Strobe Talbott Center for Security, Strategy, and Technology
The threat is real and present. In May 2023, the United States discovered one of the most extensive cyber-espionage campaigns by a Chinese hacking group in the U.S. territory of Guam.1 This attack compromised critical communication and transportation infrastructure, raising concerns that it could degrade or disrupt the Department of Defense (DOD) logistics system, thereby endangering operations and resulting in the catastrophic loss of life and property. The United States must take steps to prevent this risk by hardening the DOD logistics system against incursions and better securing its logistical data across the digital line of communication. Logistics are foundational to U.S. global power projection and the ability to provide and sustain humanitarian aid/disaster relief or armed forces operations anywhere in the world. China Sea Freight Forwarder
The current DOD approach to logistics involves deploying multiple systems to support any operation, presenting vulnerabilities. This paper will examine the vulnerabilities in the DOD logistic systems and the weaknesses of transmitting logistic information over multiple non-classified systems. The recommendations are to immediately utilize supply chain risk management (SCRM) to integrate artificial intelligence (AI), machine learning (ML), and distributed ledger technology (DLT) using blockchain and directed acyclic graph (DAG) transactions into existing systems to reduce risk and secure logistic information from external and internal attacks. This should be followed by the appointment of an executive agent with the authority to mandate a single DOD enterprise resource planning system. These actions would mitigate the DOD logistic system’s vulnerabilities, reduce opportunities for degradation or disruption by adversaries, and enable the United States to outpace adversaries and support allies now and in the future.
When a crisis happens, the DOD has logistical capabilities and systems to conduct and sustain operations in diverse environments. The primary function of logistics information is to synchronize the transportation and sustainment of people and equipment in those environments.2
Understanding the basics of the logistic supply chain process involves the movement of goods and services from raw materials to finished products delivered to customers. This process includes the various sourcing, procurement, production, and delivery stages. These stages are essential for a smooth and efficient logistic supply chain. Any disruption to one of these components can cause ripples or a tsunami throughout the entire logistic supply chain, as seen with COVID-19 impacts.
The DOD’s digital logistic system is a complex network of systems and subsystems that process and manage the Department of Defense’s supply chain. Every humanitarian and combat operation requires the DOD digital logistic supply chain systems and cyber infrastructure. These systems all include various data elements used to track and manage the movement of goods and services. Multiple data elements are in every system, with a few critical data elements found in all the DOD digital logistic supply chain systems.
These data elements enable the movement of goods and services throughout the DOD supply chain. They also manage inventory, place orders, and track shipments. The system helps ensure the DOD has a common approach to ordering material. It also helps to reduce costs and improve efficiency, except that the DOD has increased the level of risk and vulnerabilities with multiple systems.
The DOD has six major enterprise resource planning (ERP) systems. Every military department or service has developed a separate ERP software system to run its logistic operations.3 The Coast Guard uses Coast Guard Logistics Information Management System. The Department of the Air Force has an Integrated Logistics System – Supply supporting both Air and Space Forces.4 The U.S. Navy has the Naval Sustainment System5 and is separate from the Marine Corps using the Global Combat Support System – Marine Corps.6 The U.S. Army has Global Combat Support Systems Army.7 Then there is a separate system run by Defense Logistics Agency called the Federal Logistics Information System, providing information to military services, international partners, sponsored contractors, and Federal Government Entities.8 This does not account for the multiple subcomponent and feeder systems providing data to these six ERPs.
The cyber threat quickly goes from additive to exponential when involving multiple systems. The fact that the DOD lacks a single ERP system requires a multitude of systems and subsystems to deploy in support of military or disaster relief operations. Today, these multiple systems are stove-piped data silos that cannot communicate with each other, limiting the visibility of what is available or obscuring the requirements needed to be met during an operation. The current ordering process requires a request from one location to transmit data over a Non-classified Internet Protocol (IP) Router Network (NIPRNet) to a central database. This transmission of information over unclassified networks provides vulnerabilities that adversaries can leverage. Understanding how these challenges manifest in a digital logistics system is critical to mitigating vulnerabilities and assessing Supply Chain Risk Management as outlined in DODI 5200.44 “Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN).”
