Air Force Strategy for Cyberspace (2007)
Content
Air Force Strategy for Cyberspace
Lt Col Forrest B. Hare The Air Force needs a vision, badly. Glossy pamphlets created by contractors and filled with short bumper stickers and pictures of fighter jets do not suffice to motivate nor provide substantive guidance to our nation’s Airmen. A strategic vision must be developed, debated, and embraced by the Service for that vision to have any relevance to anyone outside the small circle in which it was created. In the case of cyberspace, it seemed that everyone looked to the Cyberspace Task Force to develop the strategic vision for the Service. During its one and a half year existence, the Task Force accomplished three things: it developed a consensus within the Air Force (AF) that cyberspace is a physically-occurring, warfighting domain1; it generated a sense of urgency to improve the AF’s ability to contribute to the fight in cyberspace; and it forced change by endorsing the creation of a Major Command2 for the domain. This list may not seem like much, but it took extra-ordinary effort to develop any level of consensus amongst AF senior leadership that the AF enterprise dedicated to cyberspace capabilities must be improved. It also no small feat to try to spread this message to an Air Force of 680,000 personnel scattered across the globe. Unfortunately, the Service has been amazingly unsuccessful at taking the debate to the next level. Few beside the designated torch bearers have been willing to engage the debate in an objective manner3. What should have happened as a result of the Task Force’s actions was a critical assessment across the Air Staff and the Air Force as to what the Service role in the domain should be. We should have begun discussions across the Air Force about what warfighting in cyberspace should mean to the Service and how a MAJCOM might (or might not) improve the ability to fight there. Instead, Rufus Miles's famous law, "Where you stand depends on where you sit," has driven the debate. All we have continued to do is ask each other, "What programs and units will be assigned to the new command?" In other words, the discussions have only been about rice bowls. As a result, the AF is now forging ahead with planning for a Major Command that is in danger of reaffirming cyber myth number #1: “This is just about the communicator and intelligence communities with their toys4.” But is this truly the case? The implications of developing the command in this direction cannot be recognized without a larger debate on the Air Force strategy for the domain. The intent of this essay is to energize this debate. The next section presents a potential picture of where the Service can be in cyberspace twenty years from now. This end-state is multifaceted with each sub-objective having different implications for the strategy to achieve the end-state. This discussion is followed by an argument for immediately undertaking
A “warfighting” domain means a place like the land and sea, not a concept such as physics or art. It is unfortunate, but not surprising that so few people in the Air Force understand the specific roles of service major commands. For those who are not sure they know, perhaps a description can be found in notes from a PME course. 3 This work is not intended to slight the efforts of several advocates such as 8 AF and the AF Doctrine Center. However the former has limited shouting distance as a Numbered Air Force, and the latter does not create strategy. All the torch bearers need more support. 4 Hare, Forrest B. 2006. “Five Myths of Cyberspace And Cyberpower.” Signal Magazine. July, 2006. http://www.afcea.org/signal/articles/templates/Signal_Article_Template.asp?articleid=1333&zoneid=209
2 1
three critical steps to achieve the proposed end-state. Hopefully it is not too late to engage this debate before the Service embarks on a path that leads to a dead end about a half an hour north of the Beltway. Where does the AF want to be in 2027 in the Cyberspace domain? This is a question that must be answered as a first step in developing the Air Force’s overall strategy. This section will identify several goals for the AF to achieve in the next twenty years. The AF must gather a broad consensus on this issue so the right people can begin working on the right tasks and clear up many misperceptions - the largest misperception being that the AF wants to be the “Executive Agent (EA) for the domain” which is a hollow claim and therefore not executable5. However, before establishing the end-states, two premises or fundamental factors must be addressed. The end-state proposed below is influenced by two fundamental factors; the intent of Service senior leadership, and the unique strengths of the US Air Force. ! Intent of AF senior leadership: In the first meeting the Cyber Space Task Force held with the Secretary of the Air Force in January, 2006, SecAF made one point clear to them, “We are not laying claim to the domain.6” He was adamant that he wants the Air Force to build its competencies for cyber warfare so that, if and when it is called upon to play a larger role of defending our nation in the domain, the AF is prepared. Developing expertise in the cyberspace domain will ensure a lasting role for the Air Force as the fights in all three domains, air, space and cyberspace, continue to transform. Unique Strengths of the Air Force: The Air Force must build upon its capabilities and talents that are independent of the other Services and the inter-agency community. For example, though the skills required to conduct computer network exploitation and network operations are fundamental to building expertise in the domain, focusing on these areas alone would result in duplication other agencies’ core competencies. For the Air Force to assume any leadership role in cyberspace, it must build beyond this level by integrating air and space assets in its strategy for the domain.
