The Emergence of Us Military Cyber Expertise, 1967–2018
Total Page：16
File Type：pdf, Size：1020Kb
The Scholar WHAT IS A CYBER WARRIOR? THE EMERGENCE OF U.S. MILITARY CYBER EXPERTISE, 1967–2018 Rebecca Slayton What Is a Cyber Warrior? The Emergence of U.S. Military Cyber Expertise, 1967–2018 How have military cyber operations, a diverse set of activities that often differ little from civilian cyber security work, achieved the status of “warfighting”? What activities have the greatest warfighting status, what activities have the least, and why? This paper examines the establishment and growth of expertise associated with cyber operations in the individual services and at the joint level since the late 1960s. Threat-oriented activities, such as attacking adversaries or responding to adversaries that have breached U.S. networks, have more readily achieved warfighting status than have vulnerability-oriented activities, such as patching software, training users in good security practices, and other actions that aim to prevent intrusions. Ultimately, the lower status of work and expertise associated with vulnerability mitigation remains a significant problem for military cyber operations. n May 4, 2018, U.S. Cyber Command warfighting, this paper shows that, in practice, the was elevated from a sub-unified com- individuals who perform these activities do not all mand under U.S. Strategic Command, have equal “warrior” status. making it America’s 10th unified com- Of course, it may seem strange that any cyber batantO command. At a ceremony marking this experts would have warrior status. After all, they change, Deputy Secretary of Defense Patrick typically work at desks, and without substantial Shanahan described the command’s challenge as physical risk. Furthermore, while missiles, drones, strengthening “our arsenal of cyber weapons, cy- combat aircraft, and other high technology have ber shields and cyber warriors.”1 all changed how militaries fight and what it means Shanahan’s words evoke the image of a tradi- to be a warrior, the technologies with which cy- tional warrior, fighting with weapons and a shield. ber warriors work are not unique to the military.3 And yet, cyber “warfare” differs dramatically from Every major civilian organization today also relies traditional combat.2 In fact, many cyber warriors on complex computer networks and experts who spend less time using virtual “weapons” than they defend them. While some cyber warriors attack ad- do inventing or maintaining them. While joint doc- versary computer networks, many spend their time trine treats use, invention, and maintenance as focused on defensive work that differs very little, important components of cyber “operations,” i.e., if at all, from that of civilian computer security 1 Jim Garamone, “Cybercom Now a Combatant Command, Nakasone Replaces Rogers,” DOD News, May 4, 2018, https://www.defense.gov/ Explore/News/Article/Article/1512994/cybercom-now-a-combatant-command-nakasone-replaces-rogers/. 2 I am using terms such as “cyber warfare” and “cyber warrior” colloquially. I do not mean to imply that what they do qualifies as “war” as war is understood in international law. The term “cyber warrior” has been used broadly to refer to a wide range of career specializations within the military. 3 For discussion of the warfighting identity of missileers, see George L. Chapman, “Missileer: The Dawn, Decline, and Reinvigoration of America’s Intercontinental Ballistic Missile Operators,” Master’s Thesis, Air University, 2017, https://apps.dtic.mil/dtic/tr/fulltext/u2/1045804.pdf. On drones and warfighting, see P. W. Singer, Wired for War: The Robotics Revolution and Conflict in the 21st Century (New York: Penguin Press, 2009) and Hugh Gusterson, Drone: Remote Control Warfare (Cambridge, MA: MIT Press, 2016). Air Force pilots continue to be the butt of jokes implying that they are not tough enough, as compared to marines. For example, see Mark Thompson, “Petraeus Zinger Wounds Air Force Egos,” Time, Aug. 21 2009, http://content.time.com/time/nation/article/0,8599,1917841,00.html. 62 The Scholar experts. Indeed, the U.S. Defense Department has edge, and ability were more readily seen as war- leveraged the civilian U.S. National Initiative on fighting than others. In particular, threat-focused Cybersecurity Education workforce framework to activities like offensive operations, intrusion de- build its own cyber workforce.4 For that matter, the tection, and incident response, which were first Department of Defense uses civilian contractors developed within signals intelligence units, were for both offensive and defensive cyber operations. most easily viewed as warfighting. By contrast, So, why are some kinds of cyber experts who vulnerability-focused activities such as password work for the Defense