Softest Target, Powergrid: Hacked Often

Report: U.S. electrical grid hacked repeatedly over past decade

WashingtonExaminer: State-backed hackers have probed and gained control of networks in parts of the electrical grid at least a dozen times over the last decade, according to officials.

“The grid is a tough target, but a lucrative target,” Keith Alexander, a former director of the National Security Agency, told the Associated Press. “The number of sophisticated attacks is growing. There is a constant, steady upbeat.”

Intrusions have come from China, Russia and Iran. Rather than trying to inflict immediate damage, officials say, the perpetrators have been trying to probe for vulnerabilities and stow away in critical systems.

“If the geopolitical situation changes and Iran wants to target these facilities, if they have this kind of information it will make it a lot easier,” Robert Lee, a former U.S. Air Force cyberwarfare operations officer, told the AP. “It will also help them stay quiet and stealthy inside.”

One specific incident cited by the AP involved Calpine Corp., a power producer with 100 power plants operating in 18 states and Canada. Experts say that information stolen from one of Calpine’s contractors was used to gain access to the company’s systems in 2013, and added that to the best of their knowledge, the perpetrator may still have access to Calpine’s systems today.

Citing another incident, the Wall Street Journal reported on Sunday that Iranian hackers gained control over the operating system of a small dam less than 20 miles from New York City. Officials from the FBI looked into the incident at the Bowman Avenue Dam in Rye, New York, in 2013.

The Department of Homeland Security would not confirm that event, but said in a statement that it was continuing “to coordinate national efforts to strengthen the security and resilience of critical infrastructure” and “working to raise awareness about evolving threats and promote measures to reduce risks.”

Part of the problem is that the technology powering critical infrastructure is often decades old.

“Some of the control systems boot off of floppy disks,” said Patrick Miller, who formerly performed hydroelectric dam cybersecurity for the U.S. Bureau of Reclamation and Army Corps of Engineers. “Some dams have modeling systems that run on something that looks like a washing machine hooked up to tape spools. It looks like the early NASA stuff that went to the moon.”

Intelligence officials have consistently cited the nation’s critical infrastructure as its most significant modern vulnerability in cyberspace. “My No. 1 threat that I see here is the threat to our critical infrastructure,” National Counterintelligence Executive William Evanina told the Washington Examiner in November.

Adm. Mike Rogers, the director of the National Security Agency and head of U.S. Cyber Command, has expressed the same sentiment.

“It is only a matter of ‘when’ that someone uses cyber as a tool to do damage to the critical infrastructure of our nation,” Rogers said in October. “I’m watching nation-states, groups within some of that infrastructure.

“At the moment, it seems to be really focused on reconnaissance and attempting to understand the characteristics of the structure, but it’s only a matter of time I believe until someone actually does something destructive,” Rogers added.

***

How it was found?

SAN JOSE, California (AP) — Security researcher Brian Wallace was on the trail of hackers who had snatched a California university’s housing files when he stumbled into a larger nightmare: Cyberattackers had opened a pathway into the networks running the United States’ power grid.

 

Digital clues pointed to Iranian hackers. And Wallace found that they had already taken passwords, as well as engineering drawings of dozens of power plants, at least one with the title “Mission Critical.” The drawings were so detailed that experts say skilled attackers could have used them, along with other tools and malicious code, to knock out electricity flowing to millions of homes.

Wallace was astonished. But this breach, The Associated Press has found, was not unique.

About a dozen times in the last decade, sophisticated foreign hackers have gained enough remote access to control the operations networks that keep the lights on, according to top experts who spoke only on condition of anonymity due to the sensitive nature of the subject matter.

The public almost never learns the details about these types of attacks — they’re rarer but also more intricate and potentially dangerous than data theft. Information about the government’s response to these hacks is often protected and sometimes classified; many are never even reported to the government.

These intrusions have not caused the kind of cascading blackouts that are feared by the intelligence community. But so many attackers have stowed away in the largely investor-owned systems that run the U.S. electric grid that experts say they likely have the capability to strike at will.

