Eligible Receiver (original) (raw)

No-Notice Interoperability Exercises (NIEXs) (ELIGIBLE RECEIVER) are conducted in accordance with CJCSI 3510.01, "No-Notice Interoperability Exercise Program," and provide training that is planned and executed with little or no notice to the participants. NIEXs focus on C4I and interoperability issues. Normally, two of these exercises are conducted each year. They may take the form of a CPX, FTX, or a combination of both. The ELIGIBLE RECEIVER series of exercises are directed by the Chairman of the Joint Chiefs of Staff and are designed to test DOD planning and crisis action capabilities.

In 1997, the JCS mandated the conduct of the first-ever No-Notice Interoperability Exercise (NIEX) based on an IO scenario as part of the ELIGIBLE RECEIVER exercise series. ELIGIBLE RECEIVER 97-1, as well as several other IO-based exercises, disclosed several human vulnerabilities in the cyber world, including the ease with which Red Team personnel "socially engineered" Department of Defense (DoD) personnel and the vast amount of valuable information the Red Team was able to collect from the Internet on a daily basis.

ELIGIBLE RECEIVER 1997 (9-13 June 1997) was a no-notice Joint Staff Exercise designed to test DoD planning and crisis action capabilities when faced with attacks on DoD information infrastructures. This exercise revealed significant vulnerabilities in DoD information systems and specific deficiencies in responding to attacks on their information systems. ER '97 involved DoD, Joint Staff, the Services, USACOM, USPACOM, USSPACECOM, USSOCOM, USTRANSCOM, NSA, DISA, NSC, DIA, CIA, FBI, NRO, and the Departments of State, Justice, and Transportation.

The issue of interconnectivity and the resultant critical vulnerabilities as well as deficiencies in the ability to respond effectively during such an attack was demonstrated in a no-notice exercise ELIGIBLE RECEIVER 97 (ER97). ER97 was the first large scale exercise designed to test DOD's ability to work with other branches of the government to respond to an attack on the national information infrastructure.

This exercise clearly demonstrated that IO is a real threat and that it can be a dangerous one. New methods for exploiting vulnerabilities are being developed by the hacker community with increasing frequency. These tools are widely disseminated and are publicized in open public forums.

ER '97 included an actual attack on key DoD information systems. Known vulnerabilities were exploited and computer systems were actually disrupted. DoD Red Team computer experts derived techniques and tools from open source research (primarily from the Internet), used commercial internet accounts, and exploited actual vulnerabilities. Their targets included: the National Military Command Center (NMCC) in the Pentagon, USPACOM, USSPACECOM, USTRANSCOM, and USSOCOM. The Red Team intruded computer networks, denied services, changed/removed/read e-mails, and disrupted phone services. The team gained superuser access in over 36 computer systems which meant they could create new accounts, delete accounts, turn the system off, or reformat the server hard drives.

As was graphically demonstrated by the Department of Defense's (DoD's) experience in Exercise ELIGIBLE RECEIVER 97, and with the high-profile computer intrusions dubbed SOLAR SUNRISE, The US faced increasing risks to U.S. interests in cyberspace. U.S. dependence on, and worldwide connectivity through, this relatively new medium increases the exposure to traditional adversaries and a growing body of new ones, many of whom are fast developing their capabilities to exploit and disrupt networked information systems. The ability of adversary groups and nation states to disrupt or influence U.S. civil and military activities through manipulation of our information networks, without having to confront directly traditional U.S. military power, will become an increasingly attractive option.