Each service also gets to retain a small subset of CPTs to help get at their own service-specific missions.

Maj. Josh Rykowski, mission team leader with a service-retained CPT in the Army’s Cyber Protection Brigade, explained that each 39-member CPT is broken into four sections.

The first, he told reporters during a media roundtable October 11 at the annual Association of the United States Army conference, is a headquarters section, which takes care of the administrative part of managing and running a team in addition to taking care of some of the planning in preparation for a mission.

Next, down in the actual team itself, there are two mission elements and a support element with the idea that each element has the same personnel and equipment and can be exchanged as need be and push them out on missions separately if required, Rykowski said.

In terms of the actual mission sets these teams perform, what’s different about a cyber protection team as opposed to a network operator or local administers is “at the end of the day they hunt for adversaries,” Lt. Gen. Paul Nakasone, commander of Army Cyber Command, told reporters at AUSA. “They’re looking for someone that does not want to be found in our network and that’s what is a core skill that we train in our cyber protection teams.”

CPTs can be thought of as quick reaction forces to assist local owners and are not meant to remain on the network for an extended duration.

“If I get tasked to go support a mission owner, no matter who it is, they’re not going to give me the keys to the kingdom,” a defensive cyber exercise participant at Cyber Flag, Cyber Command’s annual validation event, told C4ISRNET in June. “I’m going to have to go through the local defender, their network owner to get my recommended changes.”

[An exclusive peek inside Cyber Command’s premiere annual exercise]

“Really, I don’t want the keys to the kingdom. I wouldn’t want to become their system administrator,” another defensive team lead said. “Eventually, I’ve got to leave” their network.

For the cyber protection teams, this is a new environment into which they’re entering, another defensive team lead said. They look to the local administrators to see what normal on their network might mean or what might be anomalous behavior.

“Being an Army CPT, we’ve received a broad range of missions,” Rykowski explained. These include assisting network owners or the local defenders, educating them on CPT capabilities, and trying to leave the network in a much more defensible position, training and vulnerability assessment.

The network operators have a difficult job, Rykowski said, noting they’re on call 24/7 and focused on vulnerabilities. “What we bring to bear is we show up for a short duration with a threat focus. We help them close the gaps consistent with that particular threat,” he said.

When they show up, they bring their own kit that includes hardware (server stacks), software and sensors.

These kits provide teams with multiple tools, including: network assessment equipment; host forensics equipment, allowing them to look at the entire network and specific work stations; rudimentary defense mechanisms; plus a substantial amount of storage capability and substernal amount of computational power.

The combination “allows me to flexibly create tools on the fly from my repository of tools to figure out what my exact setup needs to be when I’m out working with my customers,” Capt. Sean Eyre, a computer network defense manger within the cyber protection brigade, told reporters.

These kits are standardized among the cyber protection brigade and for Army Cyber. Across the joint force, however, service has a different type of kit, despite CYBERCOM producing a standard requirements document that all kits must meet standard baseline requirements, Navy Lt. John Allen, CYBERCOM J35 Department of Defense Information Network operations CPT engagement lead, said during a June conference.

[Cyber Flag exclusive: What Cyber Command learns from the annual exercise]

What exists today are four types of kits, each usually with its own specific suite of tools that all meet the requirements. This does present some interoperability challenges, but the command is working toward rectifying those, Allen said.

CYBERCOM is now looking toward standardizing kits.

[Cyber Command moves toward standardized cyber kits]

Rykowski explained that they can reconfigure their kits on the fly if need be. “When we do that mission analysis … and think through what capabilities do we need to bring to bear based on the network we’re working on and based on the adversary we need to be hunting, we can set those capabilities up ahead of time so we can hit the ground running,” he said.

“It also gives us the capability to reconfigure it on the fly, so if we do hit the ground and the network may not be what it as supposed to be … we can reconfigure on site to again bring different capabilities to bear.”

These kits also have internal defenses that prevent them from becoming infected when plugged into infected networks. “While we do connect our kit directly to the network, we have defenses on it to ensure we ourselves don’t get exploited if the adversary is still on the network,” Rykowski said.

The persistent training environment has been a top priority for the Department of Defense. Just like soldiers go to the rifle range to hone their marksmanship, cyber warriors need a space to hone their hacking and defense skills. The initiative would serve as a range for cyber warriors to receive ongoing, realistic training.

