The distributed denial of service (DDoS) incidents — which essentially flood internet sites with an unusually high amount of web traffic, rendering them useless — hit at least 10 Ukrainian websites, including those of the Defense Ministry, Foreign Ministry, Culture Ministry and Ukraine’s two largest state banks. Denial of service attacks don’t require the incredible sophistication or painstaking access to networks needed for most data theft or deleterious cyberattacks, making them a common tactic among criminal organizations.

Ukrainian Information Ministry’s Center for Strategic Communications and Information Security suggested Russia could be behind the Feb. 15 incident, but didn’t provide details.

“It is possible that the aggressor resorted to tactics of petty mischief, because his aggressive plans aren’t working overall,” the statement said.

The Pentagon and U.S. Cyber Command deferred comment on the cyberattack to the National Security Council, which did not immediately respond to a request for comment.

Despite these incidents not yet being attributed to an actor, experts are worried they could signal an uptick in activity in eastern Europe amid the Russian troop buildup.

“Overall, this is telling us that more is starting to go down in Ukraine. I think this may very well signal the beginning of a Russian attack on Ukraine,” Tatyana Bolton, policy director of the Cybersecurity & Emerging Threats team at the R Street Institute think tank, told C4ISRNET. Bolton is also the former director of the Cyberspace Solarium Commission, a a bipartisan organization created in the 2019 defense policy bill to develop a multipronged U.S. cyber strategy.

Bolton noted there’s no direct indication Russian entities are responsible. However, the targets affected are what one might see during the beginning of a coordinated military campaign, she said.

Timothy Jones, vice president of systems engineering at Forescout, an enterprise defense company, cautioned that while the initial DDoS incident may not seem sophisticated, it could get worse and more complex.

With denial of service attacks, “sometimes the full extent isn’t really seen right away. We’re just starting to get some of the reports out,” said Jones. “Maybe they’re doing stuff in the background that we’re not necessarily looking at yet, or hasn’t really been felt.”

Using denial of service indicates some level of restraint, which Bolton described as a bit atypical for Russia.

“Usually, [DDoS] doesn’t take you offline for more than a day,” she said. “It can be more serious, but it’s not like encrypting all their files or deleting all their files. Those would have really been significant attacks. But the concern is also, what’s next? Is this a smokescreen for a larger incident or attack?”

The critical infrastructure sector — such as energy companies — were not targeted, which could signal that if Russia was behind the incident, they either view the banking sector as more critical or they are following general rules of warfare by not knocking out power to the civilian sector in the dead of winter, Bolton added.

DDoS is a tactic the Russians have been accused of using previously.

In mid-January, Ukraine blamed Russia for a cyberattack that temporarily disabled about 70 Ukrainian government websites simultaneously. During last month’s attack, an announcement posted stated that Ukrainians should “be afraid and expect the worst.”

Russia launched one of the most devastating cyberattacks ever on Ukraine in 2017 with the NotPetya virus, causing over $10 billion in damage worldwide. The virus, also disguised as ransomware, was a so-called “wiper” that scrubbed entire networks.

Cristin Monahan of the George Washington University’s National Security Archive’s Cyber Vault pointed out the Russians hit Estonia with a series of DDoS incidents in 2007 over Estonia’s decision to relocate a Soviet war monument, something of a watershed moment in the modern cyberwarfare era.

“The Russians made the point that even without direct military intervention, or even cyber interventions with kinetic effects, they can exert significant pressure on nations in their crosshairs, and Ukraine has received the same message for a number of years,” she said.

Monahan added that DDoS incidents rarely result in military intervention, implying the U.S. is not likely to physically engage with Russia over the loss of banking services.

The Associated Press contributed to this report.

Now it’s Washington’s turn to get serious about the “gray zone,” especially when it comes to cyber and information warfare, says a new report from the Atlantic Council. The term is used to describe competitive actions that occur below the threshold of conflict.

The think tank’s recommendations come as the Biden administration finishes its National Security Strategy and National Defense Strategy, which are expected to be published within weeks and address gray-zone or hybrid warfare.

“The DoD needs to compete now and engage in offensive hybrid warfare actions. The United States must respond where competition with China and Russia is taking place today, primarily by playing an enhanced role in gray-zone competition,” read the report, which was led by the Atlantic Council’s Clementine Starling, Air Force Lt. Col. Tyson Wetzel and Christian Trotti ― with former Defense Secretary Chuck Hagel.