And that’s what worries Wallace and other cybersecurity experts most.

“If the geopolitical situation changes and Iran wants to target these facilities, if they have this kind of information it will make it a lot easier,” said Robert M. Lee, a former U.S. Air Force cyberwarfare operations officer.

In 2012 and 2013, in well-publicized attacks, Russian hackers successfully sent and received encrypted commands to U.S. public utilities and power generators; some private firms concluded this was an effort to position interlopers to act in the event of a political crisis. And the Department of Homeland Security announced about a year ago that a separate hacking campaign, believed by some private firms to have Russian origins, had injected software with malware that allowed the attackers to spy on U.S. energy companies.

“You want to be stealth,” said Lillian Ablon, a cybersecurity expert at the RAND Corporation. “That’s the ultimate power, because when you need to do something you are already in place.”

The hackers have gained access to an aging, outdated power system. Many of the substations and equipment that move power across the U.S. are decrepit and were never built with network security in mind; hooking them up to the Internet over the last decade has given hackers new backdoors in. Distant wind farms, home solar panels, smart meters and other networked devices must be remotely monitored and controlled, which opens up the broader system to fresh points of attack.

Hundreds of contractors sell software and equipment to energy companies, and attackers have successfully used those outside companies as a way to get inside networks tied to the grid.

Attributing attacks is notoriously tricky. Neither U.S. officials nor cybersecurity experts would or could say if the Islamic Republic of Iran was involved in the attack Wallace discovered involving Calpine Corp., a power producer with 82 plants operating in 18 states and Canada.

Private firms have alleged other recent hacks of networks and machinery tied to the U.S. power grid were carried out by teams from within Russia and China, some with governmental support.

Even the Islamic State group is trying to hack American power companies, a top Homeland Security official told industry executives in October.

The attack involving Calpine is particularly disturbing because the cyberspies grabbed so much, according to previously unreported documents and interviews.

Cybersecurity experts say the breach began at least as far back as August 2013.

Calpine spokesman Brett Kerr said the company’s information was stolen from a contractor that does business with Calpine. He said the stolen diagrams and passwords were old — some diagrams dated to 2002 — and presented no threat, though some outside experts disagree.

Kerr would not say whether the configuration of the power plants’ operations networks — also valuable information — remained the same as when the intrusion occurred, or whether it was possible the attackers still had a foothold.

The hackers stole user names and passwords that could be used to connect remotely to Calpine’s networks, which were being maintained by a data security company. Even if some of the information was outdated, experts say skilled hackers could have found a way to update the passwords and slip past firewalls to get into the operations network. Eventually, they say, the intruders could have shut down generating stations, fouled communications networks and possibly caused a blackout near the plants.

They also took detailed engineering drawings of networks and power stations from New York to California — 71 in all — showing the precise location of devices that communicate with gas turbines, boilers and other crucial equipment attackers would need to hack specific plants.

Cylance researchers said the intruders stored their stolen goods on seven unencrypted FTP servers requiring no authentication to access details about Calpine’s plants. Jumbled in the folders was code that could be used to spread malware to other companies without being traced back to the attackers’ computers, as well as handcrafted software designed to mask that the Internet Protocol addresses they were using were in Iran.

Calpine didn’t know its information had been compromised until it was informed by Cylance, Kerr said.

Iranian U.N. Mission spokesman Hamid Babaei did not return calls or address questions emailed by AP.

Cylance notified the FBI, which warned the U.S. energy sector in an unclassified bulletin last December that a group using Iran-based IP addresses had targeted the industry.

Homeland Security spokesman SY Lee said that his agency is coordinating efforts to strengthen grid cybersecurity nationwide and to raise awareness about evolving threats to the electric sector through industry trainings and risk assessments. As Deputy Secretary Alejandro Mayorkas acknowledged in an interview, however, “we are not where we need to be” on cybersecurity.