The Army will be heading up this effort.

Gilday also stressed the need for capabilities. “I described a threat actor that can get their hands on new tools literally by the hour,” he said. “I need better tools than the adversary has.”

This involves not only attracting the best developers available to the “U.S. Navy so we can bring a punch to the fight,” but leveraging new acquisition vehicles such as the Defense Innovation Unit Experimental, or DIUx, to rapidly purchase tools, he said.

“How do you continue to improve yourself on a constant basis is tough in an acquisition system where progress is measured in years and not hours, weeks and months,” Gilday told reporters following his remarks.

DIUx will be an important partner, he said, because “the acquisition cycle [that] currently takes a couple of years is not going to do it for us.”

The original thinking behind cyber operations was that everything had to be controlled by the president because operations in cyberspace were all thought to shut down the internet, Brig. Gen. J.P. McGee, deputy commanding general for operations at Army Cyber Command, told reporters Feb. 8 during a media roundtable. “That’s not what we’re finding,” McGee noted.

What they’re finding is that forces can have a localized effect to accomplish missions, he said, adding that there is undoubtedly a tactical application for cyberspace applications.

The Army has been taking steps toward this paradigm shift since former chief of staff Gen. Ray Odierno directed the start of a pilot program called Cyber Support to Corps and Below, which seeks to integrate cyber effects at the tactical edge by embedding cyber forces with brigade combat teams. These effects have been tested at the National Training Center at Fort Irwin in California.

The Army is now moving to call the pilot program CEMA Support to Corps and Below. CEMA, or cyber and electromagnetic activities, is the integration of cyberspace operations, information operations and electronic warfare. The new cyber directorate within the Pentagon, headed by Brig. Gen. Patricia Frost and stood up within the last year, is the focal point for this integration.

Frost told reporters that while they were always conducting CEMA operations at the National Training Center, the sexy term at the time was cyber. Over the last few months they recognized they should call it CEMA Support to Corps and Below, she said.

Experiments have sought to determine not only how take strategic forces and assist in the tactical fight, but also what the force structure looks like. In the last two years, with no growth, Frost said they were forced to figure out how to integrate these capabilities into the current force structure. They were trying to determine the organization requirements needed in the field.

Now, she said, the Army is thinking more outside the box as the service considers manpower capabilities and capabilities needed at echelon.

A critical component for bringing situational awareness to commanders will be the ability to map out the cyber and electromagnetic terrain, McGee said. Where is everything, where are friendly wireless points, where are cellphone towers? Then, comes the effects piece: starting to figure out how to access these and deliver effects; for instance, friendly forces could temporarily shut down enemies’ internet use.

The Army is also bringing online a new electronic warfare detachment specifically for electromagnetic operations. “Effective 1 October 2018, our electronic warfare force, which we call our 29 series career field, will now become 17s, meaning that is the career field that is the baseline of cyber,” she said in December announcing the new career field. “We will start training the 29 series this year with a foundation in cyber, signals intelligence and electronic warfare. And then we’ll talk about kind of where the Army’s going with reorganization and operational capability.”

The new operational detachment, Frost said, is targeted to come online within the next year. As part of this effort, Frost is working with Army Cyber Command, Forces Command and the Cyber Center of Excellence at Fort Gordon, Georgia, to see what might be achievable in this space in five years — an aggressive timeline, but an achievable one, Frost contended.

EW has been focused on the protection of patrols and convoys in order to counter IEDs in the last 15 years, McGee noted, but now the role has been expanded to include offensive EW activities, partially induced by the activities of Russia in Ukraine.

There is also an authorities component involved, in reference to McGee’s statement that typically operations were approved at the presidential level, with the option to be delegated to the Secretary of Defense.

What authorities and permissions will be pushed out to the tactical commander? McGee asked, teeing up the development of frameworks and models that will allow for a breakdown of authorities based on the effects they would have.

The experiments have looked at current policies and whether they need to go all the way up to the secretary, Frost said. Some of the experimentation is documenting where authorities need to reside based on the type of effects they want to achieve.

The Army is also working with Cyber Command as well as the Marine Corps, given that this involves a land component problem set. With land components moving tactically, what type of capabilities will they need to support ground maneuver? she asked.

McGee added that they are planning an exercise with legal teams that will place them in different tactical scenarios and find out if there are authorities or policy changes needed.