branch, so they are limited in comparison to what individual branches can do.

master_crab3• 2 years ago

Palantir has been overstating its benefits for decades at this point. Slick UI can’t hide the almost minimal usefulness you get out of it (and even that minor utility requires an army of support engineers anyways)

ericmay• 2 years ago

Enlistees are bucketed based on rank and years within the service. It is almost impossible to make a case for Cyber Enlistees to get a separate payscale from other Enlistees because other enlistees can and do get pissed.

I wonder if (and maybe this is already in practice), there's an opportunity for warrant officers in this context. In the United States Army where I enlisted, our helicopter pilots were mostly warrant officers and then you had the staff officers who would always try and get more flying time.

The warrant officers were, I believe, paid less than the staff officers, but there's no reason to think the military can't provide additional pay. Retention and sign-on bonuses for expertly-trained cyber warfare and other compute-related activities warrant officers could be something to consider.

Even as an enlisted soldier since I worked in aviation we'd get extra pay because of the odd shifts we worked which was supposed to make up for/supplement on-base meals. I may be remembering incorrectly but being airborne trained provided some extra money as well, though nominal.

All that to say, if a W-1 is making $50,000 in base pay per year, if we wanted to we could just double that via retention and sign-on bonuses.

Of course you might say, well sure but then you know you really aren't making as much as that engineer who is pulling $180,000/year + bonus/equity, and you're right, but in a similar vein I'd say yea and you can only fly an AH-64 in the military....

2OEH8eoCRo02• 2 years ago

I think that it's complicated. Military service always looks like a bad deal on paper yet my military service is probably what I'm most proud of. I think we are fixated on $ to an unhealthy degree.

Where is Anduril getting that money? They're paid the same rate for govt contracts as everyone else no? Do they boost that with investor cash?

alephnerd5• 2 years ago

Where is Anduril getting that money?

A mix of VC funding, foreign defense sales, and private sector deals, because their products are dual use. Also, as a private company, they don't have the same kinds of expenditures that a service has (pensions, capex on infra, etc)

I think that it's complicated

Yep! Esprit de corps does play a role in retention to a limited extent.

Also, after this hearing happening in 2018, all the branches began pushing heavily for Cyber Reserves branches because it's the easiest way for them to remediate the skill and pay gap.

arccy• 2 years ago

because the military can't retain talent, they pay through the nose for contractors who don't enforce their "standards"...

bastawhiz• 2 years ago

Nobody is denying that many people find military service fulfilling. But certain roles have extremely limited talent pools. The odds that you'll find someone willing to take a position primarily for fulfillment when the starting salary for a contractor is double/triple/quadruple/quintuple what government offers, the public service role is immediately starting at a significant disadvantage.

Besides hiring talent, it carries through to career advancement and development (which plays heavily into personal fulfillment!) which on turn affects retention. If you're thinking of starting a family and settling down, being able to have more flexibility and significantly more money is a highly attractive option.

relaxing6• 2 years ago

They're paid the same rate for govt contracts as everyone else no?

No. Where did you get the idea the government pays the same rate for every contract/contractor?

Defense procurement is notoriously complicated, and there are myriad ways contracts can be structured. There is definitely no single rate.

jki2756• 2 years ago

Anduril doesn't generally sell hours to the government like most defense contractors.

alright2565• 2 years ago

Unlike most defense companies, we don’t wait for our customers to tell us what they need. We identify problems, privately fund our R&D and sell finished products off the shelf.

The idea is to be more like Microsoft or SpaceX. The government doesn't micromanage Microsoft's R&D, they simply purchase licenses for Windows off the shelf. Same thing happens for SpaceX rocket launches at this point.

neodymiumphish2• 2 years ago

Agreed! I left the Air Force with 12 years of service, 4 SANS certs, certification as a federal law enforcement officer, and experience working against APTs. At the time I left, I was getting less than $80k in compensation (excluding healthcare, cause I don’t know how to account for that), and accepted the first job offered ($103k). Left that less than a year later for a job paying $140k plus bonuses, and now I’m in an even better spot 2 years later. The military can’t compete unless they change how they pay their service members.

hed• 2 years ago

Did you get BAH? In high CoL areas like DC metro the housing allowance is like an extra 33k, tax free.

ozim5• 2 years ago

But it would take you much more to jump to that $140k if you were not in military.