That’s partly because the grid is largely privately owned and has entire sections that fall outside federal regulation, which experts argue leaves the sector poorly defended against a growing universe of hackers seeking to access its networks.

As Deputy Energy Secretary Elizabeth Sherwood Randall said in a speech earlier this year, “If we don’t protect the energy sector, we are putting every other sector of the economy in peril.”

 

Iran Swapping Nuclear Material with Russia

Sheesh, what could go wrong and what uranium and why to Russia?

In part from FreeBeacon: Russia and Iran are beginning to trade sensitive nuclear materials, an activity that is at least in part condoned by the Obama administration and permissible under the tenets of the recent nuclear accord, according to U.S. and Iranian officials.

Russian-made yellow cake, a type of uranium powder that helps turn it into a nuclear fuel, “is in Iran and Iran’s enriched uranium cargo will be sent to Russia” within the next several days, according to top Iranian officials quoted this week in the country’s state-run press.

Senior U.S. officials confirmed on Thursday that the Obama administration backs the opening of commercial nuclear trade between Moscow and Tehran.

“Commercial contracts are in place for Iran to ship its enriched uranium stockpiles to Russia,” Stephen Mull, a State Department official who is leading the administration’s charge to implement the nuclear deal, told lawmakers. More details here.

This condition is quite familiar especially with regard to Iran.

Bishkek (AKIpress)nuke plant Russia and Kazakhstan are preparing an intergovernmental agreement on construction of a nuclear power plant, Presidential aide Yuri Ushakov told TASS on Friday.

“An intergovernmental cooperation agreement is being prepared for construction of a Russia-designed nuclear power plant within the territory of Kazakhstan,” he said, adding that the issue may be touched upon on December 21 at the meeting of presidents of Russia and Kazakhstan “on the sidelines” of the CSTO (Collective Security Treaty Organization) and the SEEC (Supreme Eurasian Economic Council) summit.

“The leaders of the two countries are expected to dwell upon the problem of boosting trade and economic cooperation,” Ushakov said.

Then there is India:

BusinessInsider: India is expected to offer Russia land in Andhra Pradesh to set up units five and six of Kudankulam nuclear power plant. This is in line with the ‘Make in India‘ initiative. The decision would be finalised during Prime Minister Narendra Modi‘s visit to Moscow this week.

“We will follow principles of ‘localisation’ as per Make in India initiative for setting up Kudankulam nuclear power plant five and six,” sources told PTI.

Russia is working a deal in Jordan but back to Iran:

Back in 2013-14: WASHINGTON — Russia has agreed to build Iran two additional nuclear power plants, Iran’s state-run Press TV announced on Wednesday.

Russia will construct the new facilities next to Iran’s sole existing nuclear power plant in the city of Bushehr.

That plant was also built with Russian assistance, and was fueled for operation in 2011. The reactor was put under full Iranian control in 2013.

The deal includes two desalination plants and is reportedly in exchange for oil; Russia built first and only reactor at Bushehr.

Iran To Ship Enriched Uranium To Russia

 RFEL: Iranian nuclear officials say Tehran will export most of its enriched uranium stockpile to Russia in the coming days as it implements a nuclear deal to secure relief from international sanctions.

The Iranian news agency IRNA quotes nuclear chief Ali Akbar Salehi as saying on December 19 that “around nine tons of Iran’s enriched uranium will be exported to Russia.”

That is roughly the amount that Iran must export to bring its stockpile down to the required level under the sanctions-relief deal.

Salehi did not give a precise timetable for what he meant by “in the coming days.”

Under the terms of the deal it reached in July with world powers, Iran must reduce its stockpile of enriched uranium to around 300 kilograms. It must also deactivate and store most of its centrifuges, and remove the core of a heavy water reactor in Arak so it cannot be used to produce plutonium.

On December 16, Tehran said it was working to complete the requirements in the next two to three weeks, after the International Atomic Energy Agency (IAEA) closed its investigation of Iran’s past nuclear activities.

