The city of San Diego and the Navy are planning an enormous redevelopment of the current NAVWAR site near Old Town. Since much of NAVWAR’s mission is oriented around cybersecurity, it makes sense to consider this subject in the context of the current recommendation and available alternatives.
There are 5 alternative approaches that are under consideration, with the current recommendation being Alternative 4, in which private developers pay for construction of NAVWAR facilities in exchange for the opportunity to build residential, office, retail and hotel developments. There is a transit center as well.
My opinion is that this recommendation will adversely impact San Diego, and decision makers need to instead move forward with Alternative 1, in which the Navy simply pays to rebuild NAVWAR facilities.
Let’s elaborate on Alternative 4. This recommendation will rebuild NAVWAR facilities and collocate them with:
- 10,000 residential units
- 2,058,750 square feet of commercial space
- 2 hotels with 450 total rooms
- 433,750 square feet of retail space
- 109 buildings: 2 low-rise, 19 low to mid-rise, 51 mid-rise, 35 high-rise, 2 standalone parking structures
- Tallest buildings up to 350 feet, which is approximately 32 floors
- On-site transit facility
In cybersecurity efforts, there are two key objectives, and these certainly apply to this project:
- Reduce the attack surface
- Mitigate risk
Given the mission, activities, intellectual property and resources at NAVWAR, it seems it would represent a high-value target to adversaries — both in the physical world, as well as the cyber world. Collocating such a facility with a high-density population of civilians distributed across a mix of residential, retail and transportation centers seems diametrically opposed to security objectives.
Regardless of how strong the technology is, people are frequently the reason bad actors complete successful attacks. Breaches, ransomware, and all the other things we see in the news on an all-too frequent basis often result from exploitation of the primary vulnerability in any organization — its people Making hotels, high density housing and a transportation center co-tenants with NAVWAR would make it far easier to exploit both people and technology.
Bad actors could rent a hotel room or a condo and set up shop — identifying human targets, studying them, learning their patterns and behaviors, and then leveraging a multitude of social engineering techniques to exploit those targets. There are many ways to do this — and it happens all the time.
Also, if an adversary is renting one of those hotel or condo units, or sitting in the local coffee shop, and is within a particular range, they can and will break into WiFi systems. Or get data from someone’s phone via Bluetooth. Or use USB chargers for nefarious purposes. Or execute a host of other bad things.
People make mistakes with WiFi or Bluetooth, picking up random USB sticks, and much more. Any of these, or many other mistakes, can be used to gain access and launch attacks.
There are a multitude of stories in popular publications, academic journals and hacker forums documenting how physical proximity is a necessary prerequisite to certain types of cyber-attacks. There are multiple products available to the public that facilitate this activity. One can only imagine the tools sophisticated state actors would use.
The point is, no matter how good the people and technology of NAVWAR are, there are vulnerabilities. Those vulnerabilities can and will be exploited. Collocating NAVWAR with tenants that include hotels, high density housing/retail and a transportation center seems like a cyber defender’s nightmare. Doing so would expand the bad guy’s toolkit of tactics, techniques and procedures, expanding the attack surface and increasing risk.
The people who are trying to prevent, defend against and respond to those 8 million attacks per day have a tough job. Given the information I have seen on this project, I believe that Alternatives 2 through 5 will make that job tougher. This is one of many reasons I support Alternative 1 — the only alternative in which NAVWAR is the only tenant on NAVWAR property.
It seems reasonable to compare the current recommendation against other facilities with a similar charter. Well, it just so happens there is a clear example with a very similar charter — NAVWAR Atlantic.
What is collocated with the NAVWAR Atlantic facility? Well, it is definitely not the high-density retail or civilian residential populations suggested with Alternatives 2 through 5. Quite to the contrary, NAVWAR Atlantic is collocated with other tenants that include the Naval Nuclear Power Training Command, Border Patrol satellite academy, 269 above-ground ammunition magazines, as well as maintenance and storage of military ordnance including mines.
NAVWAR Atlantic seems to be avoiding high density civilian populations, thus reducing the attack surface and mitigating risk. So it seems logical that our NAVWAR in San Diego would select the option that helps it optimize around these same objectives. That option is clearly Alternative 1, not the current recommendation, Alternative 4.
Additional reasons supporting Alternative 1 include problematic timeframes, noise, traffic and visual aesthetics associated with Alternatives 2 through 5.
Regarding timeframes, I’d like to see NAVWAR get this new facility sooner rather than later. The environmental impact summary states that Alternative 1 “would occur by phasing the construction projects over 5 years.” However, Alternatives 2 through 5 “would be implemented over a 30-year period.” Alternative 1 is a smaller scale project with far less complexity, and simply has the highest probability of being executed most rapidly.
In terms of noise, the environmental summary states that Alternatives 2 through 5 “would result in significant noise impacts.” It also states that “perception of noise can be exacerbated by the intensity, frequency, or duration of noise.” Thirty years is a long time to deal with ongoing construction noise, as well as the radically increased noise from all the additional traffic.
The traffic resulting from an estimated 70,000 “average daily trips” (with Alternative 4) is virtually incomprehensible in terms of its impact getting in and out of Old Town, or the local beach communities. I’ve not seen any legitimate detailed plan of how to address this — largely because I don’t think one exists.
The beauty of our community would be dramatically and adversely impacted by Alternatives 2 through 5, whether from Old Town, Presidio Park, or many other vantage points.
In summary, regardless of the lens through which one views these options, Alternative 1 seems like the optimal solution for San Diego residents and NAVWAR.
Craig Huitema is a technology marketing executive and a San Diego resident.