President Donald Trump released his Making Our Military Strong Again and America First Foreign Policy last week, which hint at potential changes to the Federal cybersecurity community.
Trump said that his administration will use offensive and defensive cyber tactics to combat the Islamic State.
“The Trump Administration will work with international partners to cut off funding for terrorist groups, to expand intelligence sharing, and to engage in cyberwarfare to disrupt and disable propaganda and recruiting,” the America First Foreign Policy statement said.
Trump’s administration has yet to include any more specific details about how the United States’ cyber capabilities will be used.
Maj. Gen. Brett T. Williams is the president of operations and training at IronNet Cybersecurity and the former director of operations at Cyber Command, who wrote the Joint Force Commander’s Guide to Cyberspace Operations in 2014.
“Cyberspace offers us new and unique opportunities to exercise elements of national power in support of security objectives and it offers large potential benefits for business and our personal lives,” said Williams. “With those benefits come substantial risk, particularly in the realms of security and privacy. Trying to add ‘cyber’ to everything in order to get a bigger share of the budget or trying to equate cyber to offensive operations is not useful in framing the larger issue of how we take advantage of cyberspace while at the same time we manage the risk.”
There has been confusion about the term “cyber” because it refers to a broad field. Williams said the term is often misused.
“There is no such thing as ‘the cyber,’ ” Williams said. “Cyber is not a verb or an adjective nor should it immediately connote offensive attack operations. Cyber is best used as part of the compound word cyberspace which simply defines the domain or environment we create by hooking together all of the servers, switches, routers, and other components that make up cyberspace. Basic concepts of national security and economic strength do not change because we now have cyberspace.”
Trump hinted at plans to elevate U.S. Cyber Command (CYBERCOM) in his Make Our Military Strong Again statement.
“Cyberwarfare is an emerging battlefield, and we must take every measure to safeguard our national security secrets and systems. We will make it a priority to develop defensive and offensive cyber capabilities at our U.S. Cyber Command, and recruit the best and brightest Americans to serve in this crucial area,” the military policy statement said.
CYBERCOM operates in a dual-hat system with the National Security Agency. Congress in December expressed interest in separating the two agencies in order to give Cyber Command more independence, by passing a defense bill that would elevate the agency.
“Cyber Command relies heavily on NSA for intelligence support to operations, but the CYBERCOM mission is separate and distinct from the NSA mission,” Williams said to MeriTalk in an email. “Separating the dual hat would emphasize that distinction, clarify the requirements for training and equipping the cyber mission forces distinct from the national SIGINT (Signals Intelligence) forces and help normalize cyberspace operations with operations in the other domains—land, air, maritime, and space. The challenge in separating the dual hat is to make sure that the close collaboration that exists today, especially at the tactical level, is not lost.”
Adm. Michael Rogers heads the NSA and Cyber Command under the dual-hat system. If Cyber Command became separate it would be a command unit, equivalent to U.S. military units such as the Central and Pacific Commands.
“Cyber Command would not have matured to the place where it is today without being closely integrated with NSA,” said Williams. “That said, Cyber Command and NSA have fundamentally different missions. NSA has a strategic intelligence mission that is partly responsive to DoD and mostly responsive to the President. Cyber Command is an operational military command with specific missions to defend the homeland, operate and defend DoD networks, and plan and execute offensive cyberspace operations in support of combatant commanders.”
The Federal hiring freeze applies to executive agencies, including the Defense Department, which carries the NSA and Cyber Command under its umbrella. The freeze affects civilians in the DoD, which would make it difficult for agencies to find civilians with cyber talent to work for the Federal government.
In order to acquire more Federal cyber talent, the government must reach out to students, according to Williams.
“The military actually has pretty good success recruiting both officers and enlisted personnel to work in cyberspace operations,” Williams said. “We would like to have a more robust pool of candidates who do not require us to relax admission standards, so there must be a continuous effort to recruit from a broader pool at both the high school and university level.”
The private sector has the advantage in attracting cyber talent because it can offer higher salaries and less wait time, since prospective government employees must wade through the backlogged background investigations system before they can start working. The Office of Personnel Management has made some progress on this by designating a new bureau to handle clearance backlogs and launching a website that lists all of the available Federal cyber careers.
“Like any other company, DoD has a training burden to get them up to speed to handle the DoD mission,” said Williams. “The challenge is retention. We cannot offer enough money to overcome the draw of the civilian sector so we have to work on retaining people who want to lead, want to continue to be part of the national security team and people who like doing special, advanced things that can only be done in a government position.”
Editor’s Note: This story has been updated to clarify the status of Cyber Command.