The 35-nation governing board of the IAEA passed a resolution on December 15 ending the UN nuclear watchdog agency’s 12-year-long inquiry into suspicions of “possible military dimensions” to Iran’s nuclear work.

IAEA chief Yukiya Amano said afterward that Tehran has taken the necessary steps to cooperate with the agency and that it was “not impossible” that sanctions could be lifted in January.

Iran has shown a strong apparent desire in recent weeks to build on the momentum of the nuclear deal and restore international economic links after years of sanctions.

Iranian Industry Minister Mohammad Reza Nematzadeh said on December 17 that Tehran is prepared to begin negotiations for membership in the World Trade Organization (WTO).

Iran first applied for WTO membership in July 1996, but progress had been minimal since then due to tensions over the Iranian nuclear crisis.

Forget the EMP, It’s the Hack, You’re at Risk

Iranian hackers infiltrated computers of small dam in NY

WASHINGTON (Reuters) – Iranian hackers breached the control system of a dam near New York City in 2013, an infiltration that raised concerns about the security of the country’s infrastructure, the Wall Street Journal reported on Monday, citing former and current U.S. officials.

Two people familiar with the breach told the newspaper it occurred at the Bowman Avenue Dam in Rye, New York. The small structure about 20 miles from New York City is used for flood control.

The hackers gained access to the dam through a cellular modem, the Journal said, citing an unclassified Department of Homeland Security summary of the incident that did not specify the type of infrastructure.

The dam is a 20-foot-tall concrete slab across Blind Brook, about five miles from Long Island Sound.

“It’s very, very small,” Rye City Manager Marcus Serrano told the newspaper. He said FBI agents visited in 2013 to ask the city’s information-technology manager about a hacking incident.

The dam breach was difficult to pin down, and federal investigators at first thought the target was a much larger dam in Oregon, the Journal said.

The breach came as hackers linked to the Iranian government were attacking U.S. bank websites after American spies damaged an Iranian nuclear facility with the Stuxnet computer worm.

It illustrated concerns about many of the old computers controlling industrial systems, and the White House was notified of the infiltration, the Journal said.

The newspaper said the United States had more than 57,000 industrial control systems connected to the Internet, citing Shodan, a search engine that catalogs each machine.

Homeland Security spokesman S.Y. Lee would not confirm the breach to Reuters. He said the department’s 24-hour cybersecurity information-sharing hub and an emergency response team coordinate responses to threats to and vulnerabilities in critical infrastructure.

***

Cant Sleep, You are at Risk

In part from Wired: If you want to keep yourself up at night, spend some time reading about the latest developments in cybersecurity. Airplanes hacked, cars hacked, vulnerabilities in a breathtaking range of sensitive equipment from TSA locks to voting booths to medical devices.

The big picture is even scarier. Former NSA Director Mike McConnell suspects China has hacked “every major corporation” in the US. Edward Snowden’s NSA leaks revealed the US government has its own national and international hacking to account for. And the Ponemon Institute says 110 million Americans saw their identities compromised in 2014. That’s one in two American adults.

The system is broken. It isn’t keeping us, our companies, or our government safe. Worse yet, no one seems to know how to fix it.

How Did We Get Here?

One deceptive truth seems to drive much of the cybersecurity industry down a rabbit hole: If you keep bad actors and bad software out of your system, you have nothing to worry about.

Malicious actors target “endpoints”—any device or sensor connected to a network—to break into that network. Network security seeks to protect those endpoints with firewalls, certificates, passwords, and the like, creating a secure perimeter to keep the whole system safe.

This wasn’t difficult in the early days of the Internet and online threats. But today, most private networks have far too many endpoints to properly secure. In an age of “Bring Your Own Device,” the cloud, remote access, and the Internet of Things, there are too many vulnerabilities hackers can exploit. As Ajay Arora, CEO of file security company Vera, notes, there is no perimeter anymore. It’s a dream of the past.

But the security paradigm remains focused on perimeter defense because, frankly, no one knows what else to do. To address threats, security experts should assume compromise – that hackers and malware already have breached their defenses, or soon will – and instead classify and mitigate threats.

