The gargantuan scale of the Office of Personnel Management (OPM) hack, initially thought to have affected 4 million current and former US government workers has now ballooned to over 9 million. The White House announced on Friday that the same group of hackers were responsible for a second infiltration on a different section of the agency’s network. These files are said to include a database filled with Standard Form 86s—a security clearance questionnaire given to prospective government employees. In addition to applicant details, these forms also include extensive information on non-government workers including close acquaintances, friends and family. This has drastically inflated the number of people affected by the breach and has helped fuel the mounting pressure from the media on the Obama administration to ‘retaliate’.

Congress began the cross-examination of senior OPM officials before the House Oversight Committee this morning. When Chairman Jason Chaffetz asked why the sensitive data on OPM’s networks wasn’t encrypted, Director Katherine Archuleta explained that ‘it is not feasible to implement on networks that are too old’. Apparently OPM is now working to rectify the encryption issue, but according to Dr Andy Ozment—Assistant Secretary for Cybersecurity at the Department of Homeland Security—even encryption wouldn’t have saved OPM. He explained to the committee that the intruders had stolen valid user credentials, probably via social engineering, and this, combined with the fact that OPM had failed to implement multifactor authentication, gave the attackers easy access.

Proving that no one is completely secure in cyberspace, computer security giant Kaspersky Labs last week disclosed that that it recently fell victim to an internal network compromise. The company believes the intruders were seeking commercial information, probably connected to the development of its new technologies, but are confident they caught the intrusion in its initial stages. The malware used in the attack was distributed via Microsoft Software Installer files and didn’t write any files to disk ‘but instead resided in affected computers’ memory, making it relatively hard to detect.’ The infiltration attempt also utilised three zero-day exploits—an impressive number considering the significant price a single exploit can garner on the black market.

Switching focus to cyber diplomacy, the Chinese government has been busy in Africa and Southeast Asia. China’s Industry and Information Technology Minister Miao Wei travelled to South Africa to meet with Telecommunications and Postal Services Minister Dr Siyabonga Cwele. The two signed a ‘Plan of Action’ designed to help expand the country’s connectivity via technology, skills and knowledge exchange. It was reported that the agreement also covered everything from cyber security to e-government and intriguingly, internet governance.

Back in Beijing, the Cyberspace Administration of China (CAC) met with Indonesia’s new National Desk for Information Resilience & Cyber Security (DK2ICN).. The meeting sought to explore ways the two countries could build bilateral cyber cooperation, and highlighted the newly-established China–Southeast Asia Data Centre as a potential space for bilateral cooperation.

The Office of General Counsel at the US Department of Defense has released its latest edition of the Law of War Manual. The manual acts as a guide for military and defence officials on customary and treaty law of war, with the last comprehensive manual published in 1956. This edition of the weighty publication (1,180 single spaced pages) includes a chapter on cyber operations. Helpful definitions as to what might constitute a cyber operation, when a cyber attack could constitute a use of force, and what a proportional response might look like in response to such an incident are included in the chapter.

Since the early April release of the Parameters for a Joint Comprehensive Plan of Action Regarding the Islamic Republic of Iran’s Nuclear Program, commentators have been vocal and divided about its merits and demerits. I’m reluctant to rush to judgment about the deal. The negotiations remain a work in progress, and clarification of the key parameters before final signature at the end of June will have an important role in any assessment of its final value. Moreover, both the US and Iran have presented their own versions of the current level of agreement, which suggests the existing contest in public diplomacy is merely one more round where each is trying to cement the other’s feet in place on contentious points.

But I’d like to offer a few comments about the framework of the framework, as it were. First of all, it’s important to see the deal as an arms control measure, not as a disarmament measure. That’s an important distinction, since half the criticism levelled at the agreement is that it doesn’t lock Iran away from nuclear weapons forever. Arms control agreements codify and stabilise. They create durable expectations. They’re meant to manage a problem, rather than to solve it. That’s what we have here—which also explains why the agreement’s attracted its fair share of critics. Those deeply opposed to the possibility that Iran might ever have nuclear weapons don’t want the problem managed for a decade or so; they want it solved, even if they don’t have a perfect picture of how a solution might be achieved.

