Jordan’s Brig. Gen. Ahmad Milhim leads an effort to protect the military, government and businesses from digital attacks
UNIPATH STAFF
The information technology revolution — and the emergence of new spaces for people to communicate and conduct their daily business — has changed the world profoundly. It’s common for people to shop, deposit money in bank accounts and pay bills without leaving home. Doctors can conduct surgery with the aid of a computer network, and homeowners can monitor and control their home’s temperature and lighting from anywhere in the world. While technology has delivered many great things to mankind, terrorists and other criminal groups are using it to rob banks, spread extremist ideologies and carry out deadly attacks. Therefore, it is essential for nations to beef up defensive technologies to counter these imminent threats. Jordan is one of the first nations in the region to establish a directorate for digital security. Unipath interviewed Brig. Gen. Ahmad Milhim, director of information security for Jordan, who explains the important role of this directorate.
Unipath: Tell us about your academic background.
Brig. Gen. Milhim: I studied electrical engineering at Lawrence University in Michigan. I was sent by the Jordan Armed Forces and earned my bachelor’s degree in 1986. Upon my return to Jordan, I worked in many sections within the Armed Forces. I went again to the United States for my higher education and earned a master’s degree in computer science and engineering in 2001. That enabled me to make information technology my career in the military.
Unipath: Do you plan to build a secure network to defeat the external threats?
Brig. Gen. Milhim: The Directorate of Information Security is newly established in Jordan, starting in 2014. Our aim is to establish a secure network for Armed Forces and protect Jordan’s cyberspace. It is part of my duty to build a strong network that is difficult to infiltrate, and we are working closely with our U.S. partners to meet this objective.
Unipath: What are the challenges to implementing your plan?
Brig. Gen. Milhim: There are many challenges, but no doubt the same challenges face other nations working on similar projects. These include human resources, funding and organization. It is important to find skilled and specialized individuals in this sector and to maintain and advance their ability to be current with new technologies and to learn from other nations hit by cyber attacks. Just as we obtain new and sophisticated technologies for sharpening our skills, so do our adversaries. This effort will need a solid budget to keep pace. In addition to the financial challenges, there is the organizational challenge of educating the Armed Forces staff to be vigilant and understand the importance of cyber security. This field is new to the Armed Forces, whether in Jordan or other nations. It became necessary to build an organization that is able to secure this new front. This effort requires laws and regulations in addition to the funding and manpower to enforce the policy. The organizational challenge is the first hurdle faced by nations attempting to build cyber security organizations. It requires in-depth research and studies and the right experts to establish the specialized departments and teams. The Jordan Armed Forces recognized this challenge early on and established a specialized directorate to monitor and build the capacity needed for cyber security and a secure Armed Forces network. I am confident that with the support of our partner in the U.S. government and U.S. Central Command, we will soon build the capacity of our organization.
Unipath: What are your thoughts on holding an international conference for cyber security and its role in combating organized crime and cyber terrorists?
Brig. Gen. Milhim: I believe these conferences are essential to building partners and networks and to strengthening the trust among friends in the field. In addition, we learned firsthand about the latest studies and exchanged ideas and benefited from the experiences of other nations. No doubt, building partnerships and trust is key to success in the cyber domain.
Unipath: Why is it important for the military
to pursue a cyber-security strategy?
Brig. Gen. Milhim: Building the strategy is
like setting the cornerstone for any organization.
We state our objectives to assure and sustain success. We worked to build a strategy and have made tremendous progress toward our goals.
Unipath: Talk about the relationship between cyber security and information security in the daily lives of Soldiers.
Brig. Gen. Milhim: An information operation is a military term and means protecting sensitive information from adversaries. In other words, to protect the secrecy of an operation. The term has been improvised for cyber technology, and is a concept essential not only for militaries but the private sector as well. The private sector is continuously securing its networks to prevent cyber attacks — cyberspace has a significant impact on business profitability. It became critical to protect this space, whether for the military or the private sector. Therefore cyber security became the front line for protecting the security of military information and operations as well as the security of Soldiers on the battlefield. As information security becomes the backbone of our military operations, it becomes essential that we educate Soldiers about the vital role they play in protecting information. Although cyberspace is relatively new, it is considered the fourth front on the battlefield. Because most communication, including the global positioning system, takes place in cyberspace, it has become a battlespace as essential as ground, sea and air. In addition, the common use of personal communication devices, including by Soldiers on the battlefield, poses a huge challenge for information security. We must educate our Soldiers to protect the Armed Forces’ information security by enforcing cyber security regulations.
Unipath: How important is military cooperation with other security agencies and the private sector?
