How the Military is Defeating Hackers

Posted on May 25, 2016May 25, 2016 by Denise Simon

Here’s how the US military is beating hackers at their own game

Paul Szoldra

US Soldiers Iraq Staff Sgt. Stacy L. Pearsall/USAF

TechInsiders: There’s an unseen world war that has been fought for years with no clear battle lines, few rules of engagement, and no end in sight.

But it’s not a shooting war; not a war where combatants have been killed or wounded — at least not yet.

It’s a war that pits nations against each other for dominance in cyberspace, and the United States, like other nations employing professional hackers as “cyber soldiers,” sees it as a battlefield just like any other.

“It’s like an operational domain: Sea, land, air, space, and cyber,” Charlie Stadtlander, chief spokesperson for US Army Cyber Command, told Tech Insider. “It’s a place where our presence exists. Cyber is a normal part of military operations and needs to be considered as such.”

As US military leaders warn of the growing progress of Russia, China, and North Korea in cyberspace, the Pentagon has ramped up its own efforts in what it calls the “cyber domain” after the release of a new cyber strategy in April 2015.

“This ephemeral space that’s all around us, literally, is a space where operations can be performed against us,” Frank Pound, a program manager who leads DARPA’s “Plan X” cyber warfare platform, told Tech Insider. “And how do we defend against that? How do we detect that?”

Building a cyber army

In its cyber strategy, the military proposed 133 teams for its “cyber mission force” by 2018, 27 of which were directed to support combat missions by “generating integrated cyberspace effects in support of … operations.” (Effects is a common military term used for artillery and aircraft targeting, and soldiers proclaim “good effect on target” to communicate a direct hit).

The cyber mission force will comprise some 4,300 personnel. But only about 1,600 of those would be on a “combat mission team” that would likely be considered to be taking an offensive hacking role. They are up against China’s own “specialized military network warfare forces,” North Korea’s secretive Bureau 121 hacker unit, other nation-states, hacktivists like Anonymous, and criminal enterprises alike.

They have been further tasked with breaking into the networks of adversaries like ISIS, disrupting communications channels, stopping improvised explosive devices from being triggered through cellphones, or even, as one Marine general put it, just “trying to get inside the enemy’s [head].”

Online hacks can lead to offline outcomes, and the military has become keenly aware of that power. In 2009, the US and Israel reportedly infected Iranian computers with the Stuxnet malware that destroyed roughly one-fifth of the country’s nuclear centrifuges. And as recently as February, hackers were used against ISIS as others fought on the ground, quite possibly for the first time ever.

“These are strikes that are conducted in the war zone using cyber essentially as a weapon of war,” Defense Secretary Ash Carter told NPR. “Just like we drop bombs, we’re dropping cyber bombs.”

As one Army officer said during a 2015 training exercise, the cyber war seems to just be getting started: “Future fights aren’t going to be guns and bullets. They’re going to be ones and zeroes.”

soldiers cyber command Brian Rodan/US ArmySoldiers work together during a training exercise in 2011.

‘Prepping the battlefield’

That the Pentagon would employ specialists to defend itself in cyberspace is not surprising, since government and military systems are attacked regularly by nations trying to read soldier’s email, or others who want to uncover personal details on millions who undergo background checks for security clearances.

But the defense of networks — while still an important function — has been supplanted in some cases by an offensive strategy. That is, soldiers hacking into computers overseas for intelligence or to disrupt the enemy on the battlefield — a kind of digital tit-for-tat.

“If there’s something that you can do to prep the battlefield before a kinetic attack or to disrupt defenses during kinetic attacks, why wouldn’t a combatant commander turn to that?” Stadtlander said.

Stadtlander couldn’t talk about ongoing operations that Army Cyber Command is involved in, mainly due to the unique nature of cyber warfare. An enemy who knows the US is developing a next-generation fighter jet might develop something in response that could take years, but with a cyberattack, a fix can be developed sometimes within days.

