USAF Cyber Command (catch all)

[Stan]

The cyber security issue is a tricky one. For lack of a better option, the job of protecting government computer systems has fallen to the Department of Homeland Security (DHS), although the Air Force is an active player. The Navy and the Army also have their own programs.

So far, CNCI has been criticized for being too secretive, though the initiative is a step forward overall. In fact, it's good news that someone is finally starting to take this seriously. Both presidential candidates have expressed a committment to improving cyber security.

Knowing just who is supposed to be in charge of cyber security would be a good start.

[selil]

I'm really, really surprised. Though I shouldn't be.

The Air Force on Monday suspended all efforts related to development of a program to become the dominant service in cyberspace, according to knowledgeable sources. Top Air Force officials put a halt to all activities related to the establishment of the Cyber Command, a provisional unit that is currently part of the 8th Air Force at Barksdale Air Force Base in Louisiana, sources told Nextgov.

Anybody have any idea where this will go?

http://www.nextgov.com/nextgov/ng_20080812_7995.php

[LawVol]

I too am quite surprised given the recent symposium activity. However, maybe there is a silver lining. We (i.e. the AF) need to get our ducks in a row in other areas before tackling stuff like this. Just my .02. Let me know if you hear anything.

[Ron Humphrey]

I'm really, really surprised. Though I shouldn't be.



Anybody have any idea where this will go?

http://www.nextgov.com/nextgov/ng_20080812_7995.php

Although one would think it might also be about remembering not to place all of ones fish in one barrel. Much easier to figure out which barrel to tip than it is to figure out which one holds the most fish.

[wm]

. . . just might want to review the bidding. Given the series of holes he has to dig the AF out of, he might think it wise to hold off on new initiatives until he has a better handle on the whole picture. BTW, AFCYBER was not really going anywhere until the FY10 budget process got finished anyway.

[selil]

LawVol, Dunlap emailed me after the symposium pointing my towards his recent article, he is a pretty nice guy to talk to by the way. I had a response I worked up last week and just deleted it. The air war in Georgia kind of makes his case. Darn it.

I blogged the article I'll see what crawls out of the woodwork.

I expected a pause due to the leadership changes, but nothing would have prepared me for cessation of activities until an undetermined date. Looking for more information at this point.

[Stan]

I blogged the article I'll see what crawls out of the woodwork.

I expected a pause due to the leadership changes, but nothing would have prepared me for cessation of activities until an undetermined date. Looking for more information at this point.

Very nice job on the site, Sam ! I especially enjoyed the Georgia/Russia Cyber article.

I recently ran into a former NCO of mine now working for the IBF Cyber Division. I'm real interested in their take on this issue, and will see what I can shake outta him.

Regards, Stan

[Steve Blair]

. . . just might want to review the bidding. Given the series of holes he has to dig the AF out of, he might think it wise to hold off on new initiatives until he has a better handle on the whole picture. BTW, AFCYBER was not really going anywhere until the FY10 budget process got finished anyway.

The AF has also been having some serious issues getting its own cyber-stuff in order. They still have a hard time dealing with remote locations and operations that aren't directly linked to a base network of some kind. I'm honestly not sure if they're ready to handle an operation of cyber-command's size. That and they pissed a bunch of people off when they tried to grab SAC's insignia and give it to cybercommand....

[Stan]

Foreign Policy, posted August 2008
Shadowy hackers in Moscow and St. Petersburg? Old news. Get ready for the next generation of Russian cyberwarriors.

Much of the public argument for a harsh response among Russians rested on Kremlin-backed reports of extremely high casualties among South Ossetia’s soldiers and the civilian population, which Georgians fervently denied. This lack of clarity and factual evidence only ratcheted up the speculative nature of most discussions.

Those skeptical of the official statistics argued that the government could have fabricated the figures. In response, a group of Russian bloggers sent a public letter to SUP, ... They asked it to impose curbs on free speech and censor anyone seeking to undermine Russia’s war effort by expressing pro-Georgian sentiment. “Regular laws of peaceful times do not apply; we are at war!” read their somewhat hysterical letter. (Thankfully, SUP ignored their demands.)

It started as a fairly predictable digital conflict, mimicking the one in the real world and displaying no shortage of “conventional” cyberwarfare: Web pages were attacked, comments were erased, and photos were vandalized.

As Russian tanks lumbered southward over mountainous Ossetian terrain, Russian netizens were seeking to dominate the digital battlefield.

