Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've read the Wikipedia articles on SIPRNet and NIPRNet (which are pretty light on details) and they are supposed to be considered separate. At the network level, are they technologically incompatible or is there a high-level of human involvement to keep them unlinked and essentially airgapped?

Does SIPRNet run on its own fibre/cable/satellites/infrastructure or is it encapsulated with strong encryption running over public infrastructure? (I suspect it is both depending on the context and the speed at which secure comms need to be set up?)

share|improve this question
3  
How about we don't discuss potentially classified information on an open forum? –  Marcin Jan 7 '12 at 3:34
6  
@Marcin Why not? Only an issue if you have clearance and divulge classified info. The general public is welcome to speculate or share what we learn. –  Jeff Ferland Jan 7 '12 at 3:39
2  
Because if some info is actually classified, then viewing it on your normal computer makes your computer classified, and thus subject to being taken away for 'cleansing'. Or worse yet, the govt would ban access to StackExchange sites, preventing workers from a fantastic resource. –  Marcin Jan 7 '12 at 14:28
1  
In my country, freedom of speech and freedom of press are very important. While giving secrets away may be illegal, it is not illegal to publish and discuss them after they have been given away. A couple of years ago, the police raided the office rooms of a newspaper in order to learn about the source. The highest court ruled that this raid was violating the constituion. This site has an international target group, so it is up to each person to obey to their respective laws, (unless the StackExchange company takes actions as a hosting provider). –  Hendrik Brummermann Jan 7 '12 at 20:39
1  
Marcin, what you say is not correct. I don't think you understand how classification works (that's certainly not how it works in the US). –  D.W. Jan 3 '13 at 21:06

5 Answers 5

up vote 8 down vote accepted

According to this Web page, SIPRNet and NIPRNet are supposed to be air gapped (both from each other, and from the rest of the World). However, they are also accessible from various locations around the World, under control of several countries (it is documented that some services from a pool of countries, which includes Australia, New Zealand, Canada and United Kingdom, have access to SIPRNet and NIPRNet).

If SPIRNet and NIPRNet were really, physically air gapped worldwide, then this would imply that:

  • all communications are over wires (no radio, no satellite link);
  • there are dedicated wires just for that, including both worldwide submarine communications cable and terrestrial cables.

Considering that installing a submarine communication cable cannot be discreet in any way (and the list of such cables appears to be public knowledge), that the cost would be tremendous, and that Bradley Manning, alleged source of some classified information which was published on WikiLeaks, had access to SIPRNet from a facility located in Baghdad, one can deduce that the air gap is not thorough. It probably means that within a given facility the networks are physically apart from each other, and no computer is ever connected to both SIPRNet or NIPRNet, and some other network; on the other hand, data which exits such secured facilities is most probably heavily encrypted and conveyed over links which are shared with the rest of the World (at least US tax payers fervently hope that encryption is properly applied).

share|improve this answer
    
I suspected it couldn't really be airgapped due to the need for one-way data cables like this: datadiode.eu/products. I was curious whether the US mil (well, any military actually) had invested in creating products to physically prevent/prohibit data transfer. I guess if products like the above exist, then there are many more advanced ones as well that we don't know about. –  logicalscope Jan 7 '12 at 18:26
    
I've never used either one, but from talking to people who would know, I believe this is the correct answer. The networks are physically separated within a facility to discourage copying between them, meaning you might have 2 or 3 computers on your desk (internet, NIPR, and SIPR). This picture captures it well: en.wikipedia.org/wiki/File:Intel_GreenDoor.jpg. Outside of the facility, traffic is encrypted and transferred over the public internet – basically, just fancy names for a VPN. –  mehaase Mar 6 at 21:36

I've decided to answer my own question with my own speculation and digging.

Can the SIPRNet be physically distinct? Of course. Small networks can spring into existence without needing existing infrastructure all the time. Large networks are more of an issue. Telecomm companies around the world will lay a physically distinct cable for an outrageous fee. Something tells me that any significant military can also get the appropriate permits to lay their own cabling. Google is trying to purchase the rights to unused so-called "dark fibre" -- though that article is 6 years old, the thought remains the same.

