Here's Air Force’s $49.5M Plan to Outsource Cyberweapon and Counterhack Software

This story has been updated with more information from the Air Force.

The Air Force is finalizing a $49.5 million plan to hire private sector coders who, by developing software, can sabotage adversary computer systems and thwart incoming hack attacks. 

An official contract for the "Offensive Cyberspace Operations Defensive Cyberspace Operations Real-Time Operations and Innovation Cyber Development Custom Software Engineering Services" program is slated for publication Jan. 29, 2016. 

SHELTER, the nickname for the mouthful of a project title, is a 5.5-year deal that would add to the Defense Department’s growing arsenal of cyberweapons.

Technically referred to as "exploits," "payloads" and "implants" in a draft contract released Monday, these sophisticated, malicious programs are not exclusive to defense company computer labs. Via the Internet black market, hidden behind firewalls, anyone -- including terrorists -- can buy them from script kiddies, financially motivated hackers or other anonymous sources. (The Pentagon definition for exploit is "software or a sequence of commands that takes advantage of a vulnerability in order to cause unanticipated behavior to occur on computer software, hardware or something electronic, usually computerized.)

In a Monday analysis of the cyber capabilities of the Islamic State, Stratfor research analyst Tristan Reed points out the extremist group doesn't need HTML skills to project power online.

"Capabilities to carry out cyberterrorism do not necessarily have to come from within the Islamic State,” he said. “A thriving underground market exists,” where “offensive skills for hire and exploits in popular software not publicly known (referred to as "zero day" exploits)” are available, and “often the buyers and sellers do not have to know each other's identities."

Currently, ISIS is more interested in publicizing website breaches and hijacking social media accounts than engaging in destructive online attacks, according to Stratfor. But other nation states of potential concern such as Iran are building the kind of malware capable of impairing critical infrastructure like transportation systems, security experts say. 

And so is the Air Force, Monday’s proposed statement of work proclaims. 

Private sector professionals are wanted for hack attack and counterhack software development efforts. The branch, for example, needs a contractor for the "development and/or identification of capabilities" to "exploit and mitigate previously known and unknown hardware and operating system vulnerabilities." 

The new software initiative is a move toward incorporating digital maneuvers into physical attacks, described in the branch's forward-looking Air Force Future Operating Concept, Col. Chad LeMaire, vice commander of the 688th Cyberspace Wing, told Nextgov in an email on Wednesday.

The vision contemplates a 2035 where cyber forces have the ability to "achieve desired effects rapidly," and where "in a contested cyberspace environment, a focus on precise, predictable effects, fully synchronized with actions planned in the other domains . . . enables AF cyberspace operations to ensure the required degree of freedom of action."

LeMaire said, "The reason we specified the offensive capabilities is because we," meaning Air Force Cyber, "have requirements for them."

The Air Force wants to be able to find security holes in its own systems and find holes in all manner of technologies to wriggle inside the ones owned by adversaries. 

The goal is to be able to quickly pinpoint vulnerabilities, specifically in:

• Targeted hosts
• Servers
• Systems
• Routers
• Switches
• Cellular, Wi-Fi, WiMAX, and Bluetooth connections
• Mobile devices, operating systems, internal components
• Cloud computing technologies

The selected vendors will be assigned the responsibility of designing tools for either fixing flaws spotted or taking advantage of them, according to the proposal. The work statement calls for the "generation of payloads for developed identified capabilities," along with research into containing malware. 

Speed is key to dominance in cyberspace, and professionals will be expected to "find vulnerabilities with or without source code," in accordance with "government established timelines,” the draft contract states.

The contractors also will build tools to neutralize malicious code found seeping through the Defensewide "global information grid" network. 

In addition to attacking and blocking cyber aggressors, the software could be employed in law enforcement, counterintelligence operations, software quality assurance, reverse engineering of malicious logic, and command and control, the documents state. 

The price ceiling for the deal is $49.5 million and the Air Force is taking questions on the proposal until Dec. 18. 

Networks in the skies will be no match for Air Force cyber warriors, military officials recently told reporters.

According to Ars Technica, Air Force Maj. Gen. Burke “Ed” Wilson said the Air Force has conducted tests “where we asked the question, what if we—instead of jamming a target—put a tool on an aircraft that allowed us to touch a target with cyber? And yes, we can touch a target from an air-enabled network.”