Cyberspace is a global commons, just as the high seas, international airspace, and space over time have become. It is made up of electronic fabric created by the Internet, the world's telecommunications infrastructure, radio-frequency communications, and all unique information networks that abound across the globe. Cyberspace is like the Department of Defense's Global Information Grid concept on steroids.
And now, with the stroke of a pen and Secretary of Defense Robert Gates' June 2009 creation of a sub-unified combatant commander known as U.S. Cyber Command, cyberspace is recognized as a critical warfighting area. To succeed in future conflicts, protect our national interests, and defend the homeland, we must maintain a decisive edge in this domain. U.S. Cyber Command integrates cyberspace operations, synchronizes warfighter effects globally, and supports civil and international partners.1 The command seeks to deliver freedom of action in cyberspace to which the Navy's initial reaction has been to establish a new three-star component command, Fleet Cyber Command (FLTCYBERCOM).
Western nations are highly dependent on information technology and cyberspace for commerce, free exchange of information in their citizens' daily lives, and maintaining the intelligence edge that can determine the longevity of a society. Our transportation infrastructure, telecommunications, nuclear energy, water distribution, and other critical infrastructure are all prime targets for cyber attack.2 This nation's leadership position depends not only on our ability to operate successfully in the commons of sea, air and space, but also in cyberspace.3
The Rise of Cyber Conflict
Recent political and military conflicts demonstrate the growing use of cyber attacks in struggles between nation-states, transnational organizations, and rogue nations. Chinese and U.S. hackers exchanged volleys in 2001 following the EP-3 forced-landing incident. Since then, China has elevated cyber warfare in its strategy and amassed a cyber corps of 6,000 hackers.4
Al Qaeda uses the Internet as its command-and-control network, just as it did in planning and executing the 9/11 attacks. In its 2006 war with Israel, Hezbollah coordinated command and control (C2) via the Internet. In 2007, Russian hackers played havoc with Estonia's national information infrastructure during political disagreements between Tallinn and Moscow.5 Likewise, Russia synchronized cyber attacks with other military action in the invasion of Georgia.6
More recently, following the 2009 elections in Iran, the government conducted localized cyber attacks to dissuade demonstrators and disrupt their ability to organize a coherent resistance movement via social networking and "cyber activism."7 And North Korea used cyber attacks to lash out at U.S. government and financial Web sites in an attempt gain attention. The United States and Russia have even discussed the need for a cyberspace treaty.8 There is little doubt cyber attacks will continue to grow in both severity and reach. To win in future conflicts, we must have mastery of cyberspace.
A New Warfare Discipline
The U.S. government has for some time recognized that our political discourse and military strategy must account for cyberspace capabilities. President George W. Bush's 2008 issuance of Naval Security Presidential Directive 54, Secretary of Defense Donald Rumsfeld's 2005 National Military Strategy for Cyberspace Operations, DOD's 2009 Defense Science Board Task Force study, and the decision to establish a four-star U.S. Cyber Command are all key indicators that DOD takes cyberspace operations seriously. So is the Navy's quick response with the announcement of Fleet Cyber Command and merging N2 and N6 directorates. But what is not evident is whether the service has fully thought out a charted course to the needed cyberspace capabilities and doctrine.
Cyberspace operations have three primary dimensions relating to military operations:
- Cyber attack is non-kinetic, offensive cyber capability that takes the fight to the enemy. It could be disrupting or denying an enemy's C2 networks or critical capabilities. Just as in the movies, cyber attack may be the means to manipulate an adversary's decision-making to our advantage or disrupt its center of gravity by denying it critical infrastructure on which it depends.
- Cyber defense is the ability to conduct defensive operations. We must be able to protect our information, networks, and critical infrastructure. Cyber-defense capabilities seek to identify, deter, and defeat an adversary's cyber attack. Terms such as firewall, intrusion detection, and physical security all come into play here.
- Cyber control is my terminology for a dimension that is not always brought into the discussion. It refers to the operation and management of cyberspace infrastructure. Cyber control is the mission-focused, dynamic operation of infrastructure such as our C2 networks and logistics and supply chain, the banking industry's financial networks, and the power companies' grid.
Cyber control is the sum of network operations, spectrum management, information management, satellite control, and systems management required to provide the right information at the right time to the warfighter. The operation of our cyberspace infrastructure satisfies the purpose for which we built cyberspace capability in the first place: to enhance the efficiency of our military and business processes, whether these may be logistics, fires, C2, intelligence, planning, or other military functions. While interdependent, each dimension of cyberspace operations-attack, defense, and control-requires unique competencies, business processes, and capabilities.
The Navy Is No Stranger in Cyberspace
Navy initiatives in years past have led the way in DOD in information technology implementation and network-centric warfare concepts. The service's Copernicus and Information Technology for the 21st Century (IT21) initiatives led the department to enhance situational awareness and netted the force with end-to-end information sharing capabilities.
Whether or not you are a fan of the Navy-Marine Corps Intranet, it made great strides in the Department of the Navy to gain control of its networks and build better enterprise network security. The Next Generation Enterprise Network project will only enhance these cyber defenses and controls.