“The unique thing about cyber activity and defense is you’re talking about building a couple thousand lines of code or having a certain electronic device, or some sort of cyber capability. And just based on the nature of this space, a lot of times it can only be used once,” he said. “Once it’s known … it’s no longer a viable tool.”

Still, some insight into what the US military is capable of can be found within its own training manuals, presentations, and the few news stories by the military’s own writers. And it’s likely that hackers with Army Cyber Command, subordinate to US Cyber Command and NSA, benefit from top secret initiatives to infect “millions” of computers with malware in an effort aimed at “owning the net.”

“Denying the ability to coordinate, communicate, and assess,” Stadtlander said. “That’s an advantage that we might be able to leverage.”

Inside the Army’s cyber warfare ‘Bible’

Perhaps one of the most important publications on cyber warfare was released with little fanfare in Feb. 2014. Known as Army Field Manual 3-38 Cyber Electromagnetic Activities, it proclaimed itself as the “first doctrinal field manual of its kind,” unifying a number of other publications on network operations, electronic warfare, and intelligence into one 96-page document.

In FM 3-38, the Army defined offensive cyberspace operations as actions “intended to project power by the application of force in or through cyberspace,” while noting they are to be carried out in support of command objectives and within legal frameworks.

But what can soldiers do in cyberspace that can affect what happens on the battlefield? Quite a bit, according to the manual.

us army cyber soldier US Army

“A cyberspace attack may be employed in conjunction with” other methods of attack “to deceive, degrade, destroy, and disrupt a specific enemy integrated air defense system or enemy safe haven,” it says.

As an example, the manual offers an early warning radar site as a target which, if soldiers can get inside the network, could possibly be destroyed or degraded.

That’s just what students trained for during an exercise in March, according to the Fort Gordon Globe. Acting just as they would on the battlefield, cyber soldiers patrolled to their objective — a simulated enemy air defense control system — then searched for their target’s wireless network so it could be exploited or neutralized.

There’s little need for stealth coating on aircraft when a guy behind a computer can disable the radar site for you. The manual also offers other systems Army hackers may consider breaking into, such as enemy telephone networks, servers, and smartphones.

“Even if you think about the way that IEDs are triggered,” Stadtlander said, using the acronym for improvised explosive devices. “Or an adversary’s [intelligence, surveillance, and reconnaissance], a lot of these are done through electronics and with internet connections.”

Getting into the Army’s ‘hacker university’

Located just southwest of Augusta, Georgia is Fort Gordon, an Army installation that brings together most of the service’s cyber warriors under one roof. In 2013, the Army chose the site as the home base of its Cyber Command after the unit was established in 2010.

Also home to a 604,000 square foot operations center for the National Security Agency, Gordon is where cyber warriors are taught their craft at what the Army calls its Cyber Center of Excellence. But before they get to the military’s “hacker university,” enlisted soldiers need to score high technical scores on the military entrance exam, and sign on for five years of service, instead of the normal four-year tour.

army cyber command US ArmyInsider Fort Gordon’s Cyber Operations Center.

Due to the classified nature of their work, cyber training is often conducted in secure compartmented information facilities (SCIFs) where cell phones and other outside recording devices are not allowed, and all soldiers will have to obtain a Top Secret clearance prior to being assigned to their unit.

Soldiers go through a lengthy period of training after basic training: Six months spent at the Navy’s Center for Information Dominance in Pensacola, Florida followed by six months at Fort Gordon.

Army officers go through their own training program at the Georgia base, called Cyber Basic Officer Leader Course. The course takes nearly nine months to complete and is the longest officer training program in the Army.

Enlisted soldiers train with members of all military branches over six months at the Navy’s Cyber Analysis Course, according to Bloomberg. Since students can come from a variety of skill sets and backgrounds, the first two-thirds of classroom time focuses on basic programming, mathematics, and how networks and operating systems function. But later on they learn the steps to research and infiltrate targets, defend networks, and even hack a simulated network with Metasploit, a common tool hackers have used since its release in 2004.