In 2016, China moved away from multiple self-contained systems and consolidated its military logistics into one logistic force called the Joint Logistics Support Force (JLSF).9 The JLSF manages all medical services, transportation, supply, and other logistic functions, including integrating civilian resources to enhance joint capabilities during peace and war.10 It also controls the mandated generalized logistic support across the joint force; however, services still have a role with limited specialized support to theater command operations.11 This unification of military logistics is impressive but pales in comparison to the commercial logistics platform China’s state-supported National Public Information Platform for Transportation and Logistics (LOGINK) has made.
LOGINK is a worldwide data platform with access to ports and maritime transport systems providing shipment tracking, data management, and other services free of charge.12 LOGINK established data standards and document formats that allow the collection of vast amounts of data for analytics and the execution of logistics. The platform became an international standard in April 2022 when it was recognized as a member of the International Port Community Systems Association’s Network of Trusted Networks.13 This vast organization has data on 10 billion tons of land, sea, and air cargo in transport relating to over 500 million twenty-foot equivalent units (TEU) container movements and over 50 billion estimated exchanges per year.14 The pervasiveness of China’s state-supported commercial logistics platform provides the constant monitoring of port capabilities and throughput of U.S. cargo and our allies and partners during peacetime. The LOGINK network continues to grow as more ports worldwide use LOGINK to provide greater global visibility that China can potentially access.
As China increases its control over digital logistical information, it is also taking control of physical logistics infrastructure worldwide and important terminals in the United States. China Ocean Shipping Company (COSCO) operates the Seattle, Long Beach, and Los Angeles seaport terminals. COSCO oversees all the U.S. cargo transiting these ports. Multiple TEU movements moving globally contain U.S. military materials, and logistic data could predict current or future operations. Adversaries could cause a key delay in support or disruption of critical logistics during a crisis, endangering operations and costing lives. This real-time visibility generates considerable vulnerabilities for U.S. operations and logistics.
These logistical capabilities use digital data to enable the entire logistic supply chain process. However, these capabilities are also vulnerable to attack with the information and data all traveling on NIPRNet. In the past decade, there have been direct attacks against military logistic systems and civilian infrastructure critical to military operations. In 2012 and 2013, for example, Chinese military hackers penetrated U.S. Transportation Command’s systems and stole valuable information.15 Additionally, a transnational criminal organization assaulted and ransomed the Colonial Pipeline, in the United States, with a cyberattack in 2021, shutting down the entire pipeline that transports 2.5 million barrels of fuel daily.16
The attacks will continue. Indeed, in May 2023, officials at Microsoft working with U.S. organizations identified that a China state-sponsored hacking group penetrated telecommunications and transportation hubs and other critical infrastructure areas in the U.S. territory of Guam.17 These types of attacks could degrade or disrupt communications and logistic systems in times of crisis leading to a loss of life and property.
The digital environment is a global network exposing DOD systems, networks, and devices connected, defined as the Internet of Things (IoT), to threats worldwide.18 This environment must always be considered a contested environment where hostile actions will occur. The DOD must be able to defend against these threats from anywhere in the world as our logistics capabilities continue to evolve in this digital environment. Further, the DOD must be able to identify and adapt to immediate environmental changes and adversarial threats using supply chain risk management. The environment’s inherent complexity makes securing all these systems and networks difficult; the issue is compounded by the fact that DOD has outdated technology and slow acquisition timelines, which creates even more vulnerabilities.19 Network-based gaps and people are the most significant challenges to our trusted systems and networks in the logistics chain.
People are often the weakest link in the security chain. Employees can make mistakes that can lead to security breaches. The DOD must educate all its employees on security best practices to reduce the risk of human error. Malicious actors, including nation-states, terrorist organizations, lone-wolf hackers, and criminal groups, constantly attack the DOD. These actors continually develop new and sophisticated methods to exploit vulnerabilities in DOD systems and networks.
People are often the weakest link in the security chain. Employees can make mistakes that can lead to security breaches. The DOD must educate all its employees on security best practices to reduce the risk of human error.