It wasn’t like you could get that right of the bat.

Military experience is valuable on itself.

Yes you don’t want to stay there for whole career- but doing 5 or 10 years is going to pay off later. Just be good for your mates ;)

giantg210• 2 years ago

I mean, the reason you're getting that much is due to the experience and creds you earned during service. I can't even post into real security roles at my current company because they only want external candidates with federal experience. They post internally for 1-2 days as a formality. Even then, most of those roles are under $120k. The only roles available to me are shitty ones like application security champion and managing/configuring SAST tools.

Also a major point not covered was defined benefits vs the 401k model.

topkai22• 2 years ago

Part of the “problem” is that much military pay is “hidden”. An e-6 at 12 years makes $55.6k. That is very low compared to the private sector. However, basic allowance for housing (BAH) for an E6 with dependents is another $20-40k, so let’s call it $30k. Finally there is retirement. Retirement is harder to calculate, but traditionally if you reach 20 years then you get half your pay for the rest of your life as soon as you leave the military. An E6 @20 would get almost $30k/year, which will automatically increase with inflation. If you retire at 39 (enlisted at 19) and live to 80 you get $1.2M in inflation adjusted payments. The net present value of that is not something I know how to rigorously calculate, but $1M seems in the ball park. That’s an additional $50k/year over a 20 year career if you make it.

That means if you are a 12 year E6 and plan to stay in to 20 your real total comp is closer to $130k/year, and that’s not including BAS, retention bonuses, and other compensation. And it excludes tricare and other VA benefits post retirement.

The total potential compensation for military personnel is far more comparable than it looks, but is heavily weighted to non-cash compensation.

* Apologies if I’m being too pedantic here to much, but I wanted to make sure people who aren’t familiar with the subject can understand what I’m getting at as well.

renewiltord• 2 years ago

Anduril fires people. That’s why the government can give Anduril money. The government can’t do things that Anduril can.

zaphar• 2 years ago

I mean, the government absolutely could fire people. They aren't giving money to Anduril because Anduril can fire people. They are giving money to Anduril because:

1. Anduril is more competent than the people they can afford to hire.

2. Giving Anduril money funnels funds into local enconomies and individuals that are important to political objectives.

tzs• 2 years ago

In the military though aren't people enlisted for specific amounts of time, so if the military no longer wanted them around it could just not allow them to reenlist when their current term expires?

Even if you have a lot of time left on your current enlistment period and they don't have cause to toss you out, couldn't they reassign you for the rest of your term to something else?

michaelt• 2 years ago

The pay is part of the equation, absolutely.

But in my experience, there comes a point where people start saying "OK, now I'm earning $x00,000 I'm rich enough to afford some luxuries, what luxuries would most improve my life?" and it turns out things like "not being on call" are kinda popular.

I'm not sure there's any reasonable amount of money that would make me want to go to a boot camp and get hazed by a bunch of jocks.

So they might need pay and fixes to the culture.

crooked-v• 2 years ago

And that's before considering things like the probably higher-than-usual rate of neurodiverse workers in software, for whom military cultural issues would often go from merely unpleasant all the way up to fundamentally incompatible.

hipadev234• 2 years ago

go to a boot camp and get hazed by a bunch of jocks

Marine Corps recruit training and Air Force BMT are world’s apart.

Aeolun6• 2 years ago

I'm not sure there's any reasonable amount of money that would make me want to go to a boot camp and get hazed by a bunch of jocks.

This sounds like it’s more a problem of boot camp, not so much the cyber department.

trod1233• 2 years ago

I agree, but one oft neglected part of these things is the assumption that military and private companies are the same when we know they aren't.

The pay is one issue, but the social aspects are the much bigger issue.

In bureaucracy where jobs are almost impossible to be fired from for lack of adequate performance there is always an entrenched notion that anyone performing better is making everyone else look bad, and this results in sideband bullying, silencing, and various other forms of coercion which meet a definition of torture.