!
Desired End-State The desired end-state for the Air Force in cyberspace has several objectives related to the different operations that occur in and through cyberspace. Each one must be addressed in detail because the Service’s roles in relation to the joint force will vary by objective. ! Ensuring freedom of action (cyberspace superiority) o The Air Force will provide the joint force with robust, battle-tested options for denying the adversary freedom of action in cyberspace and countering their ability to affect our operations in the domain. These options will be
Executive Agency for specific roles is attainable and this essay presents one possible example. The author was a member of the Cyberspace Task Force and was in attendance at the meeting with the Secretary of the Air Force in January, 2006.
6 5
adaptable and available whenever and wherever an aperture or access point to the domain can be gained and maintained. The access methodologies will include line of sight, electronic attack-enabled and the ability to penetrate closed systems on the battlefield. Though the Air Force is often looked at as a tactical level “enabler,” these capabilities will allow the Air Force to provide additional sovereign, strategic options that will contribute to our robust global strike capabilities. We will provide a strategic, rapidly responsive, deterrent force in all our operating domains. Robust, battle-tested capabilities will be developed through a standardized, AF weaponization process with close interaction between the lead MAJCOM organizations, the warfighters, and the Air Staff. o In addition to its traditional role for air and space assets, the AF Component to Combatant Commanders will organize, train, and equip the air and space operations centers (AOC) to be prepared to C2 delegated cyberwarfare assets. Therefore, on order (scenario dependent), the AF will be prepared to be designated the component responsible for air, space, and cyberspace superiority in a joint fight. As in the case for Air and Space Superiority, the COMAFFOR will be prepared to integrate the cyberwarfare assets of other services through the AOC. This role will include integration, coordination, and synchronization of combat operations in cyberspace. Again, as in the case of air superiority, this does not imply that the Air Force is the only service with fielded capabilities to fight in the domain. o On order (scenario dependent), the AF will be prepared to assume the role of cyber defense and operations coordination for the joint force. In this role, the AF is not assuming responsibility for defending the other Services’ use of the domain (as we do not conduct fleet defense). However, we will defend our service portion of the domain effectively, and coordinate the efforts of all other users of the domain so that friendly freedom of action in cyberspace is assured. This role includes coordinating use of the electromagnetic spectrum and negating the operational impact of attacks to networked infrastructure among other missions. Again, the AOC will be prepared to assume this role, and we will OT&E our operation level forces, and those of other services who attend the AOC training course, for this role. o In support of Homeland Defense, the Air Force will be prepared to act as a lead service for JTF-Global Network Operations and other missions that extend beyond defense of the DoD global information grid. This role could grow to encompass such functions as providing fuzed assessments of threats and fielding deployable, multi-lingual cyber defense response teams to crisis locations. o The AF will be the service of choice for conducting intelligence and forensic analysis for the cyberspace superiority mission sets. Leveraging the proven analysis provided by AF ISR Agency, National Air and Space Intelligence Center for life-cycle employment of air and space capabilities,
and Defense Cyber Crime Center leadership in forensic analysis, the AF will be able to most effectively support the employment of AF and joint cyberspace warfighting capabilities. The emergent nature of the fight in cyberspace calls for their close integration to adapt and respond to agile adversaries. ! Conducting Cross-domain operations through cyberspace o AF forces operating in cyberspace can have direct effects on operations conducted on land, in the air, in space, and at sea7. The Air Force will build on its ability to plan and execute strategic attack and interdiction operations by expanding options executed through cyberspace. These operations will be conducted against targets that achieve joint force objectives for superiority in the other physical domains. These operations will be integrated in the same manner the Air Force conducts crossdomain operations with air warfare. This integration does not imply being limited to a 96 hour cycle since a global strike operation, integrated through the AFSTRAT AOC, must be available at any time. ! Establishing and Leveraging the Domain to Support all Operations o The Air Force, and the joint warfighter, require highly survivable, expeditionary cyber capabilities