A revised version of Joint Publication 3-12 Cyberspace Operations — published in December 2022 and while unclassified, is only available to those with DoD common access cards, according to a Joint Staff spokesperson — officially provides a definition for “expeditionary cyberspace operations,” which are “[c]yberspace operations that require the deployment of cyberspace forces within the physical domains.”

DefenseScoop has seen a copy of the updated publication.

The last version was published in 2018 and was publicly available. The Joint Staff spokesman noted that five years has been the norm for updates.

The definition, recognition and discussion of such operations are indicative of not only the maturity of cyberspace and associated operations, but the need for more tactical capabilities to get at targets that the current cyber force might not be able to access.

U.S. Cyber Command owns the offensive cyber capabilities within DOD, and the services conduct offensive cyber ops through Cybercom and the cyber mission forces that each service provides to the command. Authorities to launch cyber effects have traditionally been held at the highest levels of government. In recent years, those authorities have been streamlined and delegated. However, most cyber operations are still conducted from remote locations by the cyber mission force (CMF) and primarily focused on IP-based networks.

Many of the services have begun investing in capabilities and forces for their own offensive cyber, however, that is mostly in the blended electronic warfare or radio frequency-enabled sphere at the tactical level.

The updated doctrine recognizes that these capabilities, which will still have to be coordinated centrally, could provide access to targets that remote operators might not be able to get for a variety of reasons.

“Developing access to targets in or through cyberspace follows a process that can often take significant time. In some cases, remote access is not possible or preferable, and close proximity may be required, using expeditionary [cyber operations],” the joint publication states. “Such operations are key to addressing the challenge of closed networks and other systems that are virtually isolated. Expeditionary CO are often more regionally and tactically focused and can include units of the CMF or special operations forces … If direct access to the target is unavailable or undesired, sometimes a similar or partial effect can be created by indirect access using a related target that has higher-order effects on the desired target.”

It also notes that these effects and operations should be coordinated with the intelligence community to deconflict intelligence gain/loss.

Moreover, the updated doctrine recognizes the complexity of cyberspace and how in-demand cyber capabilities might be. Thus, global cyber support might need to “reach-forward” to support multiple combatant commands simultaneously.

“Allowing them to support [combatant commands] in this way permits faster adaptation to rapidly changing needs and allows threats that initially manifest only in one [area of responsibility] to be mitigated globally in near real time. Likewise, while synchronizing CO missions related to achieving [combatant commander] objectives, some cyberspace capabilities that support this activity may need to be forward-deployed; used in multiple AORs simultaneously; or, for speed in time-critical situations, made available via reachback,” it states. “This might involve augmentation or deployment of cyberspace capabilities to forces already forward or require expeditionary CO by deployment of a fully equipped team of personnel and capabilities.”

When it comes to internalizing the new doctrine, the Air Force sees this as additional access points for operations.

“How do we leverage folks that are and forces that are at the tactical edge for access? That’s primarily how I think about the expeditionary capabilities we have … is empowering or enabling the effect they’re trying to create or using their access or position physically, to help enable some of our effects,” Lt. Gen. Kevin Kennedy, commander of 16^th Air Force/Air Forces Cyber, told DefenseScoop at the AFCEA TechNet Cyber conference.

He noted that these access-enabling capabilities could be across the services, but primarily from an Air Force perspective, “I’m looking at looking within the Air Force, from aerial platforms down to ground-based airmen, as well about how we would do that,” he said.

Officials have described how the services are seeking to build their own forces separate from Cybercom.

“There was a lot of language that came out the [National Defense Authorization Act] that talked about force design in general. All the services to one degree or another are really — I’m not going to say rethinking — but evaluating what their contribution to the joint force is, as well as what their own … service-retained cyber teams are,” Chris Cleary, principal cyber advisor for the Department of Navy, told DefenseScoop at the AFCEA conference.

Last year’s NDAA directed the Pentagon to develop a strategy for converged cyber and electronic warfare conducted by deployed military and intelligence assets, specifically for service-retained assets.

As electronic warfare and cyber capabilities are expected to be a big part of the battlefield in 2030 — a key waypoint the Army has been building toward — it recognizes those capabilities can’t be held from remote sanctuary, Maj. Gen. Paul Stanton, commander of the Army Cyber Center of Excellence, told DefenseScoop in an interview on the sidelines of the AFCEA conference.

In fact, the Army’s principal cyber adviser has tasked the Cyber Center of Excellence with clarifying certain authorities and capabilities.