Brig. Gen. Milhim: There is no separate military and civilian cyberspace; there is only one shared cyberspace. All entities must cooperate to protect it. Cyberspace has no physical borders. There is a great deal of overlap between military and private sector networks and even among nations. This overlap means a small penetration of military or private sector networks can have an enormous impact on the military. It is therefore essential for all parties to cooperate and do whatever they can to assure the highest level of cyber security. Furthermore, it is important to provide educational programs and information sharing about current threats and to encourage everyone to report suspicious activities or cyber attacks. Jordan’s Armed Forces enjoy a great relationship with the rest of the national agencies and the private sector, and this is a strength because it makes everyone well-informed.
Unipath: Tell us about your daily work and what you do as a military leader in the field?
Brig. Gen. Milhim: I am the director of security and protection of information security. My directorate is assigned many tasks. The most important is to update the necessary capacity, policies, technologies and manpower to defend the Armed Forces’ cyberspace and leverage a secured working space. Before assuming my current position as the first director to this directorate, I filled many positions that built my leadership skills, and I hope I meet my commanders’ expectations. We are working closely with our partners in U.S Central Command to improve and obtain capabilities and technologies to ensure the security of our shared cyberspace. As I mentioned earlier, this is shared cyberspace and must be protected by all stakeholders. In addition, we are working with an open mind across the governmental and private sector to share expertise and information about threats and how to counter them.
Unipath: Why it is important for a nation to team up to maintain cyber security?
Brig. Gen. Milhim: Cyberspace is a shared space without borders, and it is the responsibility of all nations to secure it. When a personal computer is subverted, the rest of the network will be at risk and the threat spreads rapidly. Consequently, users must maintain high vigilance when browsing the Internet and reading emails and must report any suspicious activities to eliminate infections to the entire network. No nation can stop individuals from entering their cyberspace, which creates a great challenge in controlling it. In fact, a person or a small group of criminals or terrorists could cause grave damage to critical networks. We are seeing cooperation among organized crime groups across the world to coordinate massive attacks on a single target to infiltrate it. Such attacks cause severe damage to the financial and security sectors. If we don’t establish international laws and rules to regulate cyberspace and punish the criminals who violate these laws, chaos, criminality and occasional loss of life will never end. It is essential for nations to share intelligence, tools and skills to defeat cyber security threats. I am not suggesting this cooperation will completely end all threats, but it can reduce them.
Unipath: How serious are the threats to cyberspace from terrorists and criminals, and what is Jordan doing to counter them?
Brig. Gen. Milhim: No one doubts that terrorist and criminal threats have become a daily reality. These threats are as different as their objectives. Unfortunately, all indications lead us to the conclusion that these threats have not only increased in frequency but sophistication. This adds to the burden on the state to ensure the protection of its citizens and infrastructure. And it requires a sequence of actions to eliminate the threats. In Jordan, we took many actions, including establishing the program to protect our cyberspace. Beginning in 2010 with His Royal Highness Prince Faisal Bin Al Hussein and His Excellency the Chief of Staff, we created the first national strategy to protect our cyberspace. The Armed Forces were assigned this task in 2016, which makes the Armed Forces the primary entity to improve national cyberspace security. Our goal is to establish an advanced program with the highest possible protection within five years.
Unipath: Daesh has specialized groups conducting cyber attacks. Since Jordan is considered the front line against Daesh, are there any known attacks by Daesh against Jordan?
Brig. Gen. Milhim: I have no specific information about Daesh cyber attacks against Jordan, but I don’t doubt it will attempt to attack our country. Thank God, so far, there has been no successful terrorist cyber attack. This proves that our men are vigilant and ready. We maintain a high level of readiness to defeat terrorists. I thank the international conference that provides a great deal of benefits to us, including war games with many scenarios for countering cyber offenses and recovering from them. We are preparing for exercises with our friends to simulate cyber attacks and the ways to deal with them.
Unipath: What can other nations learn from Jordan’s experience in creating a cyber security strategy?
Brig. Gen. Milhim: Just as we benefited from the nations that established their programs before us, I am sure the other nations would benefit from our experience. Other nations’ experiences, whether successful or not, offer great lessons. It is critical to learn from other nations, especially in such a sophisticated domain. Since 2010, we identified the priorities for our strategy. We experienced some delays in our program because of routine bureaucracy, and this is a very important lesson for any nation wanting to build a cyber security program. Most important is establishing an organization of national authority that owns the human resources and financial and legal aspects needed to implement a cyber strategy. When we created the strategy, I highly recommended we create a complementary authority to manage it. Otherwise, it is difficult to make any progress.
Unipath: What cyber security advice do you give to Soldiers using smartphones?
Brig. Gen. Milhim: We must work with the Soldiers, and we must implement a clear policy and explain the danger of using personal phones to talk about operations or take pictures of locations, equipment or objects related to ongoing operations. We must monitor violations. We must adhere to a strict policy on using these devices and clearly prohibit the sharing of information and images of operational value. We must have the technology to identify breaches and punish violators accordingly.
Winning on the Digital Battlefield
Countering terrorist propaganda and protecting computer networks from hackers are two sides of a larger strategy
Winning the war on the digital battlefield is becoming a key objective in the fight against violent extremist organizations (VEOs). Across the Middle East and South and Central Asia, countries united against Daesh and other VEOs are countering malicious propaganda with new media tactics and devising strategies to protect government and civil institutions from devastating cyber attacks.
