As a result, they now need to perform at higher levels, work more closely together, comply with challenging new mandates, and modernize legacy systems. Additionally, organizations must do this in the face of a confusing array of choices, and in a rapidly evolving landscape of emerging technologies like blockchain, robotics and artificial intelligence.

One of the emerging technologies already affecting the sector is digital twins, particularly in supply chain management. A combination of enabling technologies and analytic capabilities, digital twins produce a virtual model of a process, system, or object, informed by real-time data.

A new report from Accenture, based on interviews with senior military, defense and aerospace officials, acknowledges the benefits of digital twins for defense supply chains, including cost efficiency, situational awareness, force readiness, fleet management and sustainability.

Digital twins tap real-time and historical data sources to enable learning, reasoning, and dynamic recalibration for improved decision-making. These emerging predictive capabilities can help reduce risk and empower leaders to make more informed decisions, faster.

However, the same report also found four primary barriers to successful digital twin deployment by defense organizations seeking to explore digital twins on a path to more advanced management of their supply chain challenges. Only by identifying and adapting to these challenges can success by guaranteed.

The knowledge deficit

The value of digital twins is in combining the power of technology and human ingenuity to support decision making. Unfortunately, the global defense community currently has a relatively low level of awareness around digital twins, even at the leadership level. Defense organizations should work to ensure senior leaders know about their effectiveness and understand that adoption is led by them, not their IT organization.

Skill deficits can also be addressed through internal learning, new on-demand talent models and through strategic partnerships with vendors and academic and research institutions.

The data dilemma

Real-time data is the oxygen for digital twins, and often, organizations allow their concerns over the quality, volume and complexity of data and the time and costs involved in managing it to supersede its deployment. Many do not realize they can build digital twins with the data they have today and evolve models and inputs over time.

The security paradox

Digital twins deliver more value to the military ecosystem when they extend beyond one organization and integrate with the entire supply chain. However, security concerns can make this difficult to do. Given this and the nascency of digital twin applications in defense supply chains, governance is lagging and perpetuates fears around security and compliance.

The way around this is to update policies and agreements on data security to ensure they also support supply chain data sharing. It also requires refining data security accreditation standards to clarify compliance with sharing rules, and ultimately prioritizing cloud adoption to connect and protect data in a consolidated manner.

The supplier gap

As momentum for digital twins grows, defense organizations will need additional criteria around digitalization and data literacy, as well as modernized contracting protocols, to select suitable suppliers. They will need agreements on data ownership and sharing to provide end-to-end visibility while enabling suppliers to protect intellectual property.

Digital twins can support a process of continuous reinvention, as organizations leading the effort strive to improve data literacy through coaching, commercial incentives, adoption of learnings and modern technologies and tools for supply chain management.

As the world adapts to volatility around markets, the environment and geopolitical events, defense organizations must prepare for more dynamic, informed management of supply chains. Digital twins will become central to supply chain management in defense and are likely to set apart leaders and laggards in military readiness and effectiveness in the years ahead. Tomorrow’s defense leaders are today forging ahead to harness the strategic value of digital twins.

Matthew Gollings is Accenture’s Global Defense Industry Lead. He also leads Accenture’s Defence & National Security Team in Australia and New Zealand.

Have an opinion?

This article is an Op-Ed and the opinions expressed are those of the author. If you would like to respond, or have an editorial of your own you would like to submit, please email C4ISRNET and Federal Times Senior Managing Editor Cary O’Reilly.

Despite the heavy toll of Russia’s missile war on Ukraine, the attacks have, in the aggregate, failed to produce the kind of decisive strategic effects Moscow likely expected would bring about Ukrainian capitulation. My recently released report, Putin’s Missile War, attributes Russia’s underperformance to incompetency within its military and to Ukraine’s skillful use of air defenses and passive measures like dispersion and deception.

Although our understanding of what has transpired in the air war over Ukraine remains incomplete, some things are becoming clearer. More than a year into the war, the Ukrainian military’s command-and-control apparatus remains intact.

Ukraine’s air force and air defenses continue to frustrate Russian air and missile operations. Western weaponry continues to flow to the front lines, and the morale of the Ukrainian people remains steadfast despite enormous hardships.

As we enter spring, Ukraine’s electric grid remains fragile, but functional. And while Discord leaks indicate Ukraine is running low on air defense interceptors, new Western air defense systems continue to arrive to mitigate a future shortfall.

Meanwhile, Russian missile attacks against Ukraine’s civilian infrastructure are becoming less frequent. Pre-war Russian missile stocks are largely diminished, and Moscow is likely now reliant on smaller numbers of newly produced missiles.

The results of Russia’s long-range strike campaign in Ukraine contrasts with those waged by the United States and coalition military forces during Operation Desert Storm and Operation Iraqi Freedom. In those wars, U.S. cruise missiles and other precision-guided munitions played a pivotal role in fracturing Iraq’s military from its political leadership, suppressing enemy air defenses and achieving coalition air supremacy.

Russia’s inability to achieve similar strategic effects with its early air campaigns gave Ukraine the time and breathing room to disperse and reconstitute its forces. And Russia’s continued inability to achieve air superiority and significantly disrupt Ukrainian logistics has permitted the Ukrainian Armed Forces to prosecute aggressive counteroffensives with increasingly sophisticated weaponry.

