I talked with @timstarks about the US MQ-9 Reaper #drone that was targeted by #Russian fighter jets yesterday. We spoke about what kinds of information could be retrieved from a drone like this should #Putin's forces get their hands on it.

Tim reached out because in researching his article, he came across the article I and Bruce Schneier wrote in May 2021 for #Brookings on how hacked drones and busted logistics are the future of war. Bruce and I were, I'm sorry to say, quite correct.

https://www.brookings.edu/techstream/hacked-drones-and-busted-logistics-are-the-cyber-future-of-warfare/

So, with Tim, I explained how the US could remotely delete data from the drone, and how that could have worked. There wouldn't be a physical way to wipe data storage on a device like that (like drilling a hole through a drive or card, or degaussing). What we often colloquially call a "remote wipe" is actually much more like taking a stick figure drawing and scribbling all over it repeatedly until the underlying picture is fully obscured.

The biggest issue is that a lack of either a transparent or accountable process for DoD acquisitions makes it difficult to say what vulnerabilities could exist in the software used by the US to reach out to and obscure the data on on that drone.

It's time to level the playing field on solely-DoD contractors and ensure that they're required, just as any of us in infosec would be, to adhere to the #CMMC instead of being exempted in their bids due to long-standing relationships.

https://www.washingtonpost.com/politics/2023/03/16/downed-us-drone-points-cyber-vulnerabilities/