The report called for new strategic competition coordinators on the National Security Council with direct access to the president, as well as a new whole-of-government messaging strategy aimed at countering anti-American narratives and reinforcing the rules-based international order. The Pentagon would play a supporting role, “executing offensive and defensive hybrid warfare activities that comport with U.S. values.”

Already, Colin Kahl, the undersecretary of defense for policy, said last month that the Defense Department’s overarching “integrated deterrence” concept ― a key part of the forthcoming National Defense Strategy ― expands “across the spectrum of conflict from high-intensity warfare to the gray zone.” That includes other instruments of national power: intelligence, economic, financial, technological and alliances, Kahl has said.

That mission is going to become more important as nations hostile to U.S. interests increasingly operate below the threshold of traditional conflict to challenge international rules and norms, particularly at flashpoints in the Taiwan Strait and Ukraine, the authors argued. The DoD has taken significant steps to compete in the gray zone, but the authors called for “a departmental paradigm shift” and for the military to go on the offense.

“The department has begun to focus more on countering our strategic competitors’ hybrid warfare efforts, but what I also see is an inherent conflict between competing now and the sexier thing, which is buying new equipment, getting ready to fight the war of the future; and sometimes, under the weight of that effort, competing today loses out a little bit,” Wetzel, who is also a senior fellow at the Atlantic Council, told Defense News.

“Everybody agrees we need to defend in the gray zone, but we really wanted to focus on the fact that we can take the offense as well,” he added.

For instance, as Russian President Vladimir Putin masses troops along Ukraine’s border and claims Ukraine and the West are the aggressors, the U.S. government ― under a more proactive approach to gray zone warfare ― would communicate more consistently and more often that Putin is the sole antagonist.

“Just on the information domain, we need to control the narrative, we need to counter false narratives a lot clearer,” Wetzel said.

The broader Atlantic Council report, drafted with expert input over the last year, made recommendations aimed at deterring or winning a conventional conflict as well as gray zone activities. Among the report’s other conclusions:

• The DoD needs guiding principles for hybrid warfare. The department should be part of unified interagency efforts, invest in “below-threshold” capabilities and training, engage only where strategically important, go on the offense to reinforce the international rules-based order, use strategic messaging, and stick to American ideals.
• Washington needs a hybrid warfare toolkit. That means establishing diplomatic norms as well as naming, shaming and sanctioning bad actors ― all the while, the DoD can show presence, launch distributed denial-of-service attacks, and conduct kinetic or non-kinetic actions against proxy or mercenary forces.
• Hybrid operations can improve conventional deterrence. Adversaries will use hybrid warfare until they can acquire a coercive deterrent against the U.S. and its allies. Containing engagement with China and Russia to cooperation and competition for as long as possible is in America’s interest ― but the U.S. “must get better at proactively engaging in and shaping the gray zone.”
• The State Department’s Global Engagement Center needs a funding boost and authorities to “lead whole-of-government strategic messaging and offensive information operations campaigns, and it needs to lead whole-of-nation efforts to engage with social media companies, and with allies and partners to create a coherent and effective campaign for countering mis- and disinformation.”

Investing in gray zone competition could mean acquiring more cyber tools as well as building an organization for “information operators,” who would quickly attribute and respond to misinformation or disinformation, said Trotti, assistant director of the Atlantic Council’s Forward Defense project.

“What they would ask for in terms of capabilities they need, I don’t know, but we do think there needs to be a focus, and a unit or units, that are really focused in that area,” Trotti said. “They would start to develop the tactics, techniques and procedures that will be used in gray zone operations or hybrid warfare operations.”

To compete with adversaries who already see conflict as part of a continuum (as opposed to binary war and peace), the DoD and its armed services have sought to embrace the tenets of information warfare by competing daily below the threshold of armed conflict.

Waiting to respond to an event after it occurs is too late, officials and experts have asserted over the last few years. Forces must be constantly engaged in the region and against malicious actors to contest their activity and collect the proper intelligence and access needed in case circumstances escalate.

The DoD and the armed services have also reorganized themselves to better align and integrate those various disciplines; they are currently developing new doctrine along this vein.

If the National Defense Strategy does prioritize gray zone conflict, it wouldn’t be the first time. In 2019, the DoD created an amendment to the National Defense Strategy focused on irregular warfare, with one of the five core themes of the annex aimed at operations in the information environment.