In a successful strike campaign, one would expect a belligerent to become less dependent on stand-off strike assets over time as it wore down its adversary’s air force and air defenses. Yet Russia has experienced the opposite. Its failure to achieve air superiority in the early phases has caused an increasing dependence on missiles and other stand-off weapons, such as one-way attack drones, to strike targets anywhere beyond the front lines. In this way, Russia has become a victim of the kind of anti-access/area denial strategies it has sought to develop over many years.

In the broadest sense, one cannot separate Russia’s haphazard missile campaign against Ukraine from wider strategic failures that have plagued nearly all aspects of Moscow’s war effort. Yet some unique factors have contributed to the underperformance of Russian missile forces. Russia’s intelligence and targeting capabilities have been too slow and inflexible to keep pace with the dynamic, fast-changing battlespace.

Russia also underestimated the scale of strike operations needed to accomplish its initial war goals. Effective Ukrainian air defenses too have limited the number of Russian missiles successfully reaching their targets. Although the impact of Ukrainian air defenses is difficult to independently confirm, the general trend lines suggest the force is growing more efficient and capable of thinning out Russian missile and drone salvos.

At the start of the conflict, for instance, Ukraine was intercepting no more than 10% of incoming Russian cruise missiles. By early fall, Ukraine was claiming to intercept around half of Russian cruise missile salvos. By the end of 2022, after the arrival of longer-range Western air defenses like NASAMS and IRIS-T, Ukraine regularly claims to intercept 75%-80% of cruise missile salvos.

Russia’s missile strikes against Ukraine have nevertheless taken a tragic toll. Since failing to reach its initial military objectives, Russia has focused its missile attacks on Ukraine’s civilian infrastructure and industry, including the electric grid and transportation infrastructure.

In the longer term, the damage Russian missiles have inflicted will likely weigh down Ukraine’s economic recovery and make additional foreign assistance critical to rebuilding. The continued provision of air defenses now will mitigate these future costs and reinforce a sense of security that could encourage Ukrainian refugees to return home. Such refugee repatriations will be important to Ukraine’s post-war economic recovery and future self-sufficiency.

In its struggle against Russian missile attacks, Ukraine has shown that Russian missiles are dangerous but not unstoppable. Even under harrowing circumstances, Ukraine has defeated advanced Russian cruise missiles with high-tech counters such as active air defenses and low-tech practices such as dispersion, mobility, deception, and camouflage.

One cannot assume Russia or others would repeat the same operational blunders in a future war. Still, Ukraine’s experience illustrates that air and missile defense works, and when combined with passive measures like dispersion and deception, can mitigate even numerous and advanced missile threats from a near-peer adversary.

Ian Williams is a fellow in the International Security Program at the Center for Strategic and International Studies and deputy director of the Missile Defense Project.

On April 11, the Biden Administration met with Balkan leaders to pledge support for their efforts to shut down Russian news sites disseminating disinformation. U.S. support could go a long way toward helping Balkan countries in their attempts to remain autonomous from Russia, which uses disinformation to try to undermine democratic governments in the post-Soviet space.

For the past three years, intelligence analysts and disinformation researchers at my company have been closely following the tactics and strategies of Russian disinformation operations. Here are some suggestions that the U.S. could take that would make even more of an impact in countering the anti-Ukraine disinformation being disseminated by Russia.

The State Department’s suggestions to block websites are a start, but will likely only impact the low-hanging fruit and activities of unsophisticated actors. Countries should not only be targeting the IP addresses and domain names of sites spreading falsehoods, but also the companies that host and support those web addresses. Other State Department-recommended efforts – such as labeling foreign government accounts, and enacting regulations that require transparency around foreign ownership of media properties – will take time to implement. There are some other steps that the U.S. could take in order to help counter the effects of Russian disinformation in the Balkans.

We know that Russia routinely uses bots – computers that pose as humans for disinformation campaigns – to exaggerate the “impact” of its messaging. A lot of Russian disinformation is actually remarkably crude and unconvincing for increasingly skeptical internet audiences, so they want to create the illusion of impact. In today’s hyper-networked media environment, having a “successful” comms strategy is an important component of great power status.

Therefore, it would be worthwhile to increase our capacity to detect bots and trolls by investing in the development of resources, personnel and software that can find the bots. Fact-checkers can use AI-based tools and large language models to recognize disinformation, however the lack of automation and the increasing sophistication of Generative AI-created disinformation makes it challenging to keep up.

Current U.S. resources are insufficient to be competitive in the fight against disinformation. Meanwhile, Russia has invested heavily in state-aligned international broadcasters, RT (Russia Today), RT Balkan and Sputnik News, purveyors of disinformation, as well as social media manipulation and hacking. Although the U.S. created the Global Engagement Center dedicated to fighting disinformation in 2016, countering disinformation has not been a budgetary priority.

Paid ‘influencers’

For the past few years, the Kremlin has paid “influencers” and popular bloggers to spread propaganda and disinformation. Although major social media platforms restricted many official Russian government accounts, these so-called “influencers” are still operational. Social media accounts owned by the Russian government, lawmakers, affiliated media, and influencers should be deleted to block this propaganda channel.

