{"id":18224,"date":"2020-01-21T11:01:27","date_gmt":"2020-01-21T11:01:27","guid":{"rendered":"https:\/\/one.sightlinemg.com\/c4isrnet\/uncategorized\/2020\/01\/21\/what-new-documents-reveal-about-cyber-commands-biggest-operation\/"},"modified":"2026-08-08T18:02:04","modified_gmt":"2026-08-08T18:02:04","slug":"what-new-documents-reveal-about-cyber-commands-biggest-operation","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/c4isrnet\/home\/2020\/01\/21\/what-new-documents-reveal-about-cyber-commands-biggest-operation\/","title":{"rendered":"What new documents reveal about Cyber Command\u2019s biggest operation"},"content":{"rendered":"\n

New documents provide insight into the growing pains U.S. Cyber Command faced in building a force while simultaneously conducting operations.<\/p>\n\n\n\n

The documents, which were released as part of a Freedom of Information Act request from the National Security Archive at George Washington University<\/a> and later shared with journalists, are a series of internal briefings and lessons from the Defense Department\u2019s most complex cyber operation at the time, Operation Glowing Symphony.<\/p>\n\n\n\n

That operation was part of the larger counter-ISIS operations \u2014 Joint Task Force-Ares<\/a> \u2014 but specifically targeted ISIS\u2019s media and online operations, taking out infrastructure and preventing ISIS members from communicating and posting propaganda.<\/p>\n\n\n\n

While Cyber Command described the operation, which took place in November of 2016, as a victory in the sense that it \u201csuccessfully contested [ISIS] in the information domain,\u201d the documents demonstrate the extent to which the command was still learning how to conduct operations and the exact steps to follow.<\/p>\n\n\n\n

\u201cProcess maturation is something they pull out a lot. Obviously, as CYBERCOM was standing up, it was pulling together plans for how they were going to operate. They actually hadn\u2019t operated that much,\u201d Michael Martelle, cyber vault fellow at the National Security Archive, told reporters. \u201cA lot of these frameworks were formed in theory. Now they go to try them out in practice.\u201d<\/p>\n\n\n\n

Cyber Command leaders have stressed in public remarks for years that the command was building its force while operating. But the extent of those operations has been limited. Officials in recent years have explained that the command didn\u2019t undertake many offensive operations. One official <\/a>said last year he could count on less than two fingers the number of operations, Cyber Command conducted in the last decade or so. One member of Congress <\/a>said DoD didn\u2019t conduct an offensive cyber operation in five years.<\/p>\n\n\n\n

But when they were in action, in this case with Operation Glowing Symphony, Martelle said the documents show cyber leaders did not anticipate the amount of data they would access.<\/p>\n\n\n\n

\u201cThey actually weren\u2019t prepared for the amount of data they were pulling off of ISIS servers \u2026 CYBERCOM was not set up for an operation of this magnitude from day one,\u201d he said. \u201cThey had to learn on the fly, they had to acquire on the fly, they had to grow on the fly.\u201d<\/p>\n\n\n\n

The documents note that Cyber Command\u2019s capability development group, is \u201cdeveloping USCYBERCOM data storage solutions.\u201d<\/p>\n\n\n\n

The capabilities develop group<\/a>, now known as the J9, serves as the advanced concepts and technology directorate and worked to plan and synchronizing cyber capability development and developed capabilities to meet urgent operational needs.<\/p>\n\n\n\n

Experts had noted that in the past the CDG\/J9 had been stressed in recent years by a limited staff and burdened by developing tools for operational needs, namely Joint Task Force-Ares.<\/p>\n\n\n\n

Another example of potential growing pains the documents point to was the fact that updates to operations checklists were not made available readily to the team.<\/p>\n\n\n\n

Finally, the documents note that authorities and processes the command was operating under that the time were restrictive in some cases.<\/p>\n\n\n\n

\u201cAbsent of significant policy changes from [the office of the secretary of defense], USCYBERCOM is limited in its ability to challenge ISIS [redacted]. As a result, USCYBERCOM has [redacted] to achieve our objectives,\u201d the executive summary of a 120-day assessment of Operation Glowing Symphony says.<\/p>\n\n\n\n

Those authorities and processes have been streamlined by the executive branch and Congress in recent years.<\/p>\n\n\n\t