Their target – critical Ukrainian government data.

As the multi-pronged invasion commenced, cruise missiles struck a Ukrainian governmental facility housing servers full of important data. At the same time, Russian cyber operatives conducted “wiper attacks” on computer networks – attempting to delete all the stored information.

Despite the sophisticated and holistic nature of the Russian attack, the Ukrainian data survived the onslaught. For a week earlier, it had been virtually smuggled out of the country. The data which had once singularly been stored on physical servers, had been uploaded to the cloud.

“The key to a country’s digital resilience in wartime is the ability quickly to move data outside the country while still connecting to and relying on it for a government’s digital operations,” according to a report from Microsoft on the cyber lessons of the Ukrainian war. “One reason these kinetic and cyberattacks have had limited operational impact is because digital operations and data have been disbursed into the public cloud,” it said.

Microsoft, which competes with Amazon, IBM, Salesforce and other software and computer networking companies in providing cloud services to governments, published the report, “Defending Ukraine: Early Lessons from the Cyber War,” on June 22.

Prior to the Russia-Ukraine war, a data protection law prohibited the Ukrainian government from utilizing the cloud to store and process data, forcing all the data to be centralized and vulnerable, according to the report. The law was amended just days before the invasion to permit the very same information to be housed on the cloud.

The cloud is a system of decentralized, networked computer servers spread out all over the world. Stored data, often encrypted and secure, is housed in duplicate across multiple servers and can be accessed via the internet from any location. The redundancy means that even if one server is destroyed, the data is not lost because it is copied elsewhere.

Governments around the world have been exploring the idea of adopting the cloud for official use. The Pentagon awarded Microsoft a contract for just that reason in 2019 before rescinding it less than a year later. New DoD contracts for cloud computing are expected to be awarded this year.

“It’s also important to think about the longer-lasting lessons that come from these efforts,” the Microsoft report said. “The last few months in Ukraine illustrate the very different defense needs that prevail during a war.”

Setting the scene

When Panetta warned of a cyber Pearl Harbor, Cyber Command was still just getting on its feet. In an interview with Fifth Domain, the former secretary said he was aiming, in part, to let the nascent cyber agency’s leaders know that the Department of Defense was in their corner.

The cyberwarriors needed to hear “that we were supporting financially the efforts there to stay on the cutting edge, and that we were developing the plans that needed to be developed to ensure the United States would remain one of the strongest players in the cyber arena,” Panetta said.

The long game, Panetta said, was to shake up ordinary citizens, to awaken them to the seriousness of the situation at a time when the nation’s cyber defenses were still in their formative stages.

Gen. Keith Alexander, then the head of Cyber Command, warned in 2012 that American readiness for a major cyberattack was “around a three [out of 10].” Panetta knew he needed to sound the alert about that situation.

“The American people needed to know that the potential for a paralyzing attack was there,” Panetta said. “We had known that cyberattacks could be used to interrupt business, to gain intellectual property. We knew about hacking. But the fact that a sophisticated virus could be used to virtually paralyze our country, to take down our electric grid, take down our financial systems … that potential was there and real.”

The arrow found its mark. “It was a clarion call, evoking the specter of a horrific national disaster as a way to galvanize public support,” said Edward Wittenstein, executive director of the Johnson Center for the Study of American Diplomacy at Yale. “It also communicated that urgency to members of Congress, whose support was needed for solidifying and resourcing Cyber Command.”

Initial reaction

Given the hyperbole of the remark — something he describes as a form of “shock therapy” — Cyber Command’s response may appear muted.

In 2014, Panetta’s successor, Defense Secretary Chuck Hagel, established a deliberately low-key tone in describing the cyber mission. Speaking at Fort Meade, Maryland, which is home to both Cyber Command and the National Security Agency, he said the United States would “maintain an approach of restraint to any cyber operations outside of U.S. government networks. The United States does not seek to militarize cyberspace.”

He added that the United States wanted to leverage the internet as a “catalyst for freedom and prosperity” instead.

In hindsight, analysts today say the keyword “restraint” doesn’t suggest that the Defense Department wasn’t taking cyber seriously. Rather, Hagel may have been seeking a muted approach with Cyber Command’s mission as a way to cool down, rather than heat up, potential use of cyber as a combatant arena.