In the most recent defense policy bill, signed into law Dec. 27, Congress asked the DoD for a report on the implementation of the irregular warfare strategy. Some members of Congress have also expressed skepticism regarding progress in the information warfare sphere, questioning who is in charge of certain areas and how the department will oversee activities to ensure success.

“I am concerned the department leadership has been slow to adapt to the changing nature of warfare in this domain,” Rep. Jim Langevin, D-R.I., who chairs the House Subcommittee on Cyber, Innovative Technologies, and Information Systems, said during an April 30 hearing.

“Too often, it appears the department’s information-related capabilities are stovepiped centers of excellence with varied management and leadership structures, which makes critical coordination more difficult. Further, the Pentagon has made limited progress implementing its 2016 Operations in the Information Environment Strategy, which raises questions about the department’s information operations leadership structure.”

Though Congress directed the creation of a principal information operations adviser in 2020, some in Congress are worried it isn’t materializing as intended.

“Unfortunately, this position was layered below the undersecretary of defense for policy, contrary to congressional intent. This position was not created as another bureaucratic layer, but as an agile, single role with the mandate to guide each service’s efforts,” Rep. Elise Stefanik, R-New York, said during the same hearing.

Other outside experts worry the DoD is not doing enough to compete and win on a daily basis against sophisticated adversaries.

“Where we’ve fallen short is accounting for the risk that China and Russia will conduct hybrid warfare-style operations against the United States itself,” Paul Stockton, former assistant secretary of defense for homeland defense, told Defense News. “I’m not talking about little green men pouring across our borders — that’ll never happen — but the use of combined information and cyberattacks to disrupt U.S. defense operations at home.”

Stockton, who recently authored a paper titled “Defeating Coercive Information Operations in Future Crises,” did note that the DoD has made progress in collaborating with NATO allies and partners in Asia to be prepared to counter gray zone threats.

However, he added, the U.S. must strengthen its deterrence by developing information operations response options that would credibly threaten Russia and China if they conduct such operations as part of a gray-zone or hybrid warfare approach.

Heritage takes over for Lt. Gen. Matthew Glavy who will become the deputy commandant for information, the Corps’ top IT officer charged with leading the service’s efforts in the information environment.

The ceremony also uncased the colors for Marine Corps Forces Space Command, which Heritage also commands. MARFORSPACE is the service component to Space Command, providing a marine force to integrate into the space enterprise while also providing capabilities to Marines stand-in forces in the enemies’ weapons engagement zone.

Heritage returns to MARFORCYBER, previously serving as its deputy commander from Marine Corps Recruiting Depot. He also previously served as deputy director for future operations, J-3, at U.S. Cyber Command.

In addition to serving as the commander of MARFORCYBER and MARFORSPACE, Heritage will also lead Joint Task Force-Ares, which has focused on non-state terrorist actors around the globe. Recently, Cyber Command shifted some of the responsibilities of the task force to include nation-states, particularly in the Indo-Pacific region.

Cyber Flag, the command’s premier annual training event, is happening on the heels of Cyber Command’s budget request that proposes adding more teams and potentially altering their composition to adapt to a rapidly changing threat landscape.

For the first time, the exercise will help identify characteristics of successful cyber protection teams, which conduct defensive cyberspace operations.

This year’s exercise, Cyber Flag 21-2, includes over 430 individuals from 17 teams from the U.S., UK, Canada, National Guard, House of Representatives and U.S. Postal Service and is taking place across eight time zones. The event uses the Persistent Cyber Training Environment — an online client that allows Cyber Command warriors to log on from anywhere for training and mission rehearsal.

The exercise was set in the Pacific region at a fictitious allied logistics support depot where teams had to contend with attacks from two adversaries: One was more advanced and focused on denial and disruption, while the other was less sophisticated and focused on theft of intellectual property and personally identifiable information.

In the past, Cyber Command used the exercise to validate teams, but as the threat has evolved, leaders wanted to test concepts and codify new team structures to optimize success.

“We’re continuously evaluating the proficiency of our force. We’re evaluating where the gaps are. We’re evaluating the new TTPs [tactics, techniques and procedures] that the adversary presents,” Coast Guard Rear Adm. Christopher Bartz, chief of exercises and training at Cyber Command, told reporters June 22. “We are evolving our training at the speed that the adversary is evolving their TTPs.”

