The distributed denial of service (DDoS) incidents — which essentially flood internet sites with an unusually high amount of web traffic, rendering them useless — hit at least 10 Ukrainian websites, including those of the Defense Ministry, Foreign Ministry, Culture Ministry and Ukraine’s two largest state banks. Denial of service attacks don’t require the incredible sophistication or painstaking access to networks needed for most data theft or deleterious cyberattacks, making them a common tactic among criminal organizations.

Ukrainian Information Ministry’s Center for Strategic Communications and Information Security suggested Russia could be behind the Feb. 15 incident, but didn’t provide details.

“It is possible that the aggressor resorted to tactics of petty mischief, because his aggressive plans aren’t working overall,” the statement said.

The Pentagon and U.S. Cyber Command deferred comment on the cyberattack to the National Security Council, which did not immediately respond to a request for comment.

Despite these incidents not yet being attributed to an actor, experts are worried they could signal an uptick in activity in eastern Europe amid the Russian troop buildup.

“Overall, this is telling us that more is starting to go down in Ukraine. I think this may very well signal the beginning of a Russian attack on Ukraine,” Tatyana Bolton, policy director of the Cybersecurity & Emerging Threats team at the R Street Institute think tank, told C4ISRNET. Bolton is also the former director of the Cyberspace Solarium Commission, a a bipartisan organization created in the 2019 defense policy bill to develop a multipronged U.S. cyber strategy.

Bolton noted there’s no direct indication Russian entities are responsible. However, the targets affected are what one might see during the beginning of a coordinated military campaign, she said.

Timothy Jones, vice president of systems engineering at Forescout, an enterprise defense company, cautioned that while the initial DDoS incident may not seem sophisticated, it could get worse and more complex.

With denial of service attacks, “sometimes the full extent isn’t really seen right away. We’re just starting to get some of the reports out,” said Jones. “Maybe they’re doing stuff in the background that we’re not necessarily looking at yet, or hasn’t really been felt.”

Using denial of service indicates some level of restraint, which Bolton described as a bit atypical for Russia.

“Usually, [DDoS] doesn’t take you offline for more than a day,” she said. “It can be more serious, but it’s not like encrypting all their files or deleting all their files. Those would have really been significant attacks. But the concern is also, what’s next? Is this a smokescreen for a larger incident or attack?”

The critical infrastructure sector — such as energy companies — were not targeted, which could signal that if Russia was behind the incident, they either view the banking sector as more critical or they are following general rules of warfare by not knocking out power to the civilian sector in the dead of winter, Bolton added.

DDoS is a tactic the Russians have been accused of using previously.

In mid-January, Ukraine blamed Russia for a cyberattack that temporarily disabled about 70 Ukrainian government websites simultaneously. During last month’s attack, an announcement posted stated that Ukrainians should “be afraid and expect the worst.”

Russia launched one of the most devastating cyberattacks ever on Ukraine in 2017 with the NotPetya virus, causing over $10 billion in damage worldwide. The virus, also disguised as ransomware, was a so-called “wiper” that scrubbed entire networks.

Cristin Monahan of the George Washington University’s National Security Archive’s Cyber Vault pointed out the Russians hit Estonia with a series of DDoS incidents in 2007 over Estonia’s decision to relocate a Soviet war monument, something of a watershed moment in the modern cyberwarfare era.

“The Russians made the point that even without direct military intervention, or even cyber interventions with kinetic effects, they can exert significant pressure on nations in their crosshairs, and Ukraine has received the same message for a number of years,” she said.

Monahan added that DDoS incidents rarely result in military intervention, implying the U.S. is not likely to physically engage with Russia over the loss of banking services.

The Associated Press contributed to this report.

Now it’s Washington’s turn to get serious about the “gray zone,” especially when it comes to cyber and information warfare, says a new report from the Atlantic Council. The term is used to describe competitive actions that occur below the threshold of conflict.

The think tank’s recommendations come as the Biden administration finishes its National Security Strategy and National Defense Strategy, which are expected to be published within weeks and address gray-zone or hybrid warfare.

“The DoD needs to compete now and engage in offensive hybrid warfare actions. The United States must respond where competition with China and Russia is taking place today, primarily by playing an enhanced role in gray-zone competition,” read the report, which was led by the Atlantic Council’s Clementine Starling, Air Force Lt. Col. Tyson Wetzel and Christian Trotti ― with former Defense Secretary Chuck Hagel.

