I've read the Wikipedia articles on SIPRNet and NIPRNet (which are pretty light on details) and they are supposed to be considered separate. At the network level, are they technologically incompatible or is there a high-level of human involvement to keep them unlinked and essentially airgapped?

Does SIPRNet run on its own fibre/cable/satellites/infrastructure or is it encapsulated with strong encryption running over public infrastructure? (I suspect it is both depending on the context and the speed at which secure comms need to be set up?)

  • 4
    How about we don't discuss potentially classified information on an open forum?
    – Marcin
    Jan 7, 2012 at 3:34
  • 17
    @Marcin Why not? Only an issue if you have clearance and divulge classified info. The general public is welcome to speculate or share what we learn.
    – Jeff Ferland
    Jan 7, 2012 at 3:39
  • 3
    Because if some info is actually classified, then viewing it on your normal computer makes your computer classified, and thus subject to being taken away for 'cleansing'. Or worse yet, the govt would ban access to StackExchange sites, preventing workers from a fantastic resource.
    – Marcin
    Jan 7, 2012 at 14:28
  • 4
    @Marcin, there are a lot of countries out there that use censorship of this or that reason (e.g. education of sexuality, discussions on human rights, democracy, non-mainstream sexuality, religion, crimes against humanity committed by the government, ...), and all of them will argue that their reasons are perfectly legal. As far as I can tell, this is a valid question. Beside the censorship issue, there is the second issue that the StackExchange company is based in the same country. But that is up to their legal department to decide, if they should apply self censorship. Jan 7, 2012 at 20:12
  • 7
    Marcin, what you say is not correct. I don't think you understand how classification works (that's certainly not how it works in the US).
    – D.W.
    Jan 3, 2013 at 21:06

5 Answers 5


According to this Web page, SIPRNet and NIPRNet are supposed to be air gapped (both from each other, and from the rest of the World). However, they are also accessible from various locations around the World, under control of several countries (it is documented that some services from a pool of countries, which includes Australia, New Zealand, Canada and United Kingdom, have access to SIPRNet and NIPRNet).

If SPIRNet and NIPRNet were really, physically air gapped worldwide, then this would imply that:

  • all communications are over wires (no radio, no satellite link);
  • there are dedicated wires just for that, including both worldwide submarine communications cable and terrestrial cables.

Considering that installing a submarine communication cable cannot be discreet in any way (and the list of such cables appears to be public knowledge), that the cost would be tremendous, and that Bradley Manning, alleged source of some classified information which was published on WikiLeaks, had access to SIPRNet from a facility located in Baghdad, one can deduce that the air gap is not thorough. It probably means that within a given facility the networks are physically apart from each other, and no computer is ever connected to both SIPRNet or NIPRNet, and some other network; on the other hand, data which exits such secured facilities is most probably heavily encrypted and conveyed over links which are shared with the rest of the World (at least US tax payers fervently hope that encryption is properly applied).

  • I suspected it couldn't really be airgapped due to the need for one-way data cables like this: datadiode.eu/products. I was curious whether the US mil (well, any military actually) had invested in creating products to physically prevent/prohibit data transfer. I guess if products like the above exist, then there are many more advanced ones as well that we don't know about. Jan 7, 2012 at 18:26
  • 4
    I've never used either one, but from talking to people who would know, I believe this is the correct answer. The networks are physically separated within a facility to discourage copying between them, meaning you might have 2 or 3 computers on your desk (internet, NIPR, and SIPR). This picture captures it well: en.wikipedia.org/wiki/File:Intel_GreenDoor.jpg. Outside of the facility, traffic is encrypted and transferred over the public internet – basically, just fancy names for a VPN. Mar 6, 2014 at 21:36

I've decided to answer my own question with my own speculation and digging.

Can the SIPRNet be physically distinct? Of course. Small networks can spring into existence without needing existing infrastructure all the time. Large networks are more of an issue. Telecomm companies around the world will lay a physically distinct cable for an outrageous fee. Something tells me that any significant military can also get the appropriate permits to lay their own cabling. Google is trying to purchase the rights to unused so-called "dark fibre" -- though that article is 6 years old, the thought remains the same.

But, for a network with global reach -- and as @TomLeek points out -- there are things that cabling cannot be used for. Satellite networks, mobile forces, and physically separated environments will need some form of through-the-air communications channel.