The exercise will allow Cyber Command, which sets general standards across all the services for cyber teams’ training and the equipment they use, to extract best practices and spread those through the cyberspace community, officials explained.

Bartz equated the effort to other constructs within the military, such as aviation stand teams that go to various units and communicate best practices through the broader aviation community.

With broader domestic participation, officials said they can observe how others conduct defensive cyber operations, contributing to a more holistic governmentwide approach for national security and defense.

Also for the first time this year, teams competed against each other with an overall winner to be selected at the conclusion of the exercise June 25. Assessors will observe how teams identify threats and the techniques defenders use to eject threats from the network or deny further compromise.

In written testimony to Congress this year, Gen. Paul Nakasone, commander of Cyber Command, outlined one of the command’s top priorities: realigning cyber protection teams.

“USCYBERCOM is working with the combatant commands to ensure they have dependable defensive support for their missions while we retain forces to deal with global challenges to the DoDIN [Department of Defense Information Network],” he wrote.

Expanded scope

Cyber Command’s expanded use of PCTE allowed the exercise to grow significantly. The range itself was five times larger than last year, the first year Cyber Command used the platform for its largest exercise.

The PCTE team even established a custom help desk for Cyber Flag — capable of assisting with everything from forgotten passwords to major engineering fixes.

The team applies lessons from the exercise to future events and versions of the platform. For example, the team improved the chat function in the platform after users found it hard to use last year, and they’re awaiting feedback.

The platform and program team have grown to be able to support thousands of activities daily, even last week supporting two major exercises simultaneously: Cyber Flag and Cyber Yankee, a National Guard-focused exercise that took place in New England.

The platform supported the cyber operations kit for UK operators during Cyber Flag, making their experience more realistic. “We want the experience of our foreign allies to be just as valuable and meaningful as any other CMF [cyber mission force] user on PCTE,” said W. Cory Bogler, lead PCTE operations engineer for Product Manager Cyber Resiliency & Training in the Army Program Executive Office Simulation, Training and Instrumentation.

Officials from the PCTE team said the next Cyber Flag — Cyber Flag 21-3 in October — will include participation from all the Five Eyes intelligence alliance nations: the U.S., UK, Canada, Australia and New Zealand.

Pentagon budget: What the budget reveals — and leaves unclear — about the cost of JADC2 | Air Force budget: Congress dealt ABMS a blow, but experts see progress | Army budget: Proposed modernization increases show Army sees joint operations as ‘top priority’

WASHINGTON — Experts picked up signs in the Navy’s budget about its joint war-fighting priorities despite a lack of details because most related spending lines are classified.

Notably, they pointed to investments in enterprise networking, command and control, and cybersecurity to support the service’s Project Overmatch.

The Navy has provided few specifics about its effort to better connect ships, aircraft and unmanned systems for Joint All-Domain Command and Control. Experts said fleets’ interconnected network structures make them susceptible to devastating interference and could explain the secrecy.

At a late May budget briefing, the Navy said classified research and development budget requests went up. “Project Overmatch with funding in the budget of FY22 has the three R&D lines that also happen to be classified. But those values do increase,” said Rear Adm. John Gumbleton, deputy assistant secretary of the Navy for budget.

Following the top item in the Navy’s unfunded priority list for a guided-missile destroyer, the service listed requests for two networking-related items critical for JADC2: $53.9 million to accelerate naval tactical grid development and $87 million for resilient communications and position, navigation and timing for combat logistics fleets.

“What we did see was there was $50 some million that was second highest unfunded requirement that the Navy was willing to put forth to Congress, which does say a lot,” said Rob Carey, president of Cloudera Government Solutions, vice president of Cloudera Public Sector and former Navy CIO and DoD principal deputy CIO.

The broader Navy budget plan pointed to investments in information warfare systems that will support Project Overmatch to seamlessly connect network sensors, manned and unmanned platforms, and weapons to help forces make better battlefield decisions than adversaries.

In this category, the Navy would spend $5.8 billion for FY22 procurement. That would include satellite communications, enterprise networks, command and control systems, ISR sensors and processor development, resilient precision, navigation and timing systems, electronic warfare systems, counter C4ISR systems, tactical data link systems and cyber, among others. By far the largest chunk of the lot is $1.19 billion requested for enterprise networks.