This is why Academia, and Government have such a hard time finding and keeping qualified people. Structurally, those in charge are the ones promoting negative production value, they may say otherwise but people lie all the time and its only rational to take people by their actions over what words they speak.

There is no amount of money that someone will justify selling/losing their sanity in exchange for money. Money isn't worth anything if you can't spend it.

If you sieve the entry with arbitrary requirements, while also making the job intolerable... of course you aren't going to attract talent.

Its not mainly a matter of money, or for that a matter of culture. Its a matter of structure, and structural failures that incentivize these deficits, they are the same deficits found in central planning.

If you can't relieve people for doing a bad job, you only ever attract parasites which crowd out your productive members, and eventually the reputation gets around and no one even bothers to apply or go down that path if they can avoid it. Couple that with systems which are designed to propagate evils without the individuals alerting to the fact, and who would risk their soul for a job?

The wisest understand that the job you choose can warp and defines you. If you segment and compartmentalize information you'll never know when you commit attrocities, and you'll be equally responsible regardless of that knowing.

Overall, Government job? Academic Job? nope moving on. Sanity, and religious beliefs are valued well above anything so base as money; but there are those types too.

giantg210• 2 years ago

Pay is only part of it. There's a huge mindset difference between controlling organizational structure/policy and the type of people that want to freely explore creative ideas that don't fit in the normal boxes (hackers). As an example, lot of people wouldn't be ok with being told you have to move, or you can't move, which is common in the military.

$200k is huge for most people. Even $100k is a good salary for most of the country. Start adding in housing allowance and a defined benefits program and it's really pretty decent. Most branches will do direct commissions up to O5 for cyber roles now.

hipadev234• 2 years ago

$200k isn’t huge for people capable of cyberwarfare.

miki123211• 2 years ago

This is a general problem for all (western) governments everywhere, not just the US or the US military.

The thing about contractors is that paying $ x million for a project is "normal", but paying a entry-level software dev twice the salary of e.g. the national police's commander in chief is completely unacceptable. If you do that, people in other branches of government will most definitely strike, and doing it will involve incredible amounts of feather ruffling. It's probably one of the hardest things for a government to do, and it stands against everything governments traditionally stand for.

I don't think democratically-elected governments have a good way out of this problem. Propaganda about "protecting the nation" probably helps somewhat with convincing people to just stomach the lower pay, but that's far from enough.

lesuorac• 2 years ago

I mean until the USG stops footing the bill for the President and VP this isn't going to change. You can pay an external contractor more than the VP but not a federal employee (some handwaveyness around locale benefits).

If Kamala had to actually pay for all of the stuff she did out of her $284,600/yr salary we'd see that number go way up real fast. I doubt that even covers her security detail if she stayed at the Observatory all year.

The USA has a revenue of ~4.5 Trillion and the 2nd in charge gets <300k while companies with well under 1T revenue have numerous employees with $xx million compensation.

[1] The aggregate limitation on pay for members of the Senior Executive Service and employees in senior-level or scientific or professional positions covered by a certified performance appraisal system is the total annual compensation payable to the Vice President under 3 U.S.C. 104 on the last day of the calendar year.

[1] https://www.opm.gov/policy-data-oversight/pay-leave/pay-admi...

jki2756• 2 years ago

Most federal employees are limited by the amount paid to a member of congress. The SES doesn't have a lot of people in it and they mostly run a bureaucracy, they're not doing real work.

dctoedt• 2 years ago

CyberCommand might be able to do something like the Navy nuclear-propulsion program: Enlisted "nukes" get enlistment bonuses and (if they "re-up" after their initial six-year enlistment) fairly-decent "STAR" reenlistment bonuses.

https://www.navytimes.com/news/your-navy/2023/06/23/big-enli...

https://www.mynavyhr.navy.mil/Portals/55/Career/ECM/Nuclear/...

alephnerd5• 2 years ago

CyberCom is a command, not a branch. Individual branches have leeway to make those compensation changes. A unified command can only provide some additional monies.

