Cyber Operational Considerations in Dense Urban Terrain

Cyber Operational Considerations in Dense Urban Terrain                    

Paul Maxwell, Andrew Hall and Daniel Bennett

Introduction

Thirtieth Corps began its attack on the city of Metropolis and its 12 million inhabitants. The Corps planners had done their homework on urban operations and had studied many historical predecessors such as Stalingrad and Hue. Initially the attack proceeded well. Over time however, enemy indirect fire accuracy seemed to defy expectations given a lack of detected observers. Patrols were increasingly ambushed and leaders were targeted at an abnormal frequency. Raids failed to produce the desired results as targets were seldom found where they were expected. It seemed that the opponent knew their every move before they were executed. It soon became clear that the enemy had more capability than our intelligence sources briefed. The attack on the dense urban area stalled without success.

Scenarios like the one described are possible given our current training models and doctrine. Military operations are likely to occur in Dense Urban Terrain (DUT) similar to Metropolis due to demographic changes of modern society. DUT is a sub- set of Military Operations in Urban Terrain (MOUT) in which there is a corpus of knowledge. As described in the Army’s Field Manual, FM 3-06, Urban Operations, the operational characteristics of this environment that the military should account for include physical, social, economic, and demographic factors. Many of these factors have been investigated and documented in the field manual and training products. Factors that have not been thoroughly discussed are the cyber characteristics of DUT and the impacts of those factors on military operations whether they are offensive, defensive, stability, or civil support. As the military analyses DUT and writes its doctrine on how to conduct operations and how to train in these environments, it is important to consider how cyber elements may influence the mission.

The urban areas in which military forces fight will certainly vary. They will range from low tech emerging cities to high tech smart cities. The structures, transport patterns, infrastructure, and footprints will be different. Despite these differences, they will possess a multitude of sensors connected by networks that can be leveraged for offensive or defensive purposes. Many of these sensors will be in the Internet of Things (IOT) devices that are exponentially growing in number.  These devices can be connected together to provide useful functions to government officials, citizens, and military personnel [ZaB14]. Even the most technically limited cities are inundated with networked sensors in the form of mobile phones and the cyber operational potential of other cities only grows beyond that to varying degrees.

For the purposes of this work, the term cyber includes computer network operations and electronic warfare. Included in this analysis are the pervasive sensors, various network technologies, electro-magnetic spectrum issues, and the ability of modern artificial intelligence to analyse the digital mountains of data produced daily. Some of the threats and opportunities discussed currently exist and some are on the horizon and will become operational in five to ten years. Additionally, the conditions under which the operations are conducted will affect the impact of these systems. High intensity operations in DUT with evacuated populations will be less affected by some of these cyber considerations while low intensity operations will be more affected.

Technological Landscape of Dense Urban Terrain

Sensors

The rapid and cyclic advancement of technology has resulted in a proliferation of inexpensive yet capable sensors throughout the globe. These can have many forms and purposes. They can be commercially installed systems with a dedicated function to personally owned sensors that are general purpose in nature. Regardless of their intended use, they provide a rich palette of military options for those who wish to use them.

Cameras are everywhere, from the traditional surveillance cameras for security purposes to the ubiquitous cameras found in mobile devices and the growing population of unmanned aerial vehicles. There is little room for something to go unobserved by a camera in a city. It is estimated that there are close to a million cameras deployed in cities such as London and Beijing [ZhC15]. This does not even include cameras within homes that exist in computers, tablets, phones, smart televisions, security systems, etc.

Complementing the cameras are microphones. These sensors are frequently found in cell phones and other mobile devices. Increasingly, they are found in items such as surveillance cameras, toys, and even watches. Many of these devices are ‘always on’, such as the Amazon Alexa, listening for acoustic events and potentially recording all that they can sense to include nearby conversations.

Another common sensor is the accelerometer. These devices are capable of measuring movement in two and three dimensions. They are embedded in mobile devices to assist with navigation, orientation, and sometimes even for protection of the device in case they fall. Accelerometers are increasingly found in ‘wearables’ of all types too such as fitness trackers.

Magnetometers are in widespread use as well. These devices sense magnetic fields such as the earth’s natural field or those resulting from the presence of ferrous objects.  Typical applications include navigation (compasses) and counting/sensing objects such as vehicles. These devices are found in mobile devices, traffic management applications, and underneath our roadways.