Champions like Admirals Jerry Tuttle, Archie Clemins, Art Cebrowski, Dick Mayo, and Vern Clark pushed the Navy to find better ways to share information for tactical advantage and focus on finding that "killer app" for C2. Through initiatives like Copernicus, IT21, and FORCEnet, the Navy defined an objective vision against which network-centric and cyber capabilities can be measured.
The service also led the way in recognizing the need to develop the technically savvy and operational leadership required to operate and control the cyber domain. With the creation of the Information Professional Officer community in 2001, the establishment in 2002 of the Naval Network Warfare Command (NETWARCOM) focused on the Fleet's information technology and information operations and space capabilities, and the refocusing of the cryptology community on information warfare, the Navy has been at the forefront of laying the foundation for cyberspace operations.
Charting the Course for Readiness
The clarity of the Navy's road ahead in cyberspace no longer seems sharp. The service appears to be struggling to define what capabilities it will provide to this fight and what infrastructure and tools are required to meet the range of naval tasks. To complicate matters, no champion or vocal proponent seems to be leading the myriad programs toward common purpose. A great deal of energy and resources were once devoted to molding programs and initiatives into capabilities leading to the FORCEnet vision that Admiral Clark articulated. To those on the waterfront, FORCEnet now seems to have faded without realization of that vision to guide the department on its journey to robust and agile cyberspace capabilities.
Over the past seven years, NETWARCOM has assumed a growing list of missions, functions, and tasks that seemingly weigh down the organization and dilute its focus on solving critical Fleet issues. Each of these new interest areas and tasks may have made sense at the time, but now the general Fleet consensus indicates that NETWARCOM is not as responsive or nimble as it was intended to be. It is trying simultaneously to cover all attack, defense, and control dimensions of cyberspace. The scope of these responsibilities, along with other assigned duties, limits its effectiveness in achieving a cyber-ready Fleet.
And now, a new FLTCYBERCOM and the supporting OPNAV realignment have entered this mix. The Navy has one chance to get this right. With the rapid growth in our adversaries' cyber capabilities and strategy, we can ill afford a lengthy effort to get things in order. We cannot pull back or be distracted. If we are to attain an advantage, we must rapidly establish a vision for cyberspace operations, align associated Navy commands with clear lines of authority to deliver needed capabilities, develop the cadre of warriors to carry out each distinct aspect of cyberspace operations, and adequately prioritize funding.
A Call to Action
More than a hundred years ago, the Navy was faced with the challenge of how it could command the commons of the high seas and have global reach. The service faced uncertainty in how to employ its battle fleet, support global operations, and influence world powers. To demonstrate that it was ready for a new era in naval warfare, the Great White Fleet sailed around the globe and demonstrated U.S. freedom of action on the sea and our ability to protect our interests in world affairs.
Today we are faced with a similar parallel of how to navigate in the commons of cyberspace, have global reach, and use that domain to influence world powers. We must be ready to take bold steps. To plot a sure and steady course forward, the following actions are necessary.
- Define a clear vision with objective capabilities. What cyberspace operations is a carrier or expeditionary strike group expected to conduct? What does the service provide to each dimension of the cyberspace force mix? Will there be squadrons akin to the Air Force's cyberspace model? What role does the Navy play in defending our critical infrastructure from cyber attack?
Programs must be designed for objective warfighting capabilities such as integrated electronic warfare or shaping cyberspace operations of an adversary. The IT21 initiative did the Fleet a great service by bringing together related programs to deliver a comprehensive warfighting capability, but now the tendency is to revert to individual programs that are no longer synchronized toward a common objective. Navy leadership must articulate a cyberspace vision and hold the helm steady toward it.
- Bring forward a cyber champion. Just as Rear Admiral William Moffett transformed naval aviation and Admiral Hyman Rickover delivered safe nuclear power to the Fleet, there needs to be long-term leadership that will stay the course and break through bureaucratic logjams in the refinement and delivery of cyber capabilities in the Navy.
In the Navy's arena of command, control, communications, computers, and intelligence, the tendency has been for each administration to make its mark and adjust the course before realizing the capabilities outlined in the vision. The pressures of the Pentagon make this no easy task, but a champion who is focused and resolute can deliver critical cyberspace capabilities to the Fleet.
- Organize with clear lines of authority. Today cyberspace operations in the Fleet are directed by committee. Cyber defense guidance often comes not only from NETWARCOM, but also from OPNAV, the Fleet commander, other type commanders, numbered Fleet commanders, and various program managers who serve as technical agents for information security.
They are not always in synch, and the result is often uneven implementation of cyberspace measures. And now the equation includes FLTCYBERCOM. It is imperative that Navy leadership clearly identify and delineate the roles and responsibilities of all parties involved, especially the relationship between the two commands. There is certainly room for a division of labor between them, with the growth in importance and scope of the cyberspace landscape.
Cyber attack and cyber defense dimensions, including information operations duties, should be given to FLTCYBERCOM, along with its integration with law enforcement. NETWARCOM is ideally suited to tackle the cyberspace control (operating the infrastructure), space equities, focusing on the "organize, train and equip" aspect, and fostering innovation in cyberspace capabilities. The relationships to the emerging OPNAV N2/N6 must also be clearly defined.