The CIA Triad

The information security community has a model to assess and respond to threats, at least as a starting point. It breaks information security into three essential components: confidentiality, integrity, and availability.

Confidentiality means protecting and keeping your secrets. Espionage and data theft are threats to confidentiality.

Availability means keeping your services running, and giving administrators access to key networks and controls. Denial of service and data deletion attacks threaten availability.

Integrity means assessing whether the software and critical data within your networks and systems are compromised with malicious or unauthorized code or bugs. Viruses and malware compromise the integrity of the systems they infect.

The Biggest Threat

Of these, integrity is the least understood and most nebulous. And what many people don’t realize is it’s the greatest threat to businesses and governments today.

Meanwhile, the cybersecurity industry remains overwhelmingly focused on confidentiality. Its mantra is “encrypt everything.” This is noble, and essential to good security. But without integrity protection, the keys that protect encrypted data are themselves vulnerable to malicious alteration. This is true even of authenticated encryption algorithms like AES-GCM.

In the bigger picture, as cybercrime evolves, it will become clear that loss of integrity is a bigger danger than loss of confidentiality. One merely has to compare different kinds of breaches to see the truth of this:

A confidentiality breach in your car means someone learns your driving habits. An integrity breach means they could take over your brakes. In a power grid, a confidentiality breach exposes system operating information. An integrity breach would compromise critical systems, risking failure or shutdown. And a confidentiality breach in the military would mean hackers could obtain data about sensitive systems. If they made an integrity beach, they could gain control over these weapons systems. Full details and actions you can take to protect yourself, go here.

Hagel: WH Worked to Destroy Me

Hagel: The White House Tried to ‘Destroy’ Me

Fallen Angel: Extortion 17 Facts and Documentary

The Final Flight of Extortion 17

It was the deadliest helicopter crash in the history of U.S. special operations. Why did it happen?

https://www.indiegogo.com/projects/fallen-angel-shoot-down-of-seal-team-six#/ DONATE HERE

AirandSpaceMagazine: A few minutes past 2 a.m. on August 6, 2011, at a dusty forward operating base 40 miles south of Kabul, Afghanistan, the rotors of two U.S. Army CH-47D Chinooks began to turn. Operating with no lights save for the faint green glow of night vision goggles and cockpit instrument panels, the two helicopters, call signs Extortion 17 (“one-seven”) and Extortion 16, lifted into the darkness and accelerated toward a destination less than 20 miles west. 

Extortion 17 and its 38 occupants would not return. A Taliban fighter shot the helicopter out of the sky with a rocket-propelled grenade and all aboard were killed—the single greatest loss of American life in the Afghan war. Those killed ranked among the world’s most highly trained and experienced commandos, including 15 men from Gold Squadron of the Naval Special Warfare Development Group, popularly called SEAL Team 6. Just three months earlier, members of a counterpart SEAL Team 6 squadron successfully raided a compound in Abbottabad, Pakistan, and killed Osama bin Laden. In light of that raid’s success, the shootdown of Extortion 17 incited a flurry of conspiracy theories: The Taliban were tipped off; it was a trap; it was retribution for the killing. No evidence has emerged to support any of these claims. Instead, two rigorous U. S. military investigations followed every moment of the mission to determine what went wrong on Extortion 17’s final flight. 

The mission had begun about four hours prior to the shootdown, when the two helicopters touched down side by side in Juy Zarin, a village in the bare rock-walled Tangi Valley of Wardak Province. As two U.S. Army AH-64 Apache attack helicopters, an Air Force AC-130 gunship, and a small fleet of unmanned surveillance aircraft orbited overhead, a platoon of the 75th Ranger Regiment and members of an Afghan special operations unit stormed down the rear ramps of the Chinooks and into the night. Their target: an Afghan named Qari Tahir and his group of fighters. Intelligence had revealed Tahir to be the senior Taliban chief of the Tangi Valley region, with probable ties to upper-echelon Taliban leadership in Pakistan. As the ground assault force rushed toward Tahir’s compound, Extortion 17 and 16 sped back to base, where they were refueled, and awaited word to extract the team, evacuate wounded, or race reinforcing troops to Juy Zarin.

