Winging It · Implausible Deniability
The first thing you learn about doing IT security for the Special Air Service is that the people you are securing are significantly more dangerous than any threat in your risk register. This is not a metaphor. These are men who can cross a desert at night using nothing but a map and the actual stars, strip and reassemble a weapon blindfolded, and operate in places so hostile that the MOD won't formally admit they exist. They move fast, because the difference between fast and not fast is the difference between coming home and not. And everything I was responsible for, every single system meant to protect what they did, asked them politely to slow down.
I joined in 2007, just as IT, and with it IT security, started to explode. They stopped being a corner of the operation and quietly became the operation. The budget was the sort of figure that would make a corporate CIO weep gently into his roadmap, and it was being spent, at speed, on handing screens to men who a few years earlier had found their way across a continent using the sky. Patrols that had run on a map and a radio were suddenly bristling with kit. There were systems for tracking vehicles over Bluetooth so the ops room could watch them move across a display. There were units that strapped to a wrist with live mapping on them, years before the rest of us were handed an iPhone and told it would change our lives. And then there were the operational systems, the ones that ran the actual missions, which were exactly as sophisticated as you would hope and exactly as fragile as everything else.
Every one of them was a genuine capability. Every one of them was also a brand new way to be tracked, intercepted, or quietly owned by a nation state with a budget that made ours look like loose change. The people using the kit had to trust that it was safe to carry, safe to switch on, safe to lose. Making it so, and working out what happened when it wasn't, was the job they gave me.
I spent much of my fourth tour of Iraq running forensic data acquisition training for a Sabre squadron. The principle is simple. You're on target, there are hard drives, you retrieve them. If you've seen Zero Dark Thirty, you've got the idea, give or take the lighting and the soundtrack. The job was teaching men who could clear a building in under a minute to handle a hard drive like unexploded ordnance, gently, and with respect, neither of which came naturally to anyone.
One of the guys went out on a job and came back buzzing. He marched up to my desk, set something down on it with the pride of a cat presenting a half-dead bird, and announced that this was going to be great. It was a UPS. An uninterruptible power supply. He had carried it seven kilometres through the dark, across rough ground, in full kit. And to be fair to him, it looked the part. To anyone who didn't spend their days around the stuff, it could easily have passed for a large external hard drive, the sort of thing actually worth carrying out. He'd applied exactly the right thinking to get it there. Find the thing that looks important, lift it under pressure, bring it home. I examined it for a moment with the face of someone conducting a careful technical assessment, then explained that he had recovered, at considerable personal risk, a very heavy battery with a light on it. He called me something unrepeatable and went off to make a brew. He was back out the following night and came home with three hard drives. He wasn't wrong, and he never mistook one again.
The secure communications were, on paper, a thing of beauty. Encrypted systems. Protocols refined over decades by people who understood what happens when you don't. And then there were the actual phone calls, in which every piece of sensitive information, without exception, was referred to as "the obvious." We need to talk about the obvious. Have you seen the latest on the obvious. An entire operational picture conveyed through a single word that had quietly been asked to mean everything, delivered with the serene confidence of men who knew exactly what they meant and trusted everyone else to keep up. And the clever bit is that it worked. Anyone tapping the line would have been utterly none the wiser. That was rather the point.
There came a point where every operator was carrying a personal BlackBerry, kept well away from anything official. In theory it was a matter of operational security, a clean handset with nothing sensitive on it. In practice it was where the rest of a life went. The texts that had no business on a sanctioned system, the calls home, the calls not home, the small private world every human being keeps regardless of clearance. Which is, of course, the entire problem. Build a channel nobody is watching and people will use it for exactly the things they'd rather nobody watched. I've thought about that drawer of handsets a great deal since, more for what they proved than for what was on them. Give a person a system built for control and a second one built for convenience, and convenience wins. Every time.
Fifteen years on, I'm still watching the same thing happen, in glass offices instead of ops rooms. The operator with a screen strapped to his wrist and no patience for the login on it is now the brilliant engineer who routes around your single sign-on because it costs him four seconds every morning. The BlackBerry in the drawer is now a shadow SaaS account, signed up with a personal email, quietly holding half the customer database because the approved tool was a misery to use. The UPS is every executive who has ever strode into my office, set the wrong thing down with total confidence, and asked me to make it secure. None of these people are stupid. Most of them are the best in the building at what they do. Which is precisely why they have no intention of waiting for whatever box I need them to tick before they can get on.
What the regiment understood, and what almost nobody I've worked with since has managed, is the difference between the two. The careless are easy. You can train the careless. You can write them a policy, sit them in a darkened room, and show them a video about not wedging fire doors open with a chair. The careless are a solved problem. The trouble, always, is the competent. People doing something entirely sensible, a few degrees off the line you so carefully drew, because the line was slowing them down and they had somewhere to be.
It took me an embarrassingly long time to work out that they were usually right. The operator who went round the slow system. The engineer who stood up his own server because the official one was six weeks away and he had a job to do that afternoon. For years I built the controls that got in their way. Closed the gaps, tightened the policy, felt quietly heroic about the whole enterprise. And it dawned on me, slowly and not at all comfortably, that I was the obstacle. They'd run the same calculation I would have, and decided the work mattered more than the four seconds my way was going to cost them. The regiment grasped this without anyone having to explain it. Ruthless about the things that genuinely mattered, the comms discipline, the names that never once touched an open line, and entirely relaxed about the things that didn't. They guarded what was worth guarding and waved the rest through. And they were almost never wrong about which was which.
Then I left, the way everyone eventually leaves, and walked into the civilian world braced for something heavier. Bigger systems. More rules. More to lose. What I found was the precise opposite. Nobody out here calls anything the obvious. Not a better word. They simply don't believe anything they touch is sensitive in the first place. The deal, the reorg, the database with forty thousand home addresses sitting in it, all of it discussed at full volume, on open calls and crowded trains and phones registered to real people with their real names. And why on earth would they think otherwise. They get to go home at five. They get to shut the laptop and forget the entire thing until morning, and nothing they did or failed to do that day is going to follow anyone into the dark. Their lives do not depend on it. Their friends' lives certainly don't. The industry adores a military metaphor, the war rooms and the kill chains and the threat actors stalking the perimeter, when the most hostile environment anyone in the building will face all year is the car park after a town hall.
I've spent fifteen years trying to make people in offices care about security the way those men did. It turns out you cannot. You can buy the tooling, run the training, commission the poster of a cartoon padlock looking concerned, and at the end of it they will still prop the fire door open with a chair, because the building is warm and the chair is right there. You can't manufacture the thing that made those men careful. It came from somewhere no policy reaches, and no procurement budget has ever found a vendor for it.
— Chris