The report called for new strategic competition coordinators on the National Security Council with direct access to the president, as well as a new whole-of-government messaging strategy aimed at countering anti-American narratives and reinforcing the rules-based international order. The Pentagon would play a supporting role, “executing offensive and defensive hybrid warfare activities that comport with U.S. values.”

Already, Colin Kahl, the undersecretary of defense for policy, said last month that the Defense Department’s overarching “integrated deterrence” concept ― a key part of the forthcoming National Defense Strategy ― expands “across the spectrum of conflict from high-intensity warfare to the gray zone.” That includes other instruments of national power: intelligence, economic, financial, technological and alliances, Kahl has said.

That mission is going to become more important as nations hostile to U.S. interests increasingly operate below the threshold of traditional conflict to challenge international rules and norms, particularly at flashpoints in the Taiwan Strait and Ukraine, the authors argued. The DoD has taken significant steps to compete in the gray zone, but the authors called for “a departmental paradigm shift” and for the military to go on the offense.

“The department has begun to focus more on countering our strategic competitors’ hybrid warfare efforts, but what I also see is an inherent conflict between competing now and the sexier thing, which is buying new equipment, getting ready to fight the war of the future; and sometimes, under the weight of that effort, competing today loses out a little bit,” Wetzel, who is also a senior fellow at the Atlantic Council, told Defense News.

“Everybody agrees we need to defend in the gray zone, but we really wanted to focus on the fact that we can take the offense as well,” he added.

For instance, as Russian President Vladimir Putin masses troops along Ukraine’s border and claims Ukraine and the West are the aggressors, the U.S. government ― under a more proactive approach to gray zone warfare ― would communicate more consistently and more often that Putin is the sole antagonist.

“Just on the information domain, we need to control the narrative, we need to counter false narratives a lot clearer,” Wetzel said.

The broader Atlantic Council report, drafted with expert input over the last year, made recommendations aimed at deterring or winning a conventional conflict as well as gray zone activities. Among the report’s other conclusions:

• The DoD needs guiding principles for hybrid warfare. The department should be part of unified interagency efforts, invest in “below-threshold” capabilities and training, engage only where strategically important, go on the offense to reinforce the international rules-based order, use strategic messaging, and stick to American ideals.
• Washington needs a hybrid warfare toolkit. That means establishing diplomatic norms as well as naming, shaming and sanctioning bad actors ― all the while, the DoD can show presence, launch distributed denial-of-service attacks, and conduct kinetic or non-kinetic actions against proxy or mercenary forces.
• Hybrid operations can improve conventional deterrence. Adversaries will use hybrid warfare until they can acquire a coercive deterrent against the U.S. and its allies. Containing engagement with China and Russia to cooperation and competition for as long as possible is in America’s interest ― but the U.S. “must get better at proactively engaging in and shaping the gray zone.”
• The State Department’s Global Engagement Center needs a funding boost and authorities to “lead whole-of-government strategic messaging and offensive information operations campaigns, and it needs to lead whole-of-nation efforts to engage with social media companies, and with allies and partners to create a coherent and effective campaign for countering mis- and disinformation.”

Investing in gray zone competition could mean acquiring more cyber tools as well as building an organization for “information operators,” who would quickly attribute and respond to misinformation or disinformation, said Trotti, assistant director of the Atlantic Council’s Forward Defense project.

“What they would ask for in terms of capabilities they need, I don’t know, but we do think there needs to be a focus, and a unit or units, that are really focused in that area,” Trotti said. “They would start to develop the tactics, techniques and procedures that will be used in gray zone operations or hybrid warfare operations.”

To compete with adversaries who already see conflict as part of a continuum (as opposed to binary war and peace), the DoD and its armed services have sought to embrace the tenets of information warfare by competing daily below the threshold of armed conflict.

Waiting to respond to an event after it occurs is too late, officials and experts have asserted over the last few years. Forces must be constantly engaged in the region and against malicious actors to contest their activity and collect the proper intelligence and access needed in case circumstances escalate.

The DoD and the armed services have also reorganized themselves to better align and integrate those various disciplines; they are currently developing new doctrine along this vein.