Because of the need for wireless communications and possibly because laying their own wires is cost-prohibitive (really?), not possible, provides no additional physical security over wireless, etc. a significant military power could share "public" infrastructure resources. It is likely such usage is only for low classified information transfer. In any event, any communications is going to be heavily encrypted using encryption algorithms and techniques that may not even be known (public/private key encryption was developed by signal intelligence researchers before DH and RSA were produced).

What I was really more interested in -- and the question was unfortunately worded -- was whether two separate networks -- SIPRNet and NIPRNet -- are technologically incompatible. All evidence points to "no, but". Any technological incompatibility would have to occur at the network edges (and definitely in layers, at that). The existence of products like a certified one-way cable hints at other physical mechanisms to ensure that non-secret and secret networks remain in a one-way relationship (information can be easily classified, but classified information is very difficult to declassify; eg. Bell-LaPadula: no read up, no write down). The existence of data-loss prevention software is a commercial realization of something that is likely already in effect in military organizations.

I think possibly more interesting is how three computers sitting on a desk remain separated. Are SIPR data cables physically locked into the data jack in the NIC? Do SIPR computers have no peripherals? I'd hazard a guess and say "yes" and "yes". Are the SIPR data jacks physically different? Maybe. I'd be interested to know the true answer to this which I don't think is classified information since there appears to be some reference to "SPIRNet RJ45" connectors in publically available military spec hardware products.

The following doc points to perhaps more of a policy-driven behaviour for attaching SIPRNet computers rather than a technological one. I also found that the following doc to be very interesting from a holistic view and this one to be interesting from a full design perspective of an installation.

All of these links and docs were found via Google. None are marked as classified which tells me that the separation mechanisms are probably working. ;-)

  • 1
    Lots of interesting questions. I think you give them too much credit. Keep in mind it's still a top-down bureaucracy led by aged men who don't know diddly about cutting edge technology. The military uses Sharepoint, Exchange, and WSUS, just like everybody else. My guess is that the separations between classification levels aren't nearly as sophisticated as our imaginations want them to be. (Although that may have begun to [slowly] change since Manning/Snowden.) Mar 6, 2014 at 21:41
  • All three documents from the last paragraph have gone the way of the 404. You don't happen to have local copies, do you?
    – grawity
    Sep 7, 2014 at 9:06

NIPRnet is its own discrete network, using leased dedicated lines and encrypting all traffic before it hits the demarcation. SIPRnet may be encrypted and tunneled over NIPRnet or have its own discrete dedicated line that is encrypted.

SIPRnet on a local installation is encrypted on each line going to each building and decrypted there. JWICS can be tunneled over SIPRnet or have its own discrete dedicated and encrypted line. There are a lot of specifics involved that are sensitive in nature and irrelevant to the discussion at hand.

The long and short is, NIPRnet is encrypted and all traffic to the Internet passes through DISA routers, firewalls, and IPS/IDS systems at the national level at various locations. DISA could easily disconnect Internet access from NIPRnet if it became necessary, and the network would be exclusively military and government, with no Internet communication possible. So, DoD networks CAN be physically their own network or be tunneled by certain specified encryption methods over another network. However, all DoD traffic travels over DoD circuits, which are dedicated line based, frequently fiber lines.

All of this is available unclassified in the public domain, but there is no central information repository.


Here is how it works: The SIPRnet and NIPRnet are two different things for a reason! SIPRnet is used for classified information, anyone who has access to it has a Secret (or higher) security clearance. The NIPRnet is used on most (if not all) government computers which handle unclassified (but FOUO) material, since it is unclassified it has global internet access. The SIPRnet does have internet access, but not the World Wide Web, but a government version of the internet for classified material. Its not that they are not compatible, they just dont want the two to be compatible. Same reason JWICS is not connected to SIPR, it is a top-secret run system.

  • 1
    You can view FOUO on NIPRnet computers. SIPRnet and NIPRnet are two different networks.
    – Ramhound
    Sep 20, 2012 at 14:15

SIPRnet is normally confined to a specific, physically secured area in a facility and is NOT encrypted inside that area. It MUST be encrypted before it exits the secure area and this is normally accomplished by specialized encryption/ decryption equipment. The information is protected by physical security when it is un-encrypted and protected by encryption when it is not protected by physical security. Encrypted SIPRnet info can reside on the NIPRnet and often does. Also, there are different levels of SIPRnet and I know these levels dictate different levels of physical security but may or may not dictate different levels of encryption. A physical separation of the infrastructure is required inside the SIPRnet facility to protect the un-encrypted information but is not normally required outside of the facility once the information is encrypted.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .