Col Brian Russel (ret)
“We were ‘owned’.” Two weeks into supporting US and Ukrainian naval forces during exercise Sea Breeze in 2021, my information warfare chief reported that a Russian-affiliated hacker had infiltrated Ukrainian government computer networks, retrieved sensitive information about our marines, and posted their personal information on a public website. The incident was equal parts security risk and embarrassing. This hack and release event fell short of the US 6th Fleet Commander’s intent to win the information fight during this strategic Black Sea engagement. Fortunately, my chief was adept enough to conduct the functional equivalent of a cyberspace attack against the offending content, removing it from the public site hosted half a world away within in a matter of hours.
How did this marine, who was not a member of the cyber mission force at the time, accomplish this worldwide strike? Because he was skilled in cyberspace operations from his previous assignment at the Marine Corps cyberspace component. This meant he could pick up the phone and reach people who could affect the cyber domain quickly and decisively, with capabilities he knew to ask for to maneuver against the Russian-aligned threat. In other words, he leveraged effects in one domain and theater to help a commander achieve a relative advantage over an adversary in another domain and theater…the essence of all-domain maneuver.
This is just one example of many imaginative and effective cyber-enabled, multi-domain actions I have observed. Harnessing the digital connectivity and borderless freedom of cyberspace let my units outmaneuver opponents across other domains and is a perfect illustration how digitally enabled operations can lead to decisive advantages against adversaries. It is time to scale this cyber-enabled potential across the joint force – beyond the relational and happenstance and formalize it into a replicable, all domain maneuver capability.
Two recent developments within US Cyber Command, one doctrinal and the other capability-based, hold the promise to turn this revolutionary potential into reality. The Department of Defense needs to prioritize the implementation of expeditionary cyberspace operations and the integrated development of the Joint Cyberspace Warfighting Architecture. This concept and weapon system can serve as the foundation of all domain maneuver, if developed and implemented correctly. In this article I describe the operational advantages of building this weapon system with the tactical edge in mind, giving it inherent technological malleability, and leveraging the latest in artificial intelligence to finally grow cyberspace operations to the needed scale.
Bridging the strategic and tactical cyber divide
In the latest edition of Cyber Defense Review, Paul Schuh offers a glimpse into how cyberspace can serve as the core of all domain maneuver. In his piece “Expeditionary Cyberspace Operations,” he describes the importance of physical proximity to a target system because the cyber mission force cannot reach all points remotely. The nature of some targets requires someone or something to be close enough to the target to access its networks for continued cyberspace operations against it. This means a cyber operator, usually in the continental United States, must coordinate with that entity across multiple geographic combatant command boundaries to conduct the operation. Implementing this concept means joint forces will be connected in real time across the globe and able to act in synch at the speed of need – a true 21st century combined arms approach. While expeditionary cyberspace operations doctrine only envisions elements of the cyber mission force affecting this global connectivity, the concept’s true potential will only be realized if it makes room for as many elements of the joint force as possible. The cyber mission force simply doesn’t have the depth to find and exploit all opportunities by itself.
During my last assignment with US Cyberspace Command, a cyberspace marine discovered evidence of a rogue nation state violating international sanctions during his mission. This marine “tipped” that information to a friend (not a cyber marine) with a forward deployed task force. The task force then intercepted the illicit activity as the first action in what became a sustained, whole-of-government sanctions enforcement effort. This is the kind of cross-domain agility needed to outpace and overmatch peer adversaries. This mutual alignment between tactical and strategic forces is a capability US adversaries can’t possibly match, especially when integrated with allies and partners.
Using cyberspace to link forces with common interests across the globe, will enable commanders to maneuver at an unprecedented scale. Maneuver in the sense of achieving and maintaining multiple forms of relative advantage (positional, temporal, psychological) over an adversary. In terms of all domain maneuver, cyberspace’s ubiquity across the joint force and society enables it to “see” across the other domains. Operators in this domain are often the first ones to identify and exploit opportunities that give the joint force relative advantage over adversaries. Coordinated cyberspace operations, enabled at scale across other domains, will be a force multiplier.
In my last commentary in this on-line journal, my co-authors and I reflected on our experience fighting ISIL in the cyber domain and described a vision for how cyberspace could let the joint force maneuver against multiple components of an adversary system even when they were dispersed across the globe. This emerging cyber doctrine and capability makes it possible to realize the ability to maneuver globally against all the threats laid out in the latest national defense strategy. Perhaps we are asking too much of cyber from a deterrence perspective, but considering the latest joint concept for competition, cyberspace operations seem extraordinarily well suited for the “persistent and long-term struggle” to find and maintain competitive advantage over adversaries. As a global domain, cyberspace is also well suited to close the geographic seams often exploited by those same adversaries.
