The U.S. Army and the Future of U.S. Cyberwarfare

The U.S. Army and the Future of U.S. Cyberwarfare

| 1

U.S. Army Rangers from 3rd Battalion, 75th Ranger Regiment, set up a mobile tacticaloperations center during a multilateral airborne operation at Tyndall Air Force Base,Florida, March 3, 2014.

Source: U.S. Army photo by Staff Sgt. Teddy Wade (Released)

The views expressed in this article are those of the author’s and do not necessarilyreflect the official policy or position of the United States Department of the Army,Department of Defense, or Government.

Written by Paul Lushenko

Edited by Denny Singh

Introduction

In 2015, the U.S. Department of Defense (DOD) published its first cyber strategy. Adopted


| 2

four years after DOD declared cyberspace as an operational domain, this strategyrepresented a milestone in America’s recognition of the U.S. military’s dependence ondigital networks for its expeditionary operations across the globe. In 2018, DOD released anupdated cyber strategy to better posture the U.S. military to compete within an increasinglycontested cyberspace environment. The revised strategy further coordinated policy andresources to strengthen the U.S. military’s ability to execute timely and effective cyberoperations; defend U.S. critical infrastructure from malicious cyber activities; secure theU.S. military’s digital networks, which serves seven million users; and expand the U.S.military’s cooperation with other agencies and departments, industry partners, and allies.To help achieve these objectives, the strategy included a “defend forward” approach thatrequires the U.S. military “to disrupt or halt malicious cyber activity at its source, includingactivity that falls below the level of armed conflict.”[1] The activities of America’s near-peercompetitors in cyberspace, particularly China and Russia, compels the U.S. military toconduct operations in this gray zone between peace and war. Indeed, General PaulNakasone, “dual-hatted” as the commander of both the U.S. Cyber Command(USCYBERCOM) and National Security Agency (NSA), recently acknowledged that the U.S.is in “daily competition” with these and other states.[2]

Since 2015, Congress has broadened its oversight of the military’s expanding cybercapabilities, which is reflected by increasingly prescriptive legislation, including the 2020National Defense Authorization Act. This law now requires Congressional notice withinfifteen days following the President’s delegation of authority to the Secretary of Defense toconduct a cyber operation that could risk wider escalation into general hostilities with atargeted adversary.[3] Independent audits of USCYBERCOM by the GovernmentAccountability Office also demonstrate heightened scrutiny of America’s ability to wagecyber warfare that has been compounded by China and Russia’s intrusions of U.S. networks.Chinese hackers are suspected of having exploited a vulnerability in the SolarWinds Orionnetwork monitoring software to breach the cyber defenses of U.S. agencies anddepartments last year, including the National Finance Center and Department ofAgriculture. Beyond their meddling in the 2016 presidential election, U.S. officials alsorecently confirmed that Russia’s Foreign Intelligence Service – likely through what is nowreferred to as the “Cozy Bear” hacker group – breached the networks of the Departments ofDefense, Homeland Security, and State in early December 2020.[4]

Despite greater oversight and accountability of the military’s ability to maneuver incyberspace, there is surprisingly little understanding among security analysts of how U.S.defense leaders have operationalized cyberwarfare. While other experts have attempted tofill this gap, their analyses have largely investigated policies, authorities, and decision-


| 3

making within USCYBERCOM’s headquarters without conveying important contributionsmade by the individual services.[5] It can be argued, for example, that U.S. Army CyberCommand (ARCYBER) constitutes the backbone of America’s Cyber Mission Force. Whilethis force draws on personnel, resources, and capability from all the services, such as the16th Air Force, ARCYBER provides access to adversarial networks across the continuum ofcompetition and conflict that is decisive to America’s positional advantage in cyberspace.While USCYBERCOM’s increasingly assertive “defend forward” approach presupposes amisattributed infrastructure and software tools to exploit network vulnerabilities, it isdependent on access that typically only ground combat forces can provide, especially duringactive hostilities, to an adversary’s physical and logical networks. The importance of closeaccess operations was a key lesson from Joint Task Force ARES’, which destroyed theIslamic State’s media operations in November 2016 during Operation Glowing Symphony.[6]

