Nuclear arsenal finds security in 8-inch floppy disks

[Kitsune]

Thought this was pretty amusing
http://defensesystems.com/articles/2014 ... dmgarea=DS

Nuclear arsenal finds security in 8-inch floppy disks

The 8-inch floppy disk is to computers what the hand crank starter is to automobiles—a relic of the past, existing in museums, black-and-white photos and maybe your grandfather’s basement.

They’re the stuff of computer nostalgia, finding themselves made into a desk clock, attached to a tote bag or throw pillow, or emblazoned on a T-shirt. And they can also be used to launch intercontinental ballistic missiles.

In a “60 minutes” report Sunday, correspondent Leslie Stahl visited an Air Force launch control center in Wyoming and discovered that Cold War-era facilities still have Cole War-era technology, including analog phones and, yes, 8-inch floppy disks that are used in issuing launch commands for the Minuteman missiles.

ICBM missile silos went up in the 1960s and ‘70s and have remained pretty much frozen in time. The missiles themselves have undergone regular upgrades, but the facilities haven’t changed much. One reason is money—according to one estimate, it would cost $352 billion over the next decade to modernize the facilities. But another reason is the security provided by old IT.

Maj. Gen. Jack Weinstein, commander of ICBM forces, told Stahl that the old hardware and software, and the lack of an Internet connection, provides solid security for the missile bases.

That makes sense, since it’s unlikely that a hacker today would have much experience with an 8-inch floppy. In fact, one of the “missileers” at the base told Stahl she had never seen one before arriving there. The disks also have a built-in protection against portable-storage attacks like Stuxnet, which was introduced to Iran’s Natanz nuclear plant via a thumb drive, since the disks don’t have nearly enough space to hold such a sophisticated piece of malware.

The 8-inch floppy was created in 1967 by IBM as a way to provide software updates for its System/370 mainframes. The first “memory disk,” as it was called, held 80 kilobytes of data. IBM introduced the floppy commercially in 1971, and by 1976 new floppies were double-sided disks that could hold 1-1.2megabytes. But they had been pretty much overtaken by 5½-inch disks by the time the PC revolution got going in the early 1980s. Since then, portable storage has steadily gotten smaller, faster and more capacious as the 8-inch floppy faded into history.

But not altogether, as their presence at the ICBM bases shows. In fact, pockets of government, with its duty to keep and manage all kinds of records, still work with the floppies, if not of the 8-inch variety. The Federal Register still accepts 3½-inch floppies along with CD-ROMs (though not flash drives or SD cards), and the Library of Congress still uses them to construct details of history in the computer era.

As reliable as the disks have been, however, age could become a concern. Digital media won’t last forever. The Wyoming launch center is planning to upgrade from its analog phones, which have proven to be unreliable, according to the “60 Minutes” report. And the Air Force reportedly will spend $19 million on upgrades to the launch centers this year and has requested $600 million for further improvements next year.

Whether that includes moving on from floppies isn’t clear, but in the meantime, they can always turn to eBay for an unopened, unused “box of 10 rare Intel double sided/double density 8- inch floppy disks,” for $44.95, plus $14.83 for expedited shipping. If need be, they can even find refurbished 8-inch floppy diskette drives for $1,211.77. That is, if the launch center had an Internet connection.

[Borgholio]

That...actually makes a good deal of sense. How many computer viruses are able to fit on an 80kb floppy anyways?

Related question, despite what the article says, floppy discs really aren't all that reliable. They do need to be replaced. Does the Air Force have a stockpile of these things or are they still being manufactured somewhere?

[Nephtys]

There's a bunch of reasons actually to use floppies. Which made sense when I was doing R&D for them. One is that if there's any data compromised, there's only so much you could take if you're only permitted to have small capacity disks in sensitive machines.

The internet connection thing is nonsensical. Of course I don't want /anything/ hooked up to an external network in a secure environment! There's no better security than literally making something physically inaccessable.

I believe the USAF has some special manufacturing. They use a lot of legacy tech for various reasons, some good and some bad, which require replacement frequently.

[Zixinus]

I would be surprised if they are manufactured somewhere. Or that eBay is a that reliable source of good floppies.

I have always heard that security through obscurity is not a good policy, although here it makes some sense. Anyone trying to hack in or sneak in a trojan would have to work with very old code and hardware. Plus I am sure (or at least hope) that there are more security arrangements in place.

Question: say that the floppies become too bothersome to use and there are just not enough replacements anymore. Would then the military switch to CDs? Or make their own obscure data carrier format?

[Simon_Jester]

Physical security comes from both obscurity (there are few logical reasons for anyone to be within ten kilometers of a typical missile silo, except for people who work there) and actual presence of men in the silo who would stop you.

It seems likely that if they have to stop using the floppies, the military will switch to a new format. Probably one that is well-known for being used safely in secure electronic systems already, and is therefore still behind the times but not as much so.

[General Zod]

I would be surprised if they are manufactured somewhere. Or that eBay is a that reliable source of good floppies.