If the National Defense Strategy does prioritize gray zone conflict, it wouldn’t be the first time. In 2019, the DoD created an amendment to the National Defense Strategy focused on irregular warfare, with one of the five core themes of the annex aimed at operations in the information environment.

In the most recent defense policy bill, signed into law Dec. 27, Congress asked the DoD for a report on the implementation of the irregular warfare strategy. Some members of Congress have also expressed skepticism regarding progress in the information warfare sphere, questioning who is in charge of certain areas and how the department will oversee activities to ensure success.

“I am concerned the department leadership has been slow to adapt to the changing nature of warfare in this domain,” Rep. Jim Langevin, D-R.I., who chairs the House Subcommittee on Cyber, Innovative Technologies, and Information Systems, said during an April 30 hearing.

“Too often, it appears the department’s information-related capabilities are stovepiped centers of excellence with varied management and leadership structures, which makes critical coordination more difficult. Further, the Pentagon has made limited progress implementing its 2016 Operations in the Information Environment Strategy, which raises questions about the department’s information operations leadership structure.”

Though Congress directed the creation of a principal information operations adviser in 2020, some in Congress are worried it isn’t materializing as intended.

“Unfortunately, this position was layered below the undersecretary of defense for policy, contrary to congressional intent. This position was not created as another bureaucratic layer, but as an agile, single role with the mandate to guide each service’s efforts,” Rep. Elise Stefanik, R-New York, said during the same hearing.

Other outside experts worry the DoD is not doing enough to compete and win on a daily basis against sophisticated adversaries.

“Where we’ve fallen short is accounting for the risk that China and Russia will conduct hybrid warfare-style operations against the United States itself,” Paul Stockton, former assistant secretary of defense for homeland defense, told Defense News. “I’m not talking about little green men pouring across our borders — that’ll never happen — but the use of combined information and cyberattacks to disrupt U.S. defense operations at home.”

Stockton, who recently authored a paper titled “Defeating Coercive Information Operations in Future Crises,” did note that the DoD has made progress in collaborating with NATO allies and partners in Asia to be prepared to counter gray zone threats.

However, he added, the U.S. must strengthen its deterrence by developing information operations response options that would credibly threaten Russia and China if they conduct such operations as part of a gray-zone or hybrid warfare approach.

The first was executed by the 27th Special Operations Communications Squadron Mission Defense Team aboard an active MC-130J Commando II. It was the first time their capability was connected to an operational weapon system outside of the labs, according to an Air Force release.

Mission defense teams are specialized groups that protect critical Air Force missions and installations such as critical infrastructure or computers associated with aircraft and remotely piloted systems. They are separate from the cyber protection teams each of the services provide to U.S. Cyber Command.

The demonstration has led to approval for the team’s capabilities to be integrated into flight operations with the MC-130J while it is in flight.

“The MDT’s ability to provide near real-time mission system cyber analysis allows mission owners critical insight regarding the weapon system’s critical components and inputs,” said 27th Special Operations Communications Squadron MDT flight chief Master Sgt. Javier Parris. “Moreover, this capability can be utilized to enhance aircrew situational awareness, decreasing their time to react to emerging cyber intrusions.”

The Air Force said as of Dec. 8 the mission defense team successfully conducted an in-flight test of the new cyber suite aboard the MC-130J and it was the first time flight data had been collected in near real time to enable cyber defense of flight operations in flight. Specifically, the cyber analysis provided by the team could shape preventative maintenance functions for the aircraft and could predict requirements needed to harden operations.

“My squadron was tasked, as a Mission Defense Team pathfinder, to predict and overcome the challenges of the future strategic competition environment — specifically within communications contested or congested environments,” said Maj. Emily Short, commander of the 27th Special Operations Communications Squadron.

Officials did not answer questions regarding the scope of the outage or number of users affected.

“The Army was experiencing problems with some emails being sent to and from unclassified [Department of Defense] DoD and external systems. Our DoD partners have since resolved this issue,” Bruce Anderson, Army spokesman, said in a statement.

The Defense Information Systems Agency, which runs the Pentagon’s global IT infrastructure, said it was first notified of a problem Wednesday.

“On Wednesday afternoon, DISA was notified of widespread DoD365-J and Army 365 email queuing. DISA worked tirelessly to quickly resolve these issues and as of this morning, normal operations have been restored and all emails have been delivered.” a DISA spokesperson said.

