The distributed denial of service (DDoS) incidents — which essentially flood internet sites with an unusually high amount of web traffic, rendering them useless — hit at least 10 Ukrainian websites, including those of the Defense Ministry, Foreign Ministry, Culture Ministry and Ukraine’s two largest state banks. Denial of service attacks don’t require the incredible sophistication or painstaking access to networks needed for most data theft or deleterious cyberattacks, making them a common tactic among criminal organizations.

Ukrainian Information Ministry’s Center for Strategic Communications and Information Security suggested Russia could be behind the Feb. 15 incident, but didn’t provide details.

“It is possible that the aggressor resorted to tactics of petty mischief, because his aggressive plans aren’t working overall,” the statement said.

The Pentagon and U.S. Cyber Command deferred comment on the cyberattack to the National Security Council, which did not immediately respond to a request for comment.

Despite these incidents not yet being attributed to an actor, experts are worried they could signal an uptick in activity in eastern Europe amid the Russian troop buildup.

“Overall, this is telling us that more is starting to go down in Ukraine. I think this may very well signal the beginning of a Russian attack on Ukraine,” Tatyana Bolton, policy director of the Cybersecurity & Emerging Threats team at the R Street Institute think tank, told C4ISRNET. Bolton is also the former director of the Cyberspace Solarium Commission, a a bipartisan organization created in the 2019 defense policy bill to develop a multipronged U.S. cyber strategy.

Bolton noted there’s no direct indication Russian entities are responsible. However, the targets affected are what one might see during the beginning of a coordinated military campaign, she said.

Timothy Jones, vice president of systems engineering at Forescout, an enterprise defense company, cautioned that while the initial DDoS incident may not seem sophisticated, it could get worse and more complex.

With denial of service attacks, “sometimes the full extent isn’t really seen right away. We’re just starting to get some of the reports out,” said Jones. “Maybe they’re doing stuff in the background that we’re not necessarily looking at yet, or hasn’t really been felt.”

Using denial of service indicates some level of restraint, which Bolton described as a bit atypical for Russia.

“Usually, [DDoS] doesn’t take you offline for more than a day,” she said. “It can be more serious, but it’s not like encrypting all their files or deleting all their files. Those would have really been significant attacks. But the concern is also, what’s next? Is this a smokescreen for a larger incident or attack?”

The critical infrastructure sector — such as energy companies — were not targeted, which could signal that if Russia was behind the incident, they either view the banking sector as more critical or they are following general rules of warfare by not knocking out power to the civilian sector in the dead of winter, Bolton added.

DDoS is a tactic the Russians have been accused of using previously.

In mid-January, Ukraine blamed Russia for a cyberattack that temporarily disabled about 70 Ukrainian government websites simultaneously. During last month’s attack, an announcement posted stated that Ukrainians should “be afraid and expect the worst.”

Russia launched one of the most devastating cyberattacks ever on Ukraine in 2017 with the NotPetya virus, causing over $10 billion in damage worldwide. The virus, also disguised as ransomware, was a so-called “wiper” that scrubbed entire networks.

Cristin Monahan of the George Washington University’s National Security Archive’s Cyber Vault pointed out the Russians hit Estonia with a series of DDoS incidents in 2007 over Estonia’s decision to relocate a Soviet war monument, something of a watershed moment in the modern cyberwarfare era.

“The Russians made the point that even without direct military intervention, or even cyber interventions with kinetic effects, they can exert significant pressure on nations in their crosshairs, and Ukraine has received the same message for a number of years,” she said.

Monahan added that DDoS incidents rarely result in military intervention, implying the U.S. is not likely to physically engage with Russia over the loss of banking services.

The Associated Press contributed to this report.

Now it’s Washington’s turn to get serious about the “gray zone,” especially when it comes to cyber and information warfare, says a new report from the Atlantic Council. The term is used to describe competitive actions that occur below the threshold of conflict.

The think tank’s recommendations come as the Biden administration finishes its National Security Strategy and National Defense Strategy, which are expected to be published within weeks and address gray-zone or hybrid warfare.

“The DoD needs to compete now and engage in offensive hybrid warfare actions. The United States must respond where competition with China and Russia is taking place today, primarily by playing an enhanced role in gray-zone competition,” read the report, which was led by the Atlantic Council’s Clementine Starling, Air Force Lt. Col. Tyson Wetzel and Christian Trotti ― with former Defense Secretary Chuck Hagel.

The report called for new strategic competition coordinators on the National Security Council with direct access to the president, as well as a new whole-of-government messaging strategy aimed at countering anti-American narratives and reinforcing the rules-based international order. The Pentagon would play a supporting role, “executing offensive and defensive hybrid warfare activities that comport with U.S. values.”

Already, Colin Kahl, the undersecretary of defense for policy, said last month that the Defense Department’s overarching “integrated deterrence” concept ― a key part of the forthcoming National Defense Strategy ― expands “across the spectrum of conflict from high-intensity warfare to the gray zone.” That includes other instruments of national power: intelligence, economic, financial, technological and alliances, Kahl has said.

That mission is going to become more important as nations hostile to U.S. interests increasingly operate below the threshold of traditional conflict to challenge international rules and norms, particularly at flashpoints in the Taiwan Strait and Ukraine, the authors argued. The DoD has taken significant steps to compete in the gray zone, but the authors called for “a departmental paradigm shift” and for the military to go on the offense.

“The department has begun to focus more on countering our strategic competitors’ hybrid warfare efforts, but what I also see is an inherent conflict between competing now and the sexier thing, which is buying new equipment, getting ready to fight the war of the future; and sometimes, under the weight of that effort, competing today loses out a little bit,” Wetzel, who is also a senior fellow at the Atlantic Council, told Defense News.

“Everybody agrees we need to defend in the gray zone, but we really wanted to focus on the fact that we can take the offense as well,” he added.

For instance, as Russian President Vladimir Putin masses troops along Ukraine’s border and claims Ukraine and the West are the aggressors, the U.S. government ― under a more proactive approach to gray zone warfare ― would communicate more consistently and more often that Putin is the sole antagonist.

“Just on the information domain, we need to control the narrative, we need to counter false narratives a lot clearer,” Wetzel said.

The broader Atlantic Council report, drafted with expert input over the last year, made recommendations aimed at deterring or winning a conventional conflict as well as gray zone activities. Among the report’s other conclusions:

• The DoD needs guiding principles for hybrid warfare. The department should be part of unified interagency efforts, invest in “below-threshold” capabilities and training, engage only where strategically important, go on the offense to reinforce the international rules-based order, use strategic messaging, and stick to American ideals.
• Washington needs a hybrid warfare toolkit. That means establishing diplomatic norms as well as naming, shaming and sanctioning bad actors ― all the while, the DoD can show presence, launch distributed denial-of-service attacks, and conduct kinetic or non-kinetic actions against proxy or mercenary forces.
• Hybrid operations can improve conventional deterrence. Adversaries will use hybrid warfare until they can acquire a coercive deterrent against the U.S. and its allies. Containing engagement with China and Russia to cooperation and competition for as long as possible is in America’s interest ― but the U.S. “must get better at proactively engaging in and shaping the gray zone.”
• The State Department’s Global Engagement Center needs a funding boost and authorities to “lead whole-of-government strategic messaging and offensive information operations campaigns, and it needs to lead whole-of-nation efforts to engage with social media companies, and with allies and partners to create a coherent and effective campaign for countering mis- and disinformation.”

Investing in gray zone competition could mean acquiring more cyber tools as well as building an organization for “information operators,” who would quickly attribute and respond to misinformation or disinformation, said Trotti, assistant director of the Atlantic Council’s Forward Defense project.

“What they would ask for in terms of capabilities they need, I don’t know, but we do think there needs to be a focus, and a unit or units, that are really focused in that area,” Trotti said. “They would start to develop the tactics, techniques and procedures that will be used in gray zone operations or hybrid warfare operations.”

To compete with adversaries who already see conflict as part of a continuum (as opposed to binary war and peace), the DoD and its armed services have sought to embrace the tenets of information warfare by competing daily below the threshold of armed conflict.

Waiting to respond to an event after it occurs is too late, officials and experts have asserted over the last few years. Forces must be constantly engaged in the region and against malicious actors to contest their activity and collect the proper intelligence and access needed in case circumstances escalate.

The DoD and the armed services have also reorganized themselves to better align and integrate those various disciplines; they are currently developing new doctrine along this vein.