“How do you execute electronic attack to achieve effects? How do you differentiate a cyber-delivered capability that benefits from proximity based on owning the land, owning the ground?Because that’s what the Army does. The principal cyber advisor, Dr. [Michael] Sulmeyer is tasking me with conducting a study to clearly define and delineate where those lines are,” Stanton said. “This study is going to help us be able to clearly define that. I expect to be tasked to kick that off here in the very near future with about 90 days to complete.”

When it comes to service-retained forces and capabilities, the Army has built the 11^th Cyber Battalion, formerly the 915^th Cyber Warfare Battalion, which provides tactical, on-the-ground cyber operations — mostly through radio-frequency effects — electronic warfare and information ops. The unit will help plan tactical operations for commanders and conduct missions in coordination with deployed forces. It consists of several expeditionary cyber and electromagnetic activities (CEMA) teams that are scalable and will maneuver with units and conduct operations on the ground for commanders.

The Navy, meanwhile, is building what it’s calling non-kinetic effects teams, which will augment afloat forces with critical information warfare capabilities. Cleary has previously noted that the service is still working through what cyber ops at sea will look like.

“As we continue to professionalize this, [information warfare commanders within carrier strike groups] will become more and more important as it fully combines all aspects of the information warfare space, the electromagnetic spectrum, command and control of networks, eventually potentially offensive cyber being delivered from sea, information operations campaigns,” Cleary said.

“That job will mature over time, and then the trick is to get the Navy and the Marine Corps to work together because we are back to our roots of being an expeditionary force. Even the Marines through [Commandant] Gen. [David] Berger’s new force design is really about getting the Marines back to being what the Marines were designed to be, which is an expeditionary fighting force that goes to sea with the Navy. We work together to achieve our objectives as a team, and we’re getting back to our blocking [and] tackling them.”

For the Marine Corps’ part, officials have been building Marine Expeditionary Force Information Groups (MIGs), which were created in 2017 and support each MEF within the Corps, integrate electronic warfare with intelligence, communications, military information support operations, space, cyber and communication strategy — all to provide MEF commanders with an information advantage.

The service has also recently established Marine Corps Information Command (MCIC), which was designed to more tightly link the service’s information forces — including cyber, intelligence and space — in theater with the broader joint force across the globe.

Mission elements the Marines have created and sent forward with Marine expeditionary units are “right in line with [Joint Publication] 3-12,” Maj. Gen. Joseph Matos, deputy commander of Marine Corps Forces Cyberspace Command, told DefenseScoop at the AFCEA conference.

“How do we take what we do at the fort, or back at Fort Meade [where Cybercom is headquartered], and be able to extend that out to the services? That’s what we’re in the process of doing right now … We started about two years ago doing that. That capability is starting to mature pretty well,” he said. “It’s to extend Cyber Command out to those forward units.”

Matos said the recently created MCIC will act as the integrator for a lot of these capabilities throughout the force, acting as a bridge of sorts.

The organization will help tactical forces understand the authorities and capabilities that cyber can provide to help them conduct their missions.

“You kind of hit a glass ceiling of the capability [of] the lower elements being able to reach out and do cyberspace operations,” Matos said of the process prior to establishing that entity. “We’re able to say, OK, here’s a team, trained, capable,’ understand the capabilities that we can bring, give them to the deployed forces to say, ‘OK, you want to do cyber operations, here’s how we can help you do that.’ We know who to talk to, the authorities and so on so forth, and we can do that. I think it’s right in line with what the [Joint Publication] 3-12 is trying to do.”

That command essentially acts as the glue between the high-end cyber forces and the tactical elements, bridging the gap between Cybercom forces and the deployed forces.

“The genesis of the Marine Corps Information Command to tie all these elements together is to address that concern, is to be that integration point between the forces below the tactical edge who have these requirements to operate in a rapidly changing environment. But also tie that to the Marine Corps Information Command knows who to talk to at Cyber Command, or at NSA, or at Space Command. To be able to be that touchpoint between the two organizations so you don’t have to have an infantry battalion going all the way to” a combatant command, Matos said during a presentation at the AFCEA conference.

“I think as we operate in this rapidly changing cyberspace world, that Marine Corps Information Command’s going to be a tremendous benefit to the [Marine Air Ground Task Force], but also to the joint world and the intelligence and cyber world,” he added.

The post New DOD doctrine officially outlines and defines ‘expeditionary cyberspace operations’ appeared first on DefenseScoop.