To really gauge the Navy’s true investments in this space, observers will need to check the Future Years Defense Program projections, Carey said, adding that funding will probably ramp up over the next five years. However, the Biden administration did not release those numbers for this budget request.

The Navy is spending on the right mission areas, said Juliana Vida, chief strategy adviser at Splunk and former Navy deputy CIO.

“It’s actually, I think, very encouraging to see that language that supports the JADC2 concept and Project Overmatch concept are now making their way into budgets with large dollars attached to them,” she said. “We all know that you follow the money in the Department of Defense and where there is funding placed, that is a very strong signal of senior leadership’s dedication to making sure that these capabilities get put into the hands of our sailors and Marines.”

Bryan Clark, senior fellow and director of the Center for Defense Concepts and Technology at the Hudson Institute, said he saw Navy investments in the budget falling into three broad buckets:

1. Alignment of communications systems to the right bandwidth or to reduce latency to support operations and decision-making in real time.
2. Interoperability to build platforms on the backbone of three existing network or sensing architectures.
3. A reduced communications signature footprint for greater resiliency on the electromagnetic spectrum.

Beyond these three, he said the details stray into the classified realm.

The Navy might have classified much of its funding plan because it views itself as more susceptible to C4ISR disruption than its service counterparts.

Calling Project Overmatch the Navy’s crown jewel and the most important capability the service is pursuing, Clark explained that an adversary could in one fell swoop disrupt the communications chain to cripple the entire fleet, which is much harder to do to an Army unit or an air sortie.

A Navy force is too slow to quickly recompose and doesn’t have the terrain in which to hide itself and regroup, he said.

As a result, the service might be trying to protect its “secret sauce” from adversary eyes, Clark said.

Carey was pleased the Navy decided to classify these items because a war would likely begin with a network attack, and Project Overmatch is all about network architectures.

“War fighting is a pretty sensitive art. This is the network side of war fighting, which you don’t want to reveal because the next war, the first parts of it will not be kinetic, they will be nonkinetic. I think the Navy smartly has classified this,” he said. Adversaries “can exploit the information that’s put out there and then figure out ways to now stymie that development because this is about accelerating war-fighting decisions by providing access to information in disparate places, running AI.”

Maj. Gen. Matthew Glavy, commander of Marine Corps Forces Cyberspace Command, will pin on his third star and assume the role of deputy commandant for information. The Corps created the position in 2017, recognizing the importance of the burgeoning information environment.

“Two years ago … [former commandant] Gen. [Robert] Neller talked with us about the need to move into the information environment, electronic warfare, MISO [military information support operations], cyber and military deception faster. He traded — intentional, deliberately traded — a three-star billet from a command and created a three star [DC-I] … who oversees that for us,” Gen. David Berger, commandant of the Marine Corps, told Congress in 2020 about the importance of the position. “You wish you could go back two years and thank him for that because right now she is incredibly far out in front of the rest of us telling us where we need to go and not just in one area, EW, but how do you integrate those domains and make it a war-fighting capability.”

Glavy will take over from Lt. Gen. Lori Reynolds. The Corps did not release information yet about who fill Glavey’s job at MARFORCYBER.

“I would anticipate that as we lay out the case, we have to look at some critical elements that will influence the future size of the cyber mission force, now 133 teams,” Gen. Paul Nakasone said at a House Armed Services Cyber, Innovative Technologies and Information Systems Subcommittee hearing.

Some members of Congress are worried that the cyber mission force — designed and built almost 10 years ago — does not reflect the current dynamic state of cyberspace.

Members questioned Nakasone last year on the topic, and he said Cyber Command would gather information for Pentagon leaders to make appropriate staffing decisions.

In fact, the congressionally mandated Cyberspace Solarium Commission recommended the Department of Defense create more cyberwarriors. That provision made it into last year’s National Defense Authorization Act in the form of providing a comprehensive assessment cyber operations forces as part of changes to the department’s quadrennial cyber posture review.

Nakasone told the committee today that he does have the data available to make such a determination.

“To prepare for the approved growth in the CMF, we will enhance our control over resources for the force, improve its readiness (including the metrics we require in doing so), and consolidate CMF training,” Nakasone wrote in congressional testimony provided to the Senate Armed Serves Committee in March and to the House Armed Services Committee on Friday. “Recent demand across DoD has demonstrated that the original 133 teams in the CMF are not enough. The strategic environment has changed since the original CMF was designated in 2012. Added forces will ensure USCYBERCOM can fulfill its responsibility as both a supported and a supporting command.”

