No. 95 APRIL 2013 Cybersecurity Operations in Support of Counterinsurgency Operations David W. Pendall Ronald Wilkes Timothy J. Robinson Cyberspace Operations in Support of Counterinsurgency Operations by David W. Pendall Ronald Wilkes Timothy J. Robinson The Institute of Land Warfare ASSOCIATION OF THE UNITED STATES ARMY AN INSTITUTE OF LAND WARFARE PAPER The purpose of the Institute of Land Warfare is to extend the educational work of AUSA by sponsoring scholarly publications, to include books, monographs and essays on key defense issues, as well as workshops and symposia. A work selected for publication as a Land Warfare Paper represents research by the author which, in the opinion of ILW’s editorial board, will contribute to a better understanding of a particular defense or national security issue. Publication as an Institute of Land Warfare Paper does not indicate that the Association of the United States Army agrees with everything in the paper but does suggest that the Association believes the paper will stimulate the thinking of AUSA members and others concerned about important defense issues. LAND WARFARE PAPER NO. 95, April 2013 Cybersecurity Operations in Support of Counterinsurgency Operations by David W. Pendall, Ronald Wilkes and Timothy J. Robinson Colonel David W. Pendall is an Army War College Fellow at the Massachusetts Institute of Technology’s Lincoln Laboratory Security Studies Program. In his previous assignment he was the Combined Joint Intelligence Officer for Regional Command–East/CJTF-1 in Afghanistan and concurrently the Intelligence Officer of the 1st Cavalry Division. He has served in key leader- ship positions within U.S. Army Europe, V Corps, Multinational Corps–Iraq, NATO/International Security Assistance Force, National Security Agency/Central Security Service and other tactical- level units. Pendall holds a B.A. from Ohio University, an M.S. from Central Michigan University and a Master’s in Military Art and Science in Theater Operations from the Army’s School of Advanced Military Studies. Lieutenant Colonel Ronald Wilkes, U.S. Army, is currently assigned to U.S. Strategic Command. He served previously with the Army Cyber Command, 1st Information Operations Command, 18th Military Police Brigade and the 3d Infantry Division. Wilkes holds a B.S. from Savannah State College, an M.A. from Webster University and an M.S. from George Mason University. Major Timothy J. Robinson, U.S. Marine Corps, is a Communication and Information Systems Officer stationed with Marine Forces Cyberspace Command. He has held numerous positions with the 9th Communication Battalion and served as an Operations Research Analyst at Marine Corps Logistics Command. Major Robinson holds a B.S. from Virginia Polytechnic and State University and an M.S. from the Naval Postgraduate School. This paper represents the opinions of the author and should not be taken to represent the views of the Department of the Army, the Department of Defense, the United States government, the Institute of Land Warfare or the Association of the United States Army or its members. © Copyright 2013 by The Association of the United States Army All rights reserved. Inquiries regarding this and future Land Warfare Papers should be directed to: AUSA’s Institute of Land Warfare, Attn: Director, ILW Programs, 2425 Wilson Boulevard, Arlington VA 22201, e-mail [email protected] or telephone (direct dial) 703-907-2627 or (toll free) 1-800-336-4570, ext. 2627. ii Contents Foreword ................................................................................................................................. v Introduction ............................................................................................................................. 1 Description of Cyberspace Operations .................................................................................... 1 Establishing Terms of Art and Science .................................................................................... 2 The Need for Agile Cyberspace Operations in the Afghanistan Theater of War ..................... 2 Cyberspace Operations in Support of Counterinsurgency and Stability Operations in Afghanistan ......................................................................................................................... 4 Recommendations for a Way Ahead ....................................................................................... 5 Conclusion ............................................................................................................................ 10 Endnotes ................................................................................................................................ 11 Glossary ................................................................................................................................ 13 iii iv Foreword This paper provides a perspective on how best to use cyberspace operations in support of U.S. military operations in Afghanistan. The authors describe the nature of cyberspace opera- tions in general, discuss the need for enhanced cyberspace operations and express a viable way ahead for future cyberspace operations in Afghanistan. They posit that additional research and coordination should be conducted to better define and develop requirements for cyberspace capabilities, command and control of cyberspace operations and integration of activities in a manner that supports the International Security Assistance Force commander, the operations of regional commanders and related strategic shaping and global counter terrorism pursuit opera- tions. The lessons we learn now while fighting the counterinsurgency (COIN) fight will serve us in future conflicts. It has become apparent there is more work to be done in exploiting our adversaries’ use of cyberspace. Insurgents and members of their supporting cells have been captured on the battlefield with all imaginable types of digital media and Internet-capable devices. Insurgents and terrorist organizations all have an online presence that is becoming more sophisticated and useful to their operations. Thus, the authors argue that it is both clear and essential that efforts to counter our enemies in the Afghan COIN fight must evolve and become more effective. Our next adversary may be well funded and technologically literate, originate from a more educated society and may have developed a comprehensive cyber operations doctrine. This paper was designed to provoke additional thought about cyberspace operational relevance, suggest neces- sary change and enable future success in Afghanistan and future conflicts. Gordon R. Sullivan General, U.S. Army Retired President, Association of the United States Army 10 April 2013 v vi Cyberspace Operations in Support of Counterinsurgency Operations Introduction The United States has fought an innovative, ruthless and persistent enemy in Afghanistan for more than 11 years. In response to an evolving adversary, the U.S. military developed counterinsurgency (COIN) doctrine to create a framework for commanders to view their op- erational environment (OE) and provide new methods of applying all the capabilities at their disposal. Comprehensive COIN operations are the basis of International Security Assistance Force (ISAF) campaign planning and tactical operations. While COIN provides a comprehen- sive strategic framework to use in defeating an insurgency, it lacks any substantive analysis concerning the value of employing cyberspace operations. America’s enemies understand the power of technology. The entry cost to using digital communications is low while the reliability, quality and simplicity of service are generally high. Open-source intelligence indicates that insurgents use different technologies to commu- nicate, create operational plans, store institutional knowledge and develop strategy. The full extent of insurgents’ employment of their technological portfolio with respect to command and control, financing, recruiting, training, propaganda dissemination and knowledge management remains an unknown. These issues are of particular concern, as they indicate a level of sophis- tication that can enable and potentially enhance operations against coalition forces. Present insurgent and/or terrorist cyber-based activities are not fully understood at the operational and tactical levels. The purpose of this paper is to describe the nature of cyberspace operations in general, discuss the need for enhanced cyberspace operations in Afghanistan and express a viable framework for how future cyberspace operations could be more effectively conducted in Afghanistan. Description of Cyberspace Operations Cyberspace operations provide support to traditional military operations and, within some rare cases and specific opportunities, replace them. Technological solutions, either offensive or exploitive, assist intelligence and operational planners in targeting individual insurgents or in- surgent networks, operating within a larger social network wherein they gain support from the 1 cyber domain. By understanding the digital patterns of life established by insurgents and sup- porting organizations, U.S. forces can conceptually develop enemy communication models and better understand their operations and tactical processes. This information improves friendly situational awareness and adds context to existing knowledge bases. In some cases, cyberspace operations can replace physical military activities by support- ing, enabling, informing and influencing