For all the evil of al-Qaida, Daesh, al-Shabab and other terror groups, they have been effective at deceiving recruits into believing they are on the side of those suffering from corruption, poverty and oppression. Although these terrorists have revealed their hypocrisy many times over, countering their narrative remains a challenge.
Shutting down or suspending the Facebook, Twitter or YouTube sites may seem like a logical reaction, but it doesn’t offer a lasting solution. New accounts are easily established to spread the propaganda. Likewise, shutting down Internet access in disputed areas is also proving difficult. Small satellite dishes can be purchased to connect to the Web, even in government-controlled areas that try to limit access.
That makes counteracting terrorist propaganda a critical weapon in winning the information war. And progress is being made.
In Cairo, a United Arab Emirates proposal on the role of the media in promoting the values of tolerance and combating extremism was approved at a meeting of the Arab Information Ministers’ Council at the General Secretariat of the Arab League. The council emphasized the importance of Arab media organizations in spreading the culture of tolerance and fighting extremism as part of a holistic strategy that makes better use of traditional and modern media platforms.
It is also promoting dialogue and interaction among nations and other peoples by highlighting the values of the Arab-Islamic civilization, which denounce practices of fanaticism, extremism and terrorism.
Egypt’s Al-Azhar University and the Dar Al-Ifta organization and its Marsad Al-Fatawa Department are monitoring, identifying and countering Daesh ideology. They share information about Daesh’s murder of innocent civilians and the destruction of mosques and historical sites.
The UAE is also taking an active role. It joined with the United States in launching a Middle Eastern digital communications center focused on using social media to combat Daesh propaganda. The Sawab Center opened in July 2015 and is named for the Arabic word for “the right or proper way.”
Its mission is to challenge Daesh propaganda and amplify moderate and tolerant voices from across the region. The center opened an online community that provides people of the region, and the world, an opportunity to launch and share content that punctures Daesh’s grotesque propaganda.
Separately, the United States has expanded an existing U.S. State Department division established in 2011 and known as the Global Engagement Center. Its responsibilities include countering extremist messages online and coordinating American counterterrorism messaging efforts. It is increasingly sharing stories of defectors and former radicals, highlighting Muslim victims of terrorism, and showcasing living conditions and battlefield realities in Daesh-held areas.
Technology experts across the region are also working to insulate critical institutions from the threat of computer hackers.
Cyber attacks have no boundaries. They threaten major government functions as well as private industry, commerce, health care, communications and personal information. Banking and electrical grids can be taken offline, bringing countries to a standstill.
That is why the work being performed at the Arab Regional Cyber Security Center, based in Oman, is so important. It organizes summits that connect public, private and academic sectors to formulate strategies and plans. This and other cyber conferences represent opportunities to build strong communication channels among countries in the region. Oman’s National Computer Emergency Readiness Team was designated in 2012 to serve as the regional center for cyber security across the Arab region.
Similar success stories are being reported in Bahrain, Afghanistan and Qatar, where each is taking a proactive approach to protecting critical communication channels and information databases from hackers.
Bahrain formed the Cyber Crime Directorate several years ago, and the country has become part of the international effort to share its experiences with other nations in the region.
One of those, Afghanistan, formed its Computer Emergency Response Team in 2009 to track cyber security in the public and private sectors. Two years ago, the country adopted a National Cybersecurity Strategy to establish a safe and secure cyber environment.
Along those same lines, Qatar has conducted national cyber security drills to gauge its understanding of the threat and improve its responses. It studied how other countries drilled for cyber attacks and applied those lessons. Rather than force banks and other private institutions to participate, Qatar’s cyber security division made the drills voluntary but highlighted the consequences of being unprepared for an attack.
The drill drew dozens of participants that shared information and learned about the effectiveness of acting cooperatively and systematically during an attack, whether it be on financial institutions, energy businesses or government agencies.
Collectively, the efforts of these nations and others have resulted in better monitoring and reporting and a closer cooperation with Internet and media companies. But in this digital age, the extremists can be expected to find new ways to get their message out. If nothing else, the experiences over the past several years have revealed the need to immediately challenge that propaganda wherever it is found and to protect our military, government and civil institutions from cyber intrusions.
Daesh’s brutal methods and intolerant ideology have no place in modern societies and deviate from the teachings of all religious traditions. Reinforcing that message goes a long way toward slowing the recruitment of innocents who may be fooled by the false narrative of Daesh and other VEOs.
WHAT’S YOUR OPINION?
- What are some of the best examples of whole-of-government approaches to cyber security?
- Do you have an example of a unique program or strategy for cyber security?
- What are some of the best innovations to counter terrorist propaganda online?
Share your ideas with us at CENTCOM.UNIPATH@MAIL.MIL