Meanwhile, officers receive similar training, though their position merits other coursework in leading operations as opposed to carrying them out. Though a cyber officer can likely step in and be more than capable, given the certifications they obtain, to include Cisco’s Certified Network Associate (CCNA) and the independent Certified Information Systems Security Professional (CISSP) credential.

“They are really valuably trained after that [schooling],” Stadtlander said.

So valuable in fact that the Army is seeing a challenge in retaining its talent from heavyweights in Silicon Valley.

Is hacking considered an ‘act of war’?

Chinese Army Hackers via Flickr

“There is no international standing or framework that is binding over any one nation-state in terms of offensive cyber operations,” Bradley P. Moss, a national security lawyer, told Tech Insider. “It’s whatever rules we put in place for ourselves.”

In essence, the US, China, Russia, and others are operating in a sort-of “digital Wild West” with few overarching guidelines outside of the Law of War that predates our interconnected world.

Cyber warfare continues unabated because there is no governing body such as the United Nations telling nations not to hack one another. Not that that would necessarily make a difference, as a 2014 UN report criticized mass surveillance programs employed by NSA and others as violating privacy rights “guaranteed by multiple treaties and conventions,” The Intercept reported.

Still, Moss explained that nations are less concerned with the legalities of hacking each other, and instead, worry about the potential diplomatic and political fallout should they be exposed.

“More or less, we all engage in some manner of warfare these days, we just don’t go to ‘war’ over it,” Moss said.

How foreign nations would likely respond to being hacked by the US is something that is considered before any offensive operation, according to a top secret presidential policy directive leaked by ex-NSA contractor Edward Snowden.

The document, made public in 2013, listed cyber attacks resulting in “loss of life, significant responsive actions against the United States, significant damage to property, serious adverse US foreign policy consequences, or serious economic impact” as requiring presidential approval.

And for US military hackers who may be on a battlefield in Iraq, Syria, or elsewhere, their self-imposed rules for cyber attacks are clear:

“Military attacks will be directed only at military targets,” reads the Pentagon’s cyberspace operations document.

us army cyber command US Army

But what of cyber attacks that have potentially devastating effects on foreign nations, such as US-made worms that cause nuclear centrifuges to fall apart, or alleged Russian-made malware that knocks out power and heat to people in the dead of winter?

Are these “acts of war”?

“From a strictly legal matter, you could designate the US Army hacking the Russian Army’s [computer] system as an act of war,” Moss said. “Just as much as if we were to have infiltrated and damaged a Russian bomber, that would be an act of war.”

But, he added: “There’s nothing that necessarily stops us, except the political and diplomatic ramifications.”

Contentious House Hearing on Iran Deal/Ben Rhodes

Posted on May 17, 2016May 17, 2016 by Denise Simon

The disdain the White House has for Republicans in Congress has a long history, but his week concerning the NYT’s interview with White House deputy security council advisor Ben Rhodes, Josh Earnest took the nastiness to a new level.

Must watch Gowdy above.

So, the hearing was held without Ben Rhodes as the White House lawyer gave Rhodes executive privilege.

Meanwhile, the Democrats in the hearing based their rhetoric and questions not on the subject at hand and the reason for the hearing but rather they all went on the collective attack of the witnesses over why the United States went into a war over a false claim on WMD.

Democrats turn Iran hearing into debate over Iraq invasion
The Iran-Iraq showdown in the House Oversight Committee probably wasn’t what GOP Rep. Jason Chaffetz intended when he arranged the session. And while Republicans made several attempts to turn the focus to the current presidential administration, not the previous one, Democrats weren’t dissuaded and the hearing degenerated into a back-and-forth. More details here from Politico.

For access to the full hearing, click here. The introduction testimony of one panelist, Mr. Hannah, go here.

FNC: Republican condemnation of a top White House aide who boasted about the administration’s success selling the Iran deal to the public reached new levels on Tuesday, as several senators urged President Obama to fire him and a House committee looking into his claims went forward with its hearing – even though he didn’t show up to testify.

