Army’s ‘120 day study’ looking at resourcing for cyber, information capabilities, authorities and forces

AUGUSTA, Ga. — The Army is conducting a study examining its cyber arsenal and funding along with resourcing for other information capabilities.

The 120-day study, as it’s referred to, comes from the secretary of the Army down through the principal cyber adviser and is being executed by the Cyber Center of Excellence, officials explained. Brig. Gen. Brian Vile, the Army Cyber School commandant, is leading the effort on behalf of the Cyber Center.

“Based on new capstone doctrine, global observations and analysis of our pacing threat, the [Cyber Center of Excellence] is conducting a study of [information advantage], cyber and [electronic warfare] forces to optimize future employment,” according to a spokesperson from the Cyber Center.

Not much is publicly known about the review, which officials are tight lipped about given the sensitive nature of it.

The study, which is about halfway done, was precipitated by U.S. Cyber Command’s enhanced budget authority that it’s poised to realize in October, which will provide it budgetary control over cyber forces and capabilities — a key maturation for the command since being created a little over 10 years ago.

“One of the things the 120-day study is going to look at is at the end of the day, what is service-retained cyber forces, what is the Army’s bill associated with that. Because under enhanced budget control authorities, the dollars that are associated with the cyber mission force fall under Cybercom,” David May, senior intelligence advisor at the Cyber Center of Excellence, told DefenseScoop on the sidelines of the TechNet Augusta conference. “What is left, what are we still responsible for and what’s the cost to the Army?”

In the near term, not much will change from the old process of the military branches serving as executive agents to procure capabilities for Cybercom and the joint cyber warriors, except that Cybercom will now reimburse them.

As part of the study, the Army is looking at what joint- and strategic-level cyber capabilities can be used by the Army for tactical forces on the battlefield.

Cybercom owns the offensive cyber capabilities and authorities within the Department of Defense, and the services conduct offensive cyber ops through Cybercom and the cyber mission forces that each service provides to the command. Authorities to launch cyber effects have traditionally been held at the highest levels of government. In recent years, those authorities have been streamlined and delegated. However, most cyber operations are still conducted from remote locations by the cyber mission force (CMF) and primarily focused on IP-based networks.

In recent years, there are more targets that are harder to reach with these remote capabilities and thus the services are now requiring their own offensive cyber tools to exploit targets. However, that is mostly in the blended electronic warfare or radio frequency-enabled sphere at the tactical level.

“The time is absolutely right for us to assess the direction that we’re heading with electronic warfare and cyber capabilities, and what does that mean in coordination with U.S. Cyber Command versus capabilities that we retain at the Army,” said Maj. Gen. Paul Stanton, commander of the Cyber Center of Excellence. “We also have a number of observations from real-world events that occur on a daily basis. We’re watching our enemy employee capabilities that we had only studied previously.”

The study is looking at capabilities that can be used by the Army as it is growing and building out is own tactical formations.

“We’re looking at opportunities here, where we’re going to look at how do we take some of these existing [offensive cyber operations] capabilities and provide them down to the tactical force,” Col.  Nadine Nally, director, Army Capabilities Manager-Cyber (ACM Cyber), said during a presentation at TechNet Augusta. “Obviously, there’s first-, second-, third-order effects of that. [It] comes with authorities and funding and training, but we’re looking at how we’re going to be involved in that effort.”

Stanton has previously alluded to some ways authorities could change based on the review.

“How do you execute electronic attack to achieve effects? How do you differentiate a cyber-delivered capability that benefits from proximity based on owning the land, owning the ground? Because that’s what the Army does. The principal cyber advisor, Dr. [Michael] Sulmeyer is tasking me with conducting a study to clearly define and delineate where those lines are,” he told DefenseScoop in a May interview. “This study is going to help us be able to clearly define that. I expect to be tasked to kick that off here in the very near future with about 90 days to complete.”

Some areas where authorities could change or must be evolved are the roles the conventional forces and intelligence community possess when it comes to electronic warfare and signals intelligence. The two are closely aligned and for decades have engendered fierce debate over what activity constitutes electronic support — sensing signals in the environment that conventional forces must do to develop targets and better understand their space — and signals intelligence, which involves the collection of foreign signals.

A new Army regulation — AR 525-24, U.S. Army Cyberspace and Electromagnetic Warfare Operations — recently helped clarify electronic support’s role from the signals intelligence community. But that’s only the beginning of changes that must happen at the tactical edge, officials say.

“Right now, the intelligence community is responsible for decryption, for example. There’s probably a line where cyber and EW forces can execute some sort of decryption associated with commercial-level encryption. But that has not yet been identified and cleaned up,” May said. “Right now, it’s solely on the intelligence community by regulation. That’s one of those authority areas where I think as the world has evolved and then we have this ubiquitous commercial encryption out there, things where I can go on the internet today and find the decryption key — that should be authorized outside the intelligence community. But that’s work to be done.”

The team working the study will be getting information from tactical commanders and sending a team to U.S. Army Pacific to gather data, officials said.

Supporting this review is the number one priority for ACM Cyber. However, some officials stated that with the evolution of cyberspace and new budgeting authorities, that office’s role may change going forward.

“At the end of the day, [Army Futures Command] will make the decision on whether or not we need to evolve ACM Cyber,” May said. “I anticipate ACM Cyber’s responsibilities evolving.”

The Army is on the precipice of releasing its doctrine for information advantage, a multi-year process that will serve as the service’s vision of information warfare and aims to outline how it will fight and win in the information dimension. It includes capabilities such as cyber, electronic warfare and influence. Once approved and built out, there will likely be an ACM that will have to be associated with it, elevating it from the current Army program office for information advantage, May said.

“It is possible that ACM Cyber may take on those roles,” he said of information advantage capabilities. “But we need to … do some additional mission analysis before we determine how we’re going to evolve their portfolio. But I do anticipate ACM Cyber evolving.”

The current official in charge of information advantage, for which no capability manager currently exists, said the Army is looking at the possibility of a capability manager for information advantage.

“All these different capabilities, is there anything that’s just for information advantage and it doesn’t touch cyber, it doesn’t touch just EW, it doesn’t touch just intel?” Col. John Agnello, director of the Army program office for information advantage at the Cyber Center of Excellence, said during a presentation at TechNet Augusta Wednesday. “Well, everything it does touches all of those things. What are we supposed to do for just information advantage? You can’t say just information advantage because that touches all the other ACMs … The long answer to that is the Army is looking at standing up an ACM IA. When it’s going to happen, I don’t know yet.”