The outage came amid the service’s transition from Defense Information Systems Agency webmail to a newly-licensed Microsoft Office 365 mail client as part of a wider adoption of web-based Microsoft products sparked by the Covid pandemic.

Many Army users took to social media to vent their frustrations about the outage.

A message sent out to some affected users Thursday said that “all external email flow to both [Army] 365 and [DoD] 365 tenants are down,” including mail forwarding between the old mail.mil email servers and the new ones.

Not all of the Army’s email tenants were affected, though, including the specialized platform used for U.S. Special Operations Command-aligned units.

Previously, the Army had announced the movement toward what it is calling Army365, which pushes the service onto a more permanent footing from the measures taken at the outset of the Covid pandemic allowing greater access to network services for remote work.

Set to replace the Commercial Virtual Remote (CVR)/Microsoft Teams capability, which was mandated to end by June 15, A365 relies on Microsoft 365 and aims to improve operational effectiveness, increase cybersecurity and provide the opportunity to eliminate other collaboration capabilities, according to an Army information sheet on the effort.

Broadly, the new system will provide video and voice teleconferencing, email, instant messaging and access to shared drives.

A365 will occur in three phases: Phase 1, which is the Teams migration and begins with an entire Army-wide transition; Phase 2, which is the email migration and will move the Defense Enterprise Email system A365 beginning in fourth quarter of Fiscal Year 2021; and Phase 3, which is the SharePoint migration and is expected to finish during fiscal 2022.

Joint Task Force-Ares was created in 2016 to combat the militant organization online as a compliment to the global coalition fighting against the group’s grip on power in Iraq and Syria. The task force has since undergone several changes. The Army’s cyber component was originally tasked to lead the joint cyber effort, but in 2018, responsibility shifted to Marine Corps Forces Cyberspace Command, which allowed the team to focus not just on the Islamic State group, but more broadly on counterterrorism efforts globally.

“Counterterrorism operations in cyberspace are continuous, helping to protect the force and prosecute targets in Afghanistan and other regions on behalf of USCENTCOM [Central Command] and USSOCOM [Special Operations Command],” Gen. Paul Nakasone, commander of Cyber Command, said in written testimony to Congress in March. “We are also shifting JTF-Ares’ focus (though not all of its missions) from counterterrorism toward heightened support to great power competition, particularly in USINDOPACOM’s [Indo-Pacific Command’s] area of responsibility.”

Broadly speaking, Cyber Command does not plan to change command-and-control relationships or organizational cyber mission force elements as Joint Task Force-Ares transitions to focus more on nation-state actors, according to a command spokesperson.

Joint Task Force-Ares’ flexible capabilities allowed its members to integrate with and support operations in Central Command, the spokesperson said. As the task force shifts responsibility, it will seek to continue coordination with INDOPACOM, 10th Fleet/Fleet Cyber Command and MARFORCYBER. Fleet Cyber Command is responsible for cyber operations in the Indo-Pacific region under what is known as the Joint Force Headquarters-Cyber construct, which provides planning, targeting, intelligence and cyber capabilities to assigned combatant commands.

Making moves

The move to shift teams’ focus marks a reflection that Cyber Command has to adapt to a changing world in which so-called great powers are a greater priority than terrorist organizations and that the DoD has identified the Indo-Pacific region as a top priority given it considers China the “pacing threat.”

“The CMF’s [cyber mission force’s] original force structure was set in 2012, and several teams were originally aligned to support the counterterrorism fight. With the return of great power competition, USCYBERCOM is realigning some teams to focus on key nations,” Nakasone wrote in his testimony.

As nation-states have continued to increase their develop of cyber and information-related capabilities, Cyber Command internally realigned selected offensive forces and shifted focus from just counterterrorism operations to strategic competition, a spokesperson said.

“By reevaluating force structure, we are able to leverage capabilities across all of our elements ensuring our cyber operations remain agile and flexible to respond and disrupt adversaries,” the spokesperson continued.

Nakasone and other officials at Cyber Command have articulated how China and the greater Indo-Pacific region are a greater focus now.

“For the year to come our priorities are set. We will focus on great power competition through persistent engagement, especially in support of USINDOPACOM,” Nakasone wrote.

