No. 58: Cyber Criminal

Our military is an all-volunteer force.

Which I consider one of its greatest strengths.

But I do sometimes wonder . . .

Why do I continue to volunteer for this shit?

Take last weekend, for example.

Friday afternoon, I drove straight from the airport to U.S. Strategic Command, or STRATCOM.

I wasn’t officially on duty until Saturday, but I wanted to check in at the Global Operations Center to ensure my accounts were in order.

On my previous two Navy Reserve duty weekends, they had not been.

My unclassified, secret, and top-secret accounts had all been disabled.

Why?  Because the Air Force doesn’t talk to the Navy, the reserves don’t talk to the active component, and no one, apparently, talks to STRATCOM.

You have to take this stupid, painful, cyber security training course every year.

And if the training expires, or if you can’t produce a current certificate of completion, you can’t access any of the systems.

But that’s only part of the problem.

In the Navy, the requirement is based on the fiscal year.

And you complete the training via Navy Knowledge Online, or NKO, the Navy’s online training portal.

But at STRATCOM, the requirement is based on your check-in date.

So, even if you’ve already completed the training for the year, if you don’t re-take the course within a few weeks of checking in, you’re considered delinquent, and your account is disabled.

Which is what happened to me on previous weekends.

Luckily, I was able to produce my completion certificate from NKO, so the dude at the IT help desk re-enabled my accounts.

But, of course, I wasn’t going to assume I was home free.

Problems like this in the military don’t get completely fixed on the first, second, or seventh attempt.

You have to keep at it, even after ten people have told you the issue has been resolved.

I’ve learned this.

So, I rolled into the operations center fresh from the airport and sat down to log into my accounts.

Which were all disabled.  Again.

The comms guy in the operations center called the help desk on my behalf.

And, again, I sent off my completed cyber security training certificate.

It took nearly two hours to re-enable my accounts.

By then, it was after seven o’clock in the evening, and I was anxious to get the hell out of there.

Not wanting to have any additional surprises the following morning, I asked the comms guy what else might go wrong.

On a whim, he asked, “Where’d you do your cyber security training?”

At NKO, I told him.

“Ah,” he said.  “That’s the problem.  If you don’t do it at JKO, the system will automatically disable your accounts.”

JKO is Joint Knowledge Online. 

It serves the same purpose as NKO but is used by members of all branches at Joint commands.

And the JKO cyber security course is the exact same fucking thing as the NKO course.

Are you shitting me? I asked the comms guy.

“Afraid not,” he said.

So, in order not to have my accounts disabled overnight, I sat there for an additional hour and completed the course at JKO.

When I finally got to the hotel, I had about four hours of sleep to look forward to.

I was working the early shift Saturday.

And I intended to give myself plenty of extra time to resolve any remaining issues with my accounts before clocking in.

The first dose of fall weather had arrived overnight, and my room was freezing when I woke up.

I switched the thermostat from air conditioning to heat.

And, almost immediately, I noticed a burning smell.

Not unusual, I thought.  The furnace always smells funny the first time you kick the heat on.

After sixty seconds, however, it started to smell as though someone had lit up a Lucky Strike in my room.

Something was no-shit burning.

And then the smoke alarm started going off.

It was just after three o’clock in the morning.

I couldn’t see any smoke, but the smell continued to get worse.

I turned off the heater as the alarm continued to blare.

Then I grabbed my iPad and started waving it furiously to try to dissipate the smell.

If I didn’t get that goddamned alarm to shut off, I assumed I’d wake up the entire hotel.

And what if I set off the sprinklers?

Shit.

I noticed the alarm had a test button on its underside.

I pressed it, and, thankfully, the alarm shut off.

But my room continued to smell like someone was chain-smoking in it.

I took a shower, hoping I wouldn’t be the reason the hotel burned down.

Half an hour later, I rolled into STRATCOM.

Thankfully, I was able to get into all my accounts.

It was a little busy at the start of the shift, but otherwise a quiet day.

And when I returned to the hotel, I saw that it was still standing.

And my room no longer smelled like stale Lucky Strikes.

Things were looking up.

I hit my favorite restaurant for dinner and turned in early, assuming the weekend’s drama was safely behind me.

Sunday morning got off to a good start.

I didn’t touch the heater, of course.

And by the time I got packed up and out of the hotel, I was a few minutes ahead of schedule.

When I pulled into the STRATCOM parking lot, there was a base security vehicle with its lights on sitting behind a parked car.

Maybe someone had locked their keys in it, I thought.

I maneuvered around the security vehicle and found a parking spot.

Then I walked into the building, through four different security checkpoints, and eventually into the Global Operations Center.

About thirty minutes later, having successfully logged into all my accounts, I stood up and casually crossed my arms.

As I did so, I felt an unfamiliar object in my flight suit’s right chest pocket.

That’s strange, I thought.  What the hell is that?

It was my cell phone.

Ho.  Lee.  Shit.

I’d brought a cellular device into a top-secret space.

And kept it there for half an hour.

A huge security violation.

I immediately turned to the Battle Watch Captain standing behind me and told him I needed to step out for a few minutes.

I then hauled ass to the nearest security checkpoint and turned myself in.

“Wait here,” the guard said.  “Someone will come escort you to the security office.”

Five minutes later, a kid in full battle rattle with an M4 machine gun slung across his chest appeared.

“Come with me, sir,” he said, ominously.

We walked up two floors to the security office and a small interrogation room where I sat for the next forty-five minutes.

Another dude came in and “interrogated” me, taking notes the entire time.

I then had to sign a sworn statement and fill out an evidence tag for my then-confiscated phone.

When will I get it back? I asked the guy who’d escorted me in.

“I dunno,” he said.  “Usually takes a couple weeks.”

The phone had to be thoroughly examined to ensure it hadn’t recorded or transmitted anything while in the building.

Which was great.

Just.  Fucking.  Great.

Now, the irony is, I am not a person who cannot be without a phone.

In fact, most of the time, I’d rather be without one.

I use my phone for work.  Not to doom scroll or watch cat videos.

So why, then, did I have it with me that particular morning, despite having developed an elaborate routine to ensure I did not take the damn thing into STRATCOM?

Because I had departed from that routine.

The cop car in the parking lot prevented me from parking in my usual place.

Which then threw me off just enough to make me forget to frisk myself for electronic devices.

And I’d crammed a few extra things into my flight suit pockets that morning, forcing me to switch my phone from my left to right pocket.

So, even had I remembered to frisk myself, there’s a chance I would have missed my phone, because it was in the wrong pocket.

In aviation, we would say that mishaps like these conformed to the Swiss Cheese Model.

No single hole in the block of cheese would cause an incident.

But, if a sufficient number aligned, bad things would happen.

Like that morning at STRATCOM.

I do love the military.

And if you stick around long enough, weekends like this happen.

But I’m not sure how much longer I can tolerate having them happen to me.

And mark my words:

Now that I’m a cyber criminal in the eyes of U.S. Strategic Command,

Someone’s gonna tell me,

That as punishment

I have to take that goddamned cyber security course

Again.

I guarantee it.