If the National Defense Strategy does prioritize gray zone conflict, it wouldn’t be the first time. In 2019, the DoD created an amendment to the National Defense Strategy focused on irregular warfare, with one of the five core themes of the annex aimed at operations in the information environment.

In the most recent defense policy bill, signed into law Dec. 27, Congress asked the DoD for a report on the implementation of the irregular warfare strategy. Some members of Congress have also expressed skepticism regarding progress in the information warfare sphere, questioning who is in charge of certain areas and how the department will oversee activities to ensure success.

“I am concerned the department leadership has been slow to adapt to the changing nature of warfare in this domain,” Rep. Jim Langevin, D-R.I., who chairs the House Subcommittee on Cyber, Innovative Technologies, and Information Systems, said during an April 30 hearing.

“Too often, it appears the department’s information-related capabilities are stovepiped centers of excellence with varied management and leadership structures, which makes critical coordination more difficult. Further, the Pentagon has made limited progress implementing its 2016 Operations in the Information Environment Strategy, which raises questions about the department’s information operations leadership structure.”

Though Congress directed the creation of a principal information operations adviser in 2020, some in Congress are worried it isn’t materializing as intended.

“Unfortunately, this position was layered below the undersecretary of defense for policy, contrary to congressional intent. This position was not created as another bureaucratic layer, but as an agile, single role with the mandate to guide each service’s efforts,” Rep. Elise Stefanik, R-New York, said during the same hearing.

Other outside experts worry the DoD is not doing enough to compete and win on a daily basis against sophisticated adversaries.

“Where we’ve fallen short is accounting for the risk that China and Russia will conduct hybrid warfare-style operations against the United States itself,” Paul Stockton, former assistant secretary of defense for homeland defense, told Defense News. “I’m not talking about little green men pouring across our borders — that’ll never happen — but the use of combined information and cyberattacks to disrupt U.S. defense operations at home.”

Stockton, who recently authored a paper titled “Defeating Coercive Information Operations in Future Crises,” did note that the DoD has made progress in collaborating with NATO allies and partners in Asia to be prepared to counter gray zone threats.

However, he added, the U.S. must strengthen its deterrence by developing information operations response options that would credibly threaten Russia and China if they conduct such operations as part of a gray-zone or hybrid warfare approach.

The first was executed by the 27th Special Operations Communications Squadron Mission Defense Team aboard an active MC-130J Commando II. It was the first time their capability was connected to an operational weapon system outside of the labs, according to an Air Force release.

Mission defense teams are specialized groups that protect critical Air Force missions and installations such as critical infrastructure or computers associated with aircraft and remotely piloted systems. They are separate from the cyber protection teams each of the services provide to U.S. Cyber Command.

The demonstration has led to approval for the team’s capabilities to be integrated into flight operations with the MC-130J while it is in flight.

“The MDT’s ability to provide near real-time mission system cyber analysis allows mission owners critical insight regarding the weapon system’s critical components and inputs,” said 27th Special Operations Communications Squadron MDT flight chief Master Sgt. Javier Parris. “Moreover, this capability can be utilized to enhance aircrew situational awareness, decreasing their time to react to emerging cyber intrusions.”

The Air Force said as of Dec. 8 the mission defense team successfully conducted an in-flight test of the new cyber suite aboard the MC-130J and it was the first time flight data had been collected in near real time to enable cyber defense of flight operations in flight. Specifically, the cyber analysis provided by the team could shape preventative maintenance functions for the aircraft and could predict requirements needed to harden operations.

“My squadron was tasked, as a Mission Defense Team pathfinder, to predict and overcome the challenges of the future strategic competition environment — specifically within communications contested or congested environments,” said Maj. Emily Short, commander of the 27th Special Operations Communications Squadron.

During the Northern Lightning Air Force exercise, which took place in August at Volk Field Air National Guard Base, aboard a Canadair Regional Jet, the company says it tested using the APG-83 Scalable Agile Beam Radar, which the company is providing to the Air Force, and what it is calling the Next Generation Electronic Warfare System, an ultrawideband system that detects the radio frequency environment to decide which signals to jam.

Company officials said it’s critical both aircraft subsystems — the active electronically scanned array radar, which is nearly identical to those aboard F-35s and F-22s, and the EW system — can perform their roles without interfering or degrading each other.