When the two Chinooks had first touched down in the village, a group of eight fighters armed with AK-47 rifles and RPG-7 rocket-propelled grenade launchers bolted from the compound. One AH-64 crew, after identifying the men as enemy combatants, fired on them with their gunship’s 30mm cannon, killing six. The remaining two fighters ducked into a stand of trees and disappeared from the Apaches’ infrared scanners. Three hours after disembarking from the Chinooks, the assault force had secured the compound and detained a number of Tahir’s men, but they hadn’t found Tahir himself. Through sensors on manned and unmanned aircraft, U.S. forces observing the mud walls and terraces of the village saw new groups of fighters gathering and maneuvering. Mission commanders, believing that Tahir was likely among one of the groups, deployed an Immediate Reaction Force (IRF) to interdict them while the Rangers held the compound. Planners then chose a new landing zone for the IRF, but it was large enough to accommodate only one Chinook.

Faced with the possibility of confronting nine or 10 Taliban fighters, planners increased the reinforcement team from 17 to 32 men, formed around the 15-man SEAL group. The IRF also included two SEALs from another team, five Navy special operations support personnel, three Air Force special tactics airmen, seven Afghan National Army commandos, a translator, and a combat assault dog. The IRF commander then made a critical decision: In order to get everyone on the ground as quickly as possible and deny the Taliban time to react, he ordered the entire force to fly in Extortion 17. Extortion 16 flew empty.

Commanders frequently request CH-47 Chinooks to insert troops. The helicopters are capacious and fast, and they can perform well in Afghanistan’s performance-degrading high altitudes and heat. U.S. Special Operations Command possesses its own specialized Chinooks—MH-47s—flown by the ultra-secretive 160th Special Operations Aviation Regiment, the “Night Stalkers.” The MH-47s’ modifications include inflight refueling probes, additional and upgraded sensors, more powerful engines, and more powerful defensive weapons than their conventional counterparts. Night Stalker pilots and crew rigorously train for nighttime raids, like the one in Juy Zarin. 

image: http://thumbs.media.smithsonianmag.com//filer/77/c7/77c79562-4261-45db-b818-71bfc7255547/04z_dj2105_map_inset.jpg__800x450_q85_crop_upscale.jpgThe crash took place about 40 miles from Kabul, in the Taliban-thick Tangi Valley.
The crash took place about 40 miles from Kabul, in the Taliban-thick Tangi Valley.

Extortion 17 and 16 weren’t MH-47s and their crews were not Night Stalkers. The mission was flown by conventional pilots flying unmodified CH-47Ds. “It’s a math problem. There are more operations than can be supported by the 160th at any given time,” says Major Matthew Brady, a former 160th pilot and company commander.

The pilots and crew of Extortion 17, however, had ideal experience and abilities for the mission that night. At the flight controls were David R. Carter of the Colorado Army National Guard and copilot Bryan J. Nichols, a Kansas-based Army reservist. Nichols had deployed three times to combat zones, and Carter, with more than 4,000 hours of flight time, was one of the most experienced helicopter pilots in the U.S. military. He was also an instructor at the High Altitude Army National Guard Aviation Training Site (see “Triple Threat: High, Hot, and Heavy,” Aug. 2014), where many U.S. and foreign helicopter pilots train for mountainous and high-altitude flying, often before deployment to Afghanistan.