Second, if this is an arms control agreement, then the final agreement itself will bear a close reading. In arms control accords, every word matters. In the New START agreement, for example, one of the principal constraints falls on nuclear warheads deployed on strategic nuclear delivery vehicles. The agreement says nothing about non-deployed strategic nuclear warheads, nothing about non-strategic warheads—whether deployed or not. The same rule about close reading applies to the Iranian agreement. The interim agreement shows an attempt to constrain Iran’s pathways to the development of fissile materials—whether by uranium enrichment or by plutonium production. So far, the broad parameters are promising, but the devil will be in the details still to be agreed. As the interim agreement itself notes, nothing is agreed until all is agreed.

Third, the agreement enshrines a new metric for arms control: a proliferation breakout timeline. That timeline—the time it would take Iran to acquire the fissile material for one nuclear weapon—is meant to be kept at one year for the next ten years. The metric’s essentially a by-product of the other technical constraints, but it does set a precedent that other future proliferators might be content to see applied to their own cases. The one-year timeline suggests that any breakout can be addressed by the international community, or at least its principal players, over that timeframe. The ten-year timeframe is not an exemption from Iran’s obligations under the NPT, but some worry that it implies an absorptive capacity within the international community in relation to a future nuclear-armed Iran.

Fourth, if this is an arms control measure and not a disarmament one, we should expect a degree of controversy about the agreement and its contents. One rule of arms control is that it’s most available when least needed. Since some constraints on the Iranian nuclear program are sorely needed, that in itself suggests concluding a final agreement won’t be simple. Arms control makes a virtue of half a loaf when the full loaf isn’t available. In the context of negotiations between two heavily nuclear-armed superpowers, half a loaf’s a good outcome. The virtue of half a loaf is going to be harder to sell in the context of proliferating powers. Treating nuclear proliferation as a management issue is more contentious.

Finally, US policy has long tended to treat each specific proliferation problem as unique. After all, nuclear proliferation comes along infrequently enough that there’s good reason to shape a response that addresses individual motivations. But that approach turns upon a broad acceptance across the US mainstream about the nature of the potential proliferator. I think we’re about to see, over coming months, whether such a level of agreement exists in relation to Iran.

In 2003, a ‘perfect storm’ of intersecting developments saw Tehran caught with one hand in the nuclear weapon cookie jar (secretly enriching uranium), despite having joined the Nuclear Non-Proliferation Treaty and given assurances that it would do no such thing. The Iranian regime was humiliated.

India and Pakistan had endured sustained condemnation when they declared their nuclear-armed status via a blizzard of tests in 1998, but they were known proliferation risks and had declined to join the NPT. Even the DPRK—not a state that anyone wants to be compared to—had gone through the formality of withdrawing from the NPT in April 2003, to (redundantly) signal its intent to pursue a nuclear weapon capability.

Iran opted to bluff its way through. Tehran steadfastly denied that it had an obligation to restore confidence in its compliance with the NPT. It insisted that everything the IAEA could discover was consistent with its intention to build a substantial network of nuclear power stations. It maintained that it was also exercising its rights under the NPT to acquire its own capacities to fuel its future reactors with enriched uranium and (potentially) plutonium. For its part, the US insisted that Iran had to get out of the enrichment business.

Twelve years later, on 2 April 2015, negotiators from China, France, Germany, Russian, America and Iran announced agreement on a Joint Comprehensive Plan of Action (JCPOA) concerning special arrangements to bolster confidence that Iran’s nuclear program is exclusively peaceful in intent and that it has no aspirations to acquire nuclear weapons. The JCPOA—details of which can be found here—is commendably comprehensive, addressing both the enriched uranium and plutonium paths to the fissile core of a nuclear weapon.

Enrichment capacity will be cut by two-thirds and technological development precluded for 10 years; stocks of low-enriched uranium are set to be reduced to token levels for 15 years; the IAEA will have enhanced visibility of and access to Iranian nuclear facilities to verify compliance with the new agreement.

The central bargain may well have been Iran’s acceptance of the need for ‘special arrangements’ with the US conceding retention of an enrichment capacity, albeit on that’s circumscribed. If one looks at the key players, the regional context over recent decades and the broader global developments on the nuclear weapon front, easily the most surprising thing about this agreement is that it happened at all.

Support for the agreement, generally on arms control grounds, has been qualified while opposition to it has been markedly more absolute and trenchant. The Australian’s Greg Sheridan  called the deal ‘a dismal outcome for the world’ as the restraints on Iran’s nuclear activities are either reversible or expire after 10–15 years while economic sanctions, once lifted, are unlikely to be re-imposed if Iran misbehaves.