A Department of Defense spokesperson told C4ISRNET that those specific numbers have not been released publicly.

Currently, there are 6,187 authorized positions for the cyber mission force with 238,000 personnel in the DoD’s cyberspace operations forces, which includes the cyber mission force, Cyber Command subordinate command elements, cybersecurity service providers, special capability providers, and specialty units, Nakasone said, drawing from the 2018 cyber posture review.

Those cyber mission force teams have undergone changes over the years to adapt to threats, allowing the freedom for commanders to task organize their teams as necessary. For example, in Nakasone’s written testimony, he noted how several teams were initially aligned to the counterterrorism fight, but with the department’s shift toward state actors, Cyber Command has realigned some units to focus on key nations.

One such example is its counter-Islamic State group task force, Joint Task Force-Ares. Cyber Command shifted the majority of the task force to focus more on nation-state actors, particularly in the Indo-Pacific region.

Nakasone told representatives that there are a few other factors that will affect the growth of the cyber mission force; chief among them is the growing importance of space.

The creation of the Space Force and Space Command adds more ground for Cyber Command to cover. The way the cyber force is staffed within the DoD is that each of the services are responsible for providing a set number of teams — offensive, defensive and intelligence/support teams — to the joint cyber mission force.

In turn, these teams are led by a Joint Force Headquarters-Cyber, which are headed by each of the service cyber component commanders, who them plan, synchronize and conduct operations for the combatant commands to which they’re assigned. The 16th Air Force and its Joint Force Headquarters-Cyber component takes responsibility for Space Command, which is in the process of creating its own Joint Cyber Center to create a tighter linkage with Cyber Command.

While all the services provide an allotted number of forces to Cyber Command through the cyber mission force, officials to date have said there are no plans for Space Force to provide cyber mission force contributions. Instead, officials have noted that they need specialized, serviced-retained cyber personnel to defend their critical assets, such as ground stations, from cyberattacks.

Adversaries are now using cyberspace in ways that weren’t necessarily imagined when the force was initially conceived. Namely, they’ve discovered they can conduct operations below the threshold of war to undermine U.S. national security and not draw a significant response.

“We have to have that balance of not only, what we are going to support our fellow combatant commands if conflict was to break out, but also if our adversaries are operating below the level of armed conflict every single day, what type of force do we need to be able to ensure that we can counteract that,” Nakasone said.

The executive order signed Wednesday touches on many issues that the Defense Department is weighing to ensure adequate protections among its vast information technology supplier network, an effort driven in large part by lawmakers’ alarm over recent high-profile government network compromises. For example, lawmakers ordered the DoD to assess programs to share cybersecurity information with the defense industrial base and to consider the possibility of a threat-hunting program on vendors’ networks.

The security of the military’s most sensitive information, such as weapon controls and service members’ locations, rides on its cyber protections.

The Biden administration is trying to eliminate any hesitation or contractual barriers that might prevent IT providers from sharing cyber threat information with the government.

“Federal agencies can’t defend what they can’t see,” a senior administration official said during a call with reporters the day Biden approved the plan. “Removing barriers to information sharing regarding threats and incidents is a fundamental first step to preventing breaches in the first place and empowering the federal government to respond when they do occur.”

The order follows a raft of major cyber breaches and compromises over the last year, including the wide-ranging, Russian-orchestrated Solar Winds intrusion of federal systems that compromised the supply chain; a Chinese-orchestrated operation that compromised Microsoft Exchange servers globally; and a ransomware attack against Colonial Pipeline that is affecting gas supplies. Officials said the order would help detect some of these problems much faster in the future.

“Companies need to share information about the incident, the vulnerability, what occurred. We’re really focused on information that’s important to be used to get out information to better help other entities defend themselves,” the senior administration official said. “We’re really creating a common threshold across the federal government to say let’s make sure that info is shared so all can defend themselves and all can get at information to private sector stakeholders and others to enable them to defend themselves as well.”

The order requires, within six months for some agencies, advanced protections including multifactor authentication of users’ identities and endpoint detection systems that constantly monitor for malicious activity and block it.

