In 1995, I convinced the program manager who was responsible for SIPRnet that they should not use HOSTS.TXT files and random IP addresses that they just pulled out of their ass.

Ultimately, the weapon that convinced them was that they wanted to ultimately connect it to the “real” Internet, once the work was completed on the multi-level secure gateway that the NSA was developing.

I convinced them that there would be no way for them to communicate with the real owners of those IP addresses, and that they would need to use the DNS to communicate with the hosts and domains on the other side of that gateway.

It was a major face-palm moment for me, but I was glad that I was the DISA.net Technical POC at the time, that my boss trusted me and he was the DISA.net Admin POC at the time, and I had built a good reputation by helping them get the first CERT inside of DOD up and running inside of a week on ASSIST.mil, back at a time when there was just the one NIC for the entire Internet and they did root zone updates only once a week.

Thank $DEITY for that MLS gateway that the NSA was developing, because otherwise SIPRnet would probably still be using HOST.TXT files and random IP addresses pulled out of their ass.

This was also the event that convinced me I needed to get out of DISA quick, because I couldn’t keep saving the entire agency from making seriously brain-damaged decisions like the one I saved them from.

Sigh....

So: the point being that despite having a secure network, the immediate impetus was to connect it to the insecure one?

And that without IP and network isolation, HOSTS.TXT was an utterly meaningless obfuscation / network isolation mechansim (which was apparently not ... apparent ... to them)?

The only bureaucracy more SNAFUd than government and military is private sector. You just don't hear so much about it except through lawsuits and leaks -- no congressional investigations or constituent concerns. Representation has some advantages.

SIPRNet (the secure version) has a parallel network for unclassified traffic (eg surfing foxnews / open-source intelligence / checking your gmail).

If I had to take a wild guess, an executive at some point said "why do I NEED to switch between these two terminals? Can't it all be secure on just one of them? I just want to be able to reply to outside emails on the SPIRNet."

And thus it happened, or probably something like that. Never underestimate the "executive factor".

Thanks. Much as I'd suspected.

And EF is very QED in DJT.