Army cyber soldiers were again deployed to Europe in 2018 to “hunt and attack” maligncyber actors attempting to disrupt America’s democratic processes. According to Nakasone,“an Army team … was able to get on the net and provide effects in support of the defense ofour midterm elections.”[7] Army cyber soldiers deployed once more to Europe in 2020 to helpsafeguard the presidential election.[8]

These and other examples pose a critical question to understanding the scope and scale ofAmerica’s cyberspace capabilities. In what ways has ARCYBER contributed to thedevelopment of U.S. cyberwarfare? Although cyber forces existed informally within theArmy before 2010, this year was a critical juncture for Army senior leaders as they formallyestablished ARCYBER. Since then, ARCYBER has developed entirely new organizationsacross all – tactical, operational, and strategic – echelons. It has also developed new trainingand doctrine, as well as accelerated the acquisition of next-generation enablingtechnologies, some of which I have participated in developing, testing, and fielding. Thisprogress, however, has been offset by unrealistic accessions and recruitment goals, trainingshortfalls, and ambitious capabilities development and testing timelines. While ARCYBERcontinues to make important organizational, training, and equipping gains, theseadvancements have sometimes outmatched the organization’s ability to fully realizecyberwarfare goals that are integral to America’s ability to deter and respond toprovocations in cyberspace in concert with other services and combat support agencies.

Organization, Training, and Equipping Initiatives

Since 2010, ARCYBER has made sweeping organizational, training, and equipping changesthat are integral to deter and impose costs on U.S. adversaries in cyberspace.

First, ARCYBER has established new organizations within both the generating and


| 4

operating forces to train soldiers, deploy them, and enable cyber operations in peace,competition, and conflict. On the one hand, ARCYBER recently consolidated its commandand staff sections at a new facility in Fort Gordan, Georgia to better coordinate andsynchronize doctrine development, training, and operations. Previously, ARCYBER had beenscattered across 11 installations within the U.S. The move co-locates the ARCYBERheadquarters with the Army Cyber Center of Excellence, which is responsible for trainingnew soldiers, as well as the NSA’s facility, which allows ARCYBER to conduct defensive andoffensive cyber operations in support of USCYBERCOM.[9]

On the other hand, ARCYBER has established new organizations that enhance itsresponsiveness to collection requirements and operational taskings imposed byUSCYBERCOM. Tactically, the Army Cyber Center of Excellence started graduatingElectronic Warfare Platoon Leaders last year that will lead companies designed to applycyber effects in support of battalions and brigades confronting adversaries prior to andduring hostilities.[10] Operationally, ARCYBER activated the 780th Military IntelligenceBrigade in 2011 to benchmark its contribution of cyber effects across the Army and jointforce.[11] Similarly, ARCYBER activated a new battalion in 2018, the 915th Cyber WarfareBattalion, to deploy Expeditionary Cyber Teams to enable cyber planning and operations atthe brigade, division, corps, and combatant command levels. Strategically, ARCYBER iscontributing planners and commanders to the Army’s new Multi-Domain Task Force that ischartered to penetrate the “anti-access/area-denial” defenses of near-peer competitors inAsia and Europe.[12]

Second, ARCYBER has developed new training and doctrine to better enableUSCYBERCOM’s “defend forward” approach. In terms of doctrine, ARCYBER has proposed“command-centric network operations.” This is designed to better streamline resources andauthorities within a single operational commander. This emerging approach is importantbecause it meets a Cyberspace Solarium Commission recommendation to consolidateexisting but fragmented U.S. Code Title 10 authorities in support of cyber operations thatconstitute a traditional military activity as defined by Section 1632 of the 2019 NationalDefense Authorization Act.[13] As far as training is concerned, ARCYBER shepherded thedevelopment of a new cyber branch in 2014 that Army leaders expect to adopt a warfightingculture similar to the infantry and other combat branches. Additionally, ARCYBER sponsorsthe Army Cyber Institute at West Point, New York that was established in 2012 to “developintellectual capital and impactful partnerships that enable the nation to outmaneuver ouradversaries in cyberspace.”[14] In addition to training cadets that attend the United StatesMilitary Academy, the institute also publishes the Cyber Defense Review that constitutes akey nexus point between training and doctrine development given that it addresses thorny


| 5

legal, moral, ethical, and operational topics germane to USCYBERCOM’s expanding use ofcyberwarfare.[15]