But sophomoric pranks and cyberattacks were only the first shots of a much wider online war in which Russian bloggers willingly enlisted as the Kremlin’s grass-roots army.

For Russian netizens, “unconventional” cyberwarfare—...

Managing information seemed all the more urgent as there were virtually no images from the first and the most controversial element in the whole war—the Georgian invasion of Tskhinvali, the capital of South Ossetia—and the destruction that, were one to believe the Kremlin’s account, followed shortly thereafter.

Much more at the link

[Stan]

Estonia has already sent around 50 army reservists to Georgia (though on a voluntary, non-uniformed basis) to conduct humanitarian work and now it has emerged that Estonia is also lending its cyber-warfare expertise to the Georgian cause.

The Estonian Foreign Ministry has confirmed that it is sending two of its leading cyber-defense experts to Tbilisi to help stave off cyber-attacks emanating in Russia. The experts are likely to be part of the new NATO cyber-defense center established in Tallinn, and if so, the move would be one of the strongest instances so far of NATO lending practical support to Georgia.

However, according to IT industry website Network World (www.networkworld.com), Estonian servers are now hosting the website of the Georgian Foreign Ministry, whose daily blog has become a key source of information in the propaganda war with Russia.

Commenting on the move on Network World, IT security specialist Richard Stiennon said: "For Russia to respond in any way to cyber defense experts being sent to Georgia it would have to acknowledge that it was directly supportive of, if not responsible for, the current attacks against Georgia’s cyber assets. Whether or not Russia reacts on the diplomatic front this cyber war has the potential of escalating rapidly if Estonia gets involved."

Other comments posted were fully supportive of the Estonian position, ranging from "Go Estonia!" to "Kudos to Estonia for sending those cyber security advisors to Georgia." Another post warned: "Russians in some of the forums are taking notice of this IP change also, let's see the outcome."

[Stan]

Nato's cyber defence warriors

An Italian sergeant, who looks young enough to still be at school, is painstakingly scanning emails that have been automatically quarantined because they contain buzzwords like "Nato secret".

A glance over his shoulder reveals emails to and from Sarajevo, Baghdad and Kabul, evidence of Nato's newly expanded horizons.

They look innocuous enough and most of the time, explains the sergeant, it is a false alarm but sometimes even quite senior officers have transgressed and they get a serious talking to about online security.

Serious threats

When it comes to cyber espionage, Nato officials refuse to say who they think is behind the attacks, in fact our escorts can hardly wait to steer us off the subject.

[kaur]

Last year, the Russian Federation led the countries of the world as the source of spam messages that are filling up email boxes everywhere, just one of the ways in which computer operators in that country represent a threat to the users of the world wide web, according to the annual report of a leading Russian Internet monitoring organization.

http://windowoneurasia.blogspot.com/...mes-world.html

[cabanab]

Whats the line? If you're not target, you're target practice. This is no different than recon for the next wave of attack. Thanks for the story.

[cabanab]

Russia - 3 wins and no loses in the cyerwar arena
http://www.guardian.co.uk/technology...nternet-access

[BobKing]

In Cyber Command - Why Stop There? I pose for discussion the creation of a new force. A "CyberSpace Force", created from the other services for space and cyberspace operations, just as the Air Force was created in 1947.

The full article is too long to post here. An abridged excerpt is listed below - I encourage anyone interested in the topic to visit the Joint Chatter blog and offer your comments.

---------------------

The Pentagon is likely to take the rare action of adding a new combatant commander, this one for cyber warfare.

Why stop there?

Why create just a cyber combatant command? Why not step back and consider whether a more substantial reorganization is needed?

Last year the term cyberspace was officially defined and last fall elevated to a new domain.

cyberspace - A global domain within the information environment consisting of the interdependent network of information technology infrastructures, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers. (CJCS CM-0363-08)

To further the discussion, it is also necessary to present the definition of another domain medium from the same publication:

space - A medium like the land, sea, and air within which military activities shall be conducted to achieve US national security objectives. (JP 3-14)

With all of the redundancies across the various services, why not consolidate them into a new service? Analogous to the National Security Act of 1947, which created the Air Force from the Army Air Force, a 21st century reorganization could create a CyberSpace Force. (The exact name is not significant, using CyberSpace Force as a generic moniker.) This new force, formed from components in all of the services, would concentrate the existing disparate and duplicative efforts into one organization. No service would lose capabilities, because we fight as a Joint team now. Personnel from the newly created force would join operations and command structures as dictated by mission requirements.

