Cyber Force A Defense Imperative

United States Cyber Force
A Defense Imperative
FOUNDATION FOR DEFENSE OF DEMOCRACIES
Dr. Erica Lonergan and RADM (Ret.) Mark Montgomery

March 2024
United States Cyber Force
A Defense Imperative
Dr. Erica Lonergan

RADM (Ret.) Mark Montgomery
March 2024
FDD PRESS
A division of the
FOUNDATION FOR DEFENSE OF DEMOCRACIES
Washington, DC
United States Cyber Force: A Defense Imperative
Table of Contents
EXECUTIVE SUMMARY...................................................................................................................... 6
HISTORY AND CURRENT ORGANIZATION OF THE U.S. MILITARY IN CYBERSPACE....... 7
IN THEIR OWN WORDS: GAPS AND CHALLENGES IN THE CURRENT MODEL ................ 13
COUNTERARGUMENTS TO ESTABLISHING A U.S. CYBER FORCE ........................................ 25
WHAT SHOULD A CYBER FORCE LOOK LIKE?............................................................................ 28
CONCLUSION...................................................................................................................................... 31
APPENDIX A:
SELECT QUOTATIONS FROM INTERVIEWS................................................................................. 32
APPENDIX B:
HISTORICAL CASE STUDIES: THE AIR FORCE AND SPACE FORCE ........................................ 35
APPENDIX C:
THE HISTORY OF U.S. INFORMATION OPERATIONS
AND THE CREATION OF CYBERCOM............................................................................................. 37
Page 5
Executive Summary these officers by rank and service but withholds their
names for reasons of privacy.
In the U.S. military, an officer who had never fired a
rifle would never command an infantry unit. Yet officers This research paints an alarming picture. The inefficient
with no experience behind a keyboard are commanding division of labor between the Army, Navy, Air Force,
cyber warfare units. This mismatch stems from the U.S. and Marine Corps prevents the generation of a cyber
military’s failure to recruit, train, promote, and retain force ready to carry out its mission. Recruitment
talented cyber warriors. The Army, Navy, Air Force, and suffers because cyber operations are not a top priority
Marines each run their own recruitment, training, and for any of the services, and incentives for new recruits
promotion systems instead of having a single pipeline vary wildly. The services do not coordinate to ensure
for talent. The result is a shortage of qualified personnel that trainees acquire a consistent set of skills or that
at U.S. Cyber Command (CYBERCOM), which has their skills correspond to the roles they will ultimately
responsibility for both the offensive and defensive fulfill at CYBERCOM. Promotion systems often hold
aspects of military cyber operations. back skilled cyber personnel because the systems were
designed to evaluate servicemembers who operate on
For the last decade, Congress, on a bipartisan basis, land, at sea, or in the air, not in cyberspace. Retention
has made clear its sharp concern about cyber personnel rates for qualified personnel are low because of
issues. In 2022, it required the secretary of defense to inconsistent policies, institutional cultures that do not
deliver a report that addresses “how to correct chronic value cyber expertise, and insufficient opportunities for
shortages of proficient personnel in key work roles” at advanced training.
CYBERCOM. The report is due on June 1.1
Resolving these issues requires the creation of a new
Often, however, military leaders have addressed independent armed service — a U.S. Cyber Force
personnel shortages by massaging statistics rather than — alongside the Army, Navy, Air Force, Marine
fixing the underlying problem. In 2018, CYBERCOM Corps, and Space Force. There is ample precedent
appeared to reach a major milestone when it certified for this approach; battlefield evolutions led to the
that all 133 of its Cyber Mission Force (CMF) teams establishment of the Air Force in 1947 and the
had enough properly trained and equipped personnel Space Force in 2019. An independent cyber service
to execute their missions. Yet multiple officers revealed would naturally prioritize the creation of a uniform
these certifications to be hollow; CYBERCOM merely approach to recruitment, training, promotion,
shifted a limited number of effective personnel from and retention of qualified personnel whose skills
team to team to make them appear complete at the correspond to CYBERCOM’s needs. In addition to
time of certification. a single, dedicated cyber training and development
schoolhouse, an independent service could establish a
To deepen the understanding of the cyber personnel cyber war college for advanced research and training,
system and its flaws, this study draws on more than 75 akin to the Army War College and its peers. Without
interviews with U.S. military officers, both active-duty the responsibility for procuring planes, tanks, or
and retired, with significant leadership and command ships, a Cyber Force could also prioritize the rapid
experience in the cyber domain.2 The study identifies acquisition of new cyber warfare systems.
1. James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, Pub. L. 117-263, 136 Stat. 2903, §1533. (https://www.
congress.gov/117/plaws/publ263/PLAW-117publ263.pdf )
2. FDD made minor edits to some of the interviews for reasons of grammar and style. No substantive changes were made. Appendix A
preserves excerpts of the interviews in their original form.
Page 6
History and Current

Organization of the U.S.
Military in Cyberspace
For nearly 40 years, the U.S. military has separated the
responsibility for force generation — the imperative
to “man, train, and equip” personnel for their specific
domains — from the responsibility of force employment
Illustrated prospective seal for U.S. Cyber Force — the use of troops in combat. The independent
(Design by Daniel Ackerman/FDD) services — the Army, Navy, Air Force, Marine Corps,
This Cyber Force need not be large. An examination and Space Force — generate forces, while the unified
of existing cyber billets suggests it would initially combatant commands employ forces and can request
comprise about 10,000 personnel but might grow manpower from each of the services.
over time. As the Space Force has shown, a smaller
For every domain but cyberspace, the United States
service can be more selective and agile in recruiting
has designated a single service as the one ultimately
skilled personnel.
responsible for force generation for its respective
Some military experts have proposed alternative domain. For example, while the Army, Navy, and
approaches to addressing the U.S. military’s cyber Marine Corps operate significant aircraft fleets, it is
personnel shortage, but each has major shortcomings. primarily the Air Force’s responsibility to man, train,
For example, some argue that CYBERCOM should and equip U.S. troops for air combat.
become more like the U.S. Special Operations
Since the establishment of CYBERCOM in 2010
Command, to which each service provides elite
and its subsequent elevation to a unified combatant
personnel uniquely trained for the land, sea, and
command in 2018, the military has had a designated
air domains. But that model makes little sense
organization for force employment in and through
for cyberspace since there are no cyber functions
cyberspace. But the United States still has no single
specific to the other warfighting domains. Others
entity responsible for cyber force generation.
argue CYBERCOM should assume responsibility
for manning, training, and equipping cyber forces in
addition to employing them on the virtual battlefield.
The Creation of CYBERCOM
But this approach would break with 40 years of The pivotal role of advanced technology in the 1991
precedent and would overwhelm CYBERCOM’s Gulf War led the Department of Defense (DoD)
leadership, which is already dual hatted with the to recognize the importance of what were then
National Security Agency, an arrangement that serves known as “computer network operations.”3 The U.S.
U.S. national security well. military began developing cyber doctrine in earnest
in 2003 after the discovery of a multi-year Russian
America’s cyber force generation system is clearly cyber espionage operation revealed the “first large-
broken. Fixing it demands nothing less than the scale cyberespionage attack by a well-funded and
establishment of an independent cyber service.
3. Joshua Rovner, “Warfighting in Cyberspace,” War on the Rocks, March 17, 2021. (https://warontherocks.com/2021/03/warfighting-
in-cyberspace)
Page 7
well-organized state actor.”4 The next year, the Joint dual-hatted structure and gave CYBERCOM a direct
Chiefs of Staff defined cyberspace as a warfighting line of communication to the secretary of defense plus
domain,5 and DoD released its first National Military greater authority to request budgetary resources.7
Strategy for Cyberspace Operations in 2006.6 (A more
detailed account can be found in Appendix C.)
After discovering additional foreign cyber espionage

“Despite standing up CYBERCOM, the
military has not established a cyber-specific
campaigns targeting the department, DoD in 2010
combined existing cyber elements to establish
training academy.
”
CYBERCOM under U.S. Strategic Command.
CYBERCOM is led by a commander dual hatted Despite standing up CYBERCOM, the military has
as director of the National Security Agency (NSA), not established a cyber-specific training academy. In
the intelligence community component responsible other areas, institutions such as the U.S. Army War
for signals intelligence and cybersecurity services. College, U.S. Naval War College, Air War College,
CYBERCOM became responsible for defending U.S. Marine Corps University, and National Defense
DoD information systems, supporting joint force University provide specialized training for senior
commanders in cyberspace, and advancing national enlisted personnel and officers, preparing them for
interests in and through cyberspace. leadership positions and assignments in the joint force.
This is known as force development.8
The services also developed their own components
responsible for information and cyber operations in The 2019 National Security Commission on Artificial
support of operations in their respective warfighting Intelligence argued for the creation of a Digital Service
domains. These components include what are Academy to address talent deficits in the defense and
now the 16th Air Force, Army Cyber Command, intelligence communities.9 DoD’s failure to implement
Fleet Cyber Command, and Marine Corps Forces this recommendation after three years and multiple
Cyberspace Command. congressional initiatives10 suggests such an academy
will not succeed absent an independent service that can
In 2018, the president elevated CYBERCOM to a deliver the expertise and resources to equip a cyber-
unified combatant command. This move retained the specific service academy.
4. Omry Haizler, “The United States’ Cyber Warfare History: Implications on Modern Cyber Operational Structures and Policymaking,”
Cyber, Intelligence, and Security, January 2017. (https://www.inss.org.il/wp-content/uploads/2017/03/The-United-States%E2%80%99-
Cyber-Warfare-History-Implications-on.pdf )
5. The Joint Chiefs of Staff, “The National Military Strategy of the United States of America,” 2004. (https://nssarchive.us/wp-content/
uploads/library/nms/nms2004); Michael Warner, “US Cyber Command’s First Decade,” Hoover Institution, December 3, 2020. (https://
www.hoover.org/sites/default/files/research/docs/warner_webready.pdf )
6. Department of Defense, “National Military Strategy for Cyberspace Operations (NMS-CO),” December 11, 2005. (https://nsarchive2.
gwu.edu/NSAEBB/NSAEBB424/docs/Cyber-023.pdf )
7. Andrew Feickert, “The Unified Command Plan and Combatant Commands: Background and Issues for Congress,” Congressional
Research Service, updated January 3, 2013. (https://crsreports.congress.gov/product/pdf/R/R42077/11)
8. U.S. Department of the Army, “Army Regulation 71-32. Force Development and Documentation Consolidated Policies,” March 20,
2019. (https://armypubs.army.mil/epubs/DR_pubs/DR_a/pdf/web/ARN8238_AR71_32_FINAL.pdf ); “J7 Directorate for Joint Force
Development,” Joint Chiefs of Staff, accessed January 8, 2024. (https://www.jcs.mil/Directorates/J7-Joint-Force-Development)
9. National Security Commission on Artificial Intelligence, “NSCAI Final Report Recommendations,” October 5, 2021. (https://www.
nscai.gov/wp-content/uploads/2021/01/Final-Report-Slides.pdf )
10. See, for example, “Cyber Service Academy,” Office of Sen. Kirsten Gillibrand, accessed January 5, 2024. (https://www.gillibrand.senate.
gov/cyberacademy)
Page 8
Current Organization of the U.S. support functions. This latter group makes up the bulk
Military in Cyberspace of COF personnel.13 Separately, some U.S. military cyber
personnel, serving outside the COF, conduct traditional
The U.S. military’s Cyberspace Operations Forces (COF)11 business functions, protect service-specific systems, and
encompass elements that conduct reconnaissance, support other functional or geographic commands (see
operational preparation of the environment, and Figure 1 below).
network-enabled operations, along with subordinate
logistics and administrative elements.12 In addition, the Within the COF, the Cyber Mission Force directs,
COF includes DoD network operations centers and coordinates, and executes cyber operations. It comprises
cybersecurity service providers that conduct traditional less than 3 percent of the COF, or approximately 6,200
network defense and information technology (IT) military and civilian personnel.14 The CMF currently
Figure 1: Cyberspace Operations Forces
Cyberspace Elements Not Part of the