This danger also includes the insider threat, where an employee or contractor with authorized access to systems uses that access to steal data or damage systems. Entry into these systems uses only a DOD common access card and a personal identification number,20 but even this two-factor system is hackable. A hack can exploit system vulnerabilities or use social engineering techniques to trick someone into giving up their credentials to provide unauthorized access with a phishing attack. Once an unauthorized user gains access, a data breach can occur, stealing sensitive data or, potentially worse, data corruption. Data corruption can be the most difficult to detect since an adversary doesn’t steal anything but makes unwanted changes in information during processing, transmission, or storage. Data corruption could be small as changing the reorder point on a nonessential item with negligible impact up to causing critical items, such as fuel or munitions, not to reorder or be sent to the wrong location, causing a loss of life, or stopping an operation due to lack of supplies.
To secure the future logistics enterprise, all users must be aware of these risks and take steps to mitigate them. The DOD’s logistical capabilities are critical to the success of its operations and are vulnerable to attack. The DOD must prioritize access control, data loss prevention, and encryption to better secure U.S. logistical data across the digital line of communication.
The DOD must take the next step to adopt innovative technologies to help it secure its information. The most promising technologies include artificial intelligence, machine learning, and distributed ledger technology to secure data and transactions in blockchain or as a directed acyclic graph. The technology must also perform when transmitting and receiving data in an intermittent cyber environment. Connectivity is never guaranteed, even in nonhostile environments.
Systems can implement access control at the user, application, and network levels to improve security. There are various methods, such as passwords, security tokens, and biometrics. The continued escalation of security requirements drives the DOD to establish a zero-trust environment in all the DOD systems.
The Zero Trust Cybersecurity Strategy is “never trust, always verify.”21 Instead of having a trusted agent that can freely roam the network, Zero Trust network access constrains the user. Zero Trust will allow users the least access and pathway options required to accomplish their tasks. These limited options are known as the minimization of pathways to resources. The user should only have the authority to access the data level required for their task and nothing more. As the user moves from the entrance portal of the system toward their destination, the verification process will be mandatory and deny access if the user tries to venture outside the set access security boundaries. The user’s authentication will be at the entrance to the system, again reaching the level of information required, and again as they access data. This method of setting access security boundaries to limit traffic is known as the micro-segmentation of the network. It enables monitoring and controlling of each segment of the network.22 Artificial intelligence and machine learning can log and analyze users’ data movements to flag abnormal behavior.
AI is a powerful tool for identifying and mitigating cyber threats. AI can detect and analyze cyber threats by examining large volumes of data from multiple sources, such as network traffic, system logs, and user behavior. Utilizing AI algorithms to identify patterns in this data can detect potential threats early before considerable damage occurs. AI can incorporate behavioral analytics to determine abnormal network traffic or user activity behavior, detecting potential cyber threats by identifying those that deviate from everyday patterns. System configuration can allow the AI to automatically respond to cyber threats by deploying real-time security measures. For example, AI can isolate infected systems, block malicious traffic, or quarantine suspicious files. The system’s AI can conduct surveillance 24/7 without human interaction. This continuous surveillance to gather and analyze threat intelligence data enables AI to add additional information on new malware or known hacking groups. Using AI to analyze this data enables the DOD to stay ahead of emerging threats and implement countermeasures to protect against them. By using AI automation for threat detection and response, organizations can reduce the risk of external cyberattacks and internal threats allowing for better protection of valuable data and assets.
Machine learning, a subfield of AI using algorithms, automates identifying and mitigating cyber threats by analyzing large volumes of data and identifying patterns indicative of malicious activity.23 By analyzing large volumes of data, ML algorithms can identify patterns that deviate from the norm and flag them as potential threats. For example, suppose an employee who typically logs in from a specific IP address suddenly starts logging in from a different country; the ML algorithm may flag this as a potential threat. ML algorithms can also predict the likelihood of future cyberattacks by analyzing historical data on cyberattacks to identify patterns. This information can prioritize security measures and allocate resources accordingly. Training ML algorithms to identify malware by analyzing its code and behavior on large datasets of known malware samples will allow it to learn to recognize patterns in the code and malicious software behavior. The algorithms analyze user behavior and identify potential insider threats by monitoring user activity and flagging abnormal behavior as a potential insider threat. For example, if an employee suddenly starts accessing sensitive files they do not usually have access to, the ML algorithm can learn to flag this as a potential insider threat.24 This situation can trigger an automatic lockout of the user once conditions meet the established thresholds on information generated by ML algorithms. This feature must also adapt to identify users in deployed locations and provide access.