Earlier in March, command Executive Director David Frederick said the priorities of the command are supporting the DoD’s China strategy and supporting the INDOPACOM commander.

“We’re very focused on working with Indo-Pacific Command to understand what they need from Cyber Command as a supporting force,” he said.

Realigning operational elements not only creates a greater focus on coordination internally, a command spokesperson said, but also on combatant commands and other organizations Cyber Command supports.

The concept stems from the addition of information warfare composite commanders at the carrier strike group level, Vice Adm. Jeffrey Trussler, deputy chief of naval operations for information warfare, N2/N6, said Wednesday at the C4ISRNET Conference.

Beginning in 2017, the Navy created information warfare commanders at each strike group to act as the focal point for the strike group commander to integrate disparate aspects of information warfare from electromagnetic spectrum to cyberspace to intelligence to oceanographic operations.

“I talk to every strike group commander that comes to the Pentagon; I ask him specifically, ‘How is that IWC [information warfare commander] concept working?’ Every one of them love their IWC and love that concept,” Trussler said. “It’s worked out very well.”

As the information warfare environment becomes more complex and more important, the Navy wants to replicate the tactical-level concept at the operational level.

Trussler said the Navy will experiment with these cells at the maritime operations centers, which is where the joint force maritime component commanders sit and where the operational level of war takes place.

Chief of Naval Operations Adm. Michael Gilday has expressed the desire to build out new dedicated information warfare cells within fleet maritime operations centers, a project that was supposed to be informed by the results from an exercise that was postponed last year due to the COVID-19 pandemic.

Now, the Navy will experiment with the information warfare cell at its Large Scale Exercise scheduled later this year, using feedback to further evaluate the concept, Trussler said.

At the end of 2019, Gilday had noted that exercises would help refine requirements and timelines for the information warfare cells as part of the budgeting process for fiscal 2022.

“We think it’s a powerful concept. We think it’s just a continued maturation of the information age, and we need to manage that information differently, not only with the tools we’re going to develop, but with how we process that in the decision-making of a commander and his staff,” Trussler said.

“Over the past year, I emphasized the importance of defending the election against foreign interference,” Gen. Paul Nakasone said before the Senate Armed Services Committee. “U.S. Cyber Command conducted more than two dozen operations to get ahead of foreign threats before they interfered or influenced our elections in 2020.” He did not name the adversaries.

Defending elections has become an enduring mission for the Department of Defense, falling mostly on Cyber Command — a significant expansion from its creation — given adversaries find the digital domain fruitful to exploit.

Details regarding these operations are scarce given their sensitivity. However, Cyber Command has been public about using its unique authorities to operate outside the U.S. to act against malicious activity.

Previously, President Donald Trump confirmed media reports that Cyber Command shut out a Russian troll farm of cyber actors who sow false or inflammatory information on the internet. Cyber Command also sent targeted messages to certain Russian cyber operatives and Russian elites believed to be gearing up to conduct operations against the elections.

According to a declassified assessment of the 2020 election released this month by the Office of the Director of National Intelligence, Russia, Iran, Cuba, Venezuela and the armed Hezbollah party in Lebanon sought to conduct influence operations against the American populace. China did not engage in any activity associated with the election, the intelligence community assessed.

Nakasone said the command built upon lessons learned from earlier operations and strengthened partnerships with other federal entities, such as the Department of Homeland Security and the FBI, to ensure a secure election.

He lauded a new tool created in partnership with the National Guard Bureau across the states to allow them to share threats. The Cyber 9-Line, as it’s called, is a portal that allows states’ Guard units to pass potential threats to Cyber Command to defeat in foreign cyberspace and conversely provides Cyber Command a way to alert states of potential threats discovered during operations. Every state joined the effort prior to the election, Nakasone said in written testimony provided to the committee.

He also shared three lessons learned from the operations to protect the 2020 elections.

First, Cyber Command has to be prepared to act, if necessary.

“Threats can arise rapidly, and opportunities can be fleeting. Our ability to operate successfully in cyberspace is a function of streamlined processes, mission readiness, and the trust of our various mission partners,” his written statement to the committee read.