I have always heard that security through obscurity is not a good policy, although here it makes some sense. Anyone trying to hack in or sneak in a trojan would have to work with very old code and hardware. Plus I am sure (or at least hope) that there are more security arrangements in place.

Question: say that the floppies become too bothersome to use and there are just not enough replacements anymore. Would then the military switch to CDs? Or make their own obscure data carrier format?

3.5" floppies are still around and almost as obsolete as 8". They could always upgrade to 3.5" or 5 1/4" floppies. I wouldn't expect them to even think about upgrading to USB or something that could be smuggled in without being really noticeable.

[Eternal_Freedom]

The idea of the USAF using old tech makes sense to me. I mean, how much computing power/data storage do those launch sites actually need? Clearly nothing beyond 1960's tech (since the Titan-II silos worked just fine (hell, one of them in Arizona still works as a museum (which is a great place to visit BTW)). So why should they upgrade the technology at obscene expense to a less-secure format when they don't have to?

Where ICBMs are concerned, I feel happier knowing they use stuff like this that's near-impossible to hack rather than ultra-modern USB 3 stuff that's heavily firewalled. I really don't want some script wizard getting in and nuking China because they can.

[Darth Tanner]

I'm sure the US military has the budget to have a second hand floppy disc making machine in a warehouse that they can roll out to make a few thousand replacements when the time comes. If they need them, I doubt they receive many software updates anymore on software built to use floppy discs.

I'd also imagine the problems their encountering with analogue phones has nothing to do with the medium but the fact the network is carrying so much digital noise.

[Sea Skimmer]

The original Minuteman 1 system was impossible to retarget without physically modifying the missiles, launched all 50 missiles per wing at once or none at all, and had no encryption on the communication cables. The present system is something of a radical improvement over that standard to say the least.

While they aren't tied into the internet, a remote launch capability does exist , but it will only function for hardware reasons if the silo looses all land line and radio communications with all launch control centers, but only a handful of command post aircraft are equipped to use it via MF radio. Of course you still need the proper launch code to make it do anything.

Some stuff has been upgraded though, like the launch control centers now use LCD displays instead of monochromatic panel stuff which did require modernizing some of the computer backend.

[Deathstalker]

"Hey, you here we're getting upgraded?"

"Really, with what?"

"Something called Skynet."

"Sounds cool. Hope nothing goes wrong with it."

[Borgholio]

"Hey, you here we're getting upgraded?"

"Really, with what?"

"Something called Skynet."

"Sounds cool. Hope nothing goes wrong with it."

Already there. It's called Google.

[Rekkon]

Physical security comes from both obscurity (there are few logical reasons for anyone to be within ten kilometers of a typical missile silo, except for people who work there) and actual presence of men in the silo who would stop you.

Plenty of silos are well within ten clicks of population centers and/or highways. I drove past several once a week or so when I was going to school in Minot, ND. A friend of mine drove up to one to photograph the "do not come in here ever" sign on the fence.

I also do not think the guys inside the silo do anything beyond monitoring for the physical security of the topside site. After all, getting out would mean opening the silo, and there is not much anyone can do to one on the surface. Back when those guys dressed as clowns broke into one, they got to hit the cover with hammers for a few minutes until external security showed up to arrest them.

[Simon_Jester]

Physical security comes from both obscurity (there are few logical reasons for anyone to be within ten kilometers of a typical missile silo, except for people who work there) and actual presence of men in the silo who would stop you.

Plenty of silos are well within ten clicks of population centers and/or highways. I drove past several once a week or so when I was going to school in Minot, ND. A friend of mine drove up to one to photograph the "do not come in here ever" sign on the fence.

OK, sorry, I was exaggerating. Still, the basic point remains that the computers are physically secured by the fact that you can't get to them.

[Sea Skimmer]

I also do not think the guys inside the silo do anything beyond monitoring for the physical security of the topside site. After all, getting out would mean opening the silo, and there is not much anyone can do to one on the surface. Back when those guys dressed as clowns broke into one, they got to hit the cover with hammers for a few minutes until external security showed up to arrest them.

All modern silos are unmanned. The last manned US launch facilities were retired in the 1960s; only certain Atlas versions and Titan 1 ever had people at the missile site. Those systems did this because the launch control was also at the silo (poor communications tech, these were rushed deployments), and some versions of Atlas and Titan 1 had multiple silos clustered together. Even then the actual silo structure itself was sealed off normally, because of the fire risk ect and just connected by service tunnels to the launch control structure and power generators. Titan 1 bases are just silly complicated and cost as much as aircraft carriers apiece.

All Minuteman versions have separate launch facilities aka silos, and launch control facilities. Ten unmanned silos are paired with a launch control bunker which holds a two man crew at all times. This bunker has a soft building built directly on top of it and its access tunnel which holds a guard team and relief control crews. Everything is spaced a few miles apart from any other facility.