These organizations and training and doctrinal advancements further support the CyberMission Force, of which ARCYBER provides 41 of the 133 Cyber Mission Teams drawn fromacross all services.[16] They are undergirded by ARCYBER’s aggressive acquisition of next-generation capabilities, which is a third key advancement. Tactically and in concert withthe Army’s Senior Intelligence Officer at the Pentagon, ARCYBER has sponsored thedevelopment of the Terrestrial Layer System. This is the Army’s first integrated Cyber,Electronic Warfare, and Signals Intelligence (SIGINT) capability, mounted on a wheeledcombat vehicle called a Stryker, that is designed to conduct cyber operations in support ofprimarily brigades.[17] The system has three options to detect and respond to an adversary’sdigital communications: “keep listening and try to decrypt it (SIGINT), try to connect to theenemy wireless network and hack into it (cyber), or transmit a jamming signal to disrupt theenemy’s communications (electronic warfare).”[18]

At the operational and strategic levels, which roughly correspond to the division and Armycomponent of combatant commands such as Central Command that manages operations inthe Middle East, ARCYBER has sponsored an enhanced version of the Terrestrial LayerSystem that can apply effects at greater ranges. It has also developed the Multi-FunctionElectronic Warfare Air Large. The Multi-Function Electronic Warfare Air Large is theArmy’s first airborne electronic warfare jamming capability that is retrofitted on a GeneralAtomics MQ-1C Gray Eagle (unmanned aerial vehicle or drone) and designed to enable theMulti-Domain Task Force in Asia and Europe.[19]

Key Challenges

Notwithstanding these contributions, which are decisive to America’s “defend forward”approach to cyberwarfare, challenges remain. Organizationally, a recent GovernmentAccountability Office report found that the pace of emerging units has outstrippedARCYBER’s ability to fully staff them with trained personnel, creating operational risks forboth the Army and joint force. The 915th Cyber Warfare Battalion was staffed at only 20percent in 2019, and the rigorous training of its two Expeditionary Cyber Teams suggeststhat the organization is likely still understaffed. More problematic, the report found that“the Army did not assess the staffing, equipping, and training risks before activating oneunit [the 915th], and only conducted an initial risk assessment before activating a secondunit,” which represents its contribution to the Multi-Domain Task Force.[20] Finally, thedegree to which ARCYBER has operationalized the intent for its soldiers and officers tointegrate cyber with other maneuver operations, such as surveillance and reconnaissance, is


| 6

unclear. To further enable the integration of cyber with other maneuver operations, Armysenior leaders recently authorized the development of more specialized cyber organizationswithin the Army’s Special Operations Forces. The Army’s premier light infantry force, the75th Ranger Regiment, recently built a new Military Intelligence Battalion with a cybercompany to help build a doctrinal template to integrate cyber operations into large-scalecombat operations against near-peer competitors.[21]


| 7


| 8

A cryptologic linguist from the Cyber Electromagnetic Activities Company assigned tothe 75th Ranger Regiment Military Intelligence Battalion analyzes the electromagneticspectrum during a multilateral training exercise. (Courtesy of the U.S. Army)

A cryptologic linguist from the Cyber Electromagnetic Activities Company assigned to the75th Ranger Regiment Military Intelligence Battalion analyzes the electromagneticspectrum during a multilateral training exercise. (Courtesy of the U.S. Army)