Operations Forces Cyberspace Operations Forces
DoD Business Function Elements
CYBERCOM Cyber Service-Retained Forces,

Subordinate Mission such as Air Force Mission Defense Teams or
Elements Force Army Tactical Signal Battalions/Brigades
Joint Cyber Centers
DoD Component Intelligence Units and Personnel

Network Operations
Centers and
Cybersecurity SOCOM-assigned forces
Providers
11. Joint Chiefs of Staff, “Cyberspace Operations, Joint Publication 3-12,” June 8, 2018. (https://irp.fas.org/doddir/dod/jp3_12.pdf );
Note that Joint Publication 3-12 was updated in December 2022, but there is not a public source for the updated doctrine. Department
of Defense, “DoD Directive 8140.01: Cyberspace Workforce Management,” October 5, 2020. (https://www.esd.whs.mil/Portals/54/
Documents/DD/issuances/dodd/814001p.pdf ); Department of Defense, “Memorandum for Chief Management Officer of the Department
of Defense: Definition of the Department of Defense Cyberspace Operations Forces (DoD COF).” December 12, 2019.
12. U.S. Department of Defense, “Memorandum for Chief Management Officer of the Department of Defense: Definition of the
Department of Defense Cyberspace Operations Forces (DoD COF).” December 12, 2019.
13. Joint Force Headquarters DODIN, Fact Sheet, “Protecting DOD Networks for Mission Success,” April 2023. (https://www.
jfhq-dodin.mil/Portals/69/PDFs/JFHQ-DODIN%20Fact%20Sheet%20-%20Command%20Overview_April2023.pdf?ver=YhyI
-lKbmblkx7TsTbR4bw%3d%3d)
14. U.S. Cyber Command Public Affairs, “Cyber 101 – Cyber Mission Force,” U.S. Cyber Command, November 1, 2022. (https://www.
cybercom.mil/Media/News/Article/3206393/cyber-101-cyber-mission-force)
Page 9
includes 133 teams. But in 2022, DoD announced the to fully employ its cyber weapons with adequately
CMF would expand to 147 teams, including:15 trained, equipped, and supported servicemembers.17
Of those 133 CMF teams, 41 came from the Army,
• Thirteen Cyber National Mission Force (CNMF) 40 from the Navy, 39 from the Air Force, and 13 from
teams responsible for “defend[ing] the nation by the Marine Corps.18
seeing adversary activity, blocking attacks, and
maneuvering in cyberspace to defeat them.” These In 2022, the CNMF became a sub-unified
operations are largely conducted as independent combatant command, endowing it with additional
campaigns, not in support of combatant authorities and responsibilities. Its commander
command missions. explained that this status will enable CNMF to build
“a force that can move faster than our adversaries,
• Twenty-seven Cyber Combat Mission Teams, which
because we have the right set of equipment, the right
“conduct military cyber operations in support of
authorities, and the right procedures that move with
combatant commands.”
agility and speed.”19
• Sixty-eight Cyber Protection Teams responsible
for “defend[ing] the DOD information networks, The 14 additional CMF teams are supposed to be
protect[ing] priority missions, and prepar[ing] cyber stood up between fiscal years 2022 and 2026. Five
forces for combat.” of the new teams are slated to come from the Army,
• Twenty-five Cyber Support Teams, which provide with the Air Force and Navy providing five and four,
analytic and planning support to CNMF and the respectively.20 By mid-2023, however, it became clear
Cyber Combat Mission Teams.16 that CYBERCOM would need to delay its plans.
In particular, the Navy will not be able to deliver
• Fourteen new teams responsible for supporting new teams for at least a few years because it needs
combatant commanders in space operations and to focus on improving the readiness of its existing
countering cyber influence. cyber personnel.21
In 2018, CYBERCOM attested that the original 133 Moreover, even the existing teams have not actually
CMF teams achieved full operational capacity (FOC). reached FOC despite what CYBERCOM claims.
In other words, each team ostensibly had the ability
15. “Our History,” U.S. Cyber Command, accessed January 8, 2024. (https://www.cybercom.mil/About/History); U.S. Department of
Defense, “Fiscal Year 2024 Defense Budget Overview,” Office of the Comptroller, April 2022, page 24. (https://comptroller.defense.gov/
Portals/45/Documents/defbudget/FY2023/FY2023_Budget_Request_Overview_Book.pdf )
16. Catherine A. Theohary, “Defense Primer: Cyberspace Operations,” Congressional Research Service, updated December 9, 2022. (https://
sgp.fas.org/crs/natsec/IF10537.pdf )
17. U.S. Cyber Command Public Affairs, “Cyber Mission Force achieves Full Operational Capability,” U.S. Cyber Command, May 17,
2018. (https://www.cybercom.mil/Media/News/News-Display/Article/1524492/cyber-mission-force-achieves-full-operational-capability)
18. Mark Pomerleau, “Here’s how DoD organizes its cyber warriors,” C4ISRNET, July 25, 2017. (https://www.c4isrnet.com/workforce/
career/2017/07/25/heres-how-dod-organizes-its-cyber-warriors)
19. Cyber National Mission Force Public Affairs, “The Evolution of Cyber: Newest Subordinate Unified Command is Nation’s Joint Cyber
Force,” U.S. Cyber Command, December 19, 2022. (https://www.cybercom.mil/Media/News/Article/3250075/the-evolution-of-cyber-
newest-subordinate-unified-command-is-nations-joint-cybe)
20. C. Todd Lopez, “Cyber Mission Force Set to Add More Teams,” DOD News, April 6, 2022. (https://www.defense.gov/News/
News-Stories/Article/Article/2991699/cyber-mission-force-set-to-add-more-teams)
21. Martin Matishak, “Cyber Command Reshuffles Force Expansion Due to Navy Readiness Woes,” The Record, June 14, 2023. (https://
therecord.media/cyber-command-reshuffles-cyber-mission-force-due-to-navy-readiness-woes); Mark Pomerleau, “Following reforms,
Navy seeing cyber mission force readiness improvements,” DefenseScoop, February 22, 2024. (https://defensescoop.com/2024/02/22/
navy-reforms-cyber-mission-force-readiness-improvements)
Page 10
Evolution of CYBERCOM’s Authorities executive agents for procurement for CYBERCOM,

although CYBERCOM also possessed limited
While CYBERCOM has had the authority to conduct
acquisition authority to execute contracts, with
operations short of armed conflict outside of DoD-
a $75 million annual cap. Then, in the FY 2022
controlled networks since its creation,22 the Fiscal
NDAA, Congress took the unusual step of providing
Year (FY) 2019 National Defense Authorization
CYBERCOM with Enhanced Budgetary Control
Act (NDAA) legislated the most important change
(EBC) to directly manage resources for equipping the
in CYBERCOM’s authorities, defining cyber
CMF.26 These EBC authorities, which will take full
operations as a “traditional military activity,” and
effect this year, reflect congressional frustration with
authorized DoD (and, by extension, CYBERCOM)
failures in the existing, services-led acquisition efforts
to act in “foreign cyberspace to disrupt, defeat, and
on CYBERCOM’s behalf. As then CYBERCOM
deter” cyberattacks against the U.S. government and
commander General Paul Nakasone explained to
the American people.23 This change allowed for more
Congress in March 2023, the hope is that EBC will
extensive planning and execution of cyber operations.
better harmonize CYBERCOM’s responsibilities and
The new authority also largely aligned with National
operations by providing it with control over funding
Security Presidential Memorandum-13 (NSPM-13),
for major acquisition programs.27
a Trump administration initiative to streamline the
process for authorizing military cyber operations.24 Nevertheless, the lion’s share of cyber funding in the FY
The Biden administration reportedly modified 2024 budget remains with the services. CYBERCOM’s
NSPM-13 but has largely kept it in place.25 budget request is approximately $2.9 billion, while
DoD’s total Cyberspace Activities Budget request for
CYBERCOM has also gained new acquisition
the services is $13.5 billion.28 Moreover, CYBERCOM
authority and statutory responsibility for managing
will still rely on the services to spend much of the
personnel. Previously, the services served as the
money that Congress appropriates.29
22. Robert Chesney, “Traditional Military Activities in Cyberspace: Clarifying DOD’s Authority and the Line Between T10
and T50 Activities?” Lawfare. May 9, 2011. (https://www.lawfaremedia.org/article/traditional-military-activities-cyberspace-
clarifying-dods-authority-and-line-between-t10-and-t50); Paul C. Ney Jr., “DOD General Counsel Remarks,” Speech before
the U.S. Cyber Command Legal Conference, March 2, 2020. (https://www.defense.gov/News/Speeches/speech/article/2099378/
dod-general-counsel-remarks-at-us-cyber-command-legal-conference)
23. John S. McCain National Defense Authorization Act for Fiscal Year 2019, Pub. L. 115-232, 132 Stat. 2123 and 132 Stat. 2132,
§§ 1632 and 1642. (https://www.govinfo.gov/app/details/PLAW-115publ232); Catherine A. Theohary, “Defense Primer: Cyberspace
Operations,” Congressional Research Service, updated December 9, 2022. (https://sgp.fas.org/crs/natsec/IF10537.pdf ); Robert
Chesney, “The Law of Military Cyber Operations and the New NDAA,” Lawfare, July 26, 2018. (https://www.lawfareblog.com/
law-military-cyber-operations-and-new-ndaa)
24. Mark Pomerleau, “What good are ‘exceptional’ cyber capabilities without authority?” C4ISRNET, July 16, 2019. (https://www.c4isrnet.
com/dod/2019/07/16/what-good-are-exceptional-cyber-capabilities-without-authority)
25. “NSPM-13 and the Future of Cyber Warfare,” The Hudson Institute, May 5, 2022. (https://www.hudson.org/events/2109-virtual-event-
nspm-13-and-the-future-of-cyber-warfare52022)
26. Paul M. Nakasone, “2023 Posture Statement of General Paul M. Nakasone,” U.S. Cyber Command, March 7, 2023. (https://www.
cybercom.mil/Media/News/Article/3320195/2023-posture-statement-of-general-paul-m-nakasone)
27. Ibid.
28. U.S. Department of Defense, U.S. Cyber Command, “Fiscal Year 2024 Budget Estimates United States Cyber Command,” March
2023. (https://comptroller.defense.gov/Portals/45/Documents/defbudget/fy2024/budget_justification/pdfs/01_Operation_and_
Maintenance/O_M_VOL_1_PART_1/CYBERCOM_OP-5.pdf )
29. U.S. Department of Defense, “Fiscal Year (FY) 2024 Budget Estimates. Operation and Maintenance, Defense-Wide,” March 2023.
(https://comptroller.defense.gov/Portals/45/Documents/defbudget/fy2024/budget_justification/pdfs/01_Operation_and_Maintenance/
O_M_VOL_1_PART_1/OM_Volume1_Part1.pdf )
Page 11
The promise of EBC was that it would bring not as a result of, the U.S. military’s current organization
CYBERCOM closer to the U.S. Special Operations for cyberspace operations.
Command (SOCOM) model, in which the force
employer helps guide procurement. However, the Congress has repeatedly raised concerns about
services still retain the vast majority of cyber-specific these issues. At a March 2023 hearing, Rep. Mike
funding, continuing CYBERCOM’s dependency Gallagher (R-WI) noted: “Since 2013, Congress has
on the services. The persistent structural problems tried to address force design and readiness through
render CYBERCOM unable to provide for itself. 24 different pieces of legislation. Twenty-four. And
It continues to rely on the military services and, in over that same period, we have tried to address the
some circumstances, the NSA for personnel, funding, civilian and military cyber workforce dilemma 45
foundational intelligence support, procurement and times; CYBERCOM acquisition matters, 12 times;
acquisition activities for cyber-specific capabilities, and defense industrial base cybersecurity, 42 times.”34
research and development for tools, and infrastructure
supporting cyber operations. Nearly every year for the past decade, Congress has
requested information or reports about military cyber
Congressional Concerns About readiness — a clear indication DoD has been unable
to satisfy congressional concerns. In 2016, Congress
CYBERCOM’s Insufficient Maturity mandated that CYBERCOM launch an expedited two-
Over the past five years, CYBERCOM has achieved year force-generation effort because the CMF had not
important operational successes. It has conducted achieved sustainable readiness.35 The next year, Congress
“hunt forward” operations at the invitation of allied and requested briefings on cyber readiness shortfalls.36 In
partner nations to help uncover and defeat cyber threats the FY 2020 NDAA, Congress required the secretary
in their networks.30 It has also defended U.S. elections,31 of defense to analyze the benefits and drawbacks of
responded to Iranian hackers in Albania,32 and helped “establishing a cyber force as a separate uniformed
Ukraine shore up its cyber systems following Russia’s service.”37 Two years later, Congress again called for an
2022 invasion.33 However, these successes came despite, assessment of U.S. cyber posture.38
30. U.S. Cyber Command, Press Release, “‘Building Resilience’: U.S. returns from second defensive Hunt Operation in Lithuania,” September
12, 2023. (https://www.cybercom.mil/Media/News/Article/3522801/building-resilience-us-returns-from-second-defensive-hunt-operation-
in-lithuania)
31. David Vergun, “Cybercom’s Partnership with NSA Helped Secure US Elections, General Says,” DoD News, March 25, 2021. (https://
www.defense.gov/News/News-Stories/Article/Article/2550364/cybercoms-partnership-with-nsa-helped-secure-us-elections-general-says)
32. Cyber National Mission Force Public Affairs, “‘Committed Partners in Cyberspace’: Following cyberattack, US conducts first defensive
Hunt Operation in Albania,” U.S. Cyber Command, March 23, 2023. (https://www.cybercom.mil/Media/News/Article/3337717/
committed-partners-in-cyberspace-following-cyberattack-us-conducts-first-defens)
33. David Vergun, “Partnering with Ukraine on Cybersecurity Paid Off, Leaders Say,” DoD News, December 3, 2022. (https://www.defense.
gov/News/News-Stories/Article/Article/3235376/partnering-with-ukraine-on-cybersecurity-paid-off-leaders-say)
34. Mike Gallagher, “Cyberspace Operations: Conflict in the 21st Century,” Hearing before the House Armed Services Committee, Cyber,
Information Technologies, and Innovation Subcommittee, March 30, 2023. (https://armedservices.house.gov/hearings/cyber-information
-technologies-and-innovation-subcommittee-hearing-cyberspace-operations)
35. National Defense Authorization Act for Fiscal Year 2017, Pub. L. 114-328, 130 Stat. 2602, §1643. (https://www.congress.gov/
bill/114th-congress/senate-bill/2943/text)
36. National Defense Authorization Act for Fiscal Year 2018, Pub. L. 115-91, 131 Stat. 1748 §1644. (https://www.congress.gov/
bill/115th-congress/house-bill/2810/text)
37. National Defense Authorization Act for Fiscal Year 2020, Pub. L. 116-92, 133 Stat. 1748, §1635. (https://www.congress.gov/116/
plaws/publ92/PLAW-116publ92.pdf )
bill/117th-congress/senate-bill/1605/text)
Page 12
In Their Own Words:

Gaps and Challenges in
the Current Model
While force employment is the responsibility of
CYBERCOM, responsibility for force generation is
spread across the five military services. This system is
Subcommittee Chairman Rep. Mike Gallagher (R-WI) failing to meet the unique demands of cyber-related
(2nd L) listens during a hearing before the Cyber, Information training and acquisition. As one general officer lamented,
Technology, and Innovation Subcommittee of the House Armed “Our current strategy of relying on the existing Services
Services Committee on Capitol Hill on March 30, 2023 in to build the cyber expertise and capabilities required
Washington, DC. (Photo by Alex Wong/Getty Images)
is inefficient, ineffective, and unlikely to succeed
The FY 2023 NDAA directed the secretary of defense despite years of investment and the best efforts of
to study the services’ responsibilities for cyber force our servicemembers.” Washington’s “only viable path
generation in light of “chronic shortages of proficient forward,” the officer said, “is to establish a new Service
personnel in key work roles.”39 Among other issues, the focused on organizing, training, and equipping forces
study is supposed to explore whether a single military required to fight – and win – in cyberspace.” 43
service should be responsible for force generation.
Manning and training for cyberspace operations
CYBERCOM implicitly acknowledged its force are not equivalent to furnishing infantry or logistics
generation challenges in its May 2023 Strategic personnel. All specialties have distinct training and skill
Priorities, vowing to improve readiness, recruitment, requirements, but the cyber domain requires a uniquely
and retention.40 DoD, meanwhile, is developing a high level of technical training. As a result, individual
so-called “Cyber Command 2.0” initiative to address cyber personnel can have outsized operational effects.
how the military generates and trains cyber forces.41 As one lieutenant colonel in the Air Force noted, “10%
In December 2023, General Nakasone observed that of the [cyber] workforce provides 90% of the value.”
the current state of U.S. military cyber organization
is unsustainable. “I think all options are on the table, Additionally, acquisition processes for equipment and
except the status quo,” he said.42 capabilities must move far more quickly than those for
39. Kristy N. Kamarck and Catherine A. Theohary, “FY2023 NDAA: Cyber Personnel Policies,” updated March 6, 2023. (https://
crsreports.congress.gov/product/pdf/R/R47270); James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, Pub. L. 117-
263, 136 Stat. 2903, §1533. (https://www.congress.gov/117/plaws/publ263/PLAW-117publ263.pdf )
40. U.S. Cyber Command Public Affairs, “Commander, US Cyber Command rolls out new Strategic Priorities,” U.S. Cyber Command, May
18, 2023. (https://www.cybercom.mil/Media/News/Article/3399867/commander-us-cyber-command-rolls-out-new-strategic-priorities)
41. Grace Dille, “DoD Fleshing out Cyber Command 2.0 Options,” MeriTalk, December 8, 2023. (https://www.meritalk.com/articles/
nakasone-calls-for-a-revamped-cybercom-2-0)
42. Jaspreet Gill, “With new threats, ‘CYBERCOM 2.0’ must push past ‘status quo’: Nakasone,” Breaking Defense, December 8, 2023.
(https://breakingdefense.com/2023/12/with-new-threats-cybercom-2-0-must-push-past-status-quo-nakasone)
43. All of the personal accounts included in this monograph are excerpted from interviews with active and recently retired servicemembers
and Defense Department civilians between December 2022 and January 2024.
Page 13
the other warfighting domains. Acquisition of software deficiencies in the U.S. military’s current cyber force
or exploits, for example, must occur rapidly to ensure generation model and readiness. They also help explain
they are not rendered obsolete.44 Moreover, many of the why the establishment of a Cyber Force is the best
most cutting-edge capabilities reside within the private and only solution to these challenges. (See Appendix
sector, including in industries not traditionally part of A for excerpts from the interviews and a demographic
the defense-industrial base. Finally, there is a potentially breakdown of the interviewees.)
greater role for non-uniformed civilian personnel in
cyberspace capability development and employment. Recruitment and Retention Shortfalls
The U.S. military is failing to recruit and retain
“Atfromroot, the current readiness issue stems