Another important policy the U.S. should consider pursuing, is to sanction fake news outlets and pro-Russian disinformation actors who are spreading propaganda under the guise of journalism. The EU has sanctioned RT and Sputnik News, but U.S. sanctions would hold even more sway. Sanctions are one of the most powerful tools the U.S. has in fighting disinformation.

The U.S. and European governments should urge all Western allies and partners, especially eastern European countries like Georgia and Moldova, to take similar steps as those listed above.

It’s important to understand that many of the disinformation narratives pertaining to Ukraine that are circulating in the U.S. don’t originate from Russia, but come from far-right actors living in the U.S. who are anti-Biden and anti-Ukraine. Thus, U.S. officials need to recognize that pro-Russian disinformation is not purely a foreign policy issue, but also a domestic one for them.

With its global influence and resources, the U.S. has the capability to make a significant difference in the battle against Russian disinformation and establish a model for other world leaders to follow. These recommendations would go a long way toward leveling the disinformation playing field.

Noam Schwartz is CEO and co-founder of ActiveFence, a global trust and safety company.

Have an opinion?

This article is an Op-Ed and the opinions expressed are those of the author. If you would like to respond, or have an editorial of your own you would like to submit, please email C4ISRNET and Federal Times Senior Managing Editor Cary O’Reilly.

Under the Biden administration, the U.S. has taken a stricter stance on the CCP’s economic and political activities. From executive orders limiting trade on semiconductors to sanctions on foreign companies with military ties to the CCP’s Military-Civil Fusion initiatives to strengthening regional alliances within the Association of Southeast Asian Nations.

One of the propellants for this hawkish security approach is the development of artificial intelligence. Unsurprisingly, many critics believe the world is in a tech cold war with the Chinese leading. Although this competition is, by all accounts, only getting started, the U.S. should work to develop safety practices for AI regardless of the pace of the race.

In 2017, the CCP announced the A New Generation Artificial Intelligence Development Plan. The elaborate program sought to expand the Party’s investment in AI research and development, train talent, and construct a world-leading AI ecosystem within China. This strategic effort intends to place China as a major technological superpower and overtake the US in certain sectors. Washington rightfully sees this as a realignment in the global order and a national security threat that minimizes competition and increases potential conflict.

The Chinese state-directed economic model repositioned the country as an economic juggernaut and global influencer in emerging technology development. China has become the world’s second-largest economy while maintaining a large state sector, accounting for forty percent of its economy. Furthermore, it has changed the global balance between the public and private sectors. The Chinese financial industry is central to the operations of state capitalism, and the channels of state influence over the private sector are multiplying.

AI ecosystem

China has managed to create an ecosystem conducive to developing cutting-edge AI capabilities faster than what may have otherwise been possible under purely free market conditions. Whether these same tactics will pay off long term remains unclear; however, if current trends continue, there is no doubt that this type of economic example will be considered a model to emulate among other non-democratic nations seeking rapid technological advancement.

The competition over access markets is a larger area of worry for the U.S., which is increasingly concerned about Chinese companies gaining market share in critical sectors like semiconductors through unfair trade practices. China exploits state subsidies and manipulates currency exchange rates to gain leverage over American firms competing abroad. Similarly, Beijing worries that Washington will continue to use its economic power by blocking Chinese investments into sensitive industries like telecommunications or defense-related tech development within the US. President Biden has signed multiple executive orders limiting foreign investment in US companies, banned the sale of sensitive semiconductors to China by NVIDIA and AMD, and forged stronger alliances with Taiwan, Japan, and South Korea.

Conflicting geopolitical interests embroil the relationship between the U.S. and China. With China vying for power and influence on the global stage, competition has also extended beyond economics into geopolitics. The U.S. is wary of Chinese expansion in the Asia-Pacific region, its potential blockade of the South China Sea, and the possibility of a Taiwan invasion. At the same time, Beijing feels encircled by America with a permanent military presence in South Korea and Japan and bilateral training agreements like those with Mongolia, Japan, and Taiwan. Air and sea collisions have historically ensnared the two countries in tension. These escalating issues lead to tense standoffs with freedom of navigation through the South China Sea—potentially leading to armed conflict only adds to the list of issues.

Prelude to war?

As AI technology develops, its potential implications on U.S.-China tensions are immense. China’s growing presence within global technology innovation will threaten American dominance in certain areas, particularly when developing new AI technology applications that are being used militarily. The CCP’s control of data structures plays a major role in the AI race. Training models on large datasets is easier when the state can leverage its citizens and private industry to develop dual-use tech and share its data.

The U.S. government, however, is legally and morally restricted from unjustly imposing its will on its citizens or forcing companies to surrender data to a competitor. This makes it more difficult to acquire large datasets, thus making the training of AI more challenging. The U.S. will need to do more with private industry to find creative ways to compete in this field with China.

As both countries continue to invest heavily in the R&D of emerging technologies, there is an increased risk that one country might gain control of crucial IP-related assets before the other, creating even more significant economic disparities that could lead to heightened geopolitical issues down the line. Additionally, if either nation could leverage their respective technological advantages against each other through espionage activities (e.g., stealing trade secrets), we would likely see an escalation in current U.S.-China tensions due solely to developments surrounding AI technology alone.