“You needed it to be interoperable with the other subsystems and one of those other key subsystems is the advanced AESA. Because you don’t want electronic warfare to have a negative impact on AESA, you don’t want AESA to have a negative impact on electronic warfare,” James Conroy, Northrop’s vice president for navigation, targeting and survivability, told C4ISRNET. The EW system is “a survivability function. AESAs aren’t typically only doing survivability, they’re doing other situational awareness as well as targeting capabilities. You have subsystems that are doing different functions, and you need both those functions to be able to operate simultaneously.”

Northrop representatives also noted the company built the EW system to be compatible with the radar.

The system flew against over 170 test points and against Joint Threat Emitters on the ground, which simulate advanced radars.

Conroy said the test was the first demonstration of the EW system outside a lab environment. During the exercise, the company took the system to an airborne platform and flew it against simulated threats while also having to operate with other aircraft and radars in the same airspace.

“During Northern Lightning, we gained valuable insight on NGEW capabilities,” Lt Col. Stephen Graham, F-16 electronic warfare test director of the Operational Flight Program Combined Test Force, said in a news release. “We are one step closer to installing the first NGEW suite on an Eglin F-16 in less than one year.”

While the Next Generation Electronic Warfare System is not in production for the Air Force, Northrop did win an other transaction authority award last year to develop the system using existing technology. Since the award, Northrop has been working with the Air Force to showcase how it can interact with the F-16, its subsystems and other critical capabilities.

This work is part of the F-16 modernization efforts the Air Force has undertaken. Because the aircraft has been flying for decades — long before modern technological threats on the battlefield — the Air Force must implement upgrades to make the system more survivable against sophisticated adversaries.

“There is a strong push to improve electronic protection for the F-16 against modern adversaries,” Graham said. “NL21 allowed for both an RF-dense environment while permitting targeted testing before, during and after LFE [Large Force Exercise] fights.”

Conroy said the F-16 is still capable.

“We really need the electronic warfare on these platforms to really make them survivable in that next generation or the next type of conflict that these platforms may be engaged in,” he said. “The RF threat environment has got so congested, meaning that there are so many other signals that are out there and being able to find the right signals really requires a lot of advanced processing.”

Northrop officials said they view the demonstration as a stepping stone. Next spring, Conroy said, they’ll begin developmental test on actual F-16s.

Enemies have begun to be more active below the threshold of war, using cyber and digital capabilities to conduct espionage against military and non-military targets while also accessing sensitive systems to disrupt them or sow doubt among users.

For 16th Air Force — the Air Force’s main information warfare entity that fuses cyber; information operations; intelligence, surveillance and reconnaissance; electronic warfare; and weather capabilities — defending these systems from digital intrusions is about producing intelligence.

“How do we generate the right intelligence to understand the threat to those weapon systems and then how do we bring together the capabilities that we have to defend our networks and our weapon systems in a way that buys down the risk for operational commanders?” Lt. Gen. Timothy Haugh, 16th Air Force commander told C4ISRNET in a Sept. 20 interview as part of the Air, Space and Cyber conference hosted by the Air Force Association.

Haugh noted many of these weapon systems pre-date the modern cyber threats perpetuated by sophisticated nation states, namely Russia and China. 16th Air Force, as a result, must try to reduce the risk to these systems.

Haugh said the defensive cyber teams within 16th Air Force are able to defend the entirety of the network all the way down to a particular enclave or a specific weapon system. The organization can ensure everyone has a common picture of the threat as well as the intelligence of what the threats look like, he said, adding they can help make those systems more defensible and less vulnerable.

Haugh also described aligning high-end defensive cyber protection teams — the highly sought and extremely technical cyber teams the services provide to U.S. Cyber Command — with internal defensive assets or resources at a local installation or wing.

The Air Force is building a cadre of mission defense teams — specialized groups that protect key Air Force missions and installations such as critical infrastructure or computers associated with aircraft and remotely piloted systems.

“Where we need to, we can use our combat power to apply additional sensors through a CPT, we can partner with the wing that has their own internal defensive capabilities or in some cases … our program offices may have a cybersecurity service provider, how do we apply them in an area to get them the right data so that we can buy down that risk for an operational commander,” Haugh said.

The Air Force recently has been experimenting with partnering the cyber protection teams and mission defense teams on training, tactics and tools.