“Fundamentally what we saw in SolarWinds was that federal government cybersecurity was not at the level needed to detect attempts to intrude and to rapidly find those that are successful,” the administration official said.

Additionally, the new order pushes the federal government to move to secure cloud services and a zero-trust architecture and mandates encryption to secure data.

In the event of a breach or lesser network problem, the order creates a “playbook” or a standard set of definitions for cyber response by federal agencies.

Software suppliers also must provide federal buyers with a “software bill of materials,” essentially a list of ingredients of what’s inside the software. John Cofrancesco, vice president of government business for Fortress Information Security, told C4ISRNET that the bill of materials was “huge.”

“Weapon systems and platforms were once thought to be disconnected standalone systems, because they were not consistently connected to a network,” Cofrancesco said. “That belief has been dispelled in large part due to the heavily reliance on software that must be updated, refreshed, loaded, downloaded and patched. Each of these present unique touch points and access points for adversaries and criminals to corrupt our systems.”

This executive order is the first step in helping to secure supply chains and add greater transparency and accountability.

Officials acknowledge that the order is limited given the authorities afforded to executive orders. While it is a welcome stride, some argue that more needs to be done to protect the federal government from sophisticated intrusions.

“This executive order is a good first step, but executive orders can only go so far. Congress is going to have to step up and do more to address our cyber vulnerabilities, and I look forward to working with the administration and my colleagues on both sides of the aisle to close those gaps,” Sen. Mark Warner, D-Virginia, chairman of the Intelligence Committee, said in a statement.

Andrew Eversden contributed to this report.

Joint Task Force-Ares was created in 2016 to combat the militant organization online as a compliment to the global coalition fighting against the group’s grip on power in Iraq and Syria. The task force has since undergone several changes. The Army’s cyber component was originally tasked to lead the joint cyber effort, but in 2018, responsibility shifted to Marine Corps Forces Cyberspace Command, which allowed the team to focus not just on the Islamic State group, but more broadly on counterterrorism efforts globally.

“Counterterrorism operations in cyberspace are continuous, helping to protect the force and prosecute targets in Afghanistan and other regions on behalf of USCENTCOM [Central Command] and USSOCOM [Special Operations Command],” Gen. Paul Nakasone, commander of Cyber Command, said in written testimony to Congress in March. “We are also shifting JTF-Ares’ focus (though not all of its missions) from counterterrorism toward heightened support to great power competition, particularly in USINDOPACOM’s [Indo-Pacific Command’s] area of responsibility.”

Broadly speaking, Cyber Command does not plan to change command-and-control relationships or organizational cyber mission force elements as Joint Task Force-Ares transitions to focus more on nation-state actors, according to a command spokesperson.

Joint Task Force-Ares’ flexible capabilities allowed its members to integrate with and support operations in Central Command, the spokesperson said. As the task force shifts responsibility, it will seek to continue coordination with INDOPACOM, 10th Fleet/Fleet Cyber Command and MARFORCYBER. Fleet Cyber Command is responsible for cyber operations in the Indo-Pacific region under what is known as the Joint Force Headquarters-Cyber construct, which provides planning, targeting, intelligence and cyber capabilities to assigned combatant commands.

Making moves

The move to shift teams’ focus marks a reflection that Cyber Command has to adapt to a changing world in which so-called great powers are a greater priority than terrorist organizations and that the DoD has identified the Indo-Pacific region as a top priority given it considers China the “pacing threat.”

“The CMF’s [cyber mission force’s] original force structure was set in 2012, and several teams were originally aligned to support the counterterrorism fight. With the return of great power competition, USCYBERCOM is realigning some teams to focus on key nations,” Nakasone wrote in his testimony.

As nation-states have continued to increase their develop of cyber and information-related capabilities, Cyber Command internally realigned selected offensive forces and shifted focus from just counterterrorism operations to strategic competition, a spokesperson said.

“By reevaluating force structure, we are able to leverage capabilities across all of our elements ensuring our cyber operations remain agile and flexible to respond and disrupt adversaries,” the spokesperson continued.

Nakasone and other officials at Cyber Command have articulated how China and the greater Indo-Pacific region are a greater focus now.

“For the year to come our priorities are set. We will focus on great power competition through persistent engagement, especially in support of USINDOPACOM,” Nakasone wrote.

Earlier in March, command Executive Director David Frederick said the priorities of the command are supporting the DoD’s China strategy and supporting the INDOPACOM commander.