“As we’re in competition leading up to this crisis, the ability of our enterprise to support our senior leaders and the [intelligence community] and the sharing with our secretary of state, with the National Security Council, with the president, with the secretary of defense — and the ability of us to share information with our partners and allies to tell them exactly what was going to happen at the timing of tempo when it happened — was amazing,” Lt. Gen. Kevin Kennedy, commander of 16^th Air Force, said Wednesday in a presentation at the Department of the Air Force Information Technology and Cyberpower conference in Montgomery, Alabama.

In recent years, foreign information operations have become more prominent and efforts to effectively combat them have appeared difficult. However, members of the intelligence community have emphasized the success of the disclosure campaign across the U.S. government, private sector and partner nations, that has been conducted during the Ukraine-Russia crisis.

The intel and information the U.S. government gathered and shared helped posture Ukraine to be ready to defeat Russian aggression, Kennnedy said.

“Now as we moved into crisis, we’re seeing how their ability to understand the environment is being able to them to help to maintain stasis during this conflict. We really saw it play out in real time,” he added.

In the coming months and years, however, there will be further analysis on why the invasion wasn’t forestalled, or what the value of cyber and the intelligence enterprise was and how that can be applied in the Pacific, where tensions between China and the United States are running high, Kennedy said.

Kennedy described deterrence as the ultimate information operation.

“When we’re talking about integrated deterrence is it’s an informational outcome,” he said, referring to one of the main pillars of the Biden administration’s national defense strategy. “Creating the effect in the mind of your adversary that today is not the day to take on the power and might of the United States of America, the United States Air Force, the United States Space Force, or any of our partners and allies.”

Kennedy compared conducting information operations to crafting a novel.

“What I’m doing is I’m writing a novel. I could be the third chapter, I don’t know where it’s going. But I’m writing a narrative and I’m moving that narrative in the direction that I want it to go,” he said. “I’m contesting the narrative that my adversary’s having and removing his ability, or her ability, to push that narrative out into our audiences and to our partners and allies.”

The goal is to expose adversaries’ malign activity and cause them friction. That could include providing accurate information such as revealing the existence or positions of their military assets or activities.

Kennedy noted that U.S. cyber forces are countering adversaries’ disinformation efforts.

“We are finding infrastructure that adversaries are using to push these narratives in the information environment, and we’re moving them,” he said. “We work across the interagency to make sure that we’re finding those outlets and we’re taking them off the battlefield.”

The post Air Force assessing information warfare lessons from Ukraine-Russia conflict appeared first on DefenseScoop.

“As we’ve seen about how information is used, I think information can be used to build coalitions in competition and I think sharing and exposing malign activity and sharing insights with our allies and partners, I think, is a key activity in competition to build those alliances and partnerships. That’s one thing I saw as the director of operations,” Lt. Gen. Kevin Kennedy told reporters Thursday.

Kennedy, who was most recently the director of operations at U.S. Cyber Command, assumed command of 16^th Air Force in a July 21 ceremony and will now be the unit’s second ever commander. He takes over for Lt. Gen. Timothy Haugh, who will head to Cyber Command to serve as its deputy commander.

16^th Air Force was created in 2019 to fuse various disciplines and commands within the Air Force to break down barriers for a more efficient information warfare entity. It serves as the service cyber component to Cyber Command and the National Security Agency converging disciplines such as cyber, intelligence, surveillance and reconnaissance, electronic warfare, information operations and weather.

Kennedy said he saw firsthand at Cyber Command the importance of partnerships and that is something he hopes to bring to 16^th Air Force.

“When we were in crisis, I think that’s also a way to contest misinformation … then as we go into crisis types or conflict type activities sharing of information really enables joint operations to be more effective,” he said. “I saw that play out as director of operations and I think as the commander of 16th Air Force, working with our wings and partners and the other Air Force components, I think we can bring that to bear.”

Partnerships have been a top priority for Gen. Paul Nakasone, the commander of Cyber Command and director of NSA.

Cyber Command has worked with several partner nations to build their capacity in cyberspace and share threat information that benefits the broader cybersecurity community.

One example includes so-called hunt forward missions, in which teams from Cyber Command physically deploy to nations at their request to hunt for malicious threats on their network.

These operations are mutually beneficial because they help bolster the security of partner nations and provide Cyber Command — and by extension, the U.S. — advanced notice of adversary tactics allowing the U.S. to harden systems at home against these observed threats.

This week Cyber Command shared technical details of malware targeting Ukrainians based on information the Ukrainian government shared with the command.

Outgoing Cmdr. Haugh also noted that at the creation of 16^th Air Force, he underestimated the importance partnerships can play.

“An area that we assumed that we would be able to maximize some of the effects we’d have was through partnership. We definitely underestimated the opportunity space there,” Haugh told reporters prior to his departure.