The House Oversight Committee hearing was called to examine White House “narratives” on the Iran deal, after top adviser Ben Rhodes was featured in a New York Times Magazine profile claiming they built an “echo chamber” to sell the plan. Chairman Jason Chaffetz, R-Utah, had called Rhodes to testify, but the White House shielded him from the appearance.

Rep. Jason Chaffetz (R UT-3) | InsideGov

Chaffetz, at the top of the hearing Tuesday, said “there’s still a shroud of secrecy” surrounding the Iran deal and he wanted to hear from Rhodes to seek “clarity.”

“I do not doubt his talents and his knowledge,” Chaffetz said. “But the deal that had been spun up and sold to the American public, I’m not sure it was as clear as it should have been.”

He said Rhodes, in the profile, showed “disdain” for the media and foreign policy circles.

Just hours earlier, the White House officially informed Chaffetz it would not make Rhodes available to testify, citing an executive privilege-related claim. Chaffetz did not go forward with plans to keep a seat open Tuesday for Rhodes, and instead called foreign policy analysts and scholars to testify on the deal. One of them, the American Enterprise Institute’s Michael Rubin, accused Rhodes of creating a “propaganda operation.”

The committee’s top Democrat, Rep. Elijah Cummings, D-Md., slammed Republicans for the hearing, criticizing the analysts they called while noting they didn’t invite military generals who support the agreement. He said Republicans rushed to hold the hearing “without even one week’s notice.”

Rep. Trey Gowdy, R-S.C., said at least Cummings would be able to question the witnesses present. Rhodes, he said, “didn’t bother to show up.”

Meanwhile, several GOP senators have written to Obama urging him to “dismiss” Rhodes “before he further tarnishes the Office of President.”

They wrote: “While members of the Executive and Legislative branches may sometimes deeply disagree on issues of vital importance to our nation’s security and prosperity, we should all agree, for the greater good of our Republic and the citizens whom we represent, to engage in our debates in a respectful, honest, and constructive manner. Mr. Rhodes’s disrespectful, deceptive, and destructive conduct has fallen appallingly short of this standard, however. Indeed, if he had conducted himself this way in a typical place of business outside Washington, where American taxpayers work, he surely would have been already fired or asked to resign.”

The Washington Free Beacon, which first reported on the letter, said it was signed by Sens. Mark Kirk, R-Ill.; John Cornyn, R-Texas; John Barrasso, R-Wyo.; and David Perdue, R-Ga.

Sources tell Fox News that the House committee was keen for Rhodes to appear voluntarily Tuesday so they avoid the territory of a possible subpoena.

The magazine article that touched off the controversy outlined how Rhodes created a narrative of the deal coming out of the 2013 election of “moderate” Iranian President Hassan Rouhani and Iran’s subsequent “openness” and willingness to negotiate.

In fact, the story stated, the majority of the deal was hammered out in 2012, well before Rouhani’s election. However, the Rhodes narrative was politically useful to the administration as it presented them as reaching out to the moderates who wanted peace.

China’s Cyber Attack on Pentagon Missile Defense Daily

Posted on April 15, 2016April 15, 2016 by Denise Simon

So, where are the strongly worded letters, the condemnation, the sanctions the counter-measures?

Cyber-warfare, industrial espionage, economic warfare.

November 2015:

WASHINGTON (Reuters) – The U.S. military on Sunday hailed the success of a complex $230 million test of the U.S. missile defense system that it said showed the ability of the Aegis and THAAD weapons systems to identify and destroy ballistic and cruise missiles at once.

The test was conducted near Wake Island in the western Pacific Ocean around 11:05 p.m. EDT by the U.S. Missile Defense Agency, U.S. European Command, U.S. Pacific Command, the Ballistic Missile Defense System Operational Test Agency and the Joint Functional Component Command for Integrated Missile Defense.

“This was a highly complex operational test of the BMDS which required all elements to work together in an integrated layered defense design to detect, track, discriminate, engage, and negate the ballistic missile threats,” MDA said in a statement released late Sunday.

The Missile Defense Agency website.