Finally, there are numerous types of sensors connected to our urban infrastructure that measure things such as pressure in pipes, valve states (open/closed), temperatures, and volumes. These sensors are often connected to Supervisory Control and Data Acquisition (SCADA) devices to provide remote control over our water, electrical, and transportation infrastructure.

Networks

All of these sensors would be somewhat insignificant though were it not for the networks that connect them and allow them to share their data. The most well-known are the internet and cellular networks. DUT environments are often blanketed by both networks. Even emerging cities with poor internet penetration are frequently well covered by cellular networks. As discussed in the next section, even the network itself can be used as a sensor for use in military operations.

Other communications protocols can often be harnessed into Mobile Ad-hoc Networks (MANETs) or dedicated mesh networks thus allowing systems to share data. Technologies such as Bluetooth, Near-Field Communications (NFC), IEEE 802.15.4 (Zigbee), IPv6 Low-power wireless Personal Area Network (6LowPAN), and cognitive radios provide backbone capability to establish a sensor network.

With a network established, the power of these numerous sensors can be utilized. Whether it is through a deliberate design or surreptitious hacking of others’ devices, the data from these sensors can help a military force to accomplish its mission or contribute to its failure. The sensors and the connective tissue of the networks are continually present in DUT and therefore a factor that must be considered in the planning of urban operations.

Impact of Technology on Operations in Dense Urban Terrain

Maneuver and Intelligence

Tracking. In military operations of all types tracking friendly and enemy units is useful. Such information can assist with coordination, fire control, identification, and targeting. Traditionally, militaries accomplish this with methods such as networked gps devices, imagery, radars, and direction finding.  In DUT environments, these methods may be limited or ineffective.  However, cyber enabled devices can replace or supplement traditional methods.

An important feature of many of these cyber enabled sensors is their ability to track personnel and/or vehicles.  Mobile devices, wifi, RFID, camera-based systems (e.g., vehicle plate recognition systems), and more support this type of intelligence gathering for those who wish to know [MiC13], [PaQ13]. This tracking can be low resolution tracking with only the ability to sense one or more objects or high resolution with the ability to identify and track specific targets. Tracking of this nature can be used for purposes such as intelligence gathering, targeting, and triggering fires. One could imagine using this type of tracking capability for applications such as geo-fencing [NaS13].  Geo-fences can establish areas that generate alerts when attacking forces enter them or when specific targets leave them.

An obvious tracking technology is based on video cameras. As previously discussed, cameras are everywhere in DUT environments. Whether it is securing a facility, providing public security, observing streets for traffic conditions, or taking selfies, the cameras are constantly capturing data. Deliberately configured or subsumed via cyber offensive operations, these video based systems such as the third generation surveillance systems in [Rat10] or the systems in [VaV05] and [BeR11] can detect, recognize, and track multiple objects. Their method for achieving this varies by system but all rely on distributed cameras, processing power (edge or centralized), and communications networks. Some systems [ZhC15] propose using under-utilized licensed frequencies such as UHF to communicate. Another system described in [AjB15] allows for users to query its surveillance database for events, generate alerts, and even predict future events. When connected to modern signal processing algorithms and artificial intelligence systems, this video data can provide valuable intelligence. This type of sensor network can allow for persistent identification and tracking of forces within the city. The ability to conceal operations or achieve tactical surprise may not exist in DUT environments.

Improved signal processing algorithms and cheaper processing power is enabling various tracking techniques based on electro-magnetic radiation. One such set of algorithms uses wifi for tracking movement. Research such as that done in [GoY15], [YaZ16], and [SoG16] demonstrate how wifi signals can be used to detect motion of human targets. Attributes of the wifi signals such as the Received Signal Strength, Time of Flight, phase of the signals, and channel state information are all used to detect movement. These systems have limited range and capability but given the widespread availability of wifi nodes in DUT environments, this technology could be adapted to provide early warning of opposing forces or indications movements by the populace. The work in [CoP14] used wifi signals as passive radar to detect and track moving vehicles at ranges up to 50m.

Other work in this area tracks targets but is more protocol agnostic and also supplements the inputs with other data types. The research in [SaW16] relies on a combination of signal analysis from wireless nodes and data from inertial measurement units (IMUs) or accelerometers. This system allows indoor navigation in what is usually a GPS denied region. Similarly, research using cell phones and the signals received from many sources (e.g., wifi, Bluetooth, 4G LTE, GPS, NFC) showed that large spaces could be radio frequency mapped in a crowd source technique thus allowing for navigation in GPS denied areas. Forces using this technology can navigate better inside the DUT environment where traditional navigation means are not as effective.