Kennedy is also taking other lessons from his time at Cyber Command, such as the recognition of how information can be a critical enabler.

“It’s clear to me as information warfare and using information, it’s ever-present during competition as we see crises across the globe, I think it is the dominant activity and then a key enabler or if not the essential enabler as we enter into conflict,” he said. “My role as the director of operations and now the commander of 16th Air Force, I see as we hunt, expose, contest, and when necessary, defeat adversaries in the information domain, I can see that my understanding of how we integrated the cyber element of national power into that as we bring those other enterprises of the ISR, EW and our weather enterprises to bear on that as well.”

The post New Air Force information warfare commander wants to increase partnerships appeared first on DefenseScoop.

Regarding what’s next for 16^th Air Force, “much of it has to do with our ability to scale and to meet the just ever increasing demand for what our airmen bring as they generate insights, as they produce outcomes every day as part of various campaigns, but also how they are preparing for operations against our pacing threat,” Lt. Gen. Timothy Haugh, told reporters ahead of the July 21 change of command ceremony. “That ability to scale to meet that diversity is that really the long term challenge for 16th Air Force, while the team has realized over the last three years that initial task to be able to integrate these capabilities.”

Haugh heads to U.S. Cyber Command to serve as its deputy commander while Lt. Gen. (Sel) Kevin Kennedy will take the reins of 16^th Air Force, which serves as the service component for Cyber Command and NSA.

The vision for creating 16^th Air Force in 2019 was breaking down the silos that existed between cyber, intelligence, surveillance and reconnaissance, electromagnetic spectrum operations and information operations by converging them to better serve combatant commander needs.

“They’ll go to war with the Air Force built by chief 21 … Today’s ceremony is a significant contribution to this moral obligation; ensuring we continue to fly, fight and win in air, space and cyberspace, now and into the future,” then-Gen. David Goldfein, the 21^st chief of staff of the Air Force said at the 16^th Air Force activation ceremony in 2019 regarding his vision for the command. “By combining the disciplines of cyber operations, ISR, electronic warfare, information operations, under a single command, we’ll remove walls and stovepipes.”

Haugh, as its first commander, said he’s proud of the progress the team has made in delivering outcomes for mission partners and creating the synergies and convergence. They need to continue to build upon these frameworks and scale in order to maintain that convergence to beat back adversaries in an ever dynamic information warfare environment.

One such area includes tightening the convergence of cyber and electromagnetic spectrum operations.

“That is an area where our service is talking about it, it’s an area Congress is interested in and now we think we can inform some of that based off of the expertise we have within our various wings,” Haugh said. “What we really want to capitalize on is the talent that brings unique expertise. That’s part of the magic of bringing 16^th Air Force together is the Air Force set out and said that one of the things that we will invest in is how do we more effectively use the electromagnetic spectrum.”

The Air Force has created a combined detachment between the 55^th Wing and the 67^th Cyberspace Wing.  

“We’re at the point now that we’ve allowed them to come together as part of our weapons and tactics conferences to see what are the things that we should be investing in that would allow them to collaborate and to produce outcomes,” Haugh said. “We have established a combined detachment between the two wings to allow them to bring that expertise together. I’m excited. We’ll see where they take that in the future, but we see based off of how cyber continues to have increasing reliance on the spectrum and then where are our adversaries go, we wanted to make sure that we’re bringing together the right expertise to innovate as that dynamic changes.”

Another area Haugh said they’re looking to scale is information operations planning.

“The growth of IO planning and the necessary role that information plays as a joint function inside the Department of Defense, that conversation of what is the role of units as components, what’s the role of our service, how do we support the combatant commands we’re aligned with, all of that does take additional capacity to ensure that we’re aligned with what it looks like in the information environment for those various commanders,” he said.

In the last two years, the Air Force has created the first initial skills training course for its information operations personnel, 14F. While this force is small, plans are to grow it to around 500 in the future.

How the services grows the capacity across all its disciplines at the right level is a balancing act, Haugh said, and they’re partnering with Air Combat Command and the combatant commands to make sure they get it right as 16^th Air Force has been developing new tactics as it matures.

Partnerships

One of the areas Haugh said he underestimated upon leading this new organization was the opportunities for partnerships across the military, federal government and international sphere.