Admiral: China Launching Cyber Attacks on Missile Defense Nets ‘Every Day’

Cyber threat comparable to Iranian, North Korean missile danger

FreeBeacon: Chinese military hackers are conducting cyber attacks on the Pentagon’s Missile Defense Agency networks on a daily basis and will soon shift to hacking into networks of missile defense contractors, the admiral in charge of the agency told Congress on Thursday.

Vice Adm. James D. Syring, the MDA chief who is in charge of building multi-billion dollar anti-missile defenses, told a House hearing that while his networks are successfully fighting off the cyber attacks, missile defense contractors need to improve their network security.

The three-star admiral said the threat of Chinese cyber attacks was equal to North Korean and Iranian missile threats.

“I view the cyber threat that I specifically face with MDA and the systems we are fielding on par with any ballistic missile threat that either Iran or North Korea possess,” Syring said.

Asked by Rep. Mike Rogers (R., Ala.), the chairman of the House Armed Services subcommittee on strategic forces, if he is fighting off cyber attacks from Chinese military hackers, Syring answered: “Yes, sir.” He limited his comments and said he would provide details of the cyber threats during a later closed-door session of the subcommittee.

“We have taken inordinate steps to protect both our classified and unclassified networks from attack, [with] constant 24/7 monitoring with teams in place plus good material protections of those systems,” he said.

“My biggest concern remains in our cleared defense contractor base and their protections,” Syring added, noting that Chinese efforts to break into missile defense networks are relentless.

“They are continuing to try and attack my government networks, every day, classified and unclassified,” he said. “But where they’re going next and we’ve gotten examples of this is to my cleared defense contractors with the unclassified controlled technical information.”

Bolstering the network security of contractors is a high priority across the entire ballistic missile defense system, he said.

Foreign states are seeking to penetrate missile defenses and other weapons systems to steal technology and data for use in their own weapons. They also seek to disrupt or destroy the systems in the event of a crisis or conflict.

A report by the Defense Science Board warned in 2013 that critical U.S. weapons and other military systems are vulnerable to cyber attack.

“The United States cannot be confident that our critical Information Technology (IT) systems will work under attack from a sophisticated and well-resourced opponent utilizing cyber capabilities in combination with all of their military and intelligence capabilities (a ‘full spectrum’ adversary,” the report concluded.

Syring said in prepared testimony his agency is deploying upgraded command and control systems with better security against cyber attacks. Missile defense personnel also are being trained to prevent cyber intrusions.

“We know that malicious cyber actors are constantly attempting to exfiltrate information from U.S Industry,” Syring stated. “We will continue to work with the defense industrial base, the FBI, and other partners to identify these issues and raise the costs of this behavior to those responsible, in coordination with national authorities and in accordance with national policy.”

Syring said a key objective is hardening U.S. missiles defenses for future conflicts, which will likely involve cyber attacks against its networks.

“We must build resilient cyber defenses that are capable of detecting and mitigating threats without impeding operations in order to ‘fight through’ the cyber threat,” he said.

Two exercises simulating cyber attacks on missile defense networks were held last year. Another exercise is set for next month.

To prevent cyber attacks through equipment and parts, MDA is tightening the security of its suppliers.

“We also have a rigorous cyber and supply chain risk management inspection program to examine everything about our systems, from the truck to supply chain, to the fielded operational ability,” Syring said.

Chinese agents were detected spying on the U.S. missile defense interceptor base at Fort Greely, Alaska, several years ago, according to defense officials.

Barry Pike, executive officer for the U.S. Army’s missiles and space program, said during the House hearing that foreign military threats are growing with the emergence of synchronized air, missile, cyber, and electronic warfare attacks.

“Across all Army [air and missile defense] programs, we are improving our resilience and ability to mitigate cyber and electronic warfare attacks,” he stated in prepared testimony.

Rogers, the subcommittee chairman, said in opening remarks at the hearing that after eight years of President Obama’s administration “our nation’s security is in more jeopardy than any time in recent memory.”