Similarly, ARCYBER continues to determine how it can better recruit and train soldiersgiven the steep competition for their skillsets among service-based industries andcommanders’ demand for their talents on the battlefield. Sergeant Major Samuel Crislip,who serves as the Senior Enlisted Advisor for the Army Cyber Institute, argued thatARCYBER is struggling to recruit men and women to serve in the Army’s new cyber branchbecause of antiquated and impersonal recruiting techniques that fail to capture theirimaginations. Rather than brick and mortar recruiting centers, Crislip recommendedARCYBER to use social media and role-playing opportunities like an online version of thebackyard game “capture-the-flag.” In this variant, a player finds more hidden messages indigital files than others to win.[22] Although ARCYBER has recruited more than 330 cyberofficers since 2015 and plans to train 200 a year at the Army Cyber Center of Excellence,Nakasone recently informed Congress that more are needed to keep pace with emergingthreats in cyberspace that China and Russia’s recent actions seem to justify.[23]

Assuming Congress authorizes more personnel, and ARCYBER can maintain its breakneckpace of training, the quality of training is an open question. The Government AccountabilityOffice found that ARCYBER’s training of new soldiers has lagged behind organizational,doctrinal, and equipping initiatives. In particular, ARCYBER does “not have the time framesfor required validation of foundational courses to CYBERCOM standards.”[24] WhereasARCYBER’s new “command-centric network operations” approach is designed to resolve thechallenges of drawing on authorities, expertise, and capabilities across multiple agenciesand departments, this will not make a difference without a trained and ready force tooperationalize the doctrine. In recognition of this vulnerability, ARCYBER has developedand is iteratively updating the “Persistent Cyber Training Environment.” This is a virtualplatform to train and certify cyber soldiers against clear standards that will prepare them todeploy in support of Army and USCYBERCOM requirements.[25] To further train and validatecyber soldiers in support of the Cyber Mission Force, ARCYBER is also integrating itsexpeditionary formations into the combat training of infantry units at large-scale trainingcenters.[26]


| 9

Such tensions between organization, recruitment, training, and doctrine developments arefurther compounded by the delayed development, testing, procurement, and fielding of next-generation cyber technologies including the Terrestrial Layer System and Multi-FunctionElectronic Warfare Air Large. Others have reported on the challenges of operationalizingboth platforms in contested environments characterized by poor connectivity to data serversand the lack of reporting standards across multiple classified and unclassified networks.Less understood is the laborious acquisition process that has caused delays in outfitting themyriad organizations that ARCYBER is developing. The Government Accountability Officenotes that ARCYBER did not adequately assess the risk of activating units at a rapid paceand now confronts an equipping challenge. Aside from understaffing, many units areactivated without equipment to train and deploy soldiers. This desynchronization threatensoperational readiness. Consequently, ARCYBER’s planners have adopted a workaroundsolution that consists of something called “prototype” equipment that mimics the intendedcapability.[27] Given the potential drawbacks of this interim solution, it may be the case thatequipping challenges represent the critical limiting factor for ARCYBER’s ability to conducta broader set of cyber missions on behalf of USCYBERCOM.

Recommendations

Since 2010, ARCYBER has made tremendous progress in building a cyber capability toenable U.S. operations in cyberspace. It had no other choice. There are no existingmeasures of performance and effectiveness to guide a military’s adoption of a cyber warfareprofile. Despite or because ARCYBER arguably benchmark’s USCYBERCOM’s “defendforward” approach, especially given that Army cyber soldiers provide critical access tocompetitors’ networks prior to, in the ramp-up toward, and during conflict in non-permissiveenvironments, it confronts several organization, training, and equipping challenges. To helpresolve these, ARCYBER should consider three recommendations.

First, ARCYBER must prioritize the development of units, whether the 915th Cyber WarfareBattalion or Multi-Domain Task Force, that best enable the Army and joint force to maintainovermatch of near-peer threats in Asia and Europe. Second, ARCYBER should also align thedevelopment of the Terrestrial Layer System, Multi-Function Electronic Warfare Air Large,and other capabilities against these priority units. While the same goes for personnel, theadded challenges here are recruitment and training. Therefore, in terms of the thirdrecommendation, ARCYBER should adopt the more personal recruiting approach suggestedby Crislip. Beyond this, ARCYBER should tap into Reserve Officers’ Training Corpsprograms and veterans’ organizations at America’s top universities and colleges to bettercompete for talent. For instance, the Cornell University Undergraduate VeteransAssociation can serve as a bridge for ARCYBER to explain its mission and career


| 10

opportunities to students at Cornell.[28] This will capitalize on their research at the Ann S.Bowers College of Computer and Information Science to support America’s security andprosperity. Further, ARCYBER should take advantage of the Army’s expanding partnershipswith academic institutions to inspire and prepare the next generation of cyber soldiers andofficers. Better advertising scholarships available to offset the rising tuition costs forundergraduate students committed to joining the Army following graduation is a goodstarting place. Chief among these scholarships are the Cyber Corps Scholarship for ServiceProgram, DOD Cyber Scholarship Program, and Science, Mathematics, and Research forTransformation Program.