AI and ML technologies, in tandem, utilizing supply chain risk management, can gain enhanced situational awareness, conduct predictive analytics, and reduce risk. They both analyze historical supply chain data and can predict future trends and events. They can monitor in real-time, identifying patterns and anomalies in data and exposing potential issues as they arise. This better prepares organizations for potential disruptions or delays. They also incorporate sensors, IoT devices, and other data sources to collect inventory levels, delivery times, and other vital metrics. Based on this information, both can assess supply chain risks and prioritize actions to mitigate those risks. The analysis would include identifying supply chain vulnerabilities, the impact of potential disruptions, and developing contingency plans to address those disruptions. Using real-time observations and risk mitigation, they provide decision support to supply chain personnel, helping them make more informed decisions based on real-time data and predictive analytics. Utilizing both optimizes supply chain processes and reduces inefficiencies. This process could include automating demand forecasting, inventory management, and logistics planning to reduce the risk of human error and improve efficiency not currently realized.
AI and ML can identify patterns and anomalies humans may miss and help organizations respond more quickly and effectively to potential threats. By leveraging these technologies, supply chains and logistic systems can gain enhanced situational awareness and improve their ability to respond to disruptions and changes that might degrade the system.
AI and ML can identify patterns and anomalies humans may miss and help organizations respond more quickly and effectively to potential threats. By leveraging these technologies, supply chains and logistic systems can gain enhanced situational awareness and improve their ability to respond to disruptions and changes that might degrade the system. However, successfully implementing AI and ML in supply chains requires careful planning and execution, including developing appropriate data governance and security policies and training personnel to use these technologies effectively.
DLT is a system for recording transactions and tracking assets in a way that makes it impossible or difficult to change, cheat, or hack the system. A distributed ledger is a shared and synchronized database across multiple computers and locations providing redundancy and interoperability of data. DLT has various purposes, including tracking financial transactions, recording property ownership, and managing supply chains. Large-scale companies, from Alphabet to Walmart, utilize this technology to provide a secure and transparent way to record transactions.25 DOD logistics requires this same capability.
There are two main types of DLT: permissionless and permissioned. Permissionless DLT is a system open to anyone wanting to participate. No central authority controls the network; all participants have an equal say in its contents. Bitcoin is an example of an open/decentralized DLT. Permissioned DLT is a system controlled by a single entity. A central authority controls the network, and all participants must agree to the terms of the network before they can participate. De Beers has been using a permissioned DLT called “Tracr” to track diamonds.26
Both permissionless and permissioned DLT have their advantages and disadvantages. Permissionless DLT is more secure and transparent but can be more challenging to scale. Permissioned DLT is easier to scale but less secure and transparent. The type of DLT that is best for a particular application will depend on the specific needs of the application.
In a crisis, a DLT shared and synchronized across multiple computers eliminates a single point of failure, providing resiliency and flexibility. DLT can add and delete nodes as required per operation and capabilities needed across a network. This secure and transparent way to record and track data will require adversaries to monitor multiple points and expend more resources than traditional systems require.
DLT has several potential benefits, including:
However, there are also several challenges associated with DLT, including:
The DOD should focus on two types of DLT. Blockchain and directed acyclic graph (DAG) are different technologies that utilize distributed ledger systems. There are differences in structure, consensus mechanism, scalability, and security.
Blockchain is a linear data structure, commonly used by the commercial sector, that stores data in blocks linked together in a chronological chain. Each block contains a list of transactions and a reference to the previous block in the chain. Conversely, a DAG is a non-linear data structure that does not use blocks or chains. Instead, a DAG arranges transactions in a directed acyclic graph, resembling a spider web, where each transaction links to multiple previous transactions.