The 10 missile group is called a flight, five flights make a squadron. Three squadrons a wing with 150 ICBMs. The US presently has three wings of Minuteman III as its ICBM force, all MX/Peacekeeper missiles having been retired, the rocket motors are now being made into space boosters.

Each ICBM deployment area also has one or more maintenance bases at which they also have an alert force with helicopters. Those are the guys who would respond to trouble at a silo normally, and reinforce the security at the launch control. Said base will hold spare missiles and warheads as maintenance floats, but has no ability to launch or control said missiles.

The way launch security works is all the launch control facilities are hard wired together, and connected by radio, as are all the ICBM silos, with computer logic that knows which are 'alive' and which have gone silent on all communications. If multiple control facilities are active, no one facility can fire the missiles alone, the others must consent to fire (and everyone has to have the proper codes too). Conversely if only one launch control facility is active and has the proper code, it can fire ALL the ICBMs it can communicate with. If no launch control facility survives, then certain command planes can issue the fire command over a special radio system that will normally be ignored by the computers. Normally said plane would talk directly to the launch control facilities via multiple possible radio systems. End result is even taking over a launch facility with the proper codes... still wont let you fire anything. Not unless you could also dig up and cut the hard lines to the silos it directly controls (buried 4-6ft deep), and jam multiple radio systems all at the same time. Not bloody likely that this can happen. The main US fear was not hyjacking so much as the security working too well and preventing the system from firing at all in a war. Thus the supposed claim that SAC kept all the codes at all zeros until 1977 when satellite communications became reliable.

This is how the modern minuteman works anyway, the original systems were much less integrated and less flexible and had some hilarious problems largely linked to SAC wanting them cheap enough to field 10,000 of. The present system works out to be very good security, but its not actually very complicated, its really just relying on the brute force of its own lavishly built up communications redundancy. Thus the reason why very old computers work fine.

In terms of physical silo security, they have a couple different automated motion detectors and now cameras, as well as internal sensors and seismic. The actual internal access system is a stacked series of armored bolted down hatches that you have to physically unscrew, no entering a code to make them open, then you reach an internal blast door which must be remotely opened by the launch control facility.

Even if you have serious amounts of explosives you can't gain access quickly because you'd have to set off a series of explosions to breach each hatch in turn, though a good shaped charge could blow a hole in the silo lid itself if you merely wanted to destroy the missile.

[Borgholio]

In terms of physical silo security, they have a couple different automated motion detectors and now cameras, as well as internal sensors and seismic. The actual internal access system is a stacked series of armored bolted down hatches that you have to physically unscrew, no entering a code to make them open, then you reach an internal blast door which must be remotely opened by the launch control facility.

I was gonna say...if the silos are fully unmanned, how can we be sure they're safe? Sounds like they're locked down pretty tight it seems though.

[Sea Skimmer]

They are meant to withstand 300psi of atomic blast even on the earliest versions, with the later (and now only) silos being more heavily built to more like 1000psu. Just the upper personal access hatch weighs something like a ton. They have to be highly secure just to avoid the doors bouncing off when that blast pressure passes and the compressive force is unleashed as a rebound (this is why blast doors in general must lock). Human interference was always considered a major threat, the original silo designs are from the late 1950s after all when America faced a non trivial threat of enemy agents putting communism in the water supply.

Details varied with each version of Minuteman though, IIRC the personal door for Minuteman II was a giant five ton plug that was found to actually be more vulnerable then the smaller hatches used by the other versions. I also forgot that one of the key security measures is that indoor door that has to be remotely opened also moves SLOW, like half hour slow, ensuring that a reaction force has time to arrive should it be subject to unauthorized movement, like say if a launch facility crewmen was helping the enemy get into the silo. Its also not horizonal as I was thinking, but vertically moving.


Anyway the doors are sandwiches of homogenous steel armor plate and reinforced concrete. Some stuff Shep found years ago specifically said the armor came from battleship armor production facilities (logical) and on the original Minuteman 1 silos had an upper and lower 3.5in thick plate. So at least seven inches of armor without even the concrete. The doors have been modified a lot since then, because the original design didn't meant hardness specs and they decided more radiation shielding was needed to deal with threats like a lot of high intensity fallout sitting on the silo door for hours (can't launch in those conditions, rads could wreck missile as it goes up).

For the bonus fun, while the silos doors can open rapidly with electrical power for tests and replacing the missile, should an actual launch be conducted a piston driven by actual explosives blows the door off and throws it 100+ feet away. This ensures that say, communist sleeper agents with a sledgehammer and a steel wedge cannot jam the door shut. Also helps get possible post nuclear attack debris off the lid. This is an endless ICBM silo design problem that has long discouraged superhardend silos (none exist in service anywhere, though ones harder then US ones certainly do). Even if you can withstand the blast, a nuke ground burst could potentially bury and operational superhardened silo in as much as 30 feet of highly radioactive debris. I have a whole PDF of silly 1980s concepts for how to solve that problem...We don't get cool shit like this in movies ever.