“What we found as a component to EUCOM, that when we talked with Naval Forces Europe, or U.S. Army Europe, or U.S. Air Forces Europe or an element of NATO, they all were really fast to say we see what capabilities you provide, how can we enable your outcomes, how can you partner with us,” he said. “The other element of partnership is our international partnerships and whether that’s helping a nation grow capacity or to partner with another nation, others to very large willingness encouraged by U.S. Cyber Command for us to partner with any number of nations that are trying to grow cyber capacity or share interests with the outcomes we’re trying to achieve.”

Part of this partnership with other combatant commands stem from the growth and maturity of what’s know as Cyber Operations-Integrated Planning Elements.

16^th Air Force, as the service component to Cyber Command, provides cyber forces and support to European Command, Strategic Command, Transportation Command and Space Command. This is done through a construct known as Joint Force Headquarters-Cyber (JFHQ-C), which provides planning, targeting, intelligence and cyber capabilities to the combatant commands to which they’re assigned. The heads of the four service cyber components also lead their respective JFHQ-Cs and oversee the cyber teams that conduct operations for the combatant commands.

The Cyber Operations-Integrated Planning Elements act as an extension of the JFHQ-Cs where cyber planners, not actual operators, are physically embedded within various staff sections at the combatant commands to provide expertise on how cyber can be incorporated into their operations.

“The ability for us to be a component in San Antonio connected simultaneously to European Command, Strategic Command, Space Command and providing a CO-IPE to TRANSCOM, without that team integrated in that combatant command staff, it would be very challenging to make sure that we’re meeting their demands,” Haugh said. “The maturity of the CO-IPEs as an element that can do cyberspace planning, intelligence development and targeting has been just absolutely essential to the maturation of Cyber Command and of the components, 16^th Air Force included.”

Across the federal government, Haugh discussed the work done with the Department of Homeland Security and the FBI in sharing information to protect elections from foreign interference.

“As we look at the core mission of 16^th Air Force, it’s a straightforward role that we have, which is to stop foreign interference in our electoral process. We’re proud to be on that team with all of our interagency partners for the role that our airmen play,” he said. “It also is exciting when you see the work that is going for alignment across how we’re approaching it, from the national cyber director to CISA to the FBI foreign influence task force, the role that NSA and Cyber Command play with the Department of Justice and then we’re contributing to that broader team. It’s powerful.”

Following the Russian operations in the 2020 election, which saw how adept they were in information warfare and how difficult those operations were to thwart, Haugh and his team have lauded the approach of exposing adversary activity to disrupt their operations in the information environment.

In the past, this has been done through the posting of malware samples to the public resource VirusTotal. Malware samples discovered in the course of operations by the Cyber National Mission Force are posted to the site to inform network owners. It also helps antivirus organizations of the strains build patches against that code and helps identify the enemies’ tools being used in ongoing campaigns.

Officials also have noted, in hypothetical examples, how various elements across the cyber and ISR realm, which now all exist under a single command creating a faster and more streamlined unity of effort, could work together to disclose the location of enemy missile batteries in the lead up to destructive action.

“It’s been successful. The ability to expose adversaries in a way that allows others to also become aware of that is a powerful concept,” Haugh said. “That exposure in and of itself isn’t something that that produces an outcome that deters an adversary, but it does impose costs. Those things are areas that we believe have to be part of any campaign, which is to expose the adversary and ensure that as we push things into the information environment, the Department of Defense operates in truth.”

The post Air Force outgoing commander says department’s information warfare command must scale appeared first on DefenseScoop.

If confirmed by the Senate, Kennedy, who is currently serving as the director of operations for U.S. Cyber Command, would get his third star and succeed Lt. Gen. Timothy Haugh. Haugh was recently selected to serve as Cyber Command’s deputy commander in April.  

16^th Air Force was created in 2019 and serves as the first information warfare entity for the Air Force. It combines cyber — serving as the main service component to Cyber Command — electronic warfare, signals intelligence, information operations and weather data.

Since its creation, 16th Air Force has rallied around a concept of convergence where it combines these various disciplines and takes a problem-centric approach to provide combatant commanders with options.

“From that data is there an outcome we want to achieve?” Haugh has previously said. “Based on that, now you have options. Is that something a combatant commander would like to be able to expose, is it something that an interagency wants to communicate to an ally, or is there something in there that is an illegal activity that might lead to a sanction?”

Kennedy has previously served in a number of cyber roles to include principal director to the deputy CIO for command, control, communications and computers and information infrastructure capabilities at the Department of Defense; director of cyberspace strategy and policy in the office of information dominance and CIO for the Secretary of the Air Force; assistant deputy CIO for digital transformation and assistant chief of staff for cyber effects operations at the headquarters Air Force level.

The post New leader chosen for Air Force’s information warfare command appeared first on DefenseScoop.