Department considered “war- management, software patching, and other forms fighters” but others are not? This paper examines of technology maintenance, which were primarily the historical process by which some of these kinds the responsibility of communications units, were of experts gained warfighter status while others did slow to be seen as a kind of warfighting. not. It shows how, throughout the 1990s and early Today, the distinction between threat-focused 2000s, key leaders in intelligence, communications, and vulnerability-focused activities can be found in and warfighting communities made the case that joint doctrine, which outlines three primary mis- computer network operations should be treated as sions for cyberspace operations. The first mission, a kind of warfighting. While specific approaches var- offensive cyber operations, is unique to the mili- ied across different services and professional spe- tary. U.S. law prohibits civilian organizations from cializations, all of these leaders struggled against a conducting offensive cyber operations unless they culture that has historically treated information-re- are operating under military authority. The second lated work such as intelligence, computing, and mission, defensive cyber operations, responds to communications as a warfighting support function, threats that have already breached Defense De- something lower in status than warfighting itself. partment networks. Some of these activities, in- Elevating the status of cyber expertise entailed cluding incident response, intrusion detection, and challenging organizational hierarchies that made network monitoring, are very similar to defensive cyber experts subordinate to traditional warf- work within major corporations, civilian govern- ighters. For example, it meant empowering cy- ment, and other non-military organizations. ber experts and organizations to effectively issue The third mission, Department of Defense In- commands to warfighting units, directing them formation Network (DODIN) operations, focuses to remediate vulnerabilities in their computer on mitigating vulnerabilities. It includes “actions networks. It also involved reorganizing well-es- taken to secure, configure, operate, extend, main- tablished military specializations, such as signals tain, and sustain [Defense Department] cyber- intelligence, electronic warfare, and communica- space and to create and preserve the confidential- tions, around cyber infrastructure and operations. ity, availability, and integrity of the DODIN.” Like Perhaps most importantly, it meant establishing defensive cyber operations, these activities are new career paths through which cyber experts commonplace in non-military organizations. Fur- might advance to the highest levels of command. thermore, by virtue of their focus on mitigating Military leaders made their case for elevating cy- vulnerabilities rather than attacking adversaries, ber expertise in a variety of ways. For example, they they have struggled to gain the status of warfight- developed concepts of cyber operations that were ing. In an effort to cast its work as warfighting, analogous to well-established concepts of kinetic Joint Force Headquarters-DODIN describes its operations. They also conducted exercises that re- mission with the phrase “Fight the DODIN,” not vealed the potential impact of cyber operations on “secure,” “maintain,” or “sustain” the DODIN.5 military warfighting and gathered data that high- And joint doctrine seems to recognize the lower lighted a steady increase in intrusions that might regard in which such operations might be held, have gone completely unnoticed if not for the work noting that “although many DODIN operations of cyber experts. activities are regularly scheduled events, they I argue that these and related activities succeed- cannot be considered routine, since their aggre- ed in establishing cyber operations as a type of gate effect establishes the framework on which warfighting, but that some kinds of skills, knowl- most DOD [Department of Defense] missions ulti- 4 William Newhouse et al., National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework, National Institute of Standards and Technology, Publication 800-181, August 2017, https://doi.org/10.6028/NIST.SP.800-181. The framework consists of seven broad functions, 33 areas of work, and 52 work roles. Each of the work roles consists of specific tasks and requires specialized knowledge, skills, and abilities. Altogether, the framework lists 1,007 tasks, 630 kinds of knowledge, 374 kinds of skills, and 176 abilities. 5 Jeffrey R. Jones, “Defense Department Cyber Requires Speed, Precision and Agility,” Signal, May 1, 2019, https://www.afcea.org/content/de- fense-department-cyber-requires-speed-precision-and-agility. 63 What Is a Cyber Warrior?