Paul Lushenko is a U.S. Army Major and Ph.D. student in International Relations at CornellUniversity, where he serves as a General Andrew Jackson Goodpaster Scholar. He is also aCouncil on Foreign Relations Term Member and co-editor of Drones and Global Order: Theimplications of remote warfare for international society (forthcoming). He would like tothank Amelia Arsenault, Dr. Erica Borghard, Dr. Shawn Lonergan for their helpfulcomments on an earlier draft of this article.

. U.S. Department of Defense, “Summary: Department of Defense Cyber Strategy1.2018,” September 18, 2018,https://media.defense.gov/2018/Sep/18/2002041658/-1/-1/1/CYBER_STRATEGY_SUMMARY_FINAL.PDF. ↑. Quoted in Yasmin Tadjdeh, “Algorithmic Warfare: Army Consolidating Cyber2.Operations Forces,” August 25, 2020,https://www.nationaldefensemagazine.org/articles/ 2020/8/25/army-consolidating-cyber-operations-forces. ↑. Robert Chesney, “The Domestic Legal Framework for US Military Cyber Operations,”3.Hoover Institute Aegis Series Paper No. 2003, July 29, 2020,https://www.hoover.org/rese arch/domestic-legal-framework-us-military-cyber-operations. ↑. David Sanger, “Russian Hackers Broke Into Federal Agencies, U.S. Officials Suspect,”4.The New York Times, December 12, 2020,https://www.nytimes.com/2020/12/13/us/politics/russian-hackers-us-government-treasur y-commerce.html. ↑. Erica D. Borghard and Shawn W. Lonergan, “To Defense Forward, the U.S. Must5.Strengthen the Cyber Mission Force,” Lawfare, March 13, 2020,https://www.lawfareblog. com/defend-forward-us-must-strengthen-cyber-mission-force.↑. Garrett M. Graff, “The Man Who Speaks Softly-and Commands a Big Cyber Army,”6.


| 11

Wired, October 13, 2020, https://www.wired.com/story/general-paul-nakasone-cyber-command-nsa/. ↑. Gary Sherftick, “Cyber teams deploying to safeguard national security,” U.S. Army,7.September 19, 2019, https://www.army.mil/article/227274/cyber_teams_deploying_to_safeguard_national_security. ↑. Julian Barnes, “U.S. Cyber Command Expands Operations to Hunt Hackers From8.Russia, Iran and China,” The New York Times, November 2, 2020,https://www.nytimes.com/2020/11/02/us/politics/cyber-command-hackers-russia.html.↑. Tadjdeh, “Algorithmic Warfare: Army Consolidating Cyber Operations Forces.” ↑9.. Kimberly Underwood, “The Army Evolves Its Formations for Cyber and Electronic10.Warfare,” Signal Magazine, October 21, 2020,https://www.afcea.org/content/army-evol ves-its-formations-cyber-and-electronic-warfare. ↑. “780th Military Intelligence Brigade,” https://www.inscom.army.mil/MSC/780MIB/ind11.ex.html. ↑. Kyle Rempfer, “New Army cyber warfare unit seriously undermanned, GAO says,”12.Army Times, August 16, 2019,https://www.armytimes.com/news/your-army/2019/08/16/ new-army-cyber-warfare-units-seriously-undermanned-gao-says/. ↑. Tadjdeh, “Algorithmic Warfare: Army Consolidating Cyber Operations Forces”;13.Borghard and Lonergan, “To Defense Forward, the U.S. Must Strengthen the CyberMission Force.” ↑. “Army Cyber Institute,” https://cyber.army.mil/. ↑14.. “The Cyber Defense Review,” https://cyberdefensereview.army.mil/. ↑15.. “Fact Sheet: U.S. Army Cyber Command,” U.S Army Cyber Command, February 7,16.2020, https://www.arcyber.army.mil/Portals/34/Fact%20Sheets/ARCYBER%20fact%20sheet%20-%20Cyber%20Mission%20Force%20(7Feb2020).pdf?ver=2020-02-10-121111-443. ↑. Paul Lushenko and Nick Bono, “Modernizing Army Intelligence For Multidomain17.Operations,” Army Magazine 69, no. 11 (November, 2019): 30-34. ↑. Sydney J. Freedberg Jr., “Boeing & Lockheed Vie for Cyber/EW/SIGINT System, TLS,”18.Breaking Defense, August 17, 2020,https://breakingdefense.com/2020/08/boeing-lockheed-vie-for-revolutionary-ew-sigint-system-tls/; Mark Pomerleau, “Army shares details on new electronic warfare units,”C4ISRNET, December 31, 2020,https://www.c4isrnet.com/electronic-warfare/2021/01/01/army-shares-details-on-new-ele ctronic-warfare-units/. ↑