“We’re very focused on working with Indo-Pacific Command to understand what they need from Cyber Command as a supporting force,” he said.

Realigning operational elements not only creates a greater focus on coordination internally, a command spokesperson said, but also on combatant commands and other organizations Cyber Command supports.

As part of force design updates the Corps announced for 2030, the service is looking to invest around $1 billion in development over the next five years, Col. Dave Burton, program manager for intelligence systems and portfolio manager for command element systems at Marine Corps Systems Command, said April 21 at the virtual C4ISRNET Conference.

The Corps is enhancing systems for its traditional electronic warfare operators for “peer-to-peer EW engagements,” Burton said.

Broadly speaking, the Marine Corps wants to develop future systems in four categories, according to Lt. Col. Brian Ackerson, branch head for Marine Air Ground Task Force electronic warfare.

First, the Corps is looking for systems that are platform agnostic, Ackerson explained during an Association of Old Crows virtual summit April 13. The Corps doesn’t want systems designed for one platform or system, but rather systems that it can spread around to fit multiple airborne or ground systems.

The service also wants systems that can be widely distributed and scalable. This means a mix of options that are portable by person, vehicle mounted or handheld. This equates to a variety of high- and low-power systems that the Corps can use together across a wide variety of units and systems.

Plus, the service needs capabilities on-demand as opposed to exquisite systems. This is especially important if the Marines expect to operate inside an enemy’s sphere of influence, what the Corps calls the weapons engagement zone, Ackerson explained.

Last, the Corps wants systems that it can network and are mutually supporting. Marines need the ability to control systems remotely, especially if they are operating over hundreds of miles in areas such as the Pacific, where the Corps’ top officer has elevated China as the greatest threat.

The networking of capabilities also has broader application outside the Marine Corps. If systems can be networked, then services can share data to provide a better situational awareness picture of the spectrum, Burton said.

“If the operational or the tactical situation calls for electronic attack, there’s a full understanding of the entire spectrum and the decision can be made to do that. If a targeting solution is required based on the spectrum data, then that sensing solution can be provided to a targeting solution and maybe a kinetic strike will occur,” he said. “We can see the spectrum as another part of the information environment that is crucial for future operations and understanding the spectrum and being able to maneuver in the spectrum either for electronic attack, electronic protect, to deny the adversary the use of spectrum is just another aspect of warfare.”

In addition to creating new structures, such as Marine Expeditionary Force Information Groups, to better compete within the larger information environment — which includes the electromagnetic spectrum — Burton said the Corps wants to develop systems for incidental operators.

These systems will go to dismounted Marines down to the infantry squad level.

“We’re looking at visualization tools, deconfliction tools that we can use to conduct traditional signals intelligence missions while we’re also managing EW missions down to the lowest level,” Burton said, adding that the need to control capabilities remotely will be critical as they look to give more systems to incidental users.

Moreover, officials understand that nonkinetic capabilities can be just as effective, if not more so in some cases, than more expensive kinetic weapons.

Adversaries are deploying higher capable systems from long range and smarter weapons. Conventional thinking might say friendly forces need to outpace those systems with capabilities such as fifth-generation fighter aircraft and other exquisite weapons.

“But from an EW perspective,” Ackerson said, “perhaps I can develop a jamming system that can escort my special aircraft or weapon system into the target.”

“I don’t have to spend a ton of money and make an exquisite platform. Maybe I need to look at new waveforms, new jamming techniques and new integrated electronic warfare capabilities with our weapon systems that can support them to get into the target,” he added. “We talk about our adversaries having precision long-range fires and exquisite capabilities. If they’re operated in the EMS, we need to be able to find them, and we need to be able to use their weaknesses to help drive targeting.”

These systems could also help set the conditions for conflict. With so-called gray zone operations and adversaries working harder in the competition phase below the threshold of warfare, nonkinetic capabilities can help sense the environment and provide potential targeting data if the situation escalates, Ackerson said.

“Realizing that gray zone activities, particularly in INDOPACOM, it’s going to help us in competition to build targeting,” he said. “We’re going to be in competition 99 percent of the time, so having that sensing capability that we could actually use is going to be huge. In conflict, I want to have those electronic attack capabilities that are going to deny, degrade, disrupt the decision cycle of an adversary. I want to have nonkinetic options that I can provide the Marine force or the joint force.”