The Chinese government has recognized AI as a critical priority in its national development plan. It invests heavily in AI research, development, and deployment to achieve economic and technological advancement, with social stability and control remaining a vital aspect of its development. The rush to adopt AI by companies worldwide and the absence of standard AI safety regulations will result in unintended consequences that developers should have anticipated had the pressure of competition not created a proverbial ‘Black Box’ of issues.

Cross-pollination

We have already seen the consequence of the lack of regulation regarding cybersecurity which led to globally impacting security breaches and malicious attacks. Most neural networks for machine learning are opaque and difficult to understand, making identifying and addressing potential safety concerns challenging. This belief parallels the idea that many people use their cars without understanding how they function. So long as it gets them where they need to go, the condition under the hood is left to the experts.

This lack of transparency can erode public trust in AI and limit its adoption. If an AI system is compromised, it could be used to spread misinformation or launch cyberattacks. Therefore, it is crucial to develop standard AI safety regulations and policies to mitigate the risks associated with AI use.

On the other hand, policymakers should only impart restrictions with an understanding of the consequences. Too many governmental barriers can hinder innovation in emerging technologies and AI. By breaking down these barriers, it may become possible to combine different perspectives and areas of expertise, leading to new insights and solutions to complex problems. In some cases, collaboration with Chinese developers could build better understanding of AI challenges.

Instead of conflict, cross-pollination of ideas between the two nations could result in novel approaches and applications that have the potential to benefit a more significant number of people than either group could achieve individually. By fostering collaboration and sharing knowledge, both countries could better equip themselves to meet the challenges posed by emerging technologies and AI.

Maj. Nicholas Dockery is a Downing Scholar at Yale University’s Jackson School of Global Affairs and an active-duty Special Forces Officer.

Have an opinion?

This article is an Op-Ed and the opinions expressed are those of the author. If you would like to respond, or have an editorial of your own you would like to submit, please email C4ISRNET and Federal Times Senior Managing Editor Cary O’Reilly.

What does this look like in practice, and how is this going to affect the federal government’s software procurement policies? Those are the types of questions that federal agencies and their software providers alike are asking as they brace for the new world of “software bills of materials” (aka “SBOMs”) and their disclosure requirements.

If you want a front-row seat to watch the federal government’s effort to make software “secure by default” in the next two years, memory safety is a great class of software vulnerability to watch. Let’s take a look.

What is memory safety?

Memory safety is a particularly ripe domain for software vulnerabilities. So much so that back in November, the National Security Agency issued guidance to “help software developers and operators prevent and mitigate software memory safety issues, which account for a large portion of exploitable vulnerabilities.”

Most low-level programming languages–like C++ and C–are memory unsafe. Developers have to manually configure and allocate the machine’s memory. If you make a mistake, your program can read or write data from the wrong type of memory. And that leads to bugs, crashes, data leaks and all kinds of potential exploits.

Dealing with memory safety in these low-level languages is something that gets taught in programming classes, but it’s tedious, error prone and time-intensive work.

Memory safety vulnerabilities include buffer overflows and use-after-free errors and have accounted for the majority of application security issues disclosed by software companies. Back in 2019, Microsoft revealed that 70% of its common vulnerabilities and exposures, or CVEs, were caused by developers making memory corruption mistakes in their C and C++ code.

Memory unsafe

According to Consumer Reports’ Future of Memory Safety report, “60 to 70 percent of browser and kernel vulnerabilities—and security bugs found in C/C++ code bases—are due to memory unsafety, many of which can be solved by using memory-safe languages.”

Memory-safe languages have been around for a long time. But up until recently, they weren’t performant or scalable enough for low-level programming at the kernel or firmware level. And so a whole class of developers continued to use memory unsafe languages.

The Rust programming language really burst onto the scene as the language that nailed developer primitives for memory and performance, and has radically changed how developers can approach low-level programming with memory safety guardrails.

The Rust community has already reached 2 million developers and has become one of the most-loved of all programming languages. Major players in the industry including Google have completed major rewrites in Rust, in the name of memory safety, including much of the critical backend infrastructure (HTTP and TLS) for Android.

But what about all that other legacy code out there in production in the world’s systems?

Rewriting software is hard. It takes a lot of time, and it takes effort to convince management that it’s a worthwhile investment. It’s one thing for publicly funded government agencies and the world’s largest tech companies with their deep pockets to rewrite for memory safety. But convincing the rest of the market, and under resourced open-source maintainers, to do the right thing is a major challenge.

In its Cybersecurity Information Sheet on Software Memory Safety released late last year, the NSA described this key challenge of driving the “culture of software development towards utilizing memory safe languages.”

The power of SBOMs

The real power of SBOMs is their up-front value to the software procurement process. They provide the “list of ingredients” that has always been missing for software consumers to be able to make informed decisions on how a technology will affect their security posture.

When we can attest to what’s inside our software before we purchase it, now the laws of supply and demand economics should drive down our overall usage of software that is memory un-safe. If you are choosing which software to adopt and have multiple options, you are going to favor the software that wasn’t written in a memory unsafe language like COBOL, because you want to avoid a weakened security posture.