But, for a network with global reach -- and as @TomLeek points out -- there are things that cabling cannot be used for. Satellite networks, mobile forces, and physically separated environments will need some form of through-the-air communications channel.

Because of the need for wireless communications and possibly because laying their own wires is cost-prohibitive (really?), not possible, provides no additional physical security over wireless, etc. a significant military power could share "public" infrastructure resources. It is likely such usage is only for low classified information transfer. In any event, any communications is going to be heavily encrypted using encryption algorithms and techniques that may not even be known (public/private key encryption was developed by signal intelligence researchers before DH and RSA were produced).

What I was really more interested in -- and the question was unfortunately worded -- was whether two separate networks -- SIPRNet and NIPRNet -- are technologically incompatible. All evidence points to "no, but". Any technological incompatibility would have to occur at the network edges (and definitely in layers, at that). The existence of products like a certified one-way cable hints at other physical mechanisms to ensure that non-secret and secret networks remain in a one-way relationship (information can be easily classified, but classified information is very difficult to declassify; eg. Bell-LaPadula: no read up, no write down). The existence of data-loss prevention software is a commercial realization of something that is likely already in effect in military organizations.

I think possibly more interesting is how three computers sitting on a desk remain separated. Are SIPR data cables physically locked into the data jack in the NIC? Do SIPR computers have no peripherals? I'd hazard a guess and say "yes" and "yes". Are the SIPR data jacks physically different? Maybe. I'd be interested to know the true answer to this which I don't think is classified information since there appears to be some reference to "SPIRNet RJ45" connectors in publically available military spec hardware products.

The following doc points to perhaps more of a policy-driven behaviour for attaching SIPRNet computers rather than a technological one. I also found that the following doc to be very interesting from a holistic view and this one to be interesting from a full design perspective of an installation.

All of these links and docs were found via Google. None are marked as classified which tells me that the separation mechanisms are probably working. ;-)

share|improve this answer
    
Lots of interesting questions. I think you give them too much credit. Keep in mind it's still a top-down bureaucracy led by aged men who don't know diddly about cutting edge technology. The military uses Sharepoint, Exchange, and WSUS, just like everybody else. My guess is that the separations between classification levels aren't nearly as sophisticated as our imaginations want them to be. (Although that may have begun to [slowly] change since Manning/Snowden.) –  mehaase Mar 6 at 21:41

Here is how it works: The SIPRnet and NIPRnet are two different things for a reason! SIPRnet is used for classified information, anyone who has access to it has a Secret (or higher) security clearance. The NIPRnet is used on most (if not all) government computers which handle unclassified (but FOUO) material, since it is unclassified it has global internet access. The SIPRnet does have internet access, but not the World Wide Web, but a government version of the internet for classified material. Its not that they are not compatible, they just dont want the two to be compatible. Same reason JWICS is not connected to SIPR, it is a top-secret run system.

share|improve this answer
    
You can view FOUO on NIPRnet computers. SIPRnet and NIPRnet are two different networks. –  Ramhound Sep 20 '12 at 14:15

NIPRnet is its own discrete network, using leased dedicated lines and encrypting all traffic before it hits the demarcation. SIPRnet may be encrypted and tunneled over NIPRnet or have its own discrete dedicated line that is encrypted.

SIPRnet on a local installation is encrypted on each line going to each building and decrypted there. JWICS can be tunneled over SIPRnet or have its own discrete dedicated and encrypted line. There are a lot of specifics involved that are sensitive in nature and irrelevant to the discussion at hand.

The long and short is, NIPRnet is encrypted and all traffic to the Internet passes through DISA routers, firewalls, and IPS/IDS systems at the national level at various locations. DISA could easily disconnect Internet access from NIPRnet if it became necessary, and the network would be exclusively military and government, with no Internet communication possible. So, DoD networks CAN be physically their own network or be tunneled by certain specified encryption methods over another network. However, all DoD traffic travels over DoD circuits, which are dedicated line based, frequently fiber lines.

All of this is available unclassified in the public domain, but there is no central information repository.

share|improve this answer

Yes. It is physically or cryptograpically seperated from the public internet.

share|improve this answer
2  
While this does technically satisfy the question would you care to elaborate? Provide some documentation or other validation? –  Scott Pack Aug 14 '12 at 1:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.