Henry Kissinger and George Shultz share Sheridan’s disappointment, contending that the deal won’t stop Iran’s nuclear potential from stoking anxieties in the Arab world that, in the final analysis, Washington will have to deal with. They stress that Iranian–Arab rivalries have been shaped over millennia, making a decade of restraint of little consequence to Arab states.

Coming to a comfortable judgement on the utility of this deal is not easy. But most criticisms fail to consider what alternative courses of action were both feasible and likely to deliver better outcomes. If abandoning enrichment had been made non-negotiable, the options might have been continual intensification of economic sanctions,- with the mounting risk that Russia and China would trigger either a break in the ranks,- or the use of force.

America still has unique capacities to attract support and make things happen, but it’s relative power and room for manoeuvre, including on the home front, isn’t what it used to be. Even the use of force could only delay an Iran determined to acquire nuclear weapons. The fact is that the character of the non-proliferation challenge has been transformed.

Acquiring nuclear weapons is not a trivial undertaking but neither is it any longer a massive, complex challenge fraught with uncertainty and the risk of failure. The decision of whether Iran becomes a nuclear-armed state rests entirely in their hands, just as it does for a significant number of other countries around the world, including Australia.

If Iran remains a non-nuclear weapons state indefinitely, it’ll be because that’s its preference. Many factors (and states) will shape the outcome on this question, not just Washington and not just this agreement.

The JCPOA is an interim agreement. Many crucial details—not least concerning the verification arrangements and the lifting of sanctions—still have to be thought through, agreed, and expressed in clear language before 30 June 2015.

Iran’s supreme leader has already tried to pre-empt the process, signalling that he’s prepared to walk away from the deal if any agreement on 30 June doesn’t provide for the immediate and complete lifting of sanctions. But if a deal can be finalised without distorting the integrity of the package, it should make a positive difference. Certainly, it is hard to see how it would make things worse.

From the time it came into being in 1947, the United States Air Force has had a state-of-the-art long-range bomber in its inventory. The first was the extraordinary B-36 Peacemaker (see photo)—the name intending to signify its deterrent value rather than (just) being ironic—and the latest is the B-2 Spirit ‘stealth’ bomber. There’ve been several notable aircraft, not least the B-52, which is now scheduled to have a service life in various versions of an astonishing 90 years. (For a review of the current USAF bomber fleet, see here.)

Bomber aircraft have been an important part of America’s superpowerdom, allowing it to project global air power and forming part of the nuclear deterrent. Some bombers over the years have never seen combat, but others have flown many ‘hot’ missions. So it’s no surprise that a new Long Range Strike–Bomber (LRS-B) system is in development. In fact, it’d be surprising if there wasn’t.

The value assigned to long-range bombers by the US is shown in how much it’s spent developing and building them. They’ve frequently been the centre of controversy about costs—not just the sometimes eye-watering direct costs but also the opportunity cost of other capabilities foregone. The B-36’s first battle was fought in Washington, with the newly-minted USAF and the Navy slugging it out over which Service would carry the strategic nuclear capability. In summary, the USN lost a planned ‘supercarrier’ to fund the bomber. The B-36 was called ‘the billion dollar blunder’ at the time (or $10 billion dollar blunder in today’s money), but at least that referred to the entire program of nearly 400 aircraft. The B-2, by contrast, cost almost a billion dollars each to build—and when the R&D is added in, the 21 aircraft fleet cost $55 billion. Read more

How times change. Yemen has fallen to the Iranian-backed Houthi rebels and the situation on the Arabian Peninsula’s more uncertain than ever. Just a few months ago, President Obama was touting the success of the US–Yemen partnership as a ‘model’ for fighting terrorism. This sudden reversal has caused some analysts—like Max Boot—to draw a set of premature and extreme conclusions about the efficacy of so-called ‘small-footprint’ interventions. But we should beware throwing the baby out with the bathwater. Better we understand first what’s involved in a small-footprint approach, the limitations of the model, and possible flaws in the Obama administration’s application of it.

In its most recent iteration, the small-footprint approach typically appears as part of the ‘lessons learned’ from Iraq and Afghanistan. But it’s not new though. Small-footprint approaches were far more the norm than the exception throughout the Cold War and even in the post-Cold War period. In such cases, the US and other allies—including Australia—provided assistance to countries fighting insurgencies. Yet the success of those approaches has been overshadowed by the mixed outcomes of large-scale counterinsurgency campaigns in Vietnam, Iraq and Afghanistan. Read more