The NSA’s National Cybersecurity Strategy report described the federal commitment to SBOMs as central to an overall “software supply chain risk mitigation objective.” It also described its efforts to develop an “adaptable safe harbor framework to shield from liability companies that securely develop and maintain their software products and services” like the NIST Secure Software Development Framework, or SSDF.

The read-between-the-lines message here is that the federal government — the country’s largest purchaser of software — will itself be using SBOMs to instruct security compliance for procurement, and then will pressure industry with the carrot of legal indemnity if they follow similar precautions.

As SBOMs give first the government, then industry at large, the standard method to inspect software packages, markets will be able to galvanize much faster to weed out critical software vulnerabilities. Memory safety may be SBOMs first killer use case, but it will be equally interesting to watch how SBOMs play a role in the government’s carrot-and-stick measures with legal indemnities and safe harbors.

Dan Lorenc is CEO and co-founder of Chainguard. Previously he was staff software engineer and lead for Google’s Open Source Security Team (GOSST). He has founded projects like Minikube, Skaffold, TektonCD, and Sigstore.

Today, though, most mobile communications rely on radio frequency signals, often enhanced with digital technology. Yet, despite many technology advances, effective communication can be difficult, depending on the environment. Systems need to sense, process and communicate information quickly, accurately, reliably, and securely, even in challenging environments.

The challenge grows with increasing dependence on ever larger volumes of data, often combined with near real time requirements. For the U.S. Department of Defense, this is one key challenge to effective command and control in the denied, degraded, intermittent or limited environments expected at the tactical edge.

Efficient and robust communications are foundational to the DoD’s Joint All-Domain Command and Control initiative. The goal is to ensure effective C2 across all domains and echelons – orchestrating all resources, such as sensors, platforms, and weapon systems, to achieve desired outcomes as quickly and efficiently as possible. Doing so requires maximizing the value of every piece of data communicated, and to as many parts of the C2 network as possible.

Think of this as creating compact data packages, or “edge semaphores” – concise, precise, interoperable, and secure.

Powered by increased compute and analytics available at the edge, to create or interpret these messages, such lightweight communications can enable exchange of mission-critical information across all domains – while reducing overall communications requirements and minimizing the impact of DDIL environments. The result would be more effective distributed C2, with better-informed decisions and faster, more accurate actions by mission stakeholders across echelons.

Purpose-built but problematic

Historically, the DoD developed systems for specific needs. Dedicated sensors feeding a customized tracking system, which in turn services a dedicated mission platform. Single purpose “stove-pipe” systems maximized effectiveness of available technology, but only for a specific application.

However, stove-piped systems don’t interoperate. Data formats from one sensor are most often not understood by others, even though the basic nature – location, track, time – is much the same. We need a far more distributed and agile approach to address the realities of the world today. A single mission may involve multiple military units and coalition partners, each with a varied and changing array of available sensors and systems at any given moment. Mission leaders and teams need to integrate these resources, make decisions and act, sometimes in mere milliseconds, to include operating in DDIL environments.

Current technologies, particularly in storage and compute, present far more capable and versatile options to support a vast range of application requirements. Thus, the solution to lack of interoperability as a critical hurdle to all-domain operations is well within reach. The ability to collaborate and combine resources across multiple systems offers far greater flexibility and mission effectiveness; exactly what JADC2 envisions.

Stovepipes aren’t the only problem. While our networks have grown more robust, our communications have become more verbose. Sensor systems can generate enormous quantities of data. Transmitting all that information for analysis can be slow or unreliable, particularly when operating in DDIL environments.

Standardizing at the edge

Designing with an edge semaphore concept helps solve these challenges. Lightweight protocols with standardized data formats across otherwise disparate sensors and systems enable efficiency and interoperability.

Lightweight protocols can minimize the quantity of data transmitted by leveraging compute and analytics to maximize the value of that data. Just as a single maritime semaphore set can encode a complex message based on prestored information, so could edge semaphores be standardized system messages, indexing richer content, whether calculated or stored locally.

Ensuring interoperability of messages requires a common taxonomy of information types to address how critical characteristics are understood, such as accuracy and precision for track data. Without this, translating information from one system to another risks unacceptable unknown errors in accuracy and precision. Introducing enhanced compute and analytics at the edge, given a common taxonomy, ensures shared data is not only lightweight and efficient, but also understood in context of both the source and the target application, thereby mitigating translation errors.

Localizing compute

A key element of the sense-track-execute process is the analysis that brings together decisions and actions. Localizing compute resources at the mission edge can optimize these analytics and amplify the advantages of lightweight protocols.

New system-on-chip processors integrate multiple system components – CPU, memory, data storage, and specialized software – into a single component. The result is higher performance, lower power consumption, greater reliability, and smaller size – addressing the size, weight, power, and cost (SWaP-C) requirements of the edge.

Today’s enhanced processors can power deeper analytics at the edge, including artificial intelligence (AI). In the past, large datasets had to be transferred from edge devices to centralized datacenters to perform higher analytics. However, a highly centralized capability is not conducive to the dynamic and distributed operational vision of JADC2. Through edge compute, highly enriched information and insights can be used locally and shared with the larger C2 network through lightweight protocols, decreasing response time to threats.

The technology to deploy edge compute and edge semaphores is available today. This approach will enable the DoD to make its C2 networks more interoperable, responsive, and resilient in the dynamic mission environments of today and the future. The result will be more effective joint all-domain distributed command and control, and with it, faster and better informed decision-making to support mission success.