to conduct global operations. Therefore the Air Force will have the capacity to extend cyberspace, whether via the EMS or physically connected systems, anywhere the AFFOR conducts operations. o Ever increasing dependence on cyberspace to conduct all air, space and cyber operations, has driven the AF to build a solid base of technological expertise. Building on the AF’s extensive expertise in establishing, maintaining, and securing cyberspace infrastructure for air and space networked-operations, the Air Force intends to be the executive agent for developing cyberspace infrastructure. These infrastructure systems will be resilient, interoperable, and defensible. Leading this mission will posture the Air Force to effectively defend its portion of the GIG, and improve the ability of the entire joint force to maneuver in the domain when our use is contested. How do we get there? As a Service there are many steps that must be taken to organize, train, and equip AF forces to reach the end-state described above. However, to prepare for the roles and missions debate in the upcoming Quadrennial Defense Review, there are three important steps that must be taken immediately.
By direct effect it is meant that the effects are not achieved indirectly through degradation of the leadership’s ability to command and control the operations (their cognition), they can be achieved directly against targets in those domains. An example of conducting such an operation through cyberspace would be jamming an RF signaling device on a transportation control system.
7
!
Continue educating the Air Force. The first thing that must be done is that which will take the longest- spread the word. Even after two years with the term in our mission statement, few members of the Service even have a general understanding of cyberspace as a domain in which we operate, let alone the strategy for a future role. If the Air Force intends to treat cyberspace on par with our other three domains, the vision should be disseminated in every forum possible from PME seminars, to accessions programs, to commander’s calls. In preparing for these events, the instructors should not rely on their previous assumptions about cyberspace. This is not just about the Internet and network operations. Demonstrate the commitment to dedicate resources. The next thing that must occur is a change in the Air Force culture. This change will also take a long time, but without a major shift, there will be resistance to implementing any strategy at every point along the way. Unfortunately, logic does not cause a shift in culture, money does. The best way to get people to embrace change, is to show them a value in dollar terms for doing so. The shift cannot be a shuffling of programs currently within the information superiority and communications portfolios. The re-allocation has to be an “inter-domain” shift. Until the Air Force demonstrates a willingness to move resources within its own portfolio, neither the rest of DoD, nor even most AF service members, will begin to accept that the Air Force culture must and will change. Do the MAJCOM right. Regardless the exact list of what is “in” and what is “out,” the command will not posture the AF for a lead role in the domain unless it improves the AF’s advocacy for those mission areas that achieve direct effects on our adversaries in cyberspace. The AF employs these capabilities from ground stations and airborne platforms which means that the command must necessarily advocate for airborne (and space?) assets. Such capabilities must be “in,” or the Air Force will accomplish nothing more than taxing the existing MAJCOM staffs to generate another command for ISR and communications. The Air Force already had a major command for each then decided to make them both field operating agencies. A need to reverse those decisions alone does not follow from the proposed end-states articulated above.
!
!
Conclusion The Cyberspace Task Force has concluded its work. The entire Air Force must now engage the debate and help to craft the Air Force’s future in this domain. The end-states need to be defined, and the Service must commit to a path to achieve the identified goals. This essay presented a recommendation for potential goals over the next twenty years and three critical steps that must be taken immediately to achieve them. With a commitment from across the AF enterprise, the Service can posture itself as the lead in the nation’s fight for cyberspace superiority. It may also be looked to as the expert for establishing and using the domain for the joint fight. But the Service must demonstrate this commitment with clear actions before the entire national security community will recognize the Air Force’s leadership role. Perhaps more so than in air and in space, everyone in the AF will play a role in this endeavor.
The first role that must be played is the role of a strategist. Whether you have played such a role traditionally, or are merely excited about the potential for the Air Force in the domain, now is your chance to shape the future. We’re still on the ground floor.
