At the Air Force Academy, cadets engage in a mix of liberal arts and STEM (science, technology, engineering and math) curriculum designed to provide a solid academic foundation. The emphasis on science means graduates receive a Bachelor of Science once their 127 credits are fulfilled. Today, science remains central, but a new area of emphasis continues to emerge: cyber.
Air Force Academy Superintendent Lt. Gen. Michelle Johnson recently spoke with C4ISRNET Editor Amber Corrin about the academy’s growing cyber focus.
C4ISRNET: Give us an overview of what you’re offering at the Air Force Academy in terms of cyber – and what is changing to facilitate and accelerate that.
LT. GEN. MICHELLE JOHNSON: What we have done in the last few years is started a cyber major for network security; it is really a major beyond computer science. I think that’s the thing about this domain, that it is not just for computer scientists or electrical engineers. As [Defense Department leaders] talk about the educational aspect of what we do and the interdisciplinary approach, not just in cyber but across curricula, now people are really looking to get that experiential approach to problem-solving to help people be better critical thinkers and pull things together.
So we have a cyber major but we also … have 19 research centers and an association with the Department of Homeland Security, Intel Corporation and a Center of Innovation that we have had a relationship with for years. And the model of that Center for Innovation is about looking at a problem, trying to find the solution so that our cadets can be exposed to the education part, the faculty can stay on the cutting edge, and then through Cooperative Research and Development Agreements, private sector can commercialize. So Intel has done so with some work we have done with them, and likewise with others at the research centers. They have done some things with their laser and optics research center and done some things a company can commercialize — laser filters and amplifiers — but we have learned the processes. We actually are the No. 1 undergraduate research university in the country, according to the National Science Foundation, because of our expansive research centers.
With that as a basis and a background, what we are going to do and what we are going to call Cyb3rworx — and of course it is spelled in a cool C-y-b-3-r-w-o-r-x because the cyber innovation centers are copyrighted names other places. Ours is an Air Force center, but it is about education; it’s not meant to replace or even attach formally to the 24th Air Force or 25th Air Force. It is meant to be a place where all the cadets and faculty have a role in learning about cyber because all of us have a role in cyber, whether you can code or not. That is the nature of a cyber sandbox if you will, to experiment, to solve tough problems with the design architecture, the intellectual architecture of, say, the Stanford Design School where they solve problems and that is how they do their coursework. It is experiential and it is based on problem-solving and a way of thinking, as opposed to just a curriculum.
C4ISRNET: What would you say led up to creating this cyber major, the CRADA agreements and all of these measures you’re taking to ensure that you are instituting proper cyber training?
JOHNSON: I think all of us feel that we are late to cyber because the technology got ahead of probably the way that people think about it. What seems to be the case is [cyber] seems to be a pretty opaque field and it needs to be demystified. I think people thought: “It’s just IT.” But it is not just IT. It is a place that challenges our thoughts on all levels.
Legally think about the Constitution as an 18th century document that talks about domains and responsibilities and boundaries. And now we have this manmade domain of cyber, and people debate the definition of that. But it is a space where things happen, communication happens, data happens, and we can see with the hacking of the political campaigns right now it can be about information. If it is an industry it can be confidence and data, and if the screens go blank that’s one thing, but if you are not sure who just said that, is that true, are those numbers right, it could affect confidence in the banking system, for example. People are starting to realize that there is something to it beyond computer science, and we need to understand what goes along with this.
So I think this sprouted up and all of us are trying to understand it better. The private sector and the Department of Defense as well are looking at this in a different angle. For us, we want to approach our Cyb3rworx as an educational foundation and not doing the craftwork per se but to help solve wicked problems and think about how to solve problems and bring that into active duty when they become lieutenants.
C4ISRNET: It sounds like Cyb3rworx is kind of the centerpiece of what you are working on right now. Can you talk more about it?
JOHNSON:
Well right now it is an idea so it is based on the work. This is at the very beginning, and we’re using renovated floors of the library on the fourth and fifth floors. We are using the model of the Design School at Stanford, so I have been out there and visited and others, collaborative spaces and that kind of work setting. [Eventually] we would like to have a facility for this and have it be public and private so that we can have private enterprise easily access and be part of the idea of it. Because private sector is a source of most of the really cool ideas and really cutting-edge things, we want to make sure we don’t try to do this in isolation; this is not a domain we can do things in isolation and be effective.
So eventually there will be a building, but in the short run we can still start working. I think the group that they started with [included] cadets from seven different academic majors and different departments of the academy. They started talking to different enterprises, whether it’s military organizations or civilian organizations and just started to say: “How do you describe your cyber risk? Do you even realize what it is, that it is not just the code, that everybody has value in data or how we communicate with each other or what we are persuaded by that is around us?” Just sort of opening awareness and define how we talk about these things.
One thing that is a bit disappointing is I started working with the cyber efforts on the Joint Staff almost 10 years ago and we are still wrestling with the aspects of lexicon. If we say we have exfiltrated the schematics of this airplane, well, wow, if I walked out of the Pentagon with a briefcase full of secrets, we know what that is and what would happen. But if somebody exfiltrates data, what is that? Is that an act of war? Is it crime? Is it espionage?
The lexicon still trails this. So these are the kinds of discussions, as well — they aren’t just doing the hardware/software aspect of it, but what are the implications of it? How do we describe it? When do we know when somebody crossed the boundary? Obviously somebody was robbed but there are other dimensions to it, right, in terms of the confidence of what people said and did.
So there are all those aspects of it and sometimes cyberwarfare might be pulling the plug on someone’s machine or cutting their fiber optic lines. It isn’t all code. So they are exploring … to understand the applications and aspects of cyber that people may not realize that we are all part of, really. It does not have to be this obscure, opaque, mysterious realm that people do not understand is really a part of us.