Retired U.S. Navy Rear Adm. Ron Fritzemeier is director of Mission Solutions for Intel, Defense and National Security group.

Have an opinion?

This article is an Op-Ed and the opinions expressed are those of the author. If you would like to respond, or have an editorial of your own you would like to submit, please email C4ISRNET and Federal Times Senior Managing Editor Cary O’Reilly.

In recent years, advances in technology, coupled with the ease of digital connection, have greatly increased the convergence of IT and OT across critical infrastructure sectors and even within the federal government. In fact, 56 out of 90 agencies report using Internet of Things technologies to control, monitor, access, or track equipment, systems, facilities, or physical assets.

Convergence brings significant benefits, from increased visibility to user-centric capabilities. Unfortunately, it also greatly increases agencies’ attack surface, so now must be included under the NCS.

IT and OT are not created equal

Lessons learned from modernizing IT unfortunately won’t apply to OT because of OT’s unique operating requirements. Efforts taken under the NCS must first consider each individually and then together.

For instance, when an IT system reaches end-of-life, an agency must decide to either continue using it at risk, pay for extended manufacturer service, or sunset and replace it all together. Each option has pros and cons, but agencies at least have options and can usually plan accordingly—sunset dates will be known in advance, diminishing potential impacts of the time variable.

However, timing is actually critical for approaching OT modernization. Gartner predicts that by 2025 cyber attackers will have weaponized OT environments to successfully harm or even kill humans. Ramifications of an attack on IT could be devastating, but might pale in comparison to the long-term human safety and critical infrastructure impacts of a well-executed attack on OT. We simply lack the luxury of time to modernize OT security that has been given to securing IT over many years.

Additionally, it is often feasible and more cost effective to simply rip-and-replace an IT system at its end-of-life. Because of how OT systems were designed, rip-and-replace isn’t a viable approach for them. Legacy OT systems were built on the engineering paradigm of twenty years ago—to be long-lasting and achieve the functional goals of monitoring and controlling critical processes.

Connectivity wasn’t a functional requirement, so neither was security. Times have changed since these systems were put in place and security risks must now be a consideration.

Further, because of the nature of what OT systems do, continuity requires that they can’t just be turned off and replaced with a new, more secure system. Unlike VoIP phones in an office, airplanes and tanks, for example, aren’t mass produced or easy to replace. When replacement of OT systems deployed in-field is possible, such efforts would take years and the required costs would be prohibitive.

Three tenets for OT security

Instead, OT security modernization should focus on improving security by augmentation, particularly for defense and weapons systems. Here are a few tips for agency decision-makers to consider when assessing OT modernization approaches:

— Any given defense or weapons system has up to hundreds of different types of hardware, components and ‘standard’ protocols in use. Tooling for cyber modernization efforts should not be limited to addressing only a subset of them. Instead, chosen solutions should be hardware and protocol agnostic. The tool must accommodate the platform rather than trying to force the platform to conform to the tool’s limitations.

— As data is the building block of IT network security, so it should be within OT systems as well. Defense and weapons systems continually produce tremendous amounts of valuable data that in its raw form isn’t of much use. But when captured, enriched and translated, it could be turned into information, when coupled with historical data and context, that can become actionable intelligence for critical security decision-making.

— “You can’t protect what you can’t see” is a common IT security maxim that also holds true for OT. The aim of OT security modernization should be complete observability—the ability to understand what is happening inside a system based on external data that the system produces and exposes. Observability can enable decision-making to be based not on backward-looking indicators and uncertain predictions, but on leading indicators providing facts, knowledge and understanding.

As the interconnection between IT and OT in onboard weapon systems increases, digital threats now put previously isolated OT at unprecedented risk. Meeting the objectives of the NCS will require a skillful approach to protecting each separately and both together to protect our warfighters and preserve American battlefield dominance.

Colby Proffitt is a cybersecurity strategist at Shift5, an Arlington, Virginia-based supplier of computer security services.

Have an opinion?

This article is an Op-Ed and the opinions expressed are those of the author. If you would like to respond, or have an editorial of your own you would like to submit, please email C4ISRNET and Federal Times Senior Managing Editor Cary O’Reilly.

Today, the U.S. faces increasingly complex and sophisticated threats from foreign governments exerting malign influence—covert actions to influence public sentiment and public discourse.

As recently as July 2022, the Justice Department unsealed an indictment against an individual working on behalf of Russian intelligence for “allegedly orchestrating a years-long foreign malign influence campaign that used various U.S. political groups to sow discord, spread pro-Russian propaganda, and interfere in elections within the United States.”

Foreign influence operations rose dramatically throughout the COVID-19 pandemic, according to the 2022 Digital Defense Report from Microsoft. The report highlighted that nation states most frequently targeted social media platforms controlled by U.S. technology companies to “distribute propaganda” to “erode trust, increase polarization, and threaten democratic processes.”

The report also explained how think tanks and NGOs, universities and academics, and government officials were the next most frequently targeted.

“These are desirable ‘soft targets’ for espionage to collect intelligence on geopolitical issues,” the report concluded.