“North Korea, Iran, Pakistan, Russia, and China are all advancing their ballistic and cruise missile programs, along with weapons of mass destruction programs, to put our military, our allies, and our homeland at risk,” Rogers said.

“At the same time, President Obama has cut missile defense practically every year he’s been in office,” he added. “America’s enemies know an opportunity when they see one; our allies see they are on their own.”

Disclosure of the Chinese hacking against missile defenses comes as Syring and other military leaders revealed the Pentagon is working on its own cyber weapons that could be used to disable or destroy missiles prior to launch.

Details about what the Pentagon calls “left-of-launch” measures remain classified but are said to include cyber attacks and other electronic warfare measures against missile launch controls and other information systems.

Pre-launch cyber attacks against missiles are designed to bolster other missile defenses, including lasers and anti-missile interceptors, that can attack enemy missiles in the early, middle, and late stages of flight, while decreasing costs.

China is developing both missile defenses and anti-satellite missiles that employ similar technologies and are known to be targeting U.S. and allied computer networks to steal technical information useful in developing its weapons.

China also has targeted U.S. and foreign suppliers that provide equipment and material used in missile defenses.

A briefing in 2014 by Joyce Corell, a senior U.S. counterintelligence official, identified numerous pathways used by foreign states to penetrate the U.S. supply chain.

“We have more than enough evidence to know the threat is real and dangerous, but we will inevitably have difficulty predicting targets and assessing impacts,” she stated in a briefing slide.

North Korea Threat Real or Sorta Real?

Posted on April 7, 2016April 7, 2016 by Denise Simon

Analysts remain sceptical of North Korea’s nuclear strike claims

Janes: Photos released by North Korean official news outlet Rodong Sinmun on 9 March showed the country’s leader, Kim Jong-un, meeting the country’s nuclear technicians at what could be a KN-08 (Hwasong-13) intercontinental ballistic missile production facility near Jonchon in the country’s northern Chaggang province.

The accompanying article said Kim was congratulating his nuclear weapon scientists for having developed a miniaturised nuclear warhead: a claim being met with scepticism by various Western analysts.

The photos and article came two days after Pyongyang threatened its South Korean neighbours with a pre-emptive nuclear strike for the 7 March initiation of joint exercises ‘Foal Eagle’ and ‘Key Resolve’: the largest set of manoeuvres ever conducted with US forces in the region, in which around 17,000 US troops are exercising alongside some 300,000 South Korean military personnel.

In the week prior to the beginning of the exercises, Pyongyang’s KCNA state news agency quoted Kim as saying that North Korea’s “nuclear warheads need to be ready for use at any time”.

Various security policy think-tanks have accused Washington and its South Korean allies of raising tensions on the Korean peninsula, calling the exercises ill-advised. Stephan Haggard from the School of Global Policy and Strategy at University of California, San Diego, who authors a blog on North Korea, told news sites like CNN, “I didn’t see the logic of expanding the exercises. I personally think that upping the sizes of the exercises didn’t serve any material function. It’s not clear that the size will bring North Korea back to the diplomatic table, so there’s no real purpose to do that. All you’ve done is stir the viper’s nest.”

Specialists on North Korea’s defence capabilities and internal politics dismiss these criticisms of the US-South Korean manoeuvres, arguing that such condemnation ignores the realities of the immediate objectives of North Korea’s nuclear programme and the nature of the regime’s internal political intrigue.

(CNN)The North Korea monitoring project 38 North says that satellite imagery shows “suspicious activity” at a nuclear enrichment site in North Korea.

Plumes of exhaust steam, a byproduct of heating the main plant at the Yongbyon Radiochemical Laboratory complex, have been seen in commercial satellite images taken March 12 and over the preceding five weeks, the group says.

This activity is unusual, the report by the Washington-based project says.

“Exhaust plumes have rarely been seen there and none have been observed on any examined imagery this past winter,” the report says.

Weeks away?

The plumes of steam do not necessarily indicate that the process for refining plutonium for nuclear weapons is underway or will be soon, the report says.