the fact that none of the existing services
enough talented cyber personnel. The “lack of
talented personnel to fill positions on the Cyber
Mission Force has been and continues to be a
prioritizes cyberspace.
” severely limiting factor for the overall force,” one
Army colonel explained. A 2022 Government
The current system compounds these force-generation Accountability Office (GAO) report similarly
challenges. Each of the services has developed its concluded that all the services “continue to experience
own solutions, leading to both inconsistencies and challenges retaining qualified cyber personnel.” Even
shortcomings. As outlined below, these issues span talent the Army, which has fared better in the recruitment
recruitment and retention; occupational designations of skilled cyber personnel, has struggled to retain its
and training; promotions; critical support functions; cyber workforce.46
administrative control; and capability acquisition.45
The current recruitment and retention shortfall
At root, the current readiness issue stems from the fact stems from multiple problems, some of them
that none of the existing services prioritizes cyberspace. inherent to the current system. First, the services
As a retired Navy captain observed, this fundamental are not using the tools at their disposal to bolster
mismatch “has yielded varying levels of fragmented compensation for high-caliber personnel, nor are the
support to cyber operations, [a] lack of continuity services compensating them equitably. In addition,
of cyber personnel, unclear career paths, insufficient the services have inconsistent and poorly designed
experience, wide use of non-cyber personnel in cyber requirements governing how long their warfighters
leadership positions, and cyber operations being treated must serve. Worse, retention suffers from problems
always as a supporting entity across all services.” with service culture, leadership, and quality of life.
The services’ promotion systems and CYBERCOM’s
The extensive interviews that inform this study provide lack of administrative support also undermine
the most direct and compelling evidence to date of the retention, as discussed later in the report.
44. U.S. Department of Defense, “DoD Instruction 5000.87 Operation of the Software Acquisition Pathway,” October 2, 2020. (https://
www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/500087p.PDF?ver=virAfQj4v_LgN1JxpB_dpA%3D%3D)
45. See also: John Fernandes, Nicolas Starck, Richard Shmel, Charles Suslowicz, and Jan Kallberg, “Assessing the Army’s Cyber Force
Structure,” The US Army War College Quarterly, August 25, 2022. (https://press.armywarcollege.edu/cgi/viewcontent.cgi?article=3170&
context=parameters)
46. Chad Bates and Charlene Rose, “Understanding-and Fixing-The Army’s Challenge in Keeping Cyber Talent,” Modern War Institute,
May 17, 2022. (https://mwi.usma.edu/understanding-and-fixing-the-armys-challenge-in-keeping-cyber-talent). For its part, the Army
still insists it does not have a retention problem because it is able to maintain its target staffing numbers. However, those numbers may
be misleading given that, as discussed later, the services are currently unable to ensure they have sufficient staffing for CYBERCOM work
roles. Moreover, the issue is not just the sheer number of personnel but their talent. Multiple interviewees decried the challenges of retaining
talented personnel. Even if the services retain enough people, they are losing some of their most qualified.
Page 14
A Cyber Force would be far better equipped to manning CYBERCOM refrain from pursuing these
recruit and retain cyber personnel, as the success of choices aggressively because cyber is only one mission
the Space Force has shown. Despite competing with and not their primary charge.” A Cyber Force, by
private sector firms that offer more attractive salaries, contrast, would naturally put cyber first.51
the Space Force has not faced problems recruiting
high-level talent.47 Because it is relatively small, the Inconsistent Compensation
Space Force can selectively recruit highly skilled In addition to being inadequate, U.S. military
individuals rather than pursuing bulk accessions to compensation for cyber personnel is inconsistent across
fill the ranks like the larger services.48 the services, damaging morale and esprit de corps.
Services Fail to Use Tools at Their Disposal Once the services recruit personnel, each service
To be fair to the services, the U.S. military is not the separately determines which ranks serve in which jobs.
only one struggling to recruit cyber talent. There is a The Marines might assign a staff sergeant (E-6) to the
national shortage of cyber personnel, and the federal same job the Air Force assigns a first sergeant (E-8).
government struggles to compete with the private With different pay scales and incentives for these
sector, which offers much better pay.49 different ranks, the result is wide pay discrepancies
between individuals performing identical work.
Unlike the military, civilian government agencies Even when the servicemembers have similar levels
use creative promotion schemes to ensure their of experience, compensation varies significantly.
cyber workforce is well-compensated, even if salaries For example, the monthly salaries of two Interactive
do not match the private sector. The military also On-Net Operators (IONs) from different services,
has some tools it can use to improve compensation, each with four to five years of experience, serving in
but the services are not using them effectively. the same location and performing largely the same
For example, the 2022 GAO study found that job, may differ by more than $700.52 This discrepancy
the Army was not offering enlistment bonuses to does not even take into account differences in housing
cyber personnel.50 allowances or pay incentives.
As one Army captain explained, CYBERCOM itself GAO studies have found that enlistment bonuses
“is not able or empowered to use these options.” also vary dramatically across the services. Whereas
Meanwhile, “the service components responsible for GAO found in 2022 that the Army was not offering
47. Lauren C. Williams, “Recruiting Crisis? Not at Space Force,” Defense One, December 2, 2022. (https://www.defenseone.com/
policy/2022/12/recruiting-crisis-not-space-force/380369)
48. Leo Shane III, “Space Force eyes easing enlistment rules to target high-demand skills,” Air Force Times, September 13, 2022. (https://
www.airforcetimes.com/news/pentagon-congress/2022/09/13/space-force-eyes-easing-enlistment-rules-to-target-high-demand-skills)
49. Sue Poremba, “The cybersecurity talent shortage: The outlook for 2023,” Cybersecurity Dive, January 5, 2023. (https://www.
cybersecuritydive.com/news/cybersecurity-talent-gap-worker-shortage/639724)
50. Government Accountability Office, “Military Cyber Personnel: Opportunities Exist to Improve Service Obligation Guidance and Data
Tracking,” December 21, 2022, page 26. (https://www.gao.gov/assets/gao-23-105423.pdf )
51. The Cyber Force could also remove combat fitness test requirements, establish more flexible grooming standards, or recruit
neurodiverse individuals for certain work roles. For an example of how other countries are recruiting non-traditional cyber
servicemembers, see: Shira Rubin, “The Israeli Army Unit That Recruits Teens With Autism,” The Atlantic, January 6, 2016.
(https://www.theatlantic.com/health/archive/2016/01/israeli-army-autism/422850); Anna Ahronheim, “IDF aims to recruit
500 soldiers with autism by end of 2022,” The Jerusalem Post (Israel), November 8, 2021. (https://www.jpost.com/israel-news/
idf-aims-to-recruit-500-soldiers-with-autism-by-the-end-of-2022-684354)
Page 15
enlistment bonuses, the Marine Corps was offering not included in this Army regulation. As a result,
$2,000 for cyber career fields, and the Navy was personnel could attend an expensive year-long cyber
offering $5,000 with an additional $30,000 bonus training course and leave the military soon afterward.57
after training completion.53 Until legislative intervention in 2023, the Marine
Corps could not assign additional service obligations
The services also use bonuses and incentives for lengthy and expensive cyber training.58
inconsistently and without regard for who is a worthy
recipient. According to the 2022 GAO study, the Culture
services base retention bonuses for cyber personnel
Many officers have described how service culture
on their broader military career, not their unique
denigrates cyber talent, damaging the morale of cyber
skill sets.54 These findings matched conclusions from
personnel and eroding retention.59 “Retention rates of
a 2017 GAO study.55 The persistence of these issues
cyber personnel are abysmal,” one retired Navy captain
five years after the initial GAO study underscores that
remarked. “The biggest reason the services hemorrhage
the services cannot fix these problems themselves.
talent is that cyber personnel do not feel valued by
Inconsistent and Poorly Designed their service’s culture.” Similarly, a retired Army
Length-of-Service Requirements colonel shared, “I’ve seen senior warfighting leaders
dismissively call cyber research ‘book reports,’ cyber
Low cyber retention rates stem in part from inconsistent operators ‘nerds,’ and cyber capability development
and poorly designed length-of-service requirements. ‘science projects.’” Only the creation of a new service
Because each service has its own retention policies, dedicated to cyberspace can address these kinds of
they have distinct requirements for how long their entrenched cultural challenges.
servicemembers, including cyber personnel, must
remain on active duty. What is more, these requirements Inconsistent Career Field Designations,
do not adequately account for the “lengthy and
expensive advanced cyber training” provided to cyber
Skill Sets, and Training
personnel, according to the GAO.56 Across the services, cyber-related career field assessments,
assignments, designations, and skill sets60 are ill-defined
For example, the Army usually requires officers and disjointed. This fragmented approach undermines
to serve three times the length of their training. training and personnel management.
However, many advanced cyber training courses are
55. Government Accountability Office, “Military Compensation: Additional Actions Are Needed to Better Manage Special and Incentive
Pay Programs,” February 3, 2017. (https://www.gao.gov/products/gao-17-39)
Tracking,” December 21, 2022. (https://www.gao.gov/assets/gao-23-105423.pdf )
Tracking,” December 21, 2022, pages 12-13. (https://www.gao.gov/assets/gao-23-105423.pdf )
Tracking,” December 21, 2022, page 14. (https://www.gao.gov/assets/gao-23-105423.pdf ); National Defense Authorization Act for Fiscal
Year 2024, Pub. L. 118-31, 137 Stat. 243, §509. (https://www.congress.gov/bill/118th-congress/house-bill/2670)
59. Suzanne Smalley, “Cyber Command’s rotation ‘problem’ exacerbates talent shortage amid growing digital threat,” CyberScoop, August
18, 2022. (https://cyberscoop.com/military-rotation-norms-challenge-cyber-command)
60. While each military service refers to career fields differently, for the purposes of this section, we will refer generically to Military
Occupational Specialty (MOS) in reference to both officer and enlisted career fields.
Page 16
Inconsistent and Inadequate Training “different service-desired outcomes and minimal

joint perspective when outside of CNMF roles,”
Currently, servicemembers arrive at CYBERCOM
the captain explained. “Without one overarching
with skill sets that are not only inconsistent but also
cyber service and related vision and clearly defined
insufficient to fulfill their basic work roles. This problem
mission, cyber training will continue to produce an
stems from each of the services not only using different
unbalanced and ineffective joint workforce where
names for their cyber operators but also training them
services will continue to prioritize efforts and service-
differently — without CYBERCOM’s needs in mind.
specific career paths.”
For example, when an Air Force cyber operations
officer, a Navy cyber warfare engineer, and a Marine
Corps cyber operations officer complete their initial
“Instead of offering specialized training, the
services provide general coursework, teach
entry training, they lack a common skillset (such as capabilities at a high level of generality, and
knowledge of specific operating systems or exploits). require operators to learn a broad range of
And none are qualified to serve in any of CYBERCOM’s system architectures rather than honing their
basic work roles upon arrival.
In fact, it was not until February 2023 that the Navy

skills on a specific system.
”
began using a separate designation for its cyber warfare A Navy lieutenant commander agreed. “Each of the
officers, in alignment with how the other services treat services are [sic] training and employing cyber personnel
their cyber operations experts.61 While the Army and to do the exact same jobs, such as exploitation analyst,
Air Force generally enable personnel to devote their tool developer, and cyber planner,” the officer observed.
careers to cyber roles, the Navy had been grouping “Despite these identical needs, there is virtually no
cyber officers with intelligence and information warfare standardization whatsoever across the entirety of the
officers, hampering their ability to develop expertise. military workforce. Each separate service maintains its
own training programs, its own performance evaluation
The services train cyber personnel at service-specific processes, its own employment metrics.” In short, “the
training centers. Army centers include the Army Cyber totality of the force is wholly uncoordinated. From a
School’s Virtual Training Area, the U.S. Army Cyber mission perspective, I have witnessed firsthand how
Center of Excellence, and Fort Eisenhower Signal this situation creates impossible problems with regard
Training Site. Air Force personnel train at the Air to technical expertise and training.”
Force Cybersecurity University and the Cyberspace
Technical Center of Excellence. The Navy has the Many other officers discussed the lack of specialization
Naval Information Warfare Training Center and the in operating systems, intelligence, exploits, and other
Naval Postgraduate School Center Cybersecurity and techniques associated with cyber-related personnel
Cyber Operations. Finally, there is the Marine Corps across the services. Instead of offering specialized
Air/Ground Combat Center in California. training, the services provide general coursework,
teach capabilities at a high level of generality, and
These centers do not have a common training system require operators to learn a broad range of system
or set of standards. As one Navy captain noted, architectures rather than honing their skills on a
“Each service has developed their own training specific system. This is like requiring Air Force pilots to
model and paths, which do have some overlap but for learn a bit about all types of aircraft in the fleet rather
the most part are not synchronized.” They each have than specializing in the particular craft they will pilot.
61. Geoff Ziezulewicz, “A new Navy ‘cyber’ rating is in the works,” Navy Times, February 15, 2023. (https://www.navytimes.com/news/
your-navy/2023/02/15/a-new-cyber-rating-is-in-the-works)
Page 17
Figure 2 contrasts CYBERCOM-defined work roles for a Naval aviator is $2.2 million, according to a
with service-specific cyber career field designations and RAND report.63 By contrast, the GAO found that
titles for both officers and enlisted personnel.62 There the training and subsequent certification to become
is little overlap between the two. Furthermore, the an interactive on-net operator costs between $220,000
service-based training with each military occupational and $500,000.64
specialty (MOS) does not slot into any particular
CYBERCOM work role. The GAO also found that courses are “not listed in
regulation or in Army or joint training systems of
Compared to the other warfighting domains, the record.” There are long breaks between courses, and
U.S. military spends relatively little time and money the length of the courses themselves fluctuates. In
on training for cyber officers. The initial cost of addition, there are often significant delays between
training an Air Force fighter pilot ranges from $5.6 when candidates are nominated for training and
to $10.9 million, and the annual cost of training when they attend.65
Figure 2: Service-Specific Cyber Career Field Designations and CYBERCOM Work Roles
Source: Adapted from the Government Accountability Office with additional research and input from interviewed experts (https://www.
gao.gov/assets/gao-23-105423.pdf page 8).
62. Government Accountability Office, “Federal Workforce: OPM Advances Efforts to Close Government-wide Skills Gaps but Needs a
Plan to Improve Its Own Capacity,” February 27, 2023, pages 18-22. (https://www.gao.gov/products/gao-23-105528)
63. For more information, see also: Michael G. Mattock, Beth J. Asch, James Hosek, and Michael Boito, “The Relative Cost-Effectiveness of
Retaining Versus Accessing Air Force Pilots,” RAND Corporation, March 27, 2019. (https://www.rand.org/pubs/research_reports/RR2415.html)
Page 18
Across the services, there is also a lack of continual replete with commissioned and non-commissioned
training for the officer corps. An April 2023 paper officers who may be good leaders but lack the cyber-
published by the National Defense University specific skills and experience necessary to excel.
concluded that the cyber domain requires continual
training with some technical training delivered every Standard service processes require an individual to
18 to 24 months.66 Although servicemembers often have held certain positions to be promoted. These
have the opportunity to attend graduate school, such roles are often entirely unrelated to CYBERCOM
courses are also not well suited to technical training for priorities. In the Army, for example, a lieutenant must
a dynamic, rapidly changing field. Such courses are also serve as a platoon leader before being promoted. But
different from the more specialized cyber upskilling many technically proficient cyber operators never
needed to create effective leaders. hold the positions deemed necessary for advancement.
Consequently, they are passed over for promotion, while
Inability to Manage Cyber Personnel those without cyber expertise are placed in command.
Because the services do not designate personnel for Compounding this issue, the personnel in charge of
particular CYBERCOM work roles, “military service the promotion process within each service typically
officials cannot determine if specific work roles are lack the requisite cyber knowledge to make effective
experiencing staffing gaps,” the GAO concluded. Put promotion decisions. A U.S. Army colonel noted that
simply, the services do not know if they have “the right the individuals on service promotion boards struggle
personnel to carry out key missions.”67 to differentiate between “officers with advanced,
skilled degrees in computer science from esteemed
Likewise, there is no system or method to track
institutions” and “those who received online degrees in
individuals with cyber skills as they transition to and
information management. … This is akin to equating
from the services and CYBERCOM. This means a
a brain surgeon with a field medic.”
servicemember may enter with initial training for
a cyber-related career field but could be moved to a It does not have to work this way. The Space Force
non-cyber career track during one of these transitions. provides an illustration. As a first lieutenant in the
Such reassignments stem from the reality that the Air Force explained, the “Space Force gives the best-
services understandably prioritize their unique needs qualified commanders the best-qualified experts (long-
and missions, which may not allow for individual time members who have reached the major, lieutenant
personnel to stay on a cyber-specific track for the colonel, or warrant officer levels), and those experts
duration of their career.68 retain the ability to work a technical role while still
benefiting from career progression.” By contrast, the
Promotion Processes Do Not Reward current promotion system for cyber “robs all highly
Technical Competence technical career fields of their most qualified experts, as
The services determine promotions for their cyber our antiquated career progression system demands they
personnel, but they use systems designed for the go on to command something rather than do their best
non-cyber world. These systems reward command work at the keyboard.”
experience — usually in non-cyber fields — over
technical competence. As a result, the services are
66. Lieutenant Colonel Jeffrey A Couillard, “Cyber Military Force,” National Defense University, April 26, 2023.
Tracking,” December 21, 2022. (https://www.gao.gov/assets/gao-23-105423.pdf )
68. Suzanne Smalley, “Cyber Command’s rotation ‘problem’ exacerbates talent shortage amid growing digital threat,” CyberScoop, August
18, 2022. (https://cyberscoop.com/military-rotation-norms-challenge-cyber-command)
Page 19
The current promotion system creates real risks to Indeed, interviewees for this project cite numerous
U.S. security. In a June 2023 military journal article, examples of senior officers who have little to no
Navy Reserve Lieutenant Commander Eric Seligman experience in the cyber domain — even though
notes that officers without cyber warfare experience the services have had 13 years since the creation of
struggle to assess the risks stemming from cyber CYBERCOM to develop qualified senior leaders. Of
operations. They face decision paralysis, improperly the U.S. military’s more than 45 general and flag officers
staff subordinate positions, and often fail to employ involved in cyber as of summer 2023, fewer than five
technical solutions necessary to achieve operational had any technical experience in the cyber domain.71
and tactical objectives. They also have difficulty
translating doctrine into action, distinguishing CYBERCOM today has promotable talent, but the
good from bad operational and tactical advice, and military is not properly utilizing it. A Marine Corps
predicting enemy maneuvers.69 captain stated that he “personally had career setbacks
because (he) pursued a master’s degree in computer
science instead of a military war-college certificate.”
“Of the U.S. military’s more than 45 general