On a technical level, many major U.S. technology companies already work together to support U.S. government efforts to counter foreign cyber intrusions. To combat foreign malign influence, the U.S. and its allies could take a page from this cyber strategy.

Cyberattacks in the digital space grew dramatically over the last two decades. Global ransomware costs have ballooned from $325 million in 2015 to $20 billion in 2021, a 57-fold increase in just six years, according to a June 2022 report from Cybersecurity Ventures, the publisher of Cybercrime Magazine.

To meet this threat, the U.S. government evolved and adapted. A key strategy was an early effort to develop institutional capabilities where businesses—which are often competitors—could share near real-time threats in the cyber domain. This development included the creation of Information Sharing and Analysis Centers in 1998. An Executive Order in 2015 expanded this to non-sector-specific Information Sharing and Analysis Organizations.

The success of these information sharing models led to the 2021 creation of the Joint Cyber Defense Collaborative within the Cybersecurity and Infrastructure Agency, which is part of the Department of Homeland Security.

The JCDC leads “integrated public-private sector cyber defense planning” by creating a “cybersecurity information fusion.” The collaborative has become an active information-sharing environment enabling cyber cooperation between the private sector, government (federal, state, local, tribal, and territorial) and international allies.

This cooperative model seemed a logical step because most attacks are against infrastructure created and owned by private companies, and these companies naturally have deeper technical knowledge of their software and systems.

Similarly, foreign influence operations also take place in public spaces that are privately-owned, primarily social media platforms. Despite this reality, however, no information-sharing space exists for private companies and the U.S. government to work together against the spread of disinformation on these networks.

The U.S. government needs a place to share information with the private sector on the tactics and techniques used by malign actors. While tech and social media companies compete against each other to build audience influence, they all suffer the burden of malicious actors trying to hijack that influence.

Efforts by foreign powers to spread disinformation generally occur across platforms simultaneously. A safe space for private companies to cooperate with each other would bolster their ability to collective thwart foreign influence operations and preserve the security of their networks.

Cyberspace Solarium Commission

The Cyberspace Solarium Commission, created by Congress to develop a strategic approach to defend against cyber attacks, published a report in 2020 calling for the formation of a Joint Collaborative Environment. The JCE is described as “a common and interoperable environment for the sharing and fusing of threat information, insight, and other relevant data across the federal government and between the public and private sectors.”

The JCE would create the dynamic environment to help facilitate information-sharing, while a JCDC branch devoted to foreign malign influence could organize stakeholders to respond to the threat.

All too often, analyses of cyberattacks focus strictly on the technical components of what is happening, while ignoring the broader context of why the attack is happening. By integrating foreign malign influence into existing cybersecurity infrastructure, the U.S. government can produce a comprehensive approach to the challenge.

David Rubin is a managing director for Deloitte Transactions and Business Analytics LLP, where he assists clients within the U.S. Intelligence Community, Department of Homeland Security and law enforcement.

Chris Weggeman is a retired U.S. Air Force Lieutenant General, where he led cyber mission forces at the U.S. Cyber Command (USCYBERCOM). He is a managing director for Deloitte & Touche LLP serving government and the public sector in cyber and strategic risk.

Have an opinion?

This article is an Op-Ed and the opinions expressed are those of the author. If you would like to respond, or have an editorial of your own you would like to submit, please email C4ISRNET and Federal Times Senior Managing Editor Cary O’Reilly.

Over the past eight sessions of Congress, there have been no fewer than 14 different Pentagon efficiency drills. The names are familiar to budget watchers: Better Buying Power 1.0 (and 2.0 … and 3.0), the Weapon Systems Acquisition Reform Act, night court, fourth-estate reform, and others. Some of these efforts were successful; others not so much.

While well-intentioned, a common theme was that these were short-term, budget-bogey exercises that yielded few new dollars for reinvestment into higher priorities. This is due in part to defense reform being over-focused on the acquisition of things. However, the majority of what the military purchases is no longer weapons systems but rather services and technology. Zealous reformers continue to over-focus on weapons buys when hardware is increasingly the commodity.

Moreover, the U.S. military is no longer a monopsony buyer able to move markets due to smaller bets, nor is the organization an original inventor changing the American economy. Rather, the military must increasingly innovate with mostly commercial products and give them a unique defense application.

In addition, the Pentagon finds itself in a new and uncomfortable position: that of needing to work to attract and entice new companies to want to do business with the armed forces. Tech and commercial companies know of the Defense Department’s low appetite for risk-taking and long timelines to take ideas from the lab to the field when compared to the private sector.

Change and modernization are needed, but not simply the rinse-and-repeat acquisition reforms of the past. Instead reform should fall into two categories:

1. Change with respect to reduction — whether of mission, rules, head count, regulations, laws, provisions, workload and more.
2. Modifications that increase accountability for passing appropriations on time and highlighting the true costs of running the U.S. military.

That means accountability, like sequestering congressional paychecks until appropriations are enacted each day after the start of the fiscal year. Appropriators must also revise rules established at a time when the defense budget was a fraction of its size today, and let the Defense Department move more money around after being approved to react in real time to changing technology.