Leveraging the two Ts: Cyberspace Technology AND Talent
While expeditionary cyberspace operations doctrine holds immense promise to revolutionize all-domain operations, a true capability needs the right combination of materials and personnel to be effective. The Joint Cyber Warfighting Architecture, hereafter described as the cyber warfighting platform, can be the right weapon system to enable all domain maneuver. However, for true operational advantage, the platform must be built with inherent malleability. Malleability allows the immediate introduction of new technology into the platform and for users to modify said technology in response to changing mission needs. This will be a radical, but necessary, departure from historically slow defense department programs of record development. In light of US Cyber Command’s recent acquisition authority and the command’s innate cyber talent pool, there is no better place to implement the emerging trend of software-based weapons development than this cyber warfighting platform.
The cyber warfighting platform is US Cyber Command’s unification of disparate systems the cyber mission force has aggregated over the years to plan, train, rehearse, and conduct cyberspace operations. Parallels with more traditional domains are difficult to draw but think of the platform as a combined F-35 simulator, hangar, flight line, air traffic control system, and airspace. An F-35 pilot needs to go to the simulator building for training, then go to the hangar to check out the aircraft, taxi that aircraft to load weapons, and then follow the instructions of the tower to take off into assigned airspace. It is much simpler for the cyberspace operator using a properly designed cyber warfighting platform. That individual will “check out” their platform station and have immediate access to the weapons or other tools needed for the mission, an ability to train on that mission right from the platform terminal, and when ready to “fly,” will have assigned pathways through cyberspace to reach and then affect the assigned target. It is certainly an immense engineering challenge to integrate all the legacy cyber systems and give the cyber warfighting platform this broad functionality. But that effort will be made a lot easier if it is built with an ability to rapidly integrate emerging technology by leveraging the talent of platform users.
After years of serving in US Cyber Command, I realized that cyberspace forces can distinctly alter the terrain to achieve operational advantage more than other warfighting domains. I worked with cyberspace operators and developers who were brilliant at modifying network architectures for resiliency, efficiency, and effectiveness. Following that assignment, I discovered this kind of talent is not restricted to the cyber mission force. There were marines in my formation who loved to code and used their off time to improve this skill. Although it wasn’t their “day job” they would develop scripts to automate a process that frustrated them at work or develop applications to present information in easier to read formats. In one case, a script developed by one of these marines became part of the current cyber warfighting platform tool arsenal. Organizational process like the Agile methodology and DevSecOps are no longer just buzz words from the commercial information technology sector. The ability to quickly engineer, test, and deploy a new capability into the cyber warfighting platform is a critical mission requirement to adapt at the speed and scale called for in the latest Department of Defense cyber strategy.
The operational advantages of a cyber warfighting platform that helps the joint force rapidly identify and exploit adversary vulnerabilities are evident. Tipping and cueing opportunities across the joint force using cyberspace as its hub and “flying” rapidly tailored cyberspace operations anywhere on the planet presents a myriad-pronged approach the nations’ adversaries will be hard pressed to match. However, the real revolution of this capability comes from enabling the talent of the service member. Military innovation at this scale is a human endeavor, and the individual is the nation’s greatest strategic advantage. The cyber warfighting platform must give those service members the most effective and efficient means of accomplishing their mission. This includes allowing them to change the platform itself when they recognize an improvement should be made and they have the skills to adjust it themselves.
Beyond operational advantage, cyber warfighting platform malleability will go a long way to retain cyber talent. US Cyber Command commander General Nakasone has said the best thing he can do to keep cyber talent is to give them missions to perform. While true, if cyber talent struggles performing those missions due to antiquated technology, they may look for greener pastures. A common lament I heard from operators was they could conduct more effective cyber operations at home on their own computer than in the mission center. It’s time to give these operators the “5th generation” cyber platform they deserve.
Technology talent exists across the military services and reinforces my original argument that the cyber warfighting platform needs to be developed with more than just the cyber mission force in mind. The recent implementation of software factories means the services, not just the cyber mission force, are major stakeholders in cyberspace capability development. If the platform is developed with this in mind, the joint force will be able to conduct global target spotting and engagement faster than its competitors and accelerate the enhancement of the platform itself. It would be like the ultimate crowd sourcing of the platform development giving it the speed and scale to continuously out cycle adversary capability improvements.