Lt Col Forrest B. Hare The Air Force needs a vision, badly. Glossy pamphlets created by contractors and filled with short bumper stickers and pictures of fighter jets do not suffice to motivate nor provide substantive guidance to our nation’s Airmen. A strategic vision must be developed, debated, and embraced by the Service for that vision to have any relevance to anyone outside the small circle in which it was created. In the case of cyberspace, it seemed that everyone looked to the Cyberspace Task Force to develop the strategic vision for the Service. During its one and a half year existence, the Task Force accomplished three things: it developed a consensus within the Air Force (AF) that cyberspace is a physically-occurring, warfighting domain1; it generated a sense of urgency to improve the AF’s ability to contribute to the fight in cyberspace; and it forced change by endorsing the creation of a Major Command2 for the domain. This list may not seem like much, but it took extra-ordinary effort to develop any level of consensus amongst AF senior leadership that the AF enterprise dedicated to cyberspace capabilities must be improved. It also no small feat to try to spread this message to an Air Force of 680,000 personnel scattered across the globe. Unfortunately, the Service has been amazingly unsuccessful at taking the debate to the next level. Few beside the designated torch bearers have been willing to engage the debate in an objective manner3. What should have happened as a result of the Task Force’s actions was a critical assessment across the Air Staff and the Air Force as to what the Service role in the domain should be. We should have begun discussions across the Air Force about what warfighting in cyberspace should mean to the Service and how a MAJCOM might (or might not) improve the ability to fight there. Instead, Rufus Miles's famous law, "Where you stand depends on where you sit," has driven the debate. All we have continued to do is ask each other, "What programs and units will be assigned to the new command?" In other words, the discussions have only been about rice bowls. As a result, the AF is now forging ahead with planning for a Major Command that is in danger of reaffirming cyber myth number #1: “This is just about the communicator and intelligence communities with their toys4.” But is this truly the case? The implications of developing the command in this direction cannot be recognized without a larger debate on the Air Force strategy for the domain. The intent of this essay is to energize this debate. The next section presents a potential picture of where the Service can be in cyberspace twenty years from now. This end-state is multifaceted with each sub-objective having different implications for the strategy to achieve the end-state. This discussion is followed by an argument for immediately undertaking
A “warfighting” domain means a place like the land and sea, not a concept such as physics or art. It is unfortunate, but not surprising that so few people in the Air Force understand the specific roles of service major commands. For those who are not sure they know, perhaps a description can be found in notes from a PME course. 3 This work is not intended to slight the efforts of several advocates such as 8 AF and the AF Doctrine Center. However the former has limited shouting distance as a Numbered Air Force, and the latter does not create strategy. All the torch bearers need more support. 4 Hare, Forrest B. 2006. “Five Myths of Cyberspace And Cyberpower.” Signal Magazine. July, 2006. http://www.afcea.org/signal/articles/templates/Signal_Article_Template.asp?articleid=1333&zoneid=209
2 1
three critical steps to achieve the proposed end-state. Hopefully it is not too late to engage this debate before the Service embarks on a path that leads to a dead end about a half an hour north of the Beltway. Where does the AF want to be in 2027 in the Cyberspace domain? This is a question that must be answered as a first step in developing the Air Force’s overall strategy. This section will identify several goals for the AF to achieve in the next twenty years. The AF must gather a broad consensus on this issue so the right people can begin working on the right tasks and clear up many misperceptions - the largest misperception being that the AF wants to be the “Executive Agent (EA) for the domain” which is a hollow claim and therefore not executable5. However, before establishing the end-states, two premises or fundamental factors must be addressed. The end-state proposed below is influenced by two fundamental factors; the intent of Service senior leadership, and the unique strengths of the US Air Force. ! Intent of AF senior leadership: In the first meeting the Cyber Space Task Force held with the Secretary of the Air Force in January, 2006, SecAF made one point clear to them, “We are not laying claim to the domain.6” He was adamant that he wants the Air Force to build its competencies for cyber warfare so that, if and when it is called upon to play a larger role of defending our nation in the domain, the AF is prepared. Developing expertise in the cyberspace domain will ensure a lasting role for the Air Force as the fights in all three domains, air, space and cyberspace, continue to transform. Unique Strengths of the Air Force: The Air Force must build upon its capabilities and talents that are independent of the other Services and the inter-agency community. For example, though the skills required to conduct computer network exploitation and network operations are fundamental to building expertise in the domain, focusing on these areas alone would result in duplication other agencies’ core competencies. For the Air Force to assume any leadership role in cyberspace, it must build beyond this level by integrating air and space assets in its strategy for the domain.