During a previous deployment to Iraq, Carter’s unit flew dozens of similar raids, which he often planned and led, and gained a reputation for working well with special operations troops. “Our area of operation was the entire country of Iraq, and every mission was at night,” says David “Pat” Gates, a pilot with Carter’s unit , the 2nd Battalion, 135th Aviation Regiment (2-135th), a Colorado Army National Guard unit based in Aurora, Colorado. “We were on goggles the whole time. We were supporting special operations, but not to the degree of the 160th. We didn’t do fast-rope inserts, building insertions, or anything like that.” Subsequent to their Iraq deployment, the unit flew the SEALs of Team 6 on practice raids around Fort Carson, Colorado, and during nighttime urban training in Denver, further cementing the 2-135th’s reputation with special operations units. At the time of the Juy Zarin raid, the battalion had been flying in Afghanistan for about two weeks.

Flying to the Tangi Valley for the second time, Extortion 17 and 16 took a different route, approaching from the northwest instead of the south. Six minutes from their estimated landing time, Extortion 16 broke away from the lead Chinook and orbited at a location close enough to help if needed. Extortion 17 sped alone toward the landing zone. 

For helicopter crews in Afghanistan, the most dangerous times are landing and taking off. Approaching to land or having just taken off, the craft is flying slow and low, so it presents a tempting target. But even a precisely aimed shot fired from an unguided weapon by a seasoned fighter is subject to the ballistics-altering whims of atmospheric variation, subtle and undetected flaws in launcher or projectile, and uncontrollable environmental factors such as wind gusts, large temperature variations, or even particulates in the air.

“There are a lot of bullets out there that say ‘To whom it may concern,’ ”says Major Doug Glover, a U.S. Marine F/A-18D weapons and sensors operator who was a senior watch officer for the Marine air operations center in southern Afghanistan. “The RPG is not a laser. It does not fly in a straight line, and there is no way to know what exact path it will take—just a fairly good idea of its trajectory.” 

Sometimes the enemy succeeds in delivering one of these “To whom it may concern” projectiles. In July 2010, an RPG-wielding fighter put a round into the tail boom of a Marine AH-1W Super Cobra, downing it and killing both pilots. In June 2005, a rocket-propelled grenade connected with the rear transmission of a 160th MH-47E Chinook as it attempted to come to a hover, downing it; all 16 on board were killed. In March 2002, two MH-47s were downed by machine gun and rocket-propelled grenade fire while close to ground level. “What we saw is that if the enemy knew where you were going to attack, they would back some guys with RPGs off 500 meters or so, to shoot during an ingress,” Glover explains. 

***

Now deep in the Tangi Valley, their night vision goggles showing the world around them in greenish hues, the IRF team members readied to hit the ground running as the pilots slowed Extortion 17 and descended toward the village. At 2:36 a.m., Extortion 17 requested an infrared spotlight, visible only through night vision goggles, to illuminate the landing zone. The crew of Slasher 02, the AC-130 circling above, flipped the switch on their powerful light. “Burn is on,” they radioed. Through the goggles, the landing zone shone brilliantly. Carter and Nichols continued the descent. “LZ is ice,” transmitted one of the Rangers on the ground, indicating the landing zone was free of enemy activity.

Seconds later, with the Chinook just over 100 feet off the ground and traveling at 58 mph, two or three previously unseen fighters emerged from the tower of a two-story building roughly 220 yards south of the helicopter, shouldering RPG launchers. They may have seen Extortion 17 and its landing zone through their own night vision goggles or simply aimed by sound alone. Two fired at roughly the same time. The first round sailed past the helicopter. The second slammed into one of the Chinook’s rear rotor blades and exploded, severing 10 feet of it. The torque of the spinning rotor assembly, now catastrophically imbalanced, ripped the rear pylon off the Chinook’s fuselage. The forward rotor system then tore off, stressed by the imbalance and the strain of carrying what would normally be a shared load. Less than five seconds after the RPG round hit, the helicopter spun uncontrollably, plummeting into a dry creek bed and erupting in a ball of fire that killed all on board.

The United States military continually works to improve protection for transport helicopters and their occupants, according to Glover and Brady. One of the most significant tactical evolutions of the Afghanistan conflict is the ever-heavier use of unmanned aerial systems and other airborne intelligence-gathering systems. Capable of loitering overhead for hours undetected, small fleets of unmanned craft passed imagery to mission planners before and during the raid at Juy Zarin, allowing them to recognize individual fighters, learn their habits, pinpoint where they slept, and identify the types of weapons they carried.

