Sidenote, he lists "Push over-the-air software updates to weapon systems (U-2) while flying the jet" in his list of accomplishments. Is this what it sounds like? It sounds like a terrible idea.
He means the initiative to provide in-air updating of the surveillance payload in response to tasking. Probably ELINT-related.
Edit: He's probably talking about this https://mobile.twitter.com/WILLROP3R/status/1318161379304591... and this https://www.thedrive.com/the-war-zone/38162/u-2-spy-plane-ta...
1) If the military gets it right with anything, it's encryption. This isn't connecting to the aircraft over the Internet using Verisign PKI. You're not gonna man-in-the-middle inject your own code into the update. The only attack vector is the software supply chain itself, but that is already an attack vector regardless of how the software gets loaded.
2) Part of the purpose of being able to do something like this is to push new software capabilities to platforms that can't be brought back to manually do it at all, like satellites in orbit. A software update that doesn't require you to launch a new rocket into space can save billions.
What gives you this confidence?
Beyond what your valuable input, I will make the general observation - I have no personal knowledge of military IT security - that the keys are necessary but they are not nearly sufficient for effective security. Also, other high-priority assets have been compromised, such as a key nuclear warhead design.
Basically, use a sufficiently secure source of randomness to produce a couple copies of an enormous (terrabytes, probably) one time pad. When the sub comes to port, deliver the drive using armed guards. When sending or receiving a message, use a section of the random data to XOR your message. If each section is only used once, none of the data can be decoded by someone without the one time pad.
I also imagine the NSA is willing to give an honest helping hand to the US military. Whereas any other entity has to hope any help from the NSA is honest, and likely doesn't include the best known bits.
Developers who know how to do this are relatively scarce. The military almost certainly does not have enough of them.
> Developers who know how to do this are relatively scarce. The military almost certainly does not have enough of them.
FYI: the NSA is part of the DoD. They most certainly have plenty of people who know how to do encryption properly, and securing military communications is also part of their job.
https://en.wikipedia.org/wiki/National_Security_Agency:
> The National Security Agency (NSA) is a national-level intelligence agency of the United States Department of Defense... The NSA is also tasked with the protection of U.S. communications networks and information systems.
I'll be the first to concede that the military is significantly behind on modern digital product management, cloud architecture, and software development.
But that doesn't extend to key management and distribution or communications security in general, which is something we're pretty damn good at.