and flag officers involved in cyber as of summer
The current promotion system creates a vicious cycle.
Potential cyber leaders cannot look to their superiors
2023, fewer than five had any technical for mentorship or wisdom gained from experience
experience in the cyber domain.
” within the domain. Facing disincentives to the further
development of their skills, talented cyber officers choose
other paths or exit the military altogether, depriving
As Seligman argues, a doctrinal and policy-focused the next generation of cyber-experienced leadership.
understanding of cyber warfare is no replacement for
hands-on experience. It would be like an officer who Lack of Administrative, Intelligence,
has “been trained on the concept of the rifle and its and Mental Health Support
potential effects on the enemy” but never actually
fired one.70 Marine Corps officers stand by the tenet, CYBERCOM lacks many of the dedicated support
“Every Marine a rifleman.” No Navy SEAL would functions that other unified combatant commands
follow an officer into battle if that officer did not go enjoy, including foundational intelligence support
through BUD/S training. However, cyber operators for operations, administrative support, and medical
and junior officers today follow the orders of a mostly support, especially for mental health.
inexperienced senior officer cadre. A Marine Corps
Administrative Support
captain concurred, “Leading in the cyberspace domain
demands technical competency that cannot be taught Too often, CYBERCOM’s few qualified cyber operators
in a 12-month schoolhouse alone.” He added, “Under are pulled away from operational responsibilities to
no circumstances would a cyber officer be asked handle administrative functions because the services
to lead a squadron of aircraft, and yet the opposite provide CYBERCOM with inadequate administrative
is often true.” support. “Very few capable analysts can dedicate
a significant amount of time to the operational
69. Eric Seligman, “Changing the Cyber Warfare Leadership Paradigm | Proceedings,” U.S. Naval Institute, June 2023. (https://www.usni.
org/magazines/proceedings/2023/june/changing-cyber-warfare-leadership-paradigm)
70. Ibid.
71. Michael J. Vassalotti, Sofia Plagakis, and Barbara Salazar Torreon, “General and Flag Officers in the US Armed Forces: Background and
Considerations for Congress,” Congressional Research Service, February 1, 2019. (https://sgp.fas.org/crs/natsec/R44389.pdf ); “Leadership,”
U.S. Fleet Cyber Command/U.S. Tenth Fleet, accessed March 9, 2024. (https://www.fcc.navy.mil/LEADERSHIP)
Page 20
mission,” a U.S. Air Force major commented. “Less centers for other warfighting domains, such as the Army’s
than 10 percent of team members have been on the National Ground Intelligence Center or the Navy’s
team for over a year,” placing a significant burden Office of Naval Intelligence. These centers address
on the few experienced analysts to both execute standing intelligence requirements about adversary
operations and train new personnel. The CNMF’s capabilities and strategies. Last year, the outgoing
elevation to a sub-unified command in December commander of CYBERCOM’s Joint Intelligence
2022 partly resolved this issue, but the CNMF is only Operations Center called the absence of a comparable
one-third of the CMF. The other teams continue to center for cyber intelligence a “gaping hole.”74
lack administrative support.
In 2023, CYBERCOM announced it would establish
The administrative burden foisted onto cyber operators a foundational cyber center in partnership with the
undermines talent retention. A 2019 internal survey of Defense Intelligence Agency (DIA) and NSA. In
the U.S. Army Cyber Command workforce found that effect, CYBERCOM attempted to build a service-
“a factor in their decision to leave after their contracts like capability to remediate the gaps stemming
or service obligations expired was their inability to from the absence of an independent cyber service.
focus on the mission or tradecraft (i.e., time spent The final version of the FY 2024 NDAA, however,
on keyboard) due to the constant distractions from did not include the proposed provision to establish
administrative requirements.”72 such a center.75
Intelligence Support If such a center were established, it would likely