Separately, Haugh explained that the maturity of a major Cyber Command program has allowed defensive cyber protection teams across the services to share data more quickly and respond to threats better.

Unified Platform is the centerpiece for Cyber Command’s program architecture that will integrate and analyze data from offensive and defensive operations with partners.

The program, which is being built by the Air Force on behalf of Cyber Command and the joint force, is enabling these teams to simultaneously share threat data and information that allows them to apply algorithms and automate where it makes sense, Haugh said.

“It’s not about acquiring information, it’s about now, how do you get the right airmen to be able to use the right algorithm to see that data. That’s advancing every day,” he said.

Part of this is enabled by what’s known as a big data platform, essentially a hybrid cloud environment that allows for storage, computation and analytics across networked sensors. There are several among Cyber Command, the Defense Information Systems Agency, Army Cyber Command and the Marine Corps.

Haugh noted his unit is working with the other service cyber components to advance tradecraft, and the big data platform has allowed them to jump forward.

The U.S. government and military traditionally relied on industry for much of the software development, but in recent years, the armed services have trained software developers to build tools for operators.

Now, an Air Force cyberspace wing is testing a hybrid approach by embedding developers at commercial production spaces — an idea the wing calls software factory as a service.

Col. Jeffrey Phillips, commander of the 67th Cyberspace Wing, discussed the effort with C4ISRNET, along with how his wing is trying to better compete in the information environment. This interview has been edited for length and clarity.

You work with some airmen to leverage the resources and spaces of the software factories that are local to the wing, and some services have started to create software development billets for personnel that work alongside operators to quickly turn on capabilities. How do you see this capability advancing for the Air Force?

We have the 90th Cyber Operations Squadron, which is aligned under the 318th Cyberspace Operations Group.

It’s the squadron that’s solely focused on capability development, and what I’ve learned as I’ve been in this job is that the key to effective and efficient capability development is to have a reliable DevSecOps platform to develop on.

That’s the development, security and operations platform. It automates the integration of security at every phase of software development life cycle from initial design though integration, testing, deployment and then software delivery.

For years, the wing has internally resourced and managed our own DevSecOps platform. It’s not the most efficient way of professionalizing capability development at all.

We know the partnerships with industry and academia bring up a whole realm of possibility and creativity. So collaboration and outreach efforts have leveraged insights with regard to talent and innovation.

We’ve recently established a relationship with Platform One and LevelUp — Air Force and industry organizations dedicated to software development. They have very mature and reliable DevSecOps platforms.

We started it as a proof of concept; we co-located 30 of our developers with the software factory in an initiative that we’re calling software factory as a service. Basically, we’re paying these companies to leverage their DevSecOps platform for our airmen to be able to develop on this very professional infrastructure that already exists.

This alleviates our developers from the burden of having to manage a capability development infrastructure, then I think we’ll evaluate periodically to determine if this initiative is bearing the fruit we anticipate it will.

I can see a future where all of our capability development airmen are co-located with software factories that already exist and we buy that as a service versus trying to develop that DevSecOps platform ourselves because we’re not funded for it, we’re not professionals at maintaining that infrastructure. We just have really, really smart airmen figuring out how to get it done. I think we buy a lot if we can leverage industry and academic partners that already do this for a living.

Is it a little too early to say how well this effort is performing?

Yes, I really have a lot of faith that it will go well. Literally we’ve started it in the last month.

We’re working through some negotiations right now to see if we can move a broader portion of our airmen into these software factories because we have a lot of faith that it’s going to be the right way to do capability development in the future.

Working with industry partners, you probably will do the unclassified software development on their DevSecOps platform.

There might be some classified aspect to develop that has to be added onto a capability that we’ll bring back into the SCIF [sensitive compartmented information facility] to top it off. I think overall, we can do the majority of our software development in the software factories.

What tools are they developing, and what teams are the tools for?

Our developers work very closely with the CPTs [cyber protection teams] and the CMTs [combat mission teams] to determine what capabilities they need.

We’ve really gotten away from the waterfall software development, and we have that integrated DevSecOps approach that’s a more agile approach to developing software, and we’ve found that it’s generating capabilities a lot faster.

Actually, we stood up what we called the cyber shoot house where we have capability developers, airmen from cyber protection teams, airmen from the combat mission teams, airmen from our range squadron, airmen from our test squadron all sitting together doing this DevSecOps capability tool development.