As it exists right now, each the services are devoting significant resources and efforts into solving the cyber challenges "in their own lane."

(Full blog article includes examples of redundancy)

In September 2001, a day prior to the terrorist attacks, Secretary Rumsfeld pointed out "Each service branch has its own surgeon general and medical operation. At the department level, four different agencies claim some degree of control over the delivery of military health care." in his Bureaucracy to Battlefield speech of 10 Sep 2001.

Similarly, why should each service recruit, organize, train and equip information assurance professionals and other related specialties?

Each of the services would resist this reorganization, just as the Army did over 60 years ago. Looking back, are there many today that would question the wisdom of having the Air Force as a separate service? (Funding issues and differences in MWR services aside...) In addition to eliminating redundancy, all the services would benefit in that they could each put more focus on their core mission.

I first asked this reorganization question seven years ago, while on a field trip staff ride to Colorado Springs, CO as part of a Space Operations elective. The general officer speaking to us answered along the lines of "it may happen eventually, but we're not there yet." That time it was more about a space reorganization. Last week, while in DC to attend Phoenix Challenge 2009, I asked a similar question regarding creating of a cyberspace force. Generally the response was "good idea, probably the right thing to do, but we can't afford it" and "maybe in 20 years." Others suggested that it should be an agency - incorporated into, or similar to, the National Security Agency.

If it's the right thing to do, why wait? The cumulative cost of duplicated efforts, followed by an eventual reorganization, surely exceeds the startup cost of doing the right thing now.

Additional Advantages

This new CyberSpace Force, if done right, could expand the pool of available personnel. Numerous reports over the last several years lament the shrinking percentage of high school graduates physically qualified for military service. Why does a programmer need to run 3 miles? We have an entire generation growing up comfortable using the complex controllers associated with Halo 3 and Guitar Hero, just to name a couple popular titles. Does it make sense to say to them, "Sorry, we can't use you to monitor and adjust the orbit of a satellite if you can't do 40 push-ups in two minutes?"

Consider the stereotypical images conjured up of "uber geeks", college IT support staff or attendees at a hackers convention (e.g. DEF CON): long (sometimes different colored) hair, may not pass a uniform inspection, may not even fit in a uniform. But does that mean we should keep them out of the cyber fight if they are willing to serve?

(Blog article includes links to images of DEFCON attendees)

Many Americans may choose to serve that otherwise would not consider traditional military service. As Noah Shachtman (Editor, Danger Room) said last week in his keynote speech at Phoenix Challenge: (paraphrasing) the military is not a popular option in Manhattan, but there a lot of people that want to feel like they are part of something.

This should be a service and not an agency. In our nation's defense we need the ability to send people where and when we need them - we can't afford to face the same challenges other departments have faced when necessary to send their personnel "down range."

Questions

What are the advantages and disadvantages of creating CYBERCOM as a new combatant command?

Is it time to perform a new reorganization of the Defense Department, creating a force focused on the Space and Cyberspace domains? What challenges would be faced in a large-scale reorganization? What opportunity costs do we continue to pay by a failure to address the root problems?

Further Reading

Additional references available in the full article

[selil]

Interesting concept, I guess from your comment about going to your blog you aren't interested in comments here, but I'll take a swing. I'm not very well versed in this cyber stuff, but you know what the heck.

First, I guess I'd ask the question of who this combatant command is going to fight? As a military force what are the targets it will engage? If from Krzygistan, Georgia, and Estonia we can ascertain the non-state actors were in fact non-uniformed adversaries, are you going to use a military force to attack these non-state actors? Under what purview of just-war or law-of-war will this occur? I'm just curious after all it is likely nothing but an academic excercise.

Second, if what General Lord (Cyber command provisional) said about 70 percent of all attacks being generated from inside the United States (backed up by CSI/FBI stats) will this combatant command be attacking United States companies and citizens? What effect will that have on posse commitatus or should we simply dispense with that as trivial in these trying times? I wonder where you are going to find a force that can act as an international military, a state militia, a federal crime buster, a disaster response agent, and can be found in all territories and states?

Third, this CYBERCOM combatant command will use what tools as a method of waging war? I don't want to bring up mutually assured destruction, but there it is.... My gosh I wonder what nation in a battle of the bits and bytes has the most to lose in a cyber engagement? In fact if you think about small wars, insurgencies and guerilla actions (there is really great website that looks at all that stuff) you might find the concept of an adversary using their opponents tools against them. Some guy named Nagl talked about eating soup with a knife of something like that.