Second, Cyber Command’s partnership with the National Security Agency is the foundation to success. Since its creation Cyber Command has been located with NSA, sharing a “dual-hatted” leader, which allowed the organization to piggyback on NSA’s infrastructure, tools and highly knowledgeable cyber workforce while it was building out.

Cyber Command now also benefits from the rich intelligence NSA gains in its foreign signals intelligence mission. Nakasone created the Election Security Group, a combined Cyber Command-NSA team focused on election threats.

Despite the controversy surrounding whether it is time to split these two organizations, Nakasone said the dual-hat arrangement provides “speed, agility and flexible responses” for the nation.

“We operate in a domain that changes rapidly, and this change is measured in weeks, perhaps months. Being able to rapidly react to that as we’ve been able to prove in such things as securities of the elections in 2018 and 2020 is empowered by that relationship,” Nakasone told senators.

Third, Nakasone highlighted the benefit of working with foreign and domestic partners to share relevant and timely information.

“We enable our domestic industry, allies and partners by providing critical threat information and insights, which improves their ability to act under their unique authorities,” he said.

The Joint Task Force Indo-Pacific team will be focused on information and influence operations in the Pacific theater, a part of the world receiving much the military’s attention because of China’s growing capabilities.

The team is poised to work with like-minded partners in the region, Gen. Richard Clarke, commander of Special Operations Command, said before the Armed Services Committee. “We actually are able to tamp down some of the disinformation that they [China] continuously sow,” he said of the task force’s efforts.

The task force is an example of the fresh ideas the military is seeking to stifle damaging adversary influence and information operations. Officials are growing more concerned about these operations that sow chaos, doubt and confusion.

“Adversary use of disinformation, misinformation and propaganda poses one of today’s greatest challenges to the United States, not just to the Department of Defense,” Christopher Maier, acting assistant secretary of defense for Special Operations/Low-intensity Conflict, said earlier this month at a House Armed Services Subcommittee hearing.

Today’s information environment gives Russia, China and non-state actors real-time access to a global audience, Maier said. “With first-mover advantage and by flooding the information environment with deliberated and manipulated information that is mostly truthful with carefully crafted deceptive elements, these actors can gain leverage to threaten our interest.”

Broadly, Maier explained that DoD organizes its efforts to combat disinformation, misinformation and propaganda in four lines of effort: countering propaganda by adversaries, force protection, countering disinformation and strategic deception abroad by adversaries, and deterring and disrupting adversarial influence capabilities.

Given that the primary delivery mechanism for this information malice is taking place through cyberspace, U.S. Cyber Command has seen an increased role beyond just affecting the 1s and 0s that are the language of the domain. Cyber Command also carries out cyber-enabled information operations of its own.

The command’s leader pointed to the DoD’s “defend forward” directive — which charges Cyber Command to get as close as possible to adversaries in networks outside the United States — as a critical aspect of combating foreign cyber and influence operations before they reach U.S. shores.

Gen. Paul Nakasone, Cyber Command’s head, explained to senators Thursday that the command conducted over a dozen operations to head off foreign influence threats prior to the 2020 elections.

“The idea of operating outside of the United States, being able to both enable our partners with information and act when authorized. This is an active approach to our adversaries,” he said. “It’s been most effective as we’ve seen with the 2018 and 2020 elections with adversaries attempting to influence us, attempting to interfere but not being able to do that.”

The forward defense concept isn’t just applicable to cyberspace. Clarke described Special Operations Forces, specifically Military Information Support Operations professionals, that are deployed forward and work closely with embassies around the world.

“By working closely with those partners to ensure that our adversaries, our competitors are not getting that free pass and to recognize what is truth from fiction and continue to highlight that to using our intel communities is critical,” he said.

1st Special Forces Command built an Information Warfare Center specifically designed to develop “influence artillery rounds” as a means of detecting adversary activity around the globe in and rapidly push that information to those that need it.

Ultimately, however, officials explained the military is just one instrument of national power to suppress these malicious activities.

“This is what the power of [Department of] Treasury brings to it, the Federal Bureau of Investigation, [Department of] Justice, Department of Homeland Security. This is the lesson that we’ve learned, is that we have to operate together because the partnership is where the power is,” Nakasone said.

While responding to information or influence operations is imperative, Nakasone said the response could diplomatic or financial, not just a military action.