Cyberspace is considered a subset of the larger information environment. How are you looking at marrying cyber and information operations personnel to achieve outcomes for various combatant commanders or U.S. Cyber Command?

I think the alignment of all the information warfare disciplines under 16th Air Force has driven a very disciplined approach to convergence among the organizations that are responsible for executing each of those missions in each of the disciplines.

Now, we’re all in the same 16th Air Force and Joint Force Headquarters Air Force battle rhythm meetings. We’re participating in the same operational planning teams, and we’re focused on integration through all phases of the joint planning process.

As you know, information operations personnel are a high-demand, low-density commodity. We have a lot of them currently employed in our operational support squadron. We have several of them deployed in the 16th Air Force JFHQ Air Force J-39 as well as man in air operations centers across the different Air Force major commands.

They’re truly experts at planning to dominate the information environment, and I think the way we’ve married them up with our cyber operators, the information operations personnel tend to build the message that we want to proliferate, and our cyber operators figure out a way to deliver that message.

You can almost look at it as building the bomb and then putting the bomb on the plane to be delivered.

The recent stand up of the 14F initial skill training course at the 39th Information Operations Squadron at Hurlburt Field in Florida has allowed us to formalize, professionalize the training that we give to those information operations airmen.

We’re seeing they’re in high demand. We can’t produce them fast enough.

Every AOC [air operations center] wants one. Several wing commanders, flying wing commanders will talk to me about integrating those IO personnel into their OSS’s [operation support squadrons] as well.

I think they’ll be in demand in the Air Force for a long time to come.

The software, called Whiddler, scans files on a network and calculates the probability of whether a file is malicious. It looks for suspicious items that don’t have a signature and therefore might escape antivirus software that scans for known problematic signatures.

The first agreement was in December 2020 and the second in May 2021. The agreements are the first for organizations under 16th Air Force, however, not the first within the Air Force itself.

The Air Force signed a cooperative research and development agreement, or CRADA, with the first company, and officials said they are working on another with the second company. The service did not name the companies or disclose the dollar amounts for the agreements.

Under these agreements, the companies can use the technology developed by the 90th Cyberspace Operations Squadron and transfer it to the private sector to better identify software risks on networks.

Officials said completing these deals has multiple benefits for not just the Air Force or Department of Defense, but potentially for the larger commercial ecosystem.

It provides “the ability to improve our technology that maybe we ourselves are no longer maintaining,” Rebecca Lively, deputy director of the 90th Cyberspace Operations Squadron, told C4ISRNET in an interview. “Through that cooperative agreement, we are able to reap the benefits of those improvements at no cost to the government or at least to now cost to our unit.”

With the technology transferred to a third party, the government can choose whether its wants to adopt improvements to the code that the companies make.

The companies can modify and improve the code and sell it to industry, making the larger community more secure, officials said. The arrangement keeps the government removed from marketing to industry but provides an advanced tool to some businesses with proprietary detection methods that hackers haven’t learned to defeat.

“I think that’s the intent of technology transfer as a whole is that ability to take something that the government has invested funds in, taxpayer funds and let it benefit the taxpayers more broadly than we do just in the DoD,” Lively said.

As a result, the Air Force is helping companies better protect consumers and companies from cyber threats, said Eric Rosenberg, chief of cyber intellectual property law at the 67th Cyberspace Wing.

A big pillar of the DoD’s approach to cybersecurity is enabling others. Many experts have referred to the need for a so-call whole-of-society approach to cybersecurity that combines the government and private sector efforts to create a more stable cyberspace.

“The United States government, in tandem with industry partners, must improve its defensive posture to prevent and or minimize the impacts and impose cost in time and money on those who exploit such vulnerabilities and target American companies and citizens,” Gen. Paul Nakasone, commander of U.S. Cyber Command, told the House Armed Services Committee in May.

Officials also noted another benefit for the DoD in inking these patent license agreements with the private sector for recruitment and retention.

“People want to see their work published, and people want that recognition that you can get by being an inventor on a genuine patent. That’s something especially in the more classified environment we don’t see as often,” Lively said. “We have the ability to leverage these patents license fees that are coming back to pay bonuses to the inventors or who helped that collaboration … That’s a huge piece there, but again, it adds a little to recruiting and retention and it ties to being able to reward our folks.”