Fourth, since cyber space I guess defined, as ill and mistaken as only the department of defense can butcher a well understood concept, made up by a science fiction writer (in 1984), who unfortunately is still living to laugh about it, exists. I guess since cyber space exists and is part of that woefully misunderstood information world we might think about those hundred year old treaties that talk about neutrality of the telephone system. The long standing tradition of spying but not using the telephone system of friendly neighbors to wage war. The various telecommunication acts and laws that are currently on the books protecting citizens and friendly allies should just be tossed out as well. I mean, all is fair in love and war, right?

Fifth, when you dig down past the world wide web, and burrow into the Internet heading towards the gold, you end up looking at the world bottom up. There floating below the Internet you have the kinetic aspects of military action available to your digital fingers (redundant?) and wallowing in the morass of the data stream all telemetry is accessible. Think about that wonderful global information grid "GIG" (beer barrel) model the whimsical military throws up on power point slides from times to time. As an aside does the military have some perverse relationship with power point? I like that GIG concept. All the people, procedures, transmissions, telemetry, command and control floating around in more than a bit/byte internet protocol world.

What could I do with all those command and control circuits in air bag controller systems you find in cars programmed in foreign countries? What might I do with the phase controller circuits on generators and power transmission equipment attached to a variety of networks? How could I operationalize kinetic stored power thousands of times more powerful than a nuclear weapon stored behind a major dam that is remotely controlled by the lowest bid contractor? What legal resources do you have to fight attacks against targets with minimal evidence of attribution when we can't even find paperwork for foreclosed houses?

When you operate at the C2 layer and no longer see the Internet as some be all/end all those pesky effects based outcomes (oops some general will be angry using that little phrase) become easier to operationalize. I know what we should do! Let's have a 60 day cyber investigation because 30+ years of research, literature, and recommendations just isn't enough to make a relevant decision. We need 60 days more.

I'm not sure creating a strictly hierarchical organization (likely top heavy with officers because that is the Air Force way), so an entrenched bureaucracy can slow response time, and erode effectiveness as only large organization can do, is going to be a good idea. Of course, you could make it really really really big as a large highly hierarchical organization is exactly how you should fight an insurgency that is likely following a swarm networked model of attack by intention rather than direction. It is always highly effective to have a strict chain of control in those situations where flexibility is incredibly important.

If that isn't your cup-of-tea let the National Security Administration do it along with the rest of the intelligence community. They will refuse to tell us what they are doing but they will spend buckets of money doing it. I'm not sure how the intelligence community would interact with the corporate world except to refuse to talk to them. The corporate world being the largest target of opportunity.

I'm a bit of contrarian.

[Ron Humphrey]

I'm a bit of contrarian.

But that little contrarian outburst of yours carries a couple of gems which better be looked at very carefully

[William F. Owen]

The Pentagon is likely to take the rare action of adding a new combatant commander, this one for cyber warfare.

No such thing as Cyber "Warfare." Warfare is the conduct of war. There might be "Cyber Operations," but that is not war.

Why create just a cyber combatant command?

Why indeed. Doesn't the NSA already do this?

Similarly, why should each service recruit, organize, train and equip information assurance professionals and other related specialties?

If this was indeed correct, then for the same reason each has it's own AIR, EW, and Logistic support. They are domain specific.

Why does a programmer need to run 3 miles? We have an entire generation growing up comfortable using the complex controllers associated with Halo 3 and Guitar Hero, just to name a couple popular titles. Does it make sense to say to them, "Sorry, we can't use you to monitor and adjust the orbit of a satellite if you can't do 40 push-ups in two minutes?"

because a fit body is a fit mind, and if he hasn't got the self-control and determination to get to do 40 push ups, I don't want him walking my dog, let alone part of my army.

Consider the stereotypical images conjured up of "uber geeks", college IT support staff or attendees at a hackers convention (e.g. DEF CON): long (sometimes different colored) hair, may not pass a uniform inspection, may not even fit in a uniform. But does that mean we should keep them out of the cyber fight if they are willing to serve?

They probably look like that for a reason. If they want to serve why didn't they sign up?

Yes, I am being deliberately confrontational for constructive reasons. The armed forces is a not a place for the "physically and socially challenged" and Cyber is more than likely an EW activity and folks are already doing that.

