Wednesday, July 8, 2015

Dick Marcinko - The Chuck Norris of Penetration Testers

Since I started my college education, I've always had genuine interest in penetration testing. Dick Marcinko was a penetration tester, but not in the way that the average information security professional would expect. In fact, Richard “Dick” Marcinko, excuse my French, was a badass outranking today’s badasses. With his wide range of knowledge, skill, and training, Dick Marcinko could be put into the ranks with Chuck Norris and Bruce Lee. His special operations team, Red Cell, was responsible for exposing a variety of vulnerabilities via controversial methods in a range of the United States’ vital security infrastructures. In my opinion, Dick Marcinko operated with merit by identifying crucial loopholes in our government’s physical security efforts.


Within his 30 years in the Navy, Richard Marcinko gained a variety of experience in every aspect of expertise concerning special operations; from being a teletype operator to working with Navy Underwater Demolition Teams, Marcinko did it all. Using this experience, Marcinko created and commanded SEAL Team SIX, which became the Navy’s first counter-terrorism special operations team. After the success of this team, Marcinko founded another counter-terrorism unit named Red Cell. Red Cell was and still is a top-notch security team with the capabilities to expose vulnerabilities in security systems. His team was hired to test the Navy’s anti-terrorism infrastructure, and did so very well. Marcinko and his team successfully identified and abused vulnerabilities in extremely secure areas. These areas included Air Force One, nuclear submarines, and Navy ships, among other secure facilities. During these heists, the Red Cell team used unorthodox methods of gaining access to some information that a real terrorist may use. Unfortunately, many of the high ranking officials within the Navy did not approve of him making fools out of them, and found ways of getting him locked up in prison for more than a year for misappropriation of military funds through “creative” bookkeeping.The fact that Dick Marcinko was put in jail for these actions raises a question of whether he did these things as a “Rogue Warrior” operating without merit, or someone who simply identified weaknesses in the Navy’s “secure” facilities. Personally, I think that Marcinko operated with merit by identifying crucial loopholes in our government’s physical security efforts. The first reason that I believe this is that Marcinko did not do these things without any sort of permission. He was hired by the United States Navy to find these vulnerabilities that absolutely existed within the system. With the vast amounts of training he had, the Navy should have expected that there would be one, if not many, weaknesses in security that Dick could bring to their attention. What Dick really did by exposing these faults, was to point out weaknesses before a real terrorist figured them out and took advantage of them in malicious ways instead of the more ethical approach that Marcinko took. If a terrorist exploited the same vulnerabilities as Marcinko, there could have been vast consequences that would far exceed that of Marcinko’s embarrassment of the higher-ranking officials within the Navy. Unfortunately, the officials who were “embarrassed” by his actions did not see the situation in the same light, and therefore took an unreasonable course of action to put an innocent man in jail.

One fact that could be argued to say that Dick Marcinko acted without merit is the fact that he treated any captives extremely roughly including tossing them around, kicking them, hitting them, etc. While this could be seen as an arrogant abuse of power, I think it is a necessary procedure that must be evaluated before it becomes a reality instead of just a drill. If the military hired Marcinko to test the military infrastructure for vulnerabilities, Marcinko delivered results. Without going to the measures that he did, he would not have been able to deliver the conclusions that he did. Had he not delivered results, he would have partially reassured the Navy that everything was secure and that there was no threat against any real acts of terror on the installations. Therefore, this extreme measure that Red Cell went to evaluate military security weaknesses was absolutely necessary to have an accurate assessment.