Both blockchain and DAG rely on consensus mechanisms to ensure the ledger’s integrity. However, the consensus mechanisms used in blockchain and a DAG differ significantly. Blockchain achieves consensus through proof-of-work, proof-of-stake, or other mechanisms that require miners to solve complex mathematical problems. A proof-of-work mechanism has the miner solve a mathematical puzzle to prove they created a new block before adding a new block.28 Proof of stake differs with miners required to own native coins to compete in validating new blocks. These owners will stake their coins for a chance to validate blocks. This validation is a lottery, so one entity cannot monopolize the process.29 A DAG takes a different approach by achieving consensus through a voting system by the nodes, where each transaction verifies two previous transactions before adding it to the ledger.
As mentioned previously, one of the main challenges of blockchain is scalability. As the number of transactions on the network increases, the blocks’ size also increases, leading to longer confirmation times and higher fees. A DAG, on the other hand, is designed as more scalable than blockchain. Because DAG transactions process in parallel, it can manage a more substantial number of transactions without the same increase in size.
Both blockchain and DAG designs are secure against attacks such as double-spending and tampering. However, the security properties of these two technologies are different. In a blockchain, security requires the assumption that a majority of the nodes in the network are honest. In a DAG, security requires the assumption that a majority of the transactions in the network are legitimate. Overall, blockchain and a DAG are different technologies with different strengths and weaknesses. While blockchain is more widely used and better understood, DAG offers unique scalability and transaction processing speed advantages.
The U.S. Air Force has taken the initiative with blockchain. The most recent was in February 2023 when it selected the company SIMBA for a $30 million initiative to progress its blockchain development. This will go toward developing applications powered by blockchain for supply chain management.30 There is no functioning military application at the time of this paper’s publication, but multiple commercial logistic companies and major Chinese-owned and-operated shipping companies are utilizing blockchain.
Global logistics companies DHL and UPS use blockchain to create more efficient and secure supply chains. DHL launched a blockchain-based solution that allows customers to track the location and status of their parcels in real time, improving supply chain transparency and reducing fraud.31 UPS joined the Blockchain in Transport Alliance (BiTA), a group of companies developing blockchain standards and solutions for the transportation industry. This powerful technology already has enticed over 300 companies to apply for BiTA membership to improve the tracking of high-value items during shipping.32 It is incredible that now an internet connection from anywhere in the world can use blockchain to track the movement of goods across the globe. As more logistics companies adopt blockchain technology, we can expect to see more innovative solutions emerge.
China’s Global Shipping Business Network (GSBN), a technology consortium, is leading in blockchain utilization in the maritime shipping domain. GSBN, based in Hong Kong, has a blockchain governance platform that includes COSCO and German shipping company Hapag-Lloyd as its partners. These companies are ranked fourth and fifth in the shipping industry, giving this conglomerate control over the largest collaborative blockchain in the shipping industry.33 GSBN has global ambitions to continue to grow and attract other companies to join this venture. This type of partnership, controlled by the Chinese, could be detrimental to the United States and its partners in times of crisis that require transoceanic shipping.
As blockchain continues to mature, a DAG is an innovative technology that still needs development, testing, and evaluation. There are currently few examples of logistics companies using DAG technology in their operations. However, multiple projects and initiatives are exploring the potential of a DAG for logistics and supply chain management.34 IOTA is a company that uses a DAG-based distributed ledger called the Tangle.35 The Tangle is lightweight and scalable by design, making it well-suited for logistics and supply chain management. IOTA has partnered with multiple companies in the logistics industry, including Jaguar and Zebra, to develop use cases for the Tangle.36 As technology continues maturing and identifying new use cases, we expect to see more logistics companies exploring the potential of a DAG for supply chain management due to its scalability, non-linear applications, and resiliency.
