FORT BELVOIR, Va. (March 1, 2016) – The Army’s efforts to integrate operational cyberspace capabilities into its tactical units took another big step forward during a recent training rotation at the National Training Center at Fort Irwin, California.
Cyber forces provided support to offensive and defensive cyberspace operations, intelligence, information operations and opposing forces for the NTC rotation for the Lancer Brigade — the 2nd Stryker Brigade Combat Team (SBCT), 2nd Infantry Division from Joint Base Lewis-McChord, Washington.
Elements of the U.S. Army Cyber Command headquarters: 780th Military Intelligence Brigade from Fort Meade, Maryland; U.S. Army Cyber Protection Brigade from Fort Gordon, Georgia; Cyberspace Opposing Force from the 1st Information Operations Command at Fort Belvoir, Virginia; 201st Expeditionary Military Intelligence Brigade from Joint Base Lewis–McChord; and Fort Gordon’s U.S. Army Cyber Center of Excellence and 7th Signal Command took part in the exercise.
The cyber participation in the training was a key element in the Army’s ongoing Cyber Support to Corps and Below pilot, designed to help the Army develop how it will build and employ cyber in its tactical formations.
To further facilitate the training and the pilot, planners, staff officers and subject-matter experts from Army Cyber, the 780th and the Cyber Protection Brigade also integrated into the brigade staff and NTC’s Operations Group for the rotation. Their role was to provide additional support and expertise for the training while gathering observations and recommendations to help the Army determine how it will train, man, equip, sustain and develop doctrine to define and conduct cyber operations in tactical environments.
The cyber component of the 2nd SBCT rotation represented an extension of an integrative cyber exercise the brigade conducted at Joint Base Lewis–McChord in October. It also follows and expands on two similar brigade combat team rotations conducted last year at the Joint Readiness Training Center at Fort Polk, Louisiana, as part of the pilot.
Each of those exercises was preceded by extensive planning and unit training at home station supported by cyber forces. Preparing the Lancer Brigade and the NTC for cyberspace training and operations was no exception, and began months before the rotation kicked off at Fort Irwin.
Cyber elements “integrated early and integrated often” with the brigade, said Lt. Col. Jonathan Burnett, the Cyber Support to Corps and Below pilot pilot lead for Army Cyber Command. That integration took several forms, he added, from familiarizing the unit with cyber operations, capabilities, execution criteria and rules of engagement and integrating into their planning processes and operations, to establishing critical intelligence support at Joint Base Lewis–McChord for the brigade at NTC, to making recommendations for hardening its networks and systems against attack.
Col. Jerry Turner, commander of the 2nd SBCT, said having cyber planners linked to the brigade during its entire train-up process helped the unit better understand the possibilities and potential of cyber on the battlefield.
At the same time, the NTC infrastructure supporting the rotation underwent a transformation to enhance training on offensive cyber operations.
Chief Warrant Officer 3 Nevery Berry from the 780th Military Intelligence Brigade, said his team worked on the infrastructure to support cyber training at NTC for about six months prior to the Lancer Brigade rotation, to create a realistic cyber environment in “the box”, as NTC’s training area is known.
Those improvements included replicating a real-world network provider serving the several mock villages in the box, establishing wifi access points and providing laptops and smartphones to enable online communication. Soldiers acting as opposing forces and “cyber threat actors” — role-players simulating civilians on the battlefield or enemy sympathizers — can use the system to do everything from carry on routine conversations to help adversary forces target U.S. Soldiers. The same network also enables friendly forces to detect and take action against threats.
Where all these training scenarios once depended on scripted processes, Burnett said, the enhanced infrastructure now more realistically reflects today’s hybrid threats.
“The environment is dynamic, and it changes, and now rather than there being a script, there is a real human factor that is manipulating how the information is viewed,” he said.