Data from devices connecting to wifi nodes can also provide a method for tracking individual devices. As shown in [AbB14], devices can be tracked passively by using data from connection logs in wifi access points. As devices interact with these access points, information about the device, such as it unique MAC address is logged. An ISR program could access these logs and use the data to track traffic flow in an area or even a particular device.

This type of tracking has also been shown to be feasible for Bluetooth devices. Using the information contained in these devices as they search to connect to other devices, movements of groups or individual devices can be mapped [StL11]. These low power sensors are common in many mobile devices and wearables thus creating a large population of data points.

Magnetometers provide another means of tracking targets. It is common for magnetic based systems to be embedded in roadways for traffic control. These sensors normally trigger traffic signals or count the number of vehicles passing a particular point to help transportation engineers improve traffic flows. If this data is shared via a wifi network then it is possible to track and with appropriate processing identify vehicles [KoO13]. Magnetic sensors may also be placed on the sides of roadways. The work of [WaZ15] showed how these sensors can count vehicles passing. This type of traffic flow data could help operations by identifying slow-go areas during intelligence preparation of the battlefield (IPB) or tracking convoy operations of opposing forces.

Due to a lack of line of sight (LOS) in DUT, radar systems would not frequently be incorporated into the Intelligence, Surveillance, and Reconnaissance (ISR) plan. Traditionally, these systems are employed in areas with clear LOS to allow their full tracking capability.  FM 3-06 recommends only employing them on the peripheries of urban areas.  However, enhancements in signal processing algorithms is making it possible for radars to work in Non-Line of Sight (NLOS) environments. [ZhZ16] showed how airborne radars (carried by heliostats) could track multiple targets in an urban  environment  using  new  processing  algorithms. Additionally,  dismounted personnel were tracked in a NLOS urban environment using X-band radars and new signal processing techniques. As computing power is improved and signal processing algorithms become more powerful, these systems will continue to break new ground.

Microphones when connected to additional processing power (Acoustic Processing Units) [HoN13] can detect acoustic events using the plethora of available sensors in DUT. These systems would detect an event (e.g., explosion, vehicle ignition), tag it with some metadata, and then forward it to a centralized server for additional processing. Devices such as these can monitor traffic density, approximate the number of people in a given space, and even identify and track specific vehicle types. Additionally, sound files from these devices have demonstrated the ability to identify which route a vehicle (or person) has travelled and in which direction [ScP13]. Even more simply, these devices can record the sounds around them to include voice communication and then forward those conversations to remote nodes for analysis. In this type of environment, every sound can be heard, recorded, and analysed.

Finally, cellular phones or other devices that connect to cellular networks provide a rich tracking capability. Each device provides an identifier to the cell nodes that it connects even if the device is not actively transmitting. This information is readily available in access logs for the cell nodes and can be used to track movements of the devices [BeC13], [RuS12]. This can help with targeting individuals. At a minimum, this technology should lead to a force protection consideration for those leaders who possess these devices.

Event Detection.  Often it is desirable in military operations to detect when certain events occur. These events could be things such as perimeter violations, detection of a target in an area of interest, or the occurrence of detonations.  On the current battlefield there already exists tools such as acoustic sniper detection/location devices and the unattended ground sensor.  However, many of these were designed for and work best in non-DUT environments where back- ground noise is limited and wave propagation models are simpler. The good news is that the density of networked sensors in DUT enables events of these types and more to be detected more easily than in other environments.

One scenario is to use the IMUs and compasses built into mobile devices to detect vehicle movement or even the occurrence of detonations (e.g., indirect fire, bombs, IEDs). [ReD13] showed that these sensors can detect and report the location and other data about earthquakes. With modified software, this could be extended to detecting large vehicle (e.g., tanks, IFVs) movement or other events that result in significant ground disturbance. A single or group of mobile devices could sense a passing vehicle through the vibrations their IMU detects and then forward that data to a central server with location and direction of travel.

Other work such as [KnP07] has demonstrated how blast events could be detected using microphones and signal processing algorithms. Once a microphone detects a blast, it adds location, time, and other metadata to an information file that is then sent to a server for further processing. Techniques such as this could be used to assist with determination of weapon accuracy and perhaps even allow for adjustment of indirect fires without an observer. Blasts could be pin-pointed to a location and compared against the target data to determine how to adjust subsequent rounds.