[Van]

I second the previous comments about the "Cyber" element - No Such Agency has the ball, let Congress hold their feet to the fire about performance, information sharing, operations, etc, and require them to cooperate and collaborate with the FBI for U.S. persons issues.

Re: The Space element - Tying Space (for the sake of a convienient definition from the ionosphere out [ionosphere — That part of the atmosphere, extending from about 70 to 500 kilometers; JP 1-02]) to Cyber is as fallacious as tying submarines to aircraft. Yes, there is a connection, but it is not a natural or obvious one.

This being said, space is an operational environment waiting for its Billy Mitchell. And this bears considerable thought. Had that insubordinate, and arrogant fighter jock not made his case, the air force probably would have split off eight to ten years later and along TAC/SAC lines (with transport being divided similarly) rather than taking all armed fixed wing and almost all transport. If the services accept gracefully that a Space Fleet is a clear and unavoidable necessity, we can approach the organization logically rather than emotionally, proactively rather than reactively. For exactly the reasons Douhet cites for an independent air service to be organized along naval lines, plus the similiarities between a space craft with a crew of more than a dozen (and that seems like a logical possibility in the long term) and a maritime vessel, an independent space service should be organized along naval lines. Sadly, in the U.S. the more likely scenario will be like the air force. The Air Force split off the Army Air Corps as its main body, then made up the rest as it went. I suspect the Air Force Space Ops community will break off and then stumble through the rest of their requirements in a similar fashion.

And we need to get this one moving. Orbital kinetic bombardment has sooo much potential [energy].

[BobKing]

Interesting concept, I guess from your comment about going to your blog you aren't interested in comments here, but I'll take a swing. I'm not very well versed in this cyber stuff, but you know what the heck.

While I'd certainly appreciate comments on the original article, that is not mutually exclusive with comments here. I'll continue to follow this discussion.

Many of your points are irrespective of what organization does this. These type of operations are already occurring. So the questions you pose are beyond theoretical.

As far as Posse Comitatus, that Act had the intention of "substantially limiting the powers of the federal government to use the military for law enforcement." The oath taken by every military member includes the phrase "I will support and defend the Constitution of the United States against all enemies, foreign and domestic" (emphasis added)

There is a significant difference between enforcing the law and protecting the nation. I'll give you that our world is becoming more complex and it's getting more difficult to clearly identify those lines.

The intent of my article was not to address or question the legal issues. Rather, assuming this is going to happen anyway, what is the best way to accomplish the mission?

Tying Space [...] to Cyber is as fallacious as tying submarines to aircraft.

To a certain extent I agree with you, but the various specialties within the two fields have more in common than they do with most of the other military professions. I considered suggesting splitting off two services, but saw that as a "bridge too far" from our current organization.

Perhaps it could be organized as one at first, with an underlying premise that as manned spaceflight becomes more prevalent, a future split would follow?

An entire essay could be written just on the redundancies across all of the services in the area of space. I doubt the other services would stand idly by and agree to let their capabilities be absorbed by the Air Force, so creating a new force may be the only viable solution to streamlining space operations.

No such thing as Cyber "Warfare." Warfare is the conduct of war. There might be "Cyber Operations," but that is not war.

William - I understand your objection. That was a direct quote from the source article referenced. That subject of "[adjective] Warfare" and "[adjective] War" is central to ongoing discussions here at Small Wars Journal and our own CAC blogs at Fort Leavenworth. Example: The Nature of War: Has it Changed Fundamentally? and On War Modifiers (updated)

Oh, someone might want to tell the Estonians! They have a very high profile conference coming up in June - Conference on Cyber Warfare. The call for papers is long past, but it might not be too late for them to change the name.

...a fit body is a fit mind, and if he hasn't got the self-control and determination to get to do 40 push ups, I don't want him walking my dog, let alone part of my army. [....] They probably look like that for a reason. If they want to serve why didn't they sign up? [...] The armed forces is a not a place for the "physically and socially challenged"

This is where I vehemently disagree with you. First, they would not be in "your army" - they would be in some new organization, something completely unlike anything that currently exists.

Second, I know many people that are healthy - perhaps even "fit" - but that would never succeed in our current military due to their natural body composition. I utterly reject the "they have to look like me" mentality embraced by promotion and selection boards.

Third, our country and our military has changed over time. Minorities and women, widely represented throughout all our services and rank structures, were not always welcome.

I'm not suggesting changing the mold. I'm suggesting creating an entirely new one, with a new purpose and with a broader net.

To all - thanks for the discussion thus far.