suffer staffing shortages unless the United States also
Cyber reconnaissance and targeting support are essential
creates a Cyber Force. The resourcing and staffing for
to the effectiveness of offensive cyber operations
existing intelligence entities usually falls to the parent
but CYBERCOM currently receives inadequate
service. While the DIA (or others) could be charged
intelligence support.73
with managing the center, it would fall to the existing
Like all combatant commands, CYBERCOM does services to provide trained and qualified personnel,
have a Joint Intelligence Operations Center, which who would likely face the same training and skill
provides operational intelligence for force employment. development issues described earlier.
Cyber operations, however, lack a dedicated all-source
Medical Support
cyberspace intelligence center to collect foundational,
ongoing intelligence about adversary cyber capabilities Cyber operators work in intense environments but are
and order of battle. The U.S. military does have such not afforded the same downtime as their counterparts
72. Chad Bates and Charlene Rose, “Understanding—And Fixing—The Army’s Challenge In Keeping Cyber Talent,” Modern War Institute,
May 17, 2022. (https://mwi.westpoint.edu/understanding-and-fixing-the-armys-challenge-in-keeping-cyber-talent)
73. Michael Warner, “Intelligence in Cyber—and Cyber in Intelligence,” Carnegie Endowment for International Peace, October 16, 2017.
(https://carnegieendowment.org/2017/10/16/intelligence-in-cyber-and-cyber-in-intelligence-pub-73393)
74. Alexandra Lohr, “Cyber Command plans an intelligence center to call its own,” Federal News Network, March 1, 2023. (https://
federalnewsnetwork.com/defense-main/2023/03/cyber-command-plans-an-intelligence-center-to-call-its-own)
75. Mark Pomerleau, “Lawmakers nix proposal to create military cyber intelligence capability,” DefenseScoop, December 7, 2023. (https://
defensescoop.com/2023/12/07/congress-nixes-proposal-to-create-military-cyber-intelligence-capability). As noted in the article, while
the conference report on the bill argued that intelligence support “must be substantially improved,” lawmakers did not want to “dictate a
specific organizational solution, but expect the Secretary of Defense to generate and implement one.”
Page 21
in other fields.76 Mental health initiatives exist across A lieutenant colonel in the U.S. Army Reserves, speaking
the DoD, including for Special Operations Forces, from personal experience at the CNMF, observed a
pilots, and operators involved with unmanned aerial “general tension” between the administrative control
flight operations.77 However, there are no programs and operational control commands. “[W]e are forced
for the distinct challenges faced by cyber personnel. to pull servicemembers away from operational tasks to
instead conduct service-related activities … This is a
Without an understanding of the work roles and systemic problem that, in mine and others’ opinions,
tasks of cyber operators, the services (and specific hurts retention, as it undermines morale,” the officer
commanders) may not appreciate the need for mental said. Administrative control commanders “often create
health services. One officer shared his troubling requirements at the expense of the mission. There are
experience: “I think many folks in military cyber have well documented times when units have closed down
been struggling with inexperienced leadership. But joint mission areas en masse to conduct unit events.”
in [my service], those put in charge of cyber units can
be downright hostile to technical cyber officers. For An Air Force major shared a similar experience: “In
example, how about getting retaliated against by your one instance, a group commander required a 12-week
[commanding officer] and your chain of command ‘life skills’ course that taught new airmen how to
simply for going to mental health [treatment]? That cook, how to date, and how to be emotionally healthy.
thing they said in the yearly [general military training] Meanwhile, the mission was manned at less than 60
about how going to mental health won’t affect your percent.” The major said, “Another commander cited
clearance … it happened to me.” an ‘unwritten rule’ stating that he only owed the [NSA]
80 percent of his airmen’s time and the other 20 percent
Service Control and Service-Related belongs to the USAF.”
Requirements Degrade Full Operational In addition to impinging on cyber operators’ time,
Capability the services can also rotate them to different, non-
“Years of investment and training are lost when cyber assignments. As one Army colonel explained,
servicemembers are moved away from the cyber “Upskilling talent is hard, takes years, and as soon as
mission,” a general officer lamented. But because someone reaches a threshold, the service rotates that
the services retain administrative control over cyber person out of the team and back to a service assignment
personnel assigned to CYBERCOM, the services … The demands within the services are continuing to
can pull them out for service-related requirements pull talent away from the CMF.”
unrelated to their cyber roles. This is one important
reason why CYBERCOM was unable to get all 133 The services’ FOC shell game
CMF teams up to FOC status and why it is so difficult By 2018, all the existing CMF teams had officially
for teams to maintain that status. reached FOC, meaning they were supposed to have
sufficiently trained and equipped personnel to execute
76. Jim Garamone, “Cybercom, NSA Senior Enlisted Leader Discusses Troops, Training, and Mental Health,” Defense.gov, May 14, 2019.
(https://www.defense.gov/News/News-Stories/Article/Article/1847532/cybercom-nsa-senior-enlisted-leader-discusses-troops-
training-mental-health)
77. “Preservation of the Force and Family,” Special Operations Command Headquarters, accessed March 9, 2024. (https://www.socom.
mil/POTFF/Pages/mind-mental_health.aspx); U.S. Department of Defense, Press Release, “Department of Defense Mental Health
Resources for Service Members and Their Families,” August 18, 2021. (https://www.defense.gov/News/Releases/Release/Article/2737954/
department-of-defense-mental-health-resources-for-service-members-and-their-fam)
Page 22
their missions.78 Yet fewer CMF teams are actually at a core squad of fully trained people cleverly assigned
FOC than official metrics indicate. to launder the reality that most soldiers were not
fully trained.” This deception “was compounded
First of all, the services have not recruited and trained by unrealistic training timelines.” U.S. Army Cyber
enough cyber personnel to fill 133 teams. As an Army Command “issued demanding deadlines to reach
colonel noted, “The lack of talented personnel to fill FOC, and lower-level commanders would then
the positions on the teams has been and continues force timelines to move even faster — presumably to
to be a severely limiting factor for the overall force. maximize their personal performance evaluations.”
From the onset of U.S. Cyber Command, [the] The result was an “environment that incentivized
services focused on recruiting, retaining, and filling exaggerating how many soldiers and [Cyber
teams to reach fully operational capable (FOC) Protection Teams] were FOC and disguising our
status. Once teams achieve FOC, they often filled numbers to higher headquarters.”
between 67-75 percent capacity.” As a result, teams
that are officially considered to be FOC are not, in Acquisitions Challenges
reality, at 100 percent strength.
Across the U.S. military, it takes an average of 10 to
According to multiple interviewees, proficient cyber 15 years to field a new capability.79 Yet in the cyber
operators are double-counted to make it appear like domain, tools are frequently updated and rendered
all the teams are at full strength. The services “play obsolete within a year or two of development (if not
a shell game [with their] top tier talent,” one Army sooner). Nevertheless, the services continue to enjoy
major warned. “It is a common occurrence that the a preponderant share of the budget and acquisitions
same 50 people are constantly task-organized from authority for cyberspace even though they have
across the force to solve any and all of the command’s not adapted to meet CYBERCOM’s timeline for
hardest problems.” An Army captain gave a similar tool acquisition. Thus, CYBERCOM is stuck with
account of how his service initially brought its cyber out-of-date capabilities and is forced to borrow the
teams up to FOC: “The Army’s rush to get teams to NSA’s tools, explaining why assessments continue to
Full Operational Capability (FOC) was built on a conclude that severing CYBERCOM from the NSA
farcical shell game in which the same personnel were would have detrimental effects.
moved from recently certified teams to new teams
until all teams had certified. Yet few are able to provide
capability if asked.” “Across the U.S. military, it takes an average of
10 to 15 years to field a new capability. Yet in
An Army Reserve major similarly said that U.S. the cyber domain, tools are frequently updated
Army Cyber Command “consistently bent numbers, and rendered obsolete within a year or two of
changed interpretations, and moved soldiers from
team to team, or mission element to mission
development (if not sooner).
”
element, to paint the picture that teams were both
fully manned and fully trained.” In fact, the officer Recognizing this problem, Congress has intervened
said, “most [Cyber Protection Teams] never exceeded several times to grant CYBERCOM greater control over
75 percent of their intended manning and relied on the acquisition of capabilities, resulting in incremental
78. Samuel Souvannason, “Navy Cyber Mission Force Teams Achieve Full Operational Capacity,” U.S. Department of Defense,
November 2, 2017. (https://www.defense.gov/News/News-Stories/Article/Article/1361059/navy-cyber-mission-force-teams-achieve-full-
operational-capability)
79. Jen Judson, “US Army looks to cut typical acquisition timeline in half,” DefenseNews, December 7, 2017. (https://www.defensenews.
com/land/2017/12/07/army-looks-to-cut-typical-acquisition-timeline-in-half )
Page 23
changes to ameliorate this issue. However, this solution and education. This leads to redundant and
runs contrary to civilian oversight of acquisition, which disparate efforts, not effective preparation for joint
services have and CYBERCOM does not. warfighting. As a major in the U.S. Air Force noted,
“The services and the other combatant commands
In the FY 2016 NDAA, Congress granted have taken it upon themselves to acquire their own
CYBERCOM authority for the development, cyber capabilities to meet their needs, resulting in
acquisition, and sustainment of cyber-specific vast duplication and reliance on defense contractors
equipment and capabilities.80 The following year, to provide questionable and often self-serving
Congress amended DoD’s special emergency operational guidance.”
procurement authority to facilitate defense against
and recovery from a cyberattack.81 As a result of Another Air Force major similarly shared:
more recent congressional direction, CYBERCOM
in 2027 will assume “service-like acquisition decision I’ve witnessed vendors sell the same $100M offering
authority” over platforms that the command uses to to two services under a different name so those
conduct cyber operations.82 services could independently lobby for resources.
I’ve witnessed one service sabotage another’s cyber
Since the passage of the FY 2016 NDAA, CYBERCOM operation (both under the same ‘Joint’ Force
has been able to hire some acquisition professionals, Headquarters) simply because that service did not
but it continues to outsource most contracting, as the receive credit. I’ve seen the services’ acquisition
services make the large purchases on its behalf.83 The communities spend over $1B on poorly defined and
director of CYBERCOM’s acquisitions directorate duplicative cyber requirements to deliver tools that
said that since Congress granted the command EBC, will never be used. Every effort to unify resources
he hoped to hire 40 people in 2023 and up to another and address national priorities is undermined and
50 in 2024. But this is still a fraction of the personnel resisted by the services who perceive no benefit to
required to manage a $3 billion budget. In comparison, their domains.
the Army boasts that its acquisition workforce “is
composed of approximately 32,000 civilian and All of this ultimately reduces force readiness. Without
military professionals,”84 or about one person for every the correct equipment, even the best-trained cyber
$6 million of discretionary budget. warrior cannot be effective in conflict. Moreover,
the ongoing effort to transfer acquisition authority
Despite CYBERCOM’s acquisition authorities and to CYBERCOM, while borne out of a legitimate
EBC, the lion’s share of funding for cyberspace frustration with the status quo, will result in the
activities remains with the services. The services, removal of traditional civilian oversight of acquisition,
however, lack a unified process for spending money which only the services can provide.
on cyber-related capabilities, equipment, training,
80. National Defense Authorization Act for Fiscal Year 2016, Pub. L. 114-92, 129 Stat. 886, §807. (https://www.congress.gov/114/plaws/
publ92/PLAW-114publ92.pdf )
bill/114th-congress/senate-bill/2943)
83. Mark Pomerleau, “Cyber Command looking to bolster acquisition office as it prepares to handle $3B annually,” FedScoop, July 27,
2022. (https://fedscoop.com/cyber-command-looking-to-bolster-acquisition-office-as-it-prepares-to-handle-3b-annually)
84. “Officers in the Army Acquisition Workforce,” United States Army Acquisition Support Center, accessed March 9, 2024. (https://asc.
army.mil/web/career-development/military-officer/information)
Page 24
Counterarguments streamlining these transfers, the Space Force acquired

more than 13,000 servicemembers and civilians in its
to Establishing a U.S. first two years.87
Cyber Force Counterargument 2: The Space

Some experts who acknowledge the force-generation Force should be responsible for force
challenges facing CYBERCOM nevertheless oppose generation for cyberspace.
the creation of a Cyber Force.85 They offer four
Some commentators argue that DoD should combine
main arguments against creating an independent,
cyber and space operations under the control of the
uniformed cyber service.
Space Force. Those who favor this position tend
to believe a service’s value is based at least in part
Counterargument 1: A Cyber Force will on its size. At present, the Space Force is small but
negatively impact readiness in the short set to grow from 8,400 to 16,000 uniformed and
term and create budgeting and personnel civilian Guardians and may continue to grow based
problems for the other services. on the importance of space operations.88 More to
the point, however, this critique ignores the fact that
This critique posits that creating a Cyber Force would a small number of highly skilled operatives can be
deprive the services of critical personnel. Transferring effective in cyberspace.
capable IT and cybersecurity professionals now focused
on network architecture and the defense of internal The argument also presumes an inherent link
service systems to the Cyber Force would leave the between space and cyberspace. Space assets, such
services bereft of skilled personnel. However, shifting as communications satellites, indeed serve a critical
only CMF billets, which do not include the services’ function in the transmission of information. Likewise,
IT and cybersecurity personnel, would render this many ground operations and weapons systems are
potential issue moot. also dependent on space assets, but this does not
mean the Space Force should train personnel for
A related objection argues that transitioning ground operations. As distinct operational domains,
personnel and budgets to the Cyber Force from space and cyberspace have unique “man, train, and
multiple services would impose an insurmountable equip” requirements.
administrative burden. Prior to the establishment of
the Space Force, the preponderance of space-related Counterargument 3: The SOCOM
personnel and investments were already housed
within the Department of the Air Force. But cyber-
model is a better fit for cyberspace
focused personnel and funding are currently much than a Cyber Force.
more dispersed.86 While this is true, all services Perhaps the most common counterargument to
have existing methods for inter-service transfers. By the creation of a Cyber Force is that CYBERCOM
85. See, for example, Military Cyber Professionals Association, “HammerCon 2023: US Cyber Force Panel (Schafer, Cleary, Franz, and
Montgomery),” June 13, 2023. (https://www.youtube.com/watch?v=CUYfjnlXGDk)
86. Sandra Erwin, “U.S. Air Force to transfer 23 units to the Space Force,” SpaceNews, March 31, 2020. (https://spacenews.
com/u-s-air-force-to-transfer-23-units-to-the-space-force)
87. Bryan Bender, “What the Space Force is, and isn’t,” Politico, February 3, 2021. (https://www.politico.com/news/2021/02/03/
space-force-explained-465799)
88. David Ignatius, “The Space Force needs to get bigger,” The Washington Post, August 22, 2023. (https://www.washingtonpost.com/
opinions/2023/08/22/us-space-force-military-pentagon-competition)
Page 25
should apply the SOCOM model to cyberspace — However, there are no land, sea, or air-specific cyber
notwithstanding SOCOM’s own growing pains over functions that only particular services can provide.
its 30-year history.89 However, while SOCOM and As one U.S. Navy captain noted, SOCOM’s “success
CYBERCOM both possess highly skilled operators, is achieved by allowing each of the service-specific
they are otherwise very different. commands to specialize in discrete types of warfare,
technologies, and operational environments.” By
In the SOCOM model, each of the services provides contrast, as a retired Navy captain noted, “Cyberattacks
the force employer — SOCOM — with expert will not be, nor are they currently, service-specific
personnel who possess skills suited to their particular nor sector-specific, so it does not make sense to
domain. For instance, an Army Ranger trains for have created service-specific mission teams, different
special operations on land, while Navy SEALs possess designators, MOSs, etc., to respond to the broad scale
skills tailored to maritime special operations. Rangers of cyberattacks.”
and SEALs are not interchangeable. The Army
cannot train SEALS, nor the Navy Rangers. Thus, A side-by-side comparison of the SOCOM and CMF
SOCOM actually gains strength from this one-of-a- structures depicts two wholly different organizational
kind distributed force-generation model. architectures, as illustrated in figures 3 and 4. SOCOM’s
Figure 3: SOCOM Structures
Subunified
Special Operations Special Operations Special Operations
Commands Command Central Command Korea Command Pacific
Theater Special
Operations Command
Special Operations Special Operations Special Operations Special Operations