A place for artificial intelligence to provide immediate value…
Speed and scale, the ability to rapidly shift joint forces and capabilities across the globe at a time and place of the nation’s choosing, is the essence of what this new platform can enable. Building that level of agility into the platform will require adoption of the latest artificial intelligence and machine learning tools. Given the advances in AI technology just over the past year, the Department of Defense is on the precipice of another revolution in military affairs. The latest developments in the cyber security field alone show that cyberspace understanding and response, even for the non-cyber expert, is getting easier and faster. While the department remains cautious by its “human in the loop” approach, the cyber warfighting platform needs to automate as many routine tasks as possible: write code, discover security issues, document mission information and so much more. This kind of automation will free the humans to enable and scale the global “tipping and cueing” called for by all domain maneuver.
Months before supporting Ukraine in exercise Sea Breeze 21, my cyber protection forces were busy defending against advanced persistent threats. The adversary was trying to infiltrate our forward deployed network nodes, which were supporting key Nordic allies in a separate exercise. This cyber team was able to successfully detect the threat, and pinpoint where the threat was coming from. We phoned US Cyber Command to request forces “hack back” to stop the persistent attack threatening out network. Unfortunately, we received the cyber equivalent of a busy signal. There was no cyber mission force currently assigned or available to shift to that target to help us stop the attack. Even if a team had been available, its ability to “lift and shift” wouldn’t have happened at the speed of need. Naturally, situations like this demand change, and the automation brought about by developments in cyber warfighting artificial intelligence to automatically find targets, determine a path in cyber to access the target, and weaponeer a firing solution, is the way to get there.
Global, all domain maneuver enabled by a cyber warfighting platform that is constantly evolving at the pace of technology and in advance of adversary adaptation is a compelling argument in and of itself. Artificial intelligence may finally tip the scale to give cyberspace forces a dominating advantage. Using the F-35 analogy, an artificial intelligence enabled platform will give a cyberspace operator multiple take off airfields and flight paths to the target. That same operator will be able to change the signature of the aircraft in relation to the target environment being flown in, at any time. And that same operator will be able to have multiple weapon loads available, that can change in flight, again, at any time. This is how the cyber mission force will be able to persistently out compete the troll farms and hacker armies of our adversaries. And the platform will finally get U.S. Cyber Command out of the “mother may I” business of borrowing similar capabilities from other government agencies to conduct cyberspace operations which in itself limits operational flexibility and speed.
When this capability is paired with all the other weapons in other domains across the joint force, and with our partners and allies, the nations adversaries won’t be able to cope with the speed and scale of this multi-pronged horns of a dilemma. Considering the cost of this software-enabled platform is pennies on the dollar compared to those other domain weapons systems, its surprising Congress hasn’t forced US Cyber Command and the services to immediately unify the platform. What commander wouldn’t want to “own” their adversaries in this way?
It can be done…
Skeptics of the power of cyberspace operations and those who have not benefitted from direct exposure to those operations may believe too much is expected of cyber and this can’t be done. It can. The time is right to make cyber-enabled all domain maneuver a reality. The joint force, globally postured and in constant contact with adversary forces in competition, is primed for the implementation of expeditionary cyberspace operations to link strategic and tactical opportunity exploitation across domains. The cyberspace talent in the cyber mission force and across the services connected by an inherently malleable cyberspace weapons platform will not only help the joint force seize those opportunities at the speed of need, but also result in an ever-increasing enhancement of the platform itself to stay one step ahead of the nation’s adversaries. And when paired with the latest in artificial intelligence technology, commanders will be armed with a revolutionary capability to truly “own” their adversaries across the competition continuum.
Brian Russell is the founder of Information Advantage and a Key Terrain Cyber Senior Fellow. He is a retired Marine Corps artillery officer, with previous assignments as the commanding officer of II Marine Expeditionary Force Information Group (II MIG) and 1st ANGLICO. His combat deployments include serving as the Military Transition Team Leader in Habbaniyah, Iraq, the executive officer of Brigade Headquarters Group in Helmand Province, Afghanistan and Plans Director in Bagram, Afghanistan. Some of his notable staff assignments include: Operations Directorate at Marine Corps Special Operations Command, Operations Directorate at United States Cyber Command, and U.S. Plans Directorate at Marine Corps Forces Cyberspace Command.
This site is free for everyone to learn about information warfare, connect with mentors, and seek the high ground! Unfortunately operating the site is not free and your donations are appreciated to keep KTC up and running. Even a five or ten dollar donation helps.