The improvements also give commanders a lot more to think about. While much of the traffic the network carries is mundane conversation, when real threats are detected it challenges a commander’s decision-making, Berry said. He will have to think about things such as key cyber terrain, critical networks and systems, cyber rules of engagement and execution criteria, what actions his forces can take and how they may affect other activities, whether they must request the authority to take action, and even whether second- or third-order effects or the possibility of collateral damage might cause him to decide not to take action.
The pilot is also giving the Army a lot to think about. The observations and recommendations of the cyber planners who partnered with the 2nd SBCT, NTC and others, such as the observer-controller/trainers who closely monitor training in the box, were presented at after-action reviews during and after the rotation, and will be further compiled for consideration by the Army’s decision-makers.
Capts. Frederick Waage and Matthew Hutchison were part of a team of researchers from the Army Cyber Institute at West Point, New York, who also took part in the NTC rotation to gather observations they said will be compiled into ACI papers designed to spark discussion about the future development of cyber activities and doctrine.
“One of the main reasons we’re out here is to gain context for current problems, so as we look out to future problems and try to develop future solutions, we have an understanding of what the cyber force is facing now, here at the NTC and at the tactical level,” Hutchison said during the rotation.
“We hope to add value by understanding the current challenges facing staff integration and cyber planning at the maneuver headquarters, as well as the expeditionary nature of cyber enabling at the maneuver headquarters,” Waage added.
Ultimately the findings from the rotation and other Cyber Support to Corps and Below pilot efforts will be used to help NTC develop and improve the cyber elements of its training, and help the Army make decisions on cyber doctrine, manning, rules of engagement, individual and collective training, tactics, equipment, and the myriad other functions necessary to creating and employing forces in a warfighting domain — even whether to incorporate cyber functions at the corps level and below at all.
Perhaps the most major lesson learned from the pilot thus far is that cyber effects can be understood and executed much like other warfighting effects such as combat engineering or intelligence operations, allowing cyber planners and operators to use maneuver terms and symbols tactical commanders are familiar with, and to integrate seamlessly into their staffs.
“It’s not about individual enemies on the battlefield,” said Maj. Wayne Sanders, executive officer for the 781st Military Intelligence Battalion, and a member of the operations team that supported cyber during the rotation. “It’s the ability to integrate into the brigade’s operations process and develop plans to support combined arms maneuver.”
“The importance of us being able to talk tactically is critical for our success in integrating in the staff,” Burnett said. “This was identified during the 3/25 BCT rotation at Joint Readiness Training Center (an earlier rotation in the pilot, involving the 3rd Brigade Combat Team, 25th Infantry Division). We came into this rotation understanding it. And so immediately the team was talking maneuver terminology and fires terminology that was understood and nested with the brigade combat team.”
“We have been able to provide a solid process to inform the brigade commander of his fight. We’ve nested with decision points and provided cyber concepts of operation or schemes of maneuver to support the brigade’s scheme of maneuver, to the point where Lancer 6, the brigade commander, and Lancer 3, the operations officer, looks at his cyberspace planner as a key member on the staff and goes to her regularly for observations and recommendations on how to integrate cyberspace operations to support the brigade fight.”
Turner said the 2nd SBCT’s successes with cyber operations have convinced him that it’s a capability that all brigade commanders should have.
“We had some great success during this rotation in terms of shaping information operations with cyber (as well as) on the wide area security mission with cyber, and then certainly in the decisive action role,” Turner said.
“So this may not be the final version, and it certainly won’t be the final version of how cyber works in a brigade, but what it’s allowed (us) to do is think about it and to begin to explore its possibilities.”
Continued CSCB pilot efforts include additional Combat Training Center rotations. Elements of the 1st Brigade Combat Team, 1st Infantry Division from Fort Riley, Kansas, are already making preparations for an August NTC rotation. In addition, increased cyber operations are being incorporated into the Network Integration Evaluation and Army Warfighter Assessment programs, a series of Soldier-led evaluations designed to integrate and rapidly progress the Army’s tactical communications network.