But U.S. forces didn’t know about every fighter during the raid, and they lost track of at least two—one of whom fired the deadly shot. Since the shootdown of Extortion 17, the military has continued to gain vital experience and equipment to enable an ever greater understanding of an enemy force, aiming to know every combatant and potential combatant and his weapon system before a raid. According to Glover, improved systems in place enable U.S. forces to monitor a target for days or even weeks prior to an operation, so they theoretically will know of even well-hidden potential RPG shooters throughout a village before transport helicopters first touch down.

The military has worked diligently to more tightly integrate gunship escorts with transport craft, according to Brady. While classification veils the specifics of these tactics, particularly for special operations raids, manned gunships can detect potential threats through a range of sensors and immediately attack if needed. Another tactic sometimes employed by gunships, according to Glover, is a show of force, in which pilots and crew fire into an empty field or stand of trees just before a transport helicopter prepares to land, using the sound of a gun alone to keep enemy heads down and fingers off triggers.

The two military investigations, one conducted by United States Central Command and one by the multi-service Joint Combat Assessment Team, pored over the details of the crash with excruciating focus and concluded that no planners or participants bore any fault regarding the circumstances leading to the shootdown of Extortion 17. Though both noted that airborne sensor coverage and closer AH-64 gunship escort should be considered in future operations, nothing could have kept the shooters from firing their RPGs that night. The Joint Combat Assessment Team report further noted that despite a robust deck of intelligence, surveillance, and reconnaissance assets, none identified the location from which the shooters fired prior to the helicopter downing. 

The shooters’ origin remains a mystery. The two may have been those who escaped Apache cannon fire, or they may have split away from either of the groups that formed after the start of the raid. The duo may also have had no ties to Tahir or any of his suspected fighters, and attacked the helicopter on their own. Should the Apache pilots have fired into the stand of trees after the two fighters ducked out of sight? Should the Apaches, or the AC-130 overhead, have fired upon the groups of suspected Taliban that gathered in the village after the raid began?

Restrained by strict rules of engagement in force at the time, the helicopter crews could not have fired without a strong indication of hostile intent. Afghanistan has long been a counter-insurgency campaign: The United States’ strategy has been to win Afghan trust through cooperation and aid. Having studied and directly observed the counter-insurgency campaign in Afghanistan, I’ve watched commanders and individual American troops consistently lean far to the side of restraint to encourage Afghans to side with American interests long after U.S. forces have left. Because unarmed villagers, unaffiliated with the Taliban, could also have been in those trees and among the groups milling about the village, the gunships could not have fired. Following a “scorched earth” tactic may have killed the two shooters—and possibly a greater number of innocents—prior to Extortion 17’s return that night, but counterinsurgency doctrine dictates that such tactics lead to potentially far worse long-term consequences. 

With a keen understanding of the propaganda value of downing Coalition helicopters, the Taliban single them out as targets. Classified reports, published by Wikileaks, teem with notes from pilots and crew of all types of military helicopters who saw RPG attacks throughout the war. According to one Army report, in the three months prior to the Juy Zarin raid, as many as 17 RPGs were fired at helicopters over Wardak and Logar provinces, a relatively small part of the country. And while all military helicopters carry countermeasures for guided missiles, nothing can interdict the dumb luck of an unguided RPG round sailing through the air. The vast majority miss. “Chance is still part of the battlefield,” says Brady. “For every one that gets lucky, there are hundreds, even thousands, that zip by you.”

“As we’ve seen a number of times, there’s a point that a lucky shot is going to get you and there is only so much you can do to mitigate it,” says Glover, the Marine aviator. “To remove the risk of rocket-propelled grenades downing helicopters in Afghanistan 100 percent, you’d have to remove the opposable thumbs of every fighting-age male in the objective area, and that’s not how we win a counter-insurgency.”