In this unique rental office space, networks are protected with firewalls — and guards, and Faraday cages.
Think your data center and IT research facilities are secure? Unless you work for a military contractor, or at Apple, it’s probably nothing like AZ Labs in Mesa, Arizona.
AZ Labs, or Arizona Laboratories for Security & Defense Research, is a cyberfortress. Literally. Like something out of a Cold War drama, the four-building campus is “certified at the highest level” of security.
Dane Mullenix, the director of AZ Labs, declined to define what “the highest level” means, but it’s way, way higher than Top Secret. These building were constructed in the 1980s by the Air Force to serve as an advanced research facility, with 250 scientists creating systems as diverse as pilot interface software for the F-16 fighter jet, advanced night-vision optics, and the command center used by the USAF. The facility is adjacent to the Phoenix-Mesa Gateway Airport, which used to be the Williams Air Force Base.
Two suites of rooms were used for flight simulators: One 8,000 square-foot room with concrete floors had the massive simulators, and an adjacent room with raised floors was filled with the mainframes that controlled the simulations. The campus has a massive network infrastructure, including dozens of OC-192 fiber links between offices and buildings.
Today, this bunker-like facility is available for anyone (well, nearly anyone) who needs a super-secure government-certified facility for developing hardware or software, running a cloud data center, or even practicing cyberwarfare. More about that in a moment.
In 2011, the Mesa lab was moved to Wright-Patterson Air Force Base’s Air Force Research Laboratory in Ohio, as a result of the BRAC (Base Realignment and Closure) Act of 2005.
The city of Mesa took over the secure campus and partnered with Alion Science and Technology Corp., a military contractor, to create what Mullenix describes as the only turn-key place where companies and startups can rent a truly safe facility – secure and certified to U.S. government standards, with both physical security guards, robust heating and cooling, and scrubbed and sanitized Internet connectivity. (I was only able to sneak one photo before they confiscated my phone.)
The buildings — and the rooms — are protected by vault-like doors that wouldn’t be out of place at Fort Knox, and there are layers of thick metal shielding that create nested Faraday cages that block radio signals. “We keep the good electrons in and keep the bad electrons out,” said Mullenix, an intensive man who has worked for Alion for 15 years, and before that was an Air Force officer for 26 years.
Need to work on a product or service that requires extreme security, both physical and cyber? Not only military contractors like Boeing or Lockheed-Martin need such facilities — in today’s world, you can’t be too paranoid.
According to Mullenix, if you need a U.S. government-certified secure facility, there are essentially three choices. You can build such a facility yourself, but that is expensive, and takes a lot of time for the certifications. You can work in a government-run secure facility, like on a military base. Or you can subcontract with a corporation that already has such a facility.
AZ Labs is a one-of-a-kind fourth option. Mullenix says that it’s the only privately owned facility that’s like a traditional startup incubator, except that it’s secure to those highest-level certifications, with each tenant literally firewalled from its neighbors. Getting a lease is not trivial: Not only does your organization have to maintain the appropriate security clearances to work in such a facility, but so do your own employees and contractors. Even the janitors have to either hold security clearances or be escorted around the facility as they work.
One of the reasons AZ Labs works, Mullenix says, is that the city of Mesa brought Alion onboard six months before the Air Force pulled out, and thus Alion’s workers could learn the systems and certifications before the facility was decommissioned.
Visiting AZ Labs with a tour group of aerospace engineers, it was easy to see the appeal of such a facility. Sure, tech companies like Apple and Google are famous for the security of their R&D departments; they wouldn’t need AZ Labs. For a startup, or a firm that generally doesn’t require that level of security, being able to rent security is pretty unique.
Fighting the Cyberwar
There are no company signs on the interior doors, and Mullenix wouldn’t divulge the names of his tenants – except one which welcomes the attention. That’s the Arizona Cyber Warfare Range, a nonprofit that is both hacking and defending against hacks. It’s not theoretical, said Brett Scott, co-founder and architect of the range, pointing to a bank of humming servers and telling the group. “Those machines are taking down ISIS Twitter accounts right now.”
Right now, the AZCWR has about 1,200 virtual servers running Ubuntu Linux, and Scott’s team is busy installing hardware upgrades to bring that to 5,500 virtual servers. Because AZCWR is a nonprofit, it’s been successful in attracting over a million dollars’ worth of servers and other gear — though Scott insists that he’ll only take donations if there are absolutely no strings attached by the donor.
Because of its profile as an active participant in cyberwarfare, Scott says that AZCWR is a target that’s being attacked all the time, and in fact he welcomes it – the engineers run forensics on every attack and learn not only about how to defend against it, but also suss out the particular characteristics, tactics, and abilities of global and domestic adversaries.
Even so, Scott is happy to have the AZCWR within the AZ Labs facility, protected by physical, radio-frequency and digital security.
I’ve been on many tours of data centers, colocation facilities, military bases and corporate R&D centers — and have never seen anything like AZ Labs. Even though the security guys wouldn’t let me carry my smartphone, it was good to know that someone is keeping the good electrons in, and the bad electrons out.