In evaluating solutions, it is evident that not all of them need to be innovative or at the cutting edge. The DOD should conduct regular security audits of its supply chains to identify vulnerabilities and ensure that they implement the correct encryption protocols. Independent third-party auditors should conduct these reviews to ensure impartiality. The DOD should also provide training and education to supply chain personnel on the importance of encryption and how to implement encryption protocols properly. This training must be mandatory for all supply chain personnel and include regular refresher courses to ensure that all personnel are current on the latest security best practices. By taking these steps, the DOD can better secure its supply chains against cyber threats and ensure the integrity of its logistical data.
The Department of Defense faces multiple challenges in conducting and sustaining operations over unclassified/NIPRNet systems in contested environments. These challenges include protecting logistical data from cyber threats, ensuring the integrity of supply chains, and maintaining situational awareness in complex operational environments. There is concern about China’s military logistic capabilities and actual threats in the commercial sector, with the U.S. military lagging behind the Chinese commercial advancement in LOGINK logistic systems and blockchain, as discussed.
The DOD must invest in technologies for enhanced situational awareness in complex operational environments and across the IoT. This includes employing artificial intelligence and machine learning to incorporate sensors, unmanned systems, and advanced analytics to monitor real-time logistical data and detect anomalies that could indicate external or internal security threats.
Information protection of data can improve dramatically by using blockchain and DAG technology. Distributed ledger technology enhances the security and transparency of logistical data. The DOD could create an immutable record of all transactions in the supply chain, making it easier to detect and prevent fraud and ensure the integrity of supply chains. The DOD could also automate the execution of logistical processes, reducing the risk of human error and increasing efficiency.
The DOD’s logistical capabilities in contested environments will require a multifaceted approach to secure its digital logistics data under attack in the cyber domain. This requires robust training of personnel to limit vulnerabilities. Plus, implementing access control, data loss prevention, and encryption utilizing robust security protocols with advanced artificial intelligence, distributed ledger technology, and machine learning technology integrated into a single DOD ERP system. The United States must convert to a single DOD enterprise resource planning system to mitigate vulnerabilities, reduce risk, improve security, and gain efficiencies.
That ERP system must have an executive agent that utilizes supply chain risk management, constantly assesses vulnerabilities, and has the authority over other DOD services and DOD agencies to control and implement a single system. This authority extends to the control of the system, including approval of artificial intelligence, distributed ledger technology, machine learning technologies, and any security software interfacing or connecting to the ERP. The executive agent has the final authority to approve application compatibility with the logistics ecosystem after testing and to force the change of current DOD logistic business processes to conform to the business processes of the chosen ERP software. This prevents the customization and lack of leadership alignment that cost the U.S. Air Force eight years and over $5 billion spent with Oracle and Accenture.37 The leading candidates for the executive agent are the Defense Logistics Agency or U.S. Transportation Command based on capability. Leading vendors for the ERP from this research are in alphabetical order, and not the priority for consideration: Infor, Microsoft Dynamics 365 for Finance and Operations, Palantir, and SAP S/4Hana.38
The DOD must immediately start utilizing supply chain risk management to integrate artificial intelligence, machine learning, and distributed ledger technologies into existing systems to reduce risk and secure logistic information from attacks.
The DOD must immediately start utilizing supply chain risk management to integrate artificial intelligence, machine learning, and distributed ledger technologies into existing systems to reduce risk and secure logistic information from attacks. The next step is appointing an executive agent with the authority to mandate a single DOD enterprise resource planning system to reduce vulnerabilities and incompatibilities with multiple systems. These actions would mitigate vulnerabilities of the DOD logistics system and reduce opportunities for degradation or disruption by adversaries, enabling the United States to outpace adversaries and support allies now and in the future.
Brad McNally, Marcos A. Melendez III, Jason Wolff
Strobe Talbott Center for Security, Strategy, and Technology
Sarah Kreps, Paul Lushenko, Keith Carter
Amy J. Nelson, Gerald L. Epstein
Get the latest from Brookings
Cheap Shipping The Brookings Institution is a nonprofit organization based in Washington, D.C. Our mission is to conduct in-depth, nonpartisan research to improve policy and governance at local, national, and global levels.