Movement.  It is easy to envision how attacks (cyber or otherwise) on a city’s infrastructure can impact the civilian populace and therefore hinder military operations. FM 3-06 discusses considerations for protecting or attacking these systems.  However, not as well considered is how cyber enabled devices can also assist with military operations in DUT by influencing movement. Attacks on infrastructure control systems can augment movement by providing concealment. Additionally, they can detect or create congested movement corridors that have an effect on current operations. The bottom line is that a city’s critical infrastructure must be considered during operational planning.

Critical infrastructure is often controlled via devices known as Supervisory Control and Data Acquisition (SCADA) devices. These systems provide remote, intelligent control over things such as our electrical grid, the water and gas distribution networks, and transportation systems. These systems exist in many places and with the development of the “smart city” concept, their numbers are sure to grow.  As shown in the attack on the Ukraine’s electrical grid, these systems can be vulnerable to cyber operations.  A criminal, military, or other user with access can use these systems to the advantage of an operation. Deliberate use of these systems could provide counter-mobility effects or assist with the mobility of units for an operation.

As mentioned, the electrical grid contains SCADA devices. These devices can open and close switches to control power at the sub-station-level and below. In some cases, as discussed in [HiV11], this control can be narrowed down to a particular neighbourhood or block. Couple this with an increasing number of devices known as “demand response controllers” and you have the ability to target an increasingly narrow geographic area. This ability could allow an operator to turn-off power to areas of their choosing. This could help offensive operations by creating concealment through the elimination of electrical light sources or hurt a defensive operation by severing electronic-based C2.

Along these same lines is the water distribution network. This network consists of control stations containing networked sensors with SCADA controllers [UKY16]. These controllers are connected to valves that turn the water on and off. Similar to the electrical power scenario, an operator could use these SCADA controllers and sensors to deny water to select areas, create dangerous over-pressure areas, or even create mass leakages that undermine the above ground infrastructure.

Lastly, the transportation network’s connectivity could be used to influence military movement. Traffic signals are increasingly monitored and controlled remotely. They also have increasingly powerful capabilities [Cisco][Surtrac]. The purpose is normally to alleviate traffic problems and provide data to assist with future traffic engineering. Instead, an operator could command these systems to cause congestion along a maneuver corridor or utilize the monitoring capabilities to understand movement patterns in the area as part of intelligence preparation of the battlefield.

Communications

Planning for military communications normally involves a variety of considerations (e.g., band allocations, emissions, line of sight) and covers technologies ranging from radio frequency to satellite to wired. This planning helps to ensure that friendly forces can communicate effectively and that we can detect, deny, and destroy enemy communications sources.  However the combination of new technologies and the characteristics of DUT environments should force the consideration of other aspects.

Cognitive Radios.  There is a growing research and commercial interest in cognitive radios. These devices use intelligent algorithms to sense the radio frequency environment for the purpose of providing reliable communications. These devices offer the possibility of creating communications networks using bands of frequencies that are currently restricted. The techniques vary but the general idea is that the radio communicates on empty/under-utilized frequencies and has the ability to cede the frequencies to higher priority devices upon detection of congestion. This means that a sensor network could be developed and emplaced that uses un-used television frequencies or FAA frequencies reserved for airports where none exist [JoN13].

This frequency flexibility can be useful not only in the commercial world to set- up inexpensive sensor and control networks without purchasing a license for a frequency band but also in the military domain. Frequency policies vary from nation to nation and thus production of devices and who can own them and transmit on them is controlled. The ability for the military to use radios that can alter the frequency range in which it operates could help decongest existing bands and improve communications [Elm13], [AkL06].

On the other hand, an adversary with this technology could create sensor or C2 networks in non-traditional bands thus making them hard to detect. Additionally, once identified, they technology is difficult to jam due to its sensing and intelligent channel switching. In the noisy RF environment of DUT, creating networks using this technology could make it difficult for military forces to find the enemy ‘needle in a haystack’ if you will.

Electro-magnetic Models. In the planning phases of operations, simulation tools are often used to plan communication node locations and to define the operational limits of the nodes for the forces involved.  These tools rely upon signal propagation models to predict how well a signal will be received based on a selected location. Many of these models are line of sight (LOS) based and do not model well in areas with heavy NLOS sections and the related challenges faced due to multipath signals. Additionally, many of our military C2 systems rely upon adequate reception of signals to provide reliable data (e.g., GPS).  Current systems do not reliably handle the NLOS DUT environment. Finally, the RF spectrum of DUT locations has not been well mapped for the vast array of urban environments that exist. What this spectrum looks like and how it will affect military communications is not well known.