It does, however, note that U.S. Director of National Intelligence James Clapper recently testified that Pyongyang had “announced its intention to ‘refurbish and restart’ its nuclear facilities,” including the uranium enrichment facility at Yongbyon, and that it could be able to recover plutonium from the reactor’s spent fuel “within a matter of weeks to months.”

Separate images appear to show further work on the site’s Experimental Light Water Reactor, a key facility for the enrichment of nuclear fuel, is ongoing, with a new transformer yard and road built, and the installation of electrical cables completed. More here.

Operation Hemorrhage

Posted on March 24, 2016March 24, 2016 by Denise Simon

It has been said often, either fight the enemy in a true war theater on the battlefield with real war tactics or fight them at home. Brussels and Paris and in the United States in Boston and San Bernardino to mention a few, the hybrid war gets real expensive. These costs are rarely measured or questioned. We are also not measuring the cost of freedoms are giving up. Add in the cost of the cyber war…..well….going back much earlier than 9-11-01 the costs cannot be calculated.

Operation Hemorrhage: The Terror Plans to Wreck the West’s Economy

The Western economy is a key underlying target in attacks like the one that the Islamic State perpetrated in Brussels.

DailyBeast: Every European who flies frequently knows the airport in Zaventem, has spent time in the ticketing area that was strewn with blood, limbs, broken glass, battered luggage and other wreckage.

It was another attack on aviation that pulled the United States into the conflict sometimes known as the “global war on terror” in the first place. Since then, airports and airplanes have remained a constant target for Islamic militants, with travelers being encumbered by new batches of security measures after each new attack or attempt.

After the ex-con Richard Reid managed to sneak a bomb aboard a transatlantic flight in December 2001, but failed to detonate the explosives, American passengers were forced to start removing their shoes on their way through security. After British authorities foiled a 2006 plot in which terrorists planned to bring liquid explosives hidden in sport drink bottles aboard multiple transatlantic flights, authorities strictly limited the quantity of liquids passengers were allowed to carry. When Umar Farouk Abdulmutallab snuck explosives hidden in his underwear onto a flight on Christmas Day 2009, he ushered in full-body scans and intrusive pat-downs.

Those are the misses. There have been hits, too. In August 2004, two female Chechen suicide bombers, so-called “black widows,” destroyed two domestic Russian flights. In January 2011, a suicide bomber struck Moscow’s Domodedovo airport in an attack that looked almost identical to the one that rocked the airport in Brussels: the bomber struck just outside the security cordon, where the airport is transformed from a “soft” target to a “hard” one. Just months ago, the self-proclaimed Islamic State (ISIS)—the perpetrator of the Brussels attacks—destroyed a Russian passenger jet flying out of Egypt’s Sinai, killing 224 people.

The targeting of airports and airplanes has been so frequent that in lighter times—back when the terrorists seemed so much worse at what they do—some pundits openly mocked their continuing return to airplanes and airports. In one representative discussion from early 2010, a well-known commentator described jihadists as having a “sort of schoolboy fixation” with aviation.

But the reason for this targeting, of course, is neither mysterious nor quixotic, and it’s one the jihadists have explained for themselves. Following the November Paris attacks, ISIS released an infographic boasting that its slaughter on the streets of Paris would force Belgium “to strengthen its security measures … which will cost them tens of millions of dollars.” Moreover, the group claimed, “the intensified security measures and the general state of unease will cost Europe in general and France in specific tends of billions of dollars due to the resulting decrease in tourism, delayed flights, and restrictions on freedom of movement and travel between European countries.”

And that was before the group successfully attacked the Brussels airport, despite those costly new security measures.

Even before 9/11, jihadists saw bleeding the American economy as the surest path to defeating their “far enemy.” When Osama bin Laden declared war against the “Jews and crusaders” in 1996, he emphasized that jihadist strikes should be coupled with an economic boycott by Saudi women. Otherwise, the Muslims would be sending their enemy money, “which is the foundation of wars and armies.”