!
Desired End-State The desired end-state for the Air Force in cyberspace has several objectives related to the different operations that occur in and through cyberspace. Each one must be addressed in detail because the Service’s roles in relation to the joint force will vary by objective. ! Ensuring freedom of action (cyberspace superiority) o The Air Force will provide the joint force with robust, battle-tested options for denying the adversary freedom of action in cyberspace and countering their ability to affect our operations in the domain. These options will be
Executive Agency for specific roles is attainable and this essay presents one possible example. The author was a member of the Cyberspace Task Force and was in attendance at the meeting with the Secretary of the Air Force in January, 2006.
6 5
adaptable and available whenever and wherever an aperture or access point to the domain can be gained and maintained. The access methodologies will include line of sight, electronic attack-enabled and the ability to penetrate closed systems on the battlefield. Though the Air Force is often looked at as a tactical level “enabler,” these capabilities will allow the Air Force to provide additional sovereign, strategic options that will contribute to our robust global strike capabilities. We will provide a strategic, rapidly responsive, deterrent force in all our operating domains. Robust, battle-tested capabilities will be developed through a standardized, AF weaponization process with close interaction between the lead MAJCOM organizations, the warfighters, and the Air Staff. o In addition to its traditional role for air and space assets, the AF Component to Combatant Commanders will organize, train, and equip the air and space operations centers (AOC) to be prepared to C2 delegated cyberwarfare assets. Therefore, on order (scenario dependent), the AF will be prepared to be designated the component responsible for air, space, and cyberspace superiority in a joint fight. As in the case for Air and Space Superiority, the COMAFFOR will be prepared to integrate the cyberwarfare assets of other services through the AOC. This role will include integration, coordination, and synchronization of combat operations in cyberspace. Again, as in the case of air superiority, this does not imply that the Air Force is the only service with fielded capabilities to fight in the domain. o On order (scenario dependent), the AF will be prepared to assume the role of cyber defense and operations coordination for the joint force. In this role, the AF is not assuming responsibility for defending the other Services’ use of the domain (as we do not conduct fleet defense). However, we will defend our service portion of the domain effectively, and coordinate the efforts of all other users of the domain so that friendly freedom of action in cyberspace is assured. This role includes coordinating use of the electromagnetic spectrum and negating the operational impact of attacks to networked infrastructure among other missions. Again, the AOC will be prepared to assume this role, and we will OT&E our operation level forces, and those of other services who attend the AOC training course, for this role. o In support of Homeland Defense, the Air Force will be prepared to act as a lead service for JTF-Global Network Operations and other missions that extend beyond defense of the DoD global information grid. This role could grow to encompass such functions as providing fuzed assessments of threats and fielding deployable, multi-lingual cyber defense response teams to crisis locations. o The AF will be the service of choice for conducting intelligence and forensic analysis for the cyberspace superiority mission sets. Leveraging the proven analysis provided by AF ISR Agency, National Air and Space Intelligence Center for life-cycle employment of air and space capabilities,
and Defense Cyber Crime Center leadership in forensic analysis, the AF will be able to most effectively support the employment of AF and joint cyberspace warfighting capabilities. The emergent nature of the fight in cyberspace calls for their close integration to adapt and respond to agile adversaries. ! Conducting Cross-domain operations through cyberspace o AF forces operating in cyberspace can have direct effects on operations conducted on land, in the air, in space, and at sea7. The Air Force will build on its ability to plan and execute strategic attack and interdiction operations by expanding options executed through cyberspace. These operations will be conducted against targets that achieve joint force objectives for superiority in the other physical domains. These operations will be integrated in the same manner the Air Force conducts crossdomain operations with air warfare. This integration does not imply being limited to a 96 hour cycle since a global strike operation, integrated through the AFSTRAT AOC, must be available at any time. ! Establishing and Leveraging the Domain to Support all Operations o The Air Force, and the joint warfighter, require highly survivable, expeditionary cyber capabilities