It also means greater transparency on the costs of doing business. As former Rep. Anthony Brown, D-Md., highlighted — but few seem to be aware — Washington spends “$1 billion more on Medicare in the defense budget than we do on new tactical vehicles. We spend more on the Defense Health Program than we do on new ships. In total, some $200 billion in the defense budget are essentially for nondefense purposes — from salaries to health care to basic research.”

Congress should focus on combining the pay and benefits of defense workforces — uniformed and civilian — and their health care into one new account. Such a change should launch a broader discussion of moving certain costs, primarily people and paychecks, out of discretionary and into mandatory federal spending. That will energize a needed debate on how much the United States is spending on direct military capability, compared to expenses beyond the scope of the Defense Department that have little impact on warfighting or belong in the domain of another agency.

When it comes to slashing the barnacles of bureaucracy and taking away mission and work, Pentagon contracting is overdue for a refresh. As the American Enterprise Institute’s Bill Greenwalt has highlighted, federal acquisition regulation clauses mandate companies doing business with the Defense Department must operate in ways that they may not otherwise have to in their commercial operations.

Some of these regulations, such as those in the Truth in Negotiations Act, are undoubtedly necessary as they prevent the taxpayer from being ripped off. Others, while well-intentioned, are simply onerous and drive up compliance costs. Paring back regulations would start updating our Soviet-style acquisition system and allow greater speed and urgency in bolstering deterrence.

In addition to regulatory refresh, the Pentagon should also review whether the work of Space Command is now duplicative or redundant given that the U.S. Space Force has stood up. Congress is poised to debate the future of Space Command as an organization that has potentially outlived its usefulness and should be sunsetted if appropriate — and then statutory work reassigned if needed.

Change doesn’t come overnight at the Pentagon. Rather, defense reform is the patient, hard work of many years, which both requires leadership and doggedness of implementation.

By pursuing these reforms (and straying away from harmful ideas like capping spending at arbitrary levels disconnected from the real world), Congress can begin this essential but difficult job of reform through reduction rather than the addition of new laws and rules that further slow down an already glacial organization. Moreover, policymakers will demonstrate their seriousness about needed defense rehabilitation, while skipping the defense-reform theater that has plagued the military for too long.

Mackenzie Eaglen is a senior fellow at the American Enterprise Institute think tank. She also serves on the U.S. Army Science Board.

Our military stresses access to space is vital to America’s national security, intelligence efforts, treaty verification, and the economy. Allowing China and Russia to gain the upper hand would imperil our interests. This is why we must be vigilant in how we develop our military space capabilities and who we work with to fortify our security. We cannot risk wasting mission success and timeliness on unreliable technology can allow our enemies to gain an advantage over us.

The Ukraine war proves why space is critical to our national security. Our satellite technology has provided crucial assistance to Ukrainians on the battlefield, ensuring the Eastern European state can defend itself. Having this power provides the winning edge in modern warfare. This edge drives our enemies to develop counter-space offensive weapons, from ground-level orbital lasers to blind our satellites to missiles that take them out of the sky.

Russia, China, North Korea, and Iran are all developing this tech to counteract America’s space dominance. Just imagine if our enemies had the upper hand in low-earth orbit. The world would be a far more dangerous place for ordinary Americans.

The most crucial project ensuring America remains the world’s preeminent space power is the National Security Space Launch program. This initiative procures contracts–including for top military satellites–that make government space launches more inexpensive and more reliable. The program is designed to maintain our nation’s continued access to space–and it’s in greater demand than ever.

That is why it’s so concerning that the Space Force has loosened bidding restrictions for Phase 3 of this important program.

Following years of lobbying from billionaire Jeff Bezos’ Blue Origin and others, the Space Force recently converted the program into a dual-lane launch approach, with one lane of the program becoming more open to newer commercial companies.

I have always been a strong proponent of increasing competition in the American space industry. In fact, when in Congress, I aggressively pushed for passage of the bill that effectively stopped the government monopoly on space launches and created the new era of private spaceflight this country realizes today.

SpaceX, United Launch Alliance

However, the Space Force designed its Phase 3 changes to the NSSL to benefit companies that still need to finish developing their launch vehicles. With companies like SpaceX (one of the companies that our private spaceflight bill helped shepherd into the marketplace), and the United Launch Alliance already possessing reliable and effective launch vehicles, the federal government cannot in good conscience risk mission security by choosing companies that have promised but not yet delivered their competing products.

Some of the companies in question have already delayed their first launches by a matter of years. Given how common delays are in the industry, there is certainly no guaranteeing that these products will be ready to service the NSSL on time — and even if they are, there is no way of knowing how reliable they will be.

Everyone wants these companies to succeed, and we have every reason to believe they will. Their time will come, but that time is not now.

The space race is the great battle of the 21st century. America must win it. Our nation must be proactive in defending the final frontier. We can’t jeopardize America’s assured access to space by adding uncertainty and questions of reliability into the warfighting domain of the future. We must ensure we invest in the best options available to deliver the best results for the American people. It’s what the U.S.’s national security needs and demands.

Nick Lampson is a former Democratic Congressman from Texas who served as the Ranking Member of the Space and Aeronautics Subcommittee.

Have an opinion?

This article is an Op-Ed and the opinions expressed are those of the author. If you would like to respond, or have an editorial of your own you would like to submit, please email C4ISRNET and Federal Times Senior Managing Editor Cary O’Reilly.