Rosenberg also noted that these licensing agreements validate a certain maturity of the labs within the 67th Cyberspace Wing and 16th Air Force.

“I think it shows that we developed as a lab and we’re able to pull off more and more sophisticated technology transfer agreements,” he said. “I think that sets the stage for us to engage in more complicated in cooperation with the private sector.”

Previously, squadron and group commanders were left out of the operational chain of command, primarily serving in an organize, train and equip role. This was the case despite the deep background in cyberspace operations these commanders might have, not to mention the ability for them — in their organize, train and equip role — to have greater insight into what teams are right for specific missions.

But Col. Jeffrey Phillips’, the wing’s commander, is working on “operationalizing” the unit — a top priority he outlined in a strategic vision from February.

He has since created Task Force Mustang, which serves in a dual-hat role commanding the 567th Cyberspace Operations Group and the task force itself. This essentially means the commander is in charge of manning, training and equipping as well as operationally leading teams that are administratively aligned under the group.

The commander now has a greater scope of responsibility because he or she is leading operational planning efforts and assigning teams to missions. “That construct has enabled us to more efficiently get cyber protection teams on task to defend critical systems that are of importance to both the Air Force and joint force commanders,” Phillips told C4ISRNET in an interview.

He added that in some cases, there were defensively focused cyber protection teams that hadn’t been on a mission in 18 months to two years because there wasn’t the right organization available to prioritize work and assigning a mission space.

Now, a colonel in charge of both aspects can use his or her deep knowledge to identify required lines of effort and the campaign plans that need addressed, then assigning units and giving orders while working through the 616th Operations Center, Phillips said.

“Now these O-6 level commanders, because they know what priorities need to be worked, what lines of effort need to be worked, they’re driving those operations instead of those airman sitting back waiting to be tasked when that might not happen if it’s not a priority for somebody else,” he said. “It gives the 567th COG/Task Force Mustang commander the ability to drive that and be proactive instead of reactive.”

He said the task force has executed several missions under this new plan and found it valuable.

Based on lessons learned from Task Force Mustang, team members may begin experimenting with offensive teams under his wing within the 67th Cyber Operations Group, Phillips said.

Additionally, through Task Force Mustang, the Air Force has discovered partnerships between cyber protection teams and mission defense teams; the latter are specialized groups that protect critical Air Force missions and installations such as critical infrastructure or computers associated with aircraft and remotely piloted systems.

The cyber protection teams that might not have been on mission for a while will travel to various bases and link up with mission defense teams, sharing tactics and secrets, given they essentially use the same equipment.

“We found a natural symbiotic relationship between the CPTs that are out on mission and the MDTs that utilize the same weapon systems, so we’ve gone to some bases where the MDTs have not gone to training yet,” Phillips said. “They’ve had their weapon system there, and so the CPTs have actually been able to load their weapon system on whatever cyber terrain the wing commander deems they want to protect, and they’ve been able to do some hands-on training with the MDT personnel that haven’t had formal training yet.”

The 350th Spectrum Warfare Wing, which has been in the works for more than a year, received the designation to start work from Air Combat Command June 25, a release said. The group hopes to enable, equip and optimize the fielding of EMS capabilities with the aim of providing a sustainable and competitive advantage in the non-physical realm. The wing will also provide maintenance, operational and technical expertise for electronic warfare support.

The wing is headquartered at Eglin Air Force Base while a permanent location is chosen. It reports to the Air Force Warfare Center, which performs operational test and evaluation, tactics development, and advanced training.

In recent years, adversaries have noted how U.S. forces are reliant in the spectrum and have sought to disrupt them by adopting high-tech methods to block access and jam or spoof communications.

“The competition in the electromagnetic spectrum is more important than ever before. The Joint Force is connected by and delivers effects in and through the EMS,” Col. William Young, commander of the 350th Spectrum Warfare Wing, said. “If we lose the fight in the EMS, we will lose the fights in all other domains. We’re here to help make sure that doesn’t happen. Standing up this unit emphasizes the Air Force’s commitment to consolidating and modernizing our entire enterprise so that joint warfighters have freedom to attack, maneuver and protect themselves at the time, place and parameters of our choosing.”