Command Africa Command Europe Command North Command South
United States Special Joint Special

Operations Command Operations Command
U.S. Marine Corps Forces U.S. Marine Corps Forces

U.S. Army Special U.S. Naval Special
Special Operations Special Operations
Operations Command Warfare Command
Command Command
Service Component Commands
89. Christopher E. Paul and Michael Schwille, “The Evolution of Special Operations as a Model for Information Forces,” National Defense
University Press, Joint Force Quarterly 100, February 10, 2021. (https://ndupress.ndu.edu/Media/News/News-Article-View/Article/2497069/
the-evolution-of-special-operations-as-a-model-for-information-forces)
Page 26
organization into many sub-unified commands and these challenges unavoidable, yet the U.S. military
geographic commands does not reflect the requisite has a better option for cyber force generation.
structure of CMF and its component parts.
Counterargument 4: CYBERCOM should
SOCOM has also faced the same challenges as
CYBERCOM regarding drawing personnel from
absorb many of the man, train, and equip
disparate services. The services’ inconsistent definitions responsibilities from the services.
of overlapping skill sets create incompatibility. This
Rather than creating a Cyber Force, some argue that
makes interoperability challenging, particularly in
CYBERCOM should evolve to absorb the force-
dynamic, high-operational-tempo environments.
generation responsibilities from the other services.
Although the defense community is largely content
This approach would be tantamount to carving out
with the way SOCOM is organized, led, and
an exception for cyber-related military matters from
operated, a GAO report from October 2022 noted
the 1986 Goldwater-Nichols Act, the landmark
that SOCOM has its own challenges concerning
legislation that drew the line between force generation
oversight and command and control.90 For SOCOM,
and force employment.
a dependence on multiple services makes some of
Figure 4: CMF Structures
National Mission
Consists of Teams
Cyber Combat
Mission Force
National Support
Teams
Co
n
sis
Cyber National
ts
of
Mission Force
Headquarters
Directed by
National CPTs
Directed by Joint Force

DODIN CPTS
Consists of Cyber Headquarters DODIN
Cyber Mission Consists of
Protection
Force
Force Directed by
CCMD CPTS Combatant Commands
Directed by
Service PTs
Service
Cyberspace
Component
Commands
Combat Mission Directed by

Teams Joint Force
Cyber National
Headquarters -
Mission Force
Combat Support Cyberspace
Teams
90. Government Accountability Office, “Special Operations Forces: Better Data Necessary to Improve Oversight and Address Command
and Control Challenges,” October 2022. (https://www.gao.gov/assets/gao-23-105163.pdf )
Page 27
In this scenario, the commander of CYBERCOM What Should a

would become responsible for military cyber force
generation and force employment in addition to his Cyber Force Look Like?
or her duties as head of the NSA. While the dual-
hatted structure for CYBERCOM and the NSA Many of the challenges outlined in the section above
was initially intended to be temporary, it remains could only be solved or at least significantly mitigated
advantageous, as concluded by a December 2022 through the creation of the Cyber Force as the force
study led by General (Ret.) Joseph Dunford, former generator for the cyber domain. CYBERCOM
chairman of the Joint Chiefs of Staff.91 The study, would remain the force employer. This new Cyber
however, conceded that simultaneously leading Force could be located within the Department of
both organizations is a significant amount of work the Army, just as the Marine Corps is housed within
for one individual. Adding what would effectively the Department of the Navy and the Space Force sits
be a third hat — force-generation responsibilities within the Department of the Air Force.
— would leave the commander less time for
the other two, or even force DoD to sever NSA Standing up this new service would be relatively
from CYBERCOM. straightforward. Initially, the Cyber Force would
Figure 5: Initial Billets of a New Cyber Force
COF Cyber Force Non-COF
DoD Business
Function Elements
CYBERCOM Cyber Force Service-Retained Forces,

Subordinate Support Staﬀ such as Air Force Mission
Elements Defense Teams or
Army Tactical Signal
Battalions/Brigades
Cyber Cyber Force
Mission Training and
Development
Force Centers Joint Cyber Centers
DoD Component
Network Operations
Centers and Intelligence Units and Personnel
Cybersecurity
Providers
SOCOM-assigned forces
Some Personnel Trained and Equipped by Cyber Force,

Trained and Equipped by Cyber Force Trained and Equipped by the Other Services
Some by the Other Services
91. Ellen Nakashima and Tim Starks, “NSA, Cyber Command should continue to share a leader, a key review suggests,” The Washington Post,
December 22, 2022. (https://www.washingtonpost.com/politics/2022/12/22/nsa-cyber-command-should-continue-share-leader-key-review
-suggests)
Page 28
encompass the billets that currently comprise the roles even though it requires highly technical and skilled
CMF: a 6,200-person mission group consisting of personnel.93 At a leadership level, the Space Force’s
servicemembers, civilians, and contractors (see Figure 5).92 establishment mostly required the lateral transfer of
Beyond the CMF, the Cyber Force could also absorb personnel from Air Force Space Command.94 The Space
a select number of billets for cyberspace operators that Force, which currently has 8,400 billets, attributes
currently fall within the SOCOM enterprise. much of its recruiting success to being small, agile, and
selective with applicants. Its leaders understand they
In addition, the Cyber Force would require the transfer do not need to mimic the larger services.95 To boost
(or addition) of support staff billets and infrastructure. recruitment, the service has also taken advantage of
The services would likely need to retain some cyber opportunities for the direct commissioning of civilians
support staff, but a percentage of the cyber-specific with requisite skills for space.96
force-generation billets from each of the services would
transfer to the Cyber Force, particularly those necessary Most importantly, the creation of a Cyber Force would
for Cyber Force training institutions. And some Cyber not require an extensive or complex shuffle of personnel,
Force recruitment of existing servicemembers would be and the services would retain defensive cyber personnel
necessary to fill the remaining gaps in support staff. This and IT infrastructure management capabilities for
shift, however, should not strain the resources of any the DoD information networks (DODIN). The
one service. In total, the Cyber Force would probably creation of a Cyber Force, however, would preclude
initially comprise approximately 10,000 personnel, service-retained personnel from conducting offensive
although this number would likely grow over time as cyberspace operations. Figure 6 illustrates proposed
cyber threats continue to expand. responsibilities of the Cyber Force and the services.
The Cyber Force could draw on lessons from the Space An initial budget for the Cyber Force would be
Force, which has encountered few issues filling its new approximately $16.5 billion, a fraction of the
Figure 6: Proposed Responsibilities for the Cyber Force and the Services
U.S. Cyber Force Responsibilities Service-Retained Responsibilities
Man, train, equip for offensive cyberspace operations
Man, train, equip for defensive cyberspace operations clearly linked to

Man, train, equip for defensive cyberspace operations
traditional service warfighting competencies
Man, train, equip for the portion of the DoD Information Networks Man, train, equip for the portions of the DODIN owned and operated
(DODIN) owned and operated by Cyber Force owned and operated by the other services
Man, train, equip for the build/operation/maintenance/defense of Man, train, equip for the build/operation/maintenance/defense of
Cyber Force IT infrastructure service-retained IT infrastructure
92. U.S. Cyber Command Public Affairs, “Cyber 101 – Cyber Mission Force,” U.S. Cyber Command, November 1, 2022. (https://www.
cybercom.mil/Media/News/Article/3206393/cyber-101-cyber-mission-force)
93. Lauren C. Williams, “Recruiting Crisis? Not at Space Force,” Defense One, December 2, 2022. (https://www.defenseone.com/
policy/2022/12/recruiting-crisis-not-space-force/380369)
94. “People,” U.S. Space Force, accessed January 8, 2024. (https://www.spaceforce.mil/About-Us/About-Space-Force/USSF-People)
95. Leo Shane III, “Space Force eyes easing enlistment rules to target high-demand skills,” Air Force Times, September 13, 2022. (https://
www.airforcetimes.com/news/pentagon-congress/2022/09/13/space-force-eyes-easing-enlistment-rules-to-target-high-demand-skills)
96. Air Force Recruiting Service, “Constructive Service Credit now offered to applicants for two Space Force career fields,” U.S. Space Force,
October 28, 2022. (https://www.spaceforce.mil/News/Article/3205270/constructive-service-credit-now-offered-to-applicants-for-two-space-
force-caree)
Page 29
hundred-billion-dollar budgets of the Army, Navy,

and Air Force. This estimate includes DoD’s current
allocation for the cyberspace activities budget ($13.5
billion), minus the cybersecurity investments from
the services ($511 million). The budget estimate
also includes the resources currently carved out for
CYBERCOM under EBC (about $2.9 billion), the
military personnel funds ($624.25 million), and
training resources.97 An apt comparison is the budget During a visit to Navy Information Operations Command
for the Space Force, for which DoD requested $30 Pensacola, then deputy commander of U.S. Cyber Command
billion for FY 2024.98 Lt. Gen. Timothy Haugh, engaged in cyber discussions with
Sailors on Oct. 12, 2023. (U.S. Navy photo by Petty Officer
While the other services may see a slight reduction Third Class Leonell Domingo)
in their budgets after the creation of a Cyber Force, A Cyber Force would also facilitate the establishment
most of the decrease would come from a reduction of more robust legal principles for cyberspace. Military
in cyber force generation costs thanks to efficiencies leaders and commanders have long required legal
from eliminating redundancies. The Cyber Force advisors for the specific domains in which they operate.
would consolidate the acquisitions process specifically The DoD legal community, in turn, has training,
for operational capabilities. It should not, however, education, and experience tracks to develop attorneys
become the IT and communications service provider who deliver this legal support. Yet unlike land, sea,
for the services, a role that would distract it from air, and space, cyberspace is an interdependent global
operational priorities.99 domain, entirely human-made, and consists largely
of privately owned and operated systems. The current
Creating a Cyber Force would also benefit the reliance on non-cyber lawyers serves U.S. cyber
NSA.100 A quarter of the NSA’s workforce comprises operations poorly.
active-duty military units, currently provided by the
services. However, these units are not held accountable If done properly, the overall readiness of the military’s
for successfully serving the NSA’s mission. With a cyber forces should not suffer during a transition to
Cyber Force focused on delivering well-trained cyber an independent Cyber Force. Instead, cyber forces
personnel, the NSA would, in turn, receive more, high- would gain more operational focus and direction while
quality, human resources. consolidating acquisition processes and maximizing
budgetary effectiveness.
97. Estimates do not include the cyberspace activities from SOCOM-aligned units/components. U.S. Department of Defense, “Fiscal Year
2024 Budget Estimates United States Cyber Command,” March 2023. (https://comptroller.defense.gov/Portals/45/Documents/defbudget/
fy2024/budget_justification/pdfs/01_Operation_and_Maintenance/O_M_VOL_1_PART_1/CYBERCOM_OP-5.pdf )
98. U.S. Department of Defense, “Fiscal Year (FY) 2024 Budget Estimates. Operation and Maintenance, Defense-Wide,” March 2023.
(https://comptroller.defense.gov/Portals/45/Documents/defbudget/fy2024/budget_justification/pdfs/01_Operation_and_Maintenance/
O_M_VOL_1_PART_1/OM_Volume1_Part1.pdf )
99. On issues of equipment and capabilities, Cyber Force should be responsible only for Deployable Mission Support Systems, a stand-alone
cyber technology suite based upon an approved USCYBERCOM hardware/software baseline designed to enable the core CPT functions of
hunt, clear, harden, and assess. Commander, Naval Information Forces, Press Release “DMSS on Deck,” September 26, 2022. (https://www.
navifor.usff.navy.mil/Press-Room/Press-Releases/Article/3169924/dmss-on-deck)
100. Michael Warner, “US Cyber Command’s First Decade,” Hoover Institution, 2008. (https://www.hoover.org/sites/default/files/
research/docs/warner_webready.pdf ); Mark Pomerleau, “Key lawmakers in favor of keeping ‘dual hat’ arrangement between Cybercom
and NSA,” DefenseScoop, November 17, 2022. (https://defensescoop.com/2022/11/17/two-key-lawmakers-in-favor-of-keeping-dual-hat-
arrangement-between-cybercom-and-nsa)
Page 30
Conclusion promised expansion of the CMF, and the delivery of