| 12

. Pomerleau, “Army shares details on new electronic warfare units.” ↑19.

. “Army Is Preparing for Cyber and Electronic Warfare Threats, but Needs to Fully20.Assess the Staffing, Equipping, and Training of New Organizations,” United StatesGovernment Accountability Office, August 2019,https://www.gao.gov/assets/710/700940 .pdf. ↑. Paul Lushenko, “The 75th Ranger Regiment Military Intelligence Battalion:21.Modernizing for Multi-Domain Battle,” Military Review 98, no. 4 (July-August, 2018):6-18. ↑. Samuel Crislip, “Capturing the Flags and Recruiting Future Cyber Soldiers,” War on22.the Rocks, August 28, 2020,https://warontherocks.com/2020/08/capturing-flags-and-recruiting-future-cyber-soldiers/. ↑. Lauren C. Williams, “GAO: Cyber Mission Force teams need more training,” FCW,23.March 7, 2019,“https://fcw.com/articles/2019/03/07/cyber-command-training-gao.aspx”; Sherftick,“Cyber teams deploying to safeguard national security.” ↑. Williams, “GAO: Cyber Mission Force teams need more training”; “Army Is Preparing24.for Cyber and Electronic Warfare Threats, but Needs to Fully Assess the Staffing,Equipping, and Training of New Organizations.” ↑. Mark Pomerleau, “What happened at the military’s biggest cyber exercise to date,”25.Fifth Domain, July 24, 2019,https://www.fifthdomain.com/dod/2019/07/24/what-happened-at-the-militarys-biggest-cyber-training-exercise-to-date/. ↑. “The Army’s Only Cyber Warfare Battalion Confirms Training Program,” U.S. Army26.Cyber Command, October 21, 2020,https://www.doncio.navy.mil/chips/ArticleDetails.as px?ID=14009. ↑. Pomerleau, “Army shares details on new electronic warfare units”; Kyle Rempfer,27.“New Army cyber warfare unit seriously undermanned, GAO says;” “Army Is Preparingfor Cyber and Electronic Warfare Threats, but Needs to Fully Assess the Staffing,Equipping, and Training of New Organizations.” ↑. “Veterans at Cornell,” https://admissions.cornell.edu/learn/veterans-cornell. ↑28.


| 13

Paul Lushenko

Major Paul Andrew Lushenko is an Intelligence Officer in the U.S. Army, Council on ForeignRelations Term Member, PhD Student at Cornell University, and adjunct research lecturerfor the Australian Graduate School of Policing and Security located at Charles SturtUniversity in Canberra, Australia. He is also the co-editor of a forthcoming book withRoutledge entitled, Drones and Global Order: The implications of remote warfare oninternational society.View all posts

http://www.cornellpolicyreview.com/author/paul-lushenko/

The U.S. Army and the Future of U.S. Cyberwarfare

Documents

Transcript of The U.S. Army and the Future of U.S. Cyberwarfare