“There’s a broader piece that is being worked right now by the administration in terms of: How do we improve the further resilience of the United States as we look at adversaries continuing to avoid our laws and policies and try to use our own infrastructure in their own attempts?” he added. “This is not going to be episodic. This is something that U.S. Cyber Command and the other combatant commands need to continue to work at.”

Instead, they might want to leave those communications intact to use them to spread false and misleading information, for example, said Lt. Gen. Mary O’Brien, Air Force deputy chief of staff for intelligence, surveillance, reconnaissance and cyber effects operations, during the Air Force Association virtual Aerospace Warfare Symposium on Feb. 25.

To prepare against potential hacking or jamming of systems that could take troops offline, the military is working to harden its communications, electronics and other digital equipment.

While this resiliency is welcome, the military must not ignore other vulnerabilities, O’Brien said.

“If our adversaries are not incentivized to disconnect us for their security, would that perhaps mean they want to maintain that connection in order to inject disinformation or misinformation and take advantage of opportunities that way,” she said. “Would they want to inject counter machine learning or counter artificial intelligence where their capabilities could corrupt ours? Could they attack our data in our algorithm integrity? What capabilities would we require then if we turn that assumption and looked at it from a different perspective?”

The misconception that adversaries’ priority is to cut communications has surfaced recently, O’Brien has noticed. Based on behavior observed in the today’s information domain, she said adversaries might not always desire to interrupt connectivity to achieve their effects.

Separately, O’Brien addressed the concern that the Department of Defense won’t be able to process or understand all available data.

“For most of my career, it has been an age of data scarcity, and we have all these prioritization frameworks on how we were going to go after the information we needed. That is being turned on its head,” she said.

The Air Force will need support from industry to handle this “data abundance,” which includes publicly available information.

Culture also must change to accept automation, with machines performing mundane tasks to free airmen to use their problem-solving skills.

“We’ll need capabilities to streamline the speed and accuracy of repetitive tasks, and we’ll need to let airmen use their higher cognitive skill sets to get after these problems — so human-machine teaming, advanced artificial intelligence, machine learning, big data analytics and automated visualization and presentation that will aid decision making,” O’Brien said.

The Corps seeks to identify companies that provide the capability and discover if existing contacts or partnerships could streamline delivery of a system, according to a “sources sought” notice on a federal contracting website Feb. 8. The service wants to determine if its requirements are in line with best available commercial technology.

The Corps is modernizing its forces and formations to better posture itself to fight in the information sphere, trying to keep pace with adversaries that use the burgeoning amount of publicly shared information to their advantage for intelligence collection, information operations and cyber operations, the notice from the Corps stated.

With the proliferation of information available online, the military is trying to exploit open source intelligence more for what the Marine Corps calls operations in the information environment.

Currently, the Corps uses a system called Integrated Intelligence Platform, which provides an open source intelligence and a cyber common operational picture by rapidly surveying datasets, identifying hidden trends and producing intelligence.

The Marines are looking more holistically at the information environment through the lens of the Information Environment Enterprise, its blueprint for information environment. As the Corps reviewed needed modernizations, it realized that subordinate units such as Marine Corps Forces Cyberspace Command lack an agile, user-friendly platform to provide accurate, timely, cost-effective interoperability with joint forces ― to include the Integrated Intelligence Platform.

Now, the Corps is reaching out to industry for assistance.

The service wants the new system ― dubbed with the slightly different name of the Integrated Information Intelligence Platform ― to handle planning and direction, collection and processing, production and dissemination of publicly available information, and open source intelligence, according to the request to industry.

Specific desired capabilities for the platform include, attribution, edge analytics, commercial threat intelligence, geospatial selector discovery, graph analytics, dark web monitoring, social/media analytics, intelligence orchestration and dissemination, publicly available information data mining, and battlespace awareness and deployable functionality.

The platform isn’t intended to directly counter these capabilities, documents suggest, but will provide analytics and intelligence that in aggregate will help prevent effectiveness of adversary actions.

The system must also adhere to U.S. Cyber Command’s Joint Cyber Warfighting Architecture, which guides how the command develops its capabilities. Given that Cyber Command employs joint teams that conduct operations and intelligence within the larger information environment, the Corps stated the platform must be compatible with the command’s systems.

Responses to the request for information are due Feb. 19, with an in-person industry day at Quantico planned for Feb. 23.