Indeed, when bin Laden first had the opportunity to publicly explain what the 9/11 attacks had accomplished, in an October 2001 interview with Al Jazeera journalist Taysir Allouni, he emphasized the costs that the attacks imposed on the United States. “According to their own admissions, the share of the losses on the Wall Street market reached 16 percent,” he said. “The gross amount that is traded in that market reaches $4 trillion. So if we multiply 16 percent with $4 trillion to find out the loss that affected the stocks, it reaches $640 billion of losses.” He told Allouni that the economic effect was even greater due to building and construction losses and missed work, so that the damage inflicted was “no less than $1 trillion by the lowest estimate.”

In his October 2004 address to the American people, dramatically delivered just before that year’s elections, bin Laden noted that the 9/11 attacks cost Al Qaeda only a fraction of the damage inflicted upon the United States. “Al Qaeda spent $500,000 on the event,” he said, “while America in the incident and its aftermath lost—according to the lowest estimates—more than $500 billion, meaning that every dollar of Al Qaeda defeated a million dollars.”

Al Qaeda fit the wars the United States had become embroiled in after 9/11 into its economic schema. In that same video, bin Laden explained how his movement sought to suck the United States and its allies into draining wars in the Muslim world. The mujahedin “bled Russia for ten years, until it went bankrupt,” bin Laden said, and they would now do the same to the United States.

Just prior to 2011, there was a brief period when jihadism appeared to be in decline. Al Qaeda in Iraq, the group that later became ISIS, had all but met with defeat at the hands of the United States and local Sunni uprisings. Successful attacks were few and far between.

Valentin Bianchi/AP

Representative of those dark times for jihadists, Al Qaeda in the Arabian Peninsula released a special issue of its online magazine Inspire celebrating a terrorist attack that claimed no victims. In October 2010, jihadists were able to sneak bombs hidden in printer cartridges onto two cargo planes. Due to strong intelligence efforts, authorities disabled both bombs before they were set to explode, but the group drew satisfaction from merely getting them aboard the planes.

“Two Nokia phones, $150 each, two HP printers, $300 each, plus shipping, transportation and other miscellaneous expenses add up to a total bill of $4,200. That is all what Operation Hemorrhage cost us,” the lead article in that special issue of Inspire boasted. “On the other hand this supposedly ‘foiled plot’, as some of our enemies would like to call [it], will without a doubt cost America and other Western countries billions of dollars in new security measures.” The magazine warned that future attacks will be “smaller, but more frequent”—an approach that “some may refer to as the strategy of a thousand cuts.”

The radical cleric Anwar Al Awlaki, writing in Inspire, explained the dilemma that he saw gripping Al Qaeda’s foes. “You either spend billions of dollars to inspect each and every package in the world,” he wrote, “or you do nothing and we keep trying again.”

Even in those days when the terrorist threat loomed so much smaller, the point was not a bad one. Security is expensive, and driving up costs is one way jihadists aim to wear down Western economies.

Unfortunately, Al Qaeda’s envisioned world of smaller but more frequent attacks proved unnecessary for the jihadists. Less than two months after the special issue of Inspire appeared that celebrated an at best half-successful attack, the revolutionary events that we then knew as the “Arab Spring” sent shockwaves through the Middle East and North Africa.

This instability would help jihadism reach the current heights to which it has ascended, where the attacks are not only more frequent but larger. Unfortunately, the United States—blinded at the time by the misguided belief that revolutions in the Arab world would devastate the jihadist movement—pursued policies that hastened the region’s instability. The damages wrought by these policies are still not fully appreciated.

The silver lining to the jihadist economic strategy is that they, too, are economically vulnerable. The damage inflicted on ISIS’s “state” by coalition bombings and other pressures forced the group to slice its fighters’ salaries at the beginning of this year. But as Al Qaeda watches its flashier jihadist rival carry out gruesome attacks on Western targets and get bombarded in return, it discerns further proof of the wisdom of its strategy of attrition.

As it watches these two sets of foes exhaust each other, Al Qaeda believes that its comparative patience will pay off. It believes that its own time will come.