“There was a sentiment at the time that we should try to make cyberspace a peaceful place. We would reserve the right to use force there — but only as a last resort,” Herbert Lin, senior research scholar at the Center for International Security and Cooperation and Hank J. Holland fellow at the Hoover Institution, told Fifth Domain.

“Hagel was saying that we will exercise a policy of restraint, that we will not be very aggressive, that we will try to do everything diplomatically before resorting to force in cyberspace,” Lin said.

With cyberwarfare still a relatively new domain, some felt that any overly aggressive steps by the United States could lead to rapid escalation. Cyber Command at that time embodied “a wariness about wading into cyberwarfare,” said James Di Pane, a research assistant at the Heritage Center for National Defense. “We don’t want to be the ones moving the goalpost and creating global norms where it is okay for countries to do that kind of thing.”

Today, Panetta explains what that “restraint” means in a military sense: to be prepared, but also to be circumspect. “The idea of restraint was that we have to be serious about the potential for this weapon, but that we can’t panic. Rather, we have to be restrained in terms of our emotions.”

Today’s cyber policy appears to be driving Cyber Command in a more proactive direction.

The new ethos

The national cyber strategy, rolled out in September 2018, makes the case that the best defense is a good offense. Rather than merely fend off attacks, the United States would let our enemies know that the U.S. is not afraid to use cyber as a weapon. The United States will “ensure adversaries understand the consequences of their malicious cyber behavior,” according to the plan.

The nation has since witnessed offensive cyber operations in action. In 2017 a Defense official confirmed the United States had been dropping “cyber bombs” on ISIS in a program dubbed Joint Task Force-Ares, led by Adm. Michael Rogers, then the head of Cyber Command.

That program aimed “to coordinate cyberspace operations against ISIS,” Rogers said in written testimony to Congress. “JTF-Ares’ mission is to provide unity of command and effort for [Cyber Command] and coalition forces working to counter ISIS in cyberspace. The JTF model has helped USCYBERCOM to direct operations in support of USCENTCOM operations, and marks an evolution in the command-and-control structure in response to urgent operational needs.”

The JTF “brought cyber out of the shadows and successfully demonstrated the value and capabilities of cyberspace operations to the Joint Force when integrated as part of [a] broader coordinated military effort,” then Lt. Gen. Paul Nakasone, commander of Army Cyber Command and JTF-Ares, wrote in congressional testimony.

This kind of operation marks a new direction for Cyber Command and was reflected in an August 2017 move by the Defense Department, recommended by then-Secretary Jim Mattis, to elevate the agency to a standalone combatant command. Until then, it had been a sub-unified command under U.S. Strategic Command.

“They now have the full operating capacity to conduct cyberwarfare. They have the people and the tools they need,” Di Pane said.

Experts say the new status, and the new approach, reflect the realities of the changed cyber landscape. There may not be an imminent Pearl Harbor: Most experts agree a single cataclysmic attack on national infrastructure seems unlikely, given the present posture of likely threat actors. But even smaller-scale attacks pose a hazard. The repeated cyber incursions unfolding daily could have a devastating cumulative effect on American infrastructure.

“In the last five years the policy of restraint hasn’t worked. People continue to break into our networks,” Lin said. “And Cyber Command doesn’t want to just sit around and wait. No military guy wants to play defense all the time. They want to go on the offensive, and the new strategy calls for a much more aggressive posture.”

To effectively execute on that new strategy, Cyber Command may have to overcome new institutional or organizational hurdles.

“They want to be like Special Operations Command, but right now Cyber Command is not postured to have that same level of success,” said Jacquelyn Schneider, an assistant professor at the Naval War College. She noted she wasn’t speaking for the Defense Department.

“They need to set up processes to acquire technology and to execute on contracts. This is about the acquisition of software, and that’s something DoD struggles with,” she said. “There is no good model, so they will need to create all these institutional processes, while they are already dealing with major threats.”

Despite the hurdles, Panetta lauds the new alignment as appropriate to the current threat.

“You’ve got to fight fire with fire. The Russians would be thinking twice about doing what they are doing in our election process if they knew they were going to be paying a price for it,” he said. “They have to know that it is not a free pass.”

To learn more about the ways Cyber Command has evolved over the last decade, download our series of essays that reflect on the origins and future of defend forward and hybrid warfare.