The wing is the result of a yearlong study the Air Force kicked off in 2018 that examined the service’s approach to the electromagnetic spectrum.

“The activation of the 350th Spectrum Warfare Wing is the latest step the Air Force has taken to maintain our competitive advantage in electromagnetic warfare,” Maj. Gen. Case Cunningham, commander of the Air Force Warfare Center, said. “Placing this critical mission under a wing commander dedicated to this mission set is fundamental to accelerating needed change and ensuring our warfighters can continue to fight and win in the EMS.”

The wing’s activation is also one piece to a larger multifaceted approach the Air Force is taking to reinvigorate its operations within the electromagnetic sphere to gain an advantage against adversaries. Other methods include reorganizing headquarters staff and modernizing legacy equipment.

Cyber Flag, the command’s premier annual training event, is happening on the heels of Cyber Command’s budget request that proposes adding more teams and potentially altering their composition to adapt to a rapidly changing threat landscape.

For the first time, the exercise will help identify characteristics of successful cyber protection teams, which conduct defensive cyberspace operations.

This year’s exercise, Cyber Flag 21-2, includes over 430 individuals from 17 teams from the U.S., UK, Canada, National Guard, House of Representatives and U.S. Postal Service and is taking place across eight time zones. The event uses the Persistent Cyber Training Environment — an online client that allows Cyber Command warriors to log on from anywhere for training and mission rehearsal.

The exercise was set in the Pacific region at a fictitious allied logistics support depot where teams had to contend with attacks from two adversaries: One was more advanced and focused on denial and disruption, while the other was less sophisticated and focused on theft of intellectual property and personally identifiable information.

In the past, Cyber Command used the exercise to validate teams, but as the threat has evolved, leaders wanted to test concepts and codify new team structures to optimize success.

“We’re continuously evaluating the proficiency of our force. We’re evaluating where the gaps are. We’re evaluating the new TTPs [tactics, techniques and procedures] that the adversary presents,” Coast Guard Rear Adm. Christopher Bartz, chief of exercises and training at Cyber Command, told reporters June 22. “We are evolving our training at the speed that the adversary is evolving their TTPs.”

The exercise will allow Cyber Command, which sets general standards across all the services for cyber teams’ training and the equipment they use, to extract best practices and spread those through the cyberspace community, officials explained.

Bartz equated the effort to other constructs within the military, such as aviation stand teams that go to various units and communicate best practices through the broader aviation community.

With broader domestic participation, officials said they can observe how others conduct defensive cyber operations, contributing to a more holistic governmentwide approach for national security and defense.

Also for the first time this year, teams competed against each other with an overall winner to be selected at the conclusion of the exercise June 25. Assessors will observe how teams identify threats and the techniques defenders use to eject threats from the network or deny further compromise.

In written testimony to Congress this year, Gen. Paul Nakasone, commander of Cyber Command, outlined one of the command’s top priorities: realigning cyber protection teams.

“USCYBERCOM is working with the combatant commands to ensure they have dependable defensive support for their missions while we retain forces to deal with global challenges to the DoDIN [Department of Defense Information Network],” he wrote.

Expanded scope

Cyber Command’s expanded use of PCTE allowed the exercise to grow significantly. The range itself was five times larger than last year, the first year Cyber Command used the platform for its largest exercise.

The PCTE team even established a custom help desk for Cyber Flag — capable of assisting with everything from forgotten passwords to major engineering fixes.

The team applies lessons from the exercise to future events and versions of the platform. For example, the team improved the chat function in the platform after users found it hard to use last year, and they’re awaiting feedback.

The platform and program team have grown to be able to support thousands of activities daily, even last week supporting two major exercises simultaneously: Cyber Flag and Cyber Yankee, a National Guard-focused exercise that took place in New England.

The platform supported the cyber operations kit for UK operators during Cyber Flag, making their experience more realistic. “We want the experience of our foreign allies to be just as valuable and meaningful as any other CMF [cyber mission force] user on PCTE,” said W. Cory Bogler, lead PCTE operations engineer for Product Manager Cyber Resiliency & Training in the Army Program Executive Office Simulation, Training and Instrumentation.

Officials from the PCTE team said the next Cyber Flag — Cyber Flag 21-3 in October — will include participation from all the Five Eyes intelligence alliance nations: the U.S., UK, Canada, Australia and New Zealand.