to conduct global operations. Therefore the Air Force will have the capacity to extend cyberspace, whether via the EMS or physically connected systems, anywhere the AFFOR conducts operations. o Ever increasing dependence on cyberspace to conduct all air, space and cyber operations, has driven the AF to build a solid base of technological expertise. Building on the AF’s extensive expertise in establishing, maintaining, and securing cyberspace infrastructure for air and space networked-operations, the Air Force intends to be the executive agent for developing cyberspace infrastructure. These infrastructure systems will be resilient, interoperable, and defensible. Leading this mission will posture the Air Force to effectively defend its portion of the GIG, and improve the ability of the entire joint force to maneuver in the domain when our use is contested. How do we get there? As a Service there are many steps that must be taken to organize, train, and equip AF forces to reach the end-state described above. However, to prepare for the roles and missions debate in the upcoming Quadrennial Defense Review, there are three important steps that must be taken immediately.
By direct effect it is meant that the effects are not achieved indirectly through degradation of the leadership’s ability to command and control the operations (their cognition), they can be achieved directly against targets in those domains. An example of conducting such an operation through cyberspace would be jamming an RF signaling device on a transportation control system.
7
!
Continue educating the Air Force. The first thing that must be done is that which will take the longest- spread the word. Even after two years with the term in our mission statement, few members of the Service even have a general understanding of cyberspace as a domain in which we operate, let alone the strategy for a future role. If the Air Force intends to treat cyberspace on par with our other three domains, the vision should be disseminated in every forum possible from PME seminars, to accessions programs, to commander’s calls. In preparing for these events, the instructors should not rely on their previous assumptions about cyberspace. This is not just about the Internet and network operations. Demonstrate the commitment to dedicate resources. The next thing that must occur is a change in the Air Force culture. This change will also take a long time, but without a major shift, there will be resistance to implementing any strategy at every point along the way. Unfortunately, logic does not cause a shift in culture, money does. The best way to get people to embrace change, is to show them a value in dollar terms for doing so. The shift cannot be a shuffling of programs currently within the information superiority and communications portfolios. The re-allocation has to be an “inter-domain” shift. Until the Air Force demonstrates a willingness to move resources within its own portfolio, neither the rest of DoD, nor even most AF service members, will begin to accept that the Air Force culture must and will change. Do the MAJCOM right. Regardless the exact list of what is “in” and what is “out,” the command will not posture the AF for a lead role in the domain unless it improves the AF’s advocacy for those mission areas that achieve direct effects on our adversaries in cyberspace. The AF employs these capabilities from ground stations and airborne platforms which means that the command must necessarily advocate for airborne (and space?) assets. Such capabilities must be “in,” or the Air Force will accomplish nothing more than taxing the existing MAJCOM staffs to generate another command for ISR and communications. The Air Force already had a major command for each then decided to make them both field operating agencies. A need to reverse those decisions alone does not follow from the proposed end-states articulated above.
!
!
Conclusion The Cyberspace Task Force has concluded its work. The entire Air Force must now engage the debate and help to craft the Air Force’s future in this domain. The end-states need to be defined, and the Service must commit to a path to achieve the identified goals. This essay presented a recommendation for potential goals over the next twenty years and three critical steps that must be taken immediately to achieve them. With a commitment from across the AF enterprise, the Service can posture itself as the lead in the nation’s fight for cyberspace superiority. It may also be looked to as the expert for establishing and using the domain for the joint fight. But the Service must demonstrate this commitment with clear actions before the entire national security community will recognize the Air Force’s leadership role. Perhaps more so than in air and in space, everyone in the AF will play a role in this endeavor.
The first role that must be played is the role of a strategist. Whether you have played such a role traditionally, or are merely excited about the potential for the Air Force in the domain, now is your chance to shape the future. We’re still on the ground floor.