Markham will take over at agency’s west branch in St. Louis, assisting with the integration of NGA’s activities across the western United States. According to an NGA press release, Markham will oversee the NGA Operations Center, the Office of NGA Defense, the Office of Expeditionary Operations, an NGA leadership at the three National Reconnaissance Office Aerospace Data facilities.

“I know [dual-hatting] is a departure from past practices, but I strongly believe it reflects how the position and our leadership structure has evolved,” Cardillo said. “[Brett] knows the mission, the workforce and the community.”

Prior to this appointment, Markham served as the agency’s director of analytic operations in the analysis directorate. Over the course of his 28 year naval career Markham served in various analytic, staff and leadership positions that included five strategic deterrent patrols, three carrier deployments, and service at three Combatant Commands and the Joint Staff. Markham also served as the deputy director of intelligence for North American Aerospace Defense Command and the United States Northern command.

At the Nov. 28 Association of Old Crows’ International Symposium and Convention, Air Force Gen. Stephen Wilson, the service’s vice chief of staff, emphasized his branch’s increased focus on Electronic Ware (EW). As a result, the Air Force is launching the Enterprise Capability Collaboration Team (ECCT) to further research the subject, Breaking Defense reported.

However, Wilson said the Air Force must go beyond simply strengthening what has worked in the past. He emphasized the need for both efficiency and innovation for the team as the Air Force wants EW capabilities that not only have stronger performance, but also adapt to changing conflict environments.

[Read more about EW in our ebook: Electronic Warfare Cyber Convergence]

As a means to facilitate the Air Force’s newfound EW focus, the service awarded L3 a contract to develop the Gulfstream 550 Airborne Early Warning (AEW) aircraft, aka EC-X, as an EW platform. Defense Tech reports that as of now, EC-X’s focus will be on jamming enemy command control communications, such as radio, computers and radar.

ECCT is the third such study the Air Force is undertaking as part of its efforts to better synthesize air, cyber, and space-based combat abilities for future conflict. C4ISRNET had previously reported that these newfound measures, collectively called MDC2, are to ensure that the Air Force is ready for the 2030s military environment, where the focus will be on stifling enemy defense capabilities through multi-domain electronics and cyberspace.

The ARA San Juan and its sailors went missing Wednesday, Nov. 15, after departing the city of Ushuaia and following a series of naval exercises. The submarine reported a technical breakdown and had to re-navigate to the Mar Del Plata, making its last reported contact near the Argentine coast.

However, a lack of contact with the sub necessitated involvement from NASA and the U.S. Navy as well as eight nations, including Brazil, South African and the United Kingdom.

On Saturday, Nov. 18, the U.S. Navy’s Undersea Rescue Command deployed two independent rescue assets including a Submarine Rescue Chamber that can rescue six people at a time while reaching depths of 850 feet. It also offered a Pressurized Rescue Model that submerges up to 2,000 feet for docking and mating with a submarine settled on the ocean floor.

The Navy also has the ability to deploy unmanned underwater vehicles that use sonar technology for searching out targets. The New York Post showcased the Bluefin 12D as one such vehicle, and cited its ability to run for 30 hours at a depth of around 5,000 feet.

NASA’s prime asset in the search for the San Juan is a P-3 Orion patrol plane, which was originally introduced in the 1960s as an anti-submarine surveillance craft. The plane employs a magnetic anomaly detector, or magnetometer, a gravimeter for analyzing small gravity fluctuations, and infrared cameras and sensors that are traditionally used measure ice thickness.

The Argentine military had previously detected what they thought were communication attempts from the submarine via seven satellite messages. However, Argentine navy spokesman Enrique Balbi indicated that said messages turned out not to be from the San Juan.

Bill Gattle, president of Harris’ space and intelligence systems division. said the design is “fully mature” and “not a prototype.”

The current GPS III satellite navigation payload, also built by Harris, contains a three times reduction in range error, an eight times increase in anti-jamming power, added signals including compatibility with Global Navigation Satellite Systems (GNSS) and stronger signal integrity.

The next generation of the GPS III navigation payload plans to build on that foundation with stronger signals, flexibility in adapting advancing GPS technology, and subsequent changes being implemented on a mission-by-mission need basis. Furthermore, the next-gen navigation payload will also grant the clock signal for a new GPS III Search and Rescue (SAR) payload.

Lockheed Martin is the prime contractor on the Air Force’s GPS III satellites.