The unshakable fortress: Hacks, leaks, and pentagon bug bounty programs
What do a 15-year-old hacker, Julian Assange, inattentive administrators, and the War Thunder forum have in common? They were all involved in data leaks from the Pentagon. This article will explore several of the most prominent examples of leaks linked to one of the world's most secure agencies, as well as discuss the experience of interaction between the U.S. Department of Defense and ethical hackers.
Jonathan James
According to the U.S. Department of Defense, the first hacking of the Pentagon occurred in 1999 by a 15-year-old named Jonathan James, known among hackers as C0mrade. Jonathan found a server with a backdoor that allowed anyone to connect. He connected to the server, installed a sniffer, and gained access to all the traffic. This server belonged to a unit of the Department of Defense. Within a month, the boy intercepted numerous credentials, which he used to access the Department of Defense computers and download a vast amount of emails from Pentagon employees' mailboxes. Jonathan did all this not for personal gain but out of simple curiosity. Naturally, the intrusion was noticed, investigated, and the juvenile perpetrator was found. Jonathan's case is unique because he became the first minor in the U.S. to go to jail specifically for hacking.
Gary McKinnon
Two years after Jonathan James's story, another young hacker managed to breach this fortress alone. In January 2001, Gary McKinnon, a systems administrator from London, first broke into the American military computer system. Instead of wondering "how to hack the Pentagon," he simply found a flaw in the security system. Gary created a Perl program that identified administrator-status computers without a password. To the U.S. military ministry's embarrassment, there were many such machines. For 13 whole months, Gary studied the contents of Pentagon and later NASA computers unpunished. He was searching for evidence of extraterrestrial life and, according to him, found it. A year after his first intrusion, Gary was exposed, but he managed to avoid responsibility because a wave of protest arose, and the UK authorities did not extradite him to the U.S.
Julian Assange
Discussing whether the Pentagon was hacked, one cannot overlook Julian Assange, the founder of WikiLeaks. Since 2006, the portal has been publishing classified materials from the Pentagon and other U.S. law enforcement agencies. It is not known for certain whether Assange hacked government servers himself or if he received documents from third parties. But as the creator and distributor of information, he faces numerous charges, with a total criminal sentence of 175 years of imprisonment.
Edward Snowden
To extract and publicize classified Pentagon documents, hacking is not always necessary. Sometimes the danger lies within the employees themselves, who disagree with the methods of the military ministry. The most striking example is Edward Snowden. In 2013, he was an employee of the military system and had access to classified documentation. He learned about the massive U.S. surveillance of citizens of various countries around the world. Deciding to disclose the data, Snowden downloaded nearly 2 million secret documents onto a flash drive and took it out of the NSA office hidden in a simple Rubik's Cube. Then came the publications in the world media, major disclosures, accusations of espionage, fleeing the country, and a safe haven in Russia. It should be noted that there was also no selfish motive in this case.
Case of Jack Teixeira
In 2023, a loud scandal erupted related to the leak of classified Pentagon documents. Their photos appeared on the Discord platform, the 4Chan forum, Twitter, and some Telegram channels. Initially, it was thought that the Russians had hacked the Pentagon, but it later turned out that the leak was again related to a person working in the system and having access to secret information. Later, the world was shocked by footage of the arrest of Jack Teixeira—an Air Force pilot in red shorts being led by heavily armed American special forces. The information published by Teixeira contained secret documents concerning the conflict in Ukraine and revealing U.S. surveillance of partner countries. Jack was accused of espionage and now faces many years in an American prison.
Curious Cases
There have been many curious cases in the history of the Pentagon and similar agencies that led to the disclosure of official information. For example, last year a story surfaced about a typo that caused letters from the U.S. Department of Defense to go to mail addresses in Mali for years. Confidential information about U.S. (and French) military technology often surfaced on the War Thunder game forums so frequently that moderators had to publicly explain why their forum became a treasure trove of secret drawings. The U.S. military department did not overlook careless administrators either. Data can be found on at least one case when an unprotected Pentagon server with sensitive information was "shining" online for a long time. There are probably more such unpublicized incidents.
Pentagon and ethical hackers
If the human factor problem is solved by tightening internal policies toward employees, the Pentagon website and the entire U.S. Department of Defense infrastructure are protected by ethical hackers. As early as 2016, a government vulnerability search program called Hack the Pentagon was launched on the HackerOne platform. More than 100 potential breaches in ministry defense were discovered, and over 1,400 pentesters participated in the project. The number of participants is easily explainable. First, hacking the Pentagon online is the dream of any hacker. Secondly, the first bug bounty program of the Ministry of Defense was conducted on a paid basis. Individual payouts ranged from $100 to $15,000, with a total budget of $75,000. The next program was conducted in 2018 and focused on publicly accessible websites of the Ministry of Defense.
By the end of 2020, the department was hacked more than 12,000 times, but within controlled tests. Hackers were no longer paid for finding vulnerabilities but were awarded points on the HackerOne platform. The start of the third bug bounty program of the Pentagon was announced in 2023. But this time, hackers were invited to try to penetrate systems that control mechanical operations, such as heating and air conditioning in the main building, the Pentagon's heating and cooling installation, a modular office complex, and a parking lot. The task of the hackers is to identify weaknesses and vulnerabilities and provide recommendations for improving and strengthening the overall security situation.
Conclusion
It is naive to think that in the modern world there are objects that simply cannot be hacked. And the Pentagon is no exception. Today we have told only a few stories related to hacking and data leakage from the U.S. military department. But there are many more incidents that have not been publicly disclosed. Meanwhile, the Pentagon does not close itself off and actively uses external specialists to find vulnerabilities and weak spots in the system. This is the right tactic that helps the ministry improve its cybersecurity and respond more intelligently to attempts at penetration.