That said, individual branches absolutely are doing that, and have started doing that after the 2018 hearing referenced in the article above.

halJordan• 2 years ago

The problem with that is a) the pay still isnt enough. But mainly the problem is that army bonuses are by MOS. The cyber mos can be done by a high schooler (by design). You can just get another high schooler by selling them that theyll be a hacker.

Actual operators already get the highest bonus the Army offers. But the reality is the Army will pay a civilian twice what a soldier gets (total compensation, including bonuses and intangibles) for the exact same job.

Terr_3• 2 years ago

To add insult to injury, tool developers often perform technical due diligence for capabilities procured from contractors. These capabilities typically mirror the capabilities that talented tool developers create on a quarterly basis, and the government will pay multiples of a developer’s annual salary for them. Nowhere else in the military is its economic rent so clear to the servicemember.

As someone who feels more like a thing-builder than a thief-saboteur, this description is definitely off-putting.

neilv2• 2 years ago

The intersection of people who can run a 15-minute two mile and dissect a Windows kernel memory dump is vanishingly small.

When I was doing consulting computer stuff for aviation safety[1], I used to joke to myself that I had The Right Stuff... for sitting on my butt, typing on a computer.

But I never voiced that joke in the presence of clients or partner organizations. Where some of the personnel were actual fighter pilots, and who knows what else.

[1] Incidentally, that might be the work I'm most proud of being a part of. I'm not disrespecting government work at all. I only pivoted from Federal technical consulting, back to tech industry startups, because of performing like a FAANG ~L7 for years, yet still not being able to afford a condo in my HCOLA. (And, just when I'd finally verbally negotiated a big chunk of work that would've fixed the money problem, a perfect storm of bad luck ruined that.)

analogwzrd3• 2 years ago

I almost graduated (switched programs) from a graduate school cybersecurity program. They tried making the program "interdisciplinary" which essentially meant that they dumbed down the technical classes so that non-technical undergraduate degrees could pass them.

I tried to put together a team of students to compete in one of MITRE's cybersecurity competitions, but struggled to get other students to create SSH keys so that they could get access to the competition server. Not hack into the server, just follow instructions that I gave them to create keys and give me the public ones so that they could log in and participate.

The industry has a similar problem that the military does: It's very difficult to take non-technical people and train them to be cybersecurity professionals, much less hackers.

You need to start with an engineering background, and it almost has to be electrical or computer engineering, or at least computer science. Of those people with that background, hacking in particular is a type of thinking, problem solving, and mentality that not everyone has.

If you want to defend, attack, or manipulate cyber infrastructure you need an understanding of how that infrastructure is designed and operates. An engineering background will at least give you the building blocks for that.

neilv2• 2 years ago

Can we say that Technical vs. Non-Technical in this space isn't so much about formal credentials, as it is about putting in a lot of time to learn about many relevant things, hands-on and probably exploratory?

The person whose only degree is Art school dropout, but who's logged many hours coding personal projects, running their own Linux or BSD machines, playing with networking, tweaking a game binary, etc., will wipe the floor with more-credentialed others, at a lot of real-world computer technical stuff.

Compared to person with a Engineering degree, or even a Computer Science degree-- but who spent no time outside of classwork, Leetcode memorizing, and a GitHub profile that was motivated only by FAANG-application coaching.

Those people who couldn't create their keypairs probably have fine raw material for becoming the kind of Technical person you need. But they're just having a pile of information shoveled at them in lectures and homework. And maybe they just wanted a job. And nobody told them that, if you want to be good, you have to put in the hours of quality unstructured learning time.

analogwzrd3• 2 years ago

I don't put a huge emphasis on credentials. If someone is capable and talented, a degree doesn't change that. However, if they were able to complete an engineering degree (or insert analogous degree from any other area) then they have demonstrated an aptitude and capability that others have not.

The people who couldn't create their keypairs may have had the raw material, but they were trying perform at a level they weren't yet capable of - they couldn't google a simple task and follow instructions. They needed to go back to square zero and learn basics when they were in a graduate program. And because the graduate program was dumbed down, they weren't going to learn the basics in the program.

The military is an impossible place for hackers, and what to do about it (2018)

Related Stories