There is a dearth of research on the effectiveness of military communications systems in DUT. How signals will propagate and the ability of systems to effectively communicate is not well characterized. One study has shown that the most common path-loss models do not accurately capture the realities of the environment [Xin15] from city to city. This is especially true in outdoor-to-indoor or indoor-to-indoor communications. Other work exploring low power transmitters such as those found in sensor networks describes the inadequacy of the models used for those devices [AlC16]. The authors propose the development of new algorithms and models to make better predictions on transmitter and receiver positioning. However, given the ever growing pervasiveness of emitting devices within an urban environment and the terrain that an urban environment presents to RF signals the ability to accurately model signal propagation, particularly deterministically, will be a fairly intractable problem for the foreseeable future.

DUT environments can be expected to have a very crowded RF spectrum. The number of transmitters is immense and includes things such as television, radio, wifi, cellular, Bluetooth, emergency services, airport and weather radars, and IOT devices. How all of these systems will impact military operations and systems is not well known. The authors of [AlT15] conducted a study to map the RF spectrum in an urban location. As expected, some bands are heavily occupied and thus jamming a system (e.g., cognitive radio network) in this region could impact many bystander systems. Additionally, they found there were many open bands in restricted ranges that could be utilized by intelligent cognitive radios. Much potential exists in the use of cognitive radios in that they can sense the environment in real time and then have the flexibility to react appropriately given that environment. However, given the uncertainty of knowing this environment ahead of time it can be very difficult to plan and coordinate the communications aspect of an operation in advance from a capacity and capability perspective.

Finally, the structures in many DUT locations create what are known as “urban canyons” where LOS dependent systems such as GPS receivers do not function well. Given the increasing reliance on GPS signals for navigation, C2, and precision weapon control access to these signals and the quality of the data therein is vital. As with many of the challenges mentioned, increasing computational power coupled with better algorithms can help. Work done by [WaG14] suggests that coupling 3-D models of DUT environments with signal processing algorithms can result in improved GPS location data in urban canyons.

Mesh and Other Networks.  As previously discussed, DUT environments are flush with network devices. They are engineered to work on purpose-built networks for specific uses. Despite this, they are not limited to just that purpose.  Ad-hoc mesh networks could be established either willingly or using malicious code to create C2 or sensor networks for an adversary.  These networks can be dynamic and resilient in the face of changing device density and operational conditions.

One must also consider the use of designed networks for operational needs. There are numerous “apps” and other software on mobile devices that create communications platforms that can perform as C2 nodes. Some of these apps even provide end-to-end encryption capabilities that provide an unsophisticated opponent communications security on par with the most technologically advanced nations. The effectiveness of these non-traditional networks has been demonstrated in public movements such as the Arab Spring where masses of people were assembled and directed via social media and other applications. Military operations in DUT must consider how to monitor and when necessary utilize these means of communications to ensure operational success.

Conclusions and Future Work

Dense Urban Terrain presents numerous challenges and opportunities to military forces due its cyber characteristics. The volume of networked devices and communications platforms offers both offensive and defensive opportunities and challenges. The intelligence and command and control capabilities that these devices offer is unparalleled in other terrain. As discussed, these devices can impact maneuver, movement, and targeting as well. Without deliberate planning by operational staffs and appropriate action, it will be difficult to conceal operations and protect high value assets. It is necessary for the military to investigate these technologies more closely, to develop techniques for mitigating/utilizing them, and to create training environments where they can be used. Given the likelihood of conducting future operations in a DUT zone, it is imperative that we prepare adequately.

The preparation for this environment of course includes continuing work on the cyber security of our networks and critical infrastructure. Many of the issues discussed can be mitigated, or taken advantage of through thorough knowledge of their cyber security and electronic properties. Training should incorporate scenarios where IOT and mobile device sensors are used offensively or defensively to alter the operation’s outcome.   Just as we learned to camouflage personnel and equipment to protect against visual detection and radars, troops need to learn how to camouflage operations from these networked sensors. Intelligence personnel need to learn about the data offered by these sensors and how to acquire that data. This can improve their IPB and their targeting. Electronic warfare units need to understand the evolving spectrum they face and the nature of the devices they will attempt to surveil or jam. Finally, continued research needs to be done to improve signal propagation models and signal processing algorithms so that planning tools and the use GPS devices within an urban environment can be improved.