- Look for a few good cyber warriors. Cyberspace operations require a cadre of technically astute leadership and operators. Talented people are likely the most critical piece of our ability to succeed in cyberspace. The Navy has made strides in the last several years, with the establishment of the Information Professional community, refocusing cryptology on information warfare, mergers in associated enlisted ratings, and developing the Information Assurance Work Force.
Some imply that this piece of the puzzle will be solved by simply merging the Intelligence, Information Professional, and Information Warfare communities. Further, outsourcing technical competencies to contractors and inadequate sea/shore rotations for our enlisted Sailors have significant implications.
The key is to recognize that each of the three dimensions of cyberspace operations requires a distinct set of skills. While there are commonalities in understanding basic capabilities and the role of information in warfare, specific analytical, technical, and tactical capabilities are needed in each case. Just as it is not realistic to pick a random surface warfare officer and place that person in a fighter cockpit, the attack, defense, and control aspects of cyberspace require different skills for optimal execution of the cyber missions.
Given the time it takes to develop these personnel, the Navy must get this right in the near term and immediately establish a task force to lay out and execute a manpower plan to provide competencies for excelling in cyberspace operations.
- Define what to protect. We are afloat in a sea of information. The advances in information technology have delivered benefits by netting the force, but we are confronting a rising tide of information and data flowing across these nets.
Sun Tzu's dictum "He who defends everywhere will be weak everywhere" applies to cyber defense. If we don't recognize what is critical information, it will be difficult if not impossible to protect that information as it flows through cyberspace. To address this, the Navy must revitalize efforts to identify key data requirements and operational processes that must be hardened against would-be adversaries.
The service should also consider incorporating into our cyberspace defense mechanisms measures to respond to operational threats, similar to those we have in Maritime Domain Awareness.
- Enable enlightened innovation. Information technology continues to flourish and advance rapidly. But in recent years, the Navy has lessened the priority on vibrant experimentation focused on delivering cyberspace capabilities. In the tight competition for funding, some would let innovation and experimentation efforts fall off altogether.
But for the Navy to remain competitive and current in cyberspace, initiatives like Trident Warrior, exchanges with industry and academia, and participation in venues like Blackhat and Def Con are key. The service still has a unique opportunity, if it exploits the Naval Postgraduate School's longstanding relationship with Silicon Valley and develops a Cyberspace Center of Excellence focused on advancing cyberspace military capabilities.
- Strengthen our cyberspace infrastructure. Ultimately, all these imperatives come down to delivering the tools our naval cyber forces need to succeed. We must find a way that balances the defense acquisition system and joint requirements processes to rapidly deliver needed capability to the field.
There must be feedback from the innovation and experimentation initiatives to modify and deliver cyber capabilities-quickly. The speed of innovation and adaption by our adversaries is greater than our current acquisition system can accommodate. Vice Admiral Dick Mayo stated five years ago that our networks were "fragile." Similarly, our cyberspace capability is fragile and must be strengthened with defensive capabilities that are resilient to attack, offensive capabilities that can easily be injected into theater operations, and network operations capabilities that provide visibility and fault tolerance across our cyberspace infrastructure. If these operations really are a definitive warfare area, budgetary investments must back that up.
In these fiscally constrained times, the Navy and DOD are faced with some hard choices in delivering the needed cyberspace capabilities. China and India are emerging as global powers with views different from our own. Russia seeks to regain its position in the world. Almost eight years after 9/11, our troops are still fighting in the mountains of Afghanistan.
Cyberspace capabilities are vital to our daily operations, whether they provide intelligence, direct military operations, or transmit logistics information critical to sustainment of the force. The information that rides through the cyberspace global commons is critical to these and future operations. Our adversaries will continue to exploit cyberspace to their advantage unless we are prepared to deter, dissuade, and defeat them. Cyberspace is here to stay-whether we are ready or not.
1. Secretary of Defense Memo, 23 June 2009, Establishment of a Subordinate Unified U.S. Cyber Command Under U.S. Strategic Command for Military Cyberspace Operations.
2. Mustaque Ahamad et al., Emerging Cyber Threats Report for 2009, Georgia Tech Information Security Center, pp. 3-4.
3. LCOL Bob Strickland, CDR James H. Mills, and CAPT Fatih Sayin, Filling the Seams: Applying the Operational Threat Model to the Global Commons, Joint Forces Staff College 2008 MacArthur Award Paper, August 2008.
4. P. W. Singer, Wired for War (New York: Penguin, 2009), 244-50.
5. Joshua Davis, "Hackers Take Down the Most Wired Country in Europe," Wired, No. 15.09, 21 August 2007.
6. Ahamad et al., Emerging Cyber Threats Report.
7. Mark Drapeau and Linton Wells II, Social Software and National Security: An Initial Net Assessment, Center for Technology and National Security Policy, National Defense University, April 2009, pp. 19-22.
8. John Markoff and Andrew E. Kramer, "U.S. and Russia Differ on a Treaty for Cyberspace," New York Times, 27 June 2009.