EBC do not address major underlying force-generation
Years after designating cyberspace as a warfighting problems. U.S. policymakers must acknowledge the
domain, leaders must acknowledge the writing on the difficult reality that the military has tried and failed to
wall. The scope and scale of cyber threats are growing. salvage the status quo.
Cyberspace plays a central role in China’s strategy as the
“pacing threat” for the United States. China has already This failure stems from the basic fact that non-cyber
centralized its cyber, space, electronic warfare, and services are responsible for cyber force generation.
psychological warfare capabilities within its Strategic The solution is to create an independent, uniformed
Support Force. Russia is actively leveraging cyber Cyber Force. While many experts have long called
operations both on the battlefield and to threaten U.S. for the creation of an independent Cyber Force,102
critical infrastructure and interfere in American politics. policymakers should especially listen to the voices of
those servicemembers with direct, extensive operational
Conventional wisdom holds that the U.S. military is experience. The numerous first-hand accounts
well positioned to dominate in the cyber realm given highlighted in this monograph offer a compelling
CYBERCOM’s current resources, capabilities, and testament to the need for an independent service
authorities. However, recent congressionally mandated for cyberspace.
studies,101 independent analyses and audits, and the
accumulated personal accounts from current and The United States has a limited window of opportunity
retired servicemembers demonstrate otherwise. to reorganize, allocate resources, and develop
sustainable cyber force readiness. The U.S. military has
Previous attempts to increase U.S. cyber force failed to fix the problem on its own. Only Congress
readiness have failed. Measures such as the elevation of can create a new independent service, so it is time for
CYBERCOM to a unified combatant command, the lawmakers to act.
101. John Plumb, “Testimony Before House Armed Services Committee,” March 30, 2023. (https://armedservices.house.gov/sites/
republicans.armedservices.house.gov/files/Plumb%20Testimony.pdf )
102. James Stavridis, “The US Military Needs to Create a Cyber Force,” Bloomberg, March 8, 2023. (Archived version available at https://
web.archive.org/web/20230311100830/https://www.washingtonpost.com/business/2023/03/08/the-us-needs-a-seventh-branch-of-the-
military-cyber-force/aa72d5dc-bdab-11ed-9350-7c5fccd598ad_story.html)
Page 31
Appendix A: Select Quotations from Interviews

The following are illustrative excerpts from more than General Officer, U.S. Military
130 pages of interviews with 76 active-duty and recently
separated servicemembers and Defense Department “Our current strategy of relying on the existing Services
civilians about cyber readiness, CYBERCOM, and the to build the cyber expertise and capabilities required is
challenges they have encountered. These interviews inefficient, ineffective, and unlikely to succeed despite
were collected over the course of the past year and speak years of investment and the best efforts of our service
to the significant challenges discussed throughout this members. Without a doubt, the only viable path
monograph. The authors have chosen not to disclose forward for USCYBERCOM is to establish a new
the full remarks to protect the individuals who agreed Service focused on organizing, training, and equipping
to share their personal experiences. forces required to fight — and win — in cyberspace.”
Thirty-four percent of the interviewees came from the “Years of investment and training are lost when service
U.S. Army, 30 percent from the U.S. Navy, and 26 members are moved away from the cyber mission.
percent from the U.S. Air Force. A small number of Complicated and inconsistently applied incentive
accounts also come from the Marine Corps, Space Force, programs result in retention issues.”
and DoD civilians. Most of the accounts (61 percent)
“Differences in training also impact USCYBERCOM’s
came from officers with ranks of O-4 to O-6. Another
ability to conduct operations.”
26 percent come from officers with ranks of O-3.
Notably, one interview is with a general officer (O-7).
Colonel, United States Air Force
Figure 7: The Service of Interviewees “In aggregate, we see a combatant command spending
an inordinate amount of time executing Service-
1
3
3
like responsibilities at the expense of its primary
Army | 34.2% responsibilities to defend the [Department of Defense
Navy | 30.3% Information Networks], provide support to combatant
26
20 Air Force | 26.3% commanders for execution of their missions around
Marines | 3.9% the world, and strengthen our nation’s ability to
Space Force | 1.3% withstand and respond to cyber-attack. Instead,
Civilian | 3.9% we have a Department of Defense with no single
service incentivized to put cyberspace operations at
23
the forefront.”
Figure 8: The Rank of Interviewees “If you look [at] who leads cyberspace operations in
the Department of Defense, they are not typically
3
1 2 1
6
O7 | 1.3% grown from within the cyberspace operations force.
3 O6 | 7.9% Cyber leaders should lead cyberspace operations and
O5 | 22.4% represent cyberspace operations in joint warfighting.
17 O4 | 30.3% We need ‘cyber minded’ leaders.”
20 O3 | 26.3%
O2 | 3.9% Colonel, United States Army
Chief Warrant Officer | 1.3%
E7 | 2.6%
“Having been on both the inside and outside of the
23
Civilian | 3.9%
Cyber Mission Force since it was first established, the
Page 32
lack of talented personnel to fill the positions on both … Applying the USCYBERCOM methodology to
teams has been and continues to be a severely limiting air warfare would be akin to requiring every service to
factor for the overall force.” operate the same aircraft, to accomplish every aspect of
air warfare, in every operational environment.”
“In fact, it was once found that about 10% of
the personnel execute as much as 80% of the
operational missions.” Captain, United States Marine Corps
[On the subject of officers sitting on promotion “Leading in the cyberspace domain demands technical
boards] “Officers with advanced, skilled degrees in competency that cannot be taught in a twelve-month
computer science from esteemed institutions are schoolhouse alone. One of my worst professional
equated with those who received online degrees in experiences involved working underneath a woefully
information management; they are given no additional unprepared commander with a degree in culinary
consideration for their knowledge, skills, or abilities arts … Under no circumstances would a cyber officer
and are disadvantaged. This is akin to equating a brain be asked to lead a squadron of aircraft, and yet the
surgeon with a field medic.” opposite is often true.”
Captain (Ret.), United States Navy Major, United States Air Force
“The development of service-specific cyber specialty “I’ve witnessed vendors sell the same $100M offering
fields without dedicated senior level commitments has to two services under a different name so those services
yielded varying levels of fragmented support to cyber could independently lobby for resources. I’ve witnessed
operations, lack of continuity of cyber personnel, one service sabotage another’s cyber operation (both
unclear career paths, insufficient experience, wide use of under the same ‘Joint’ Force Headquarters) simply
noncyber personnel in cyber leadership positions, and because that service did not receive credit. I’ve seen
cyber operations being treated always as a supporting the services’ acquisition communities spend over $1B
entity across all services.” on poorly defined and duplicative cyber requirements
to deliver tools that will never be used. Every effort
“[C]yber attacks will not be nor are they currently to unify resources and address national priorities is
service-specific nor sector-specific, so it does not make undermined and resisted by the services who perceive
sense to have created service-specific mission teams, no benefit to their domains.”
different designators, MOSs, etc., to respond to the
broad scale of cyber attacks.” Colonel (Ret.), United States Army
Captain, United States Navy “I’ve seen senior warfighting leaders dismissively call
cyber research ‘book reports,’ cyber operators ‘nerds,’
“[United States Special Operations Command]’s and cyber capability development ‘science projects.’
success is achieved by allowing each of the service These … leaders who make critical cyber operational,
specific commands to specialize in discrete types of resource allocation, and risk assessment decisions
warfare, technologies, and operational environments. control promotions to choose people that look
USSOCOM picks the ‘best athlete’ depending on the like themselves.”
operational outcome they are trying to achieve.”
“USCYBERCOM assigns the military services … Lieutenant Colonel,
essentially requiring every team to master every aspect United States Marine Corps
of cyber warfare to successfully operate against their
“I can’t speak for the other services, but I perceive
assigned target. This methodology is completely out of
a lack of career progression for cyber officers in the
sync with the way the rest of the DoD is constructed
Marine Corps. I commanded a Combat Mission
Page 33
Team and am fully qualified to join the cyber field told me ‘Someday you can change things; when
but decided not to apply for the specialty because of you’re a general.’ They didn’t know what that really
the limited command opportunities.” communicated to me.”
Lieutenant Colonel, Commander, United States Navy

United States Air Force “The core of the issue facing the broader [Cyberspace
“[Headquarters, Air Force] has commissioned multiple Operations Forces] is the lack of a single service
RAND studies on cyber force structure, then ignores designed to man, train, equip, and manage the careers
the key recommendations.” of a full cadre of Cyber Operations professionals.
The current construct of the military services is not
“Few, if any, qualified offensive cyber operators have conducive to developing, retaining, and advancing a
graduated to positions of command, Colonels, and highly trained Cyber Force. Each service is focused on
Generals. This is comparable to an Air Force in which being proficient in and advancing those servicemembers
none of the Colonels and Generals have ever been who excel in their respective warfighting domains (sea,
qualified pilots.” air, and land).”
“Coupling Goldwater-Nichols and the fact that the
USAF doesn’t see ‘cyberspace operations’ as one of its Captain, United States Army
core missions, [the U.S. Air Force] will likely continue “It is important to highlight the issues in Cyber are
to deprioritize developing and promoting leaders to not solely because of problems within the Army. A
achieve DoD objectives in and through cyberspace.” lack of joint command vision regarding the separation
[USAF removed “cyber” from the Air Force Mission of roles and responsibilities between USCC and the
Statement in 2021.] NSA, for example, has led to significant confusion and
constantly changing direction regarding what problems
Captain, United States Air Force the command is required to solve.”
“Not for more money or flexibility — I always
understood the military couldn’t match industry here, Major, United States Air Force
but that’s not why anybody I knew joined the military. “In short, the Air Force values breadth over technical
I left for the same reason as many others: when you feel depth and meeting requirements on paper versus
your organization keeps you from making an impact building and enabling true technical talent. When
on the mission and you can’t change the organization, I arrived at Keesler AFB for my initial skills training
then you either have to stop caring so much or leave. I as a cyber warfare officer, I was ecstatic. I was finally
saw two primary things holding the Air Force back that going to be a part of the force responsible for the slogan
it would not fix. I believe it will require a separate cyber ‘it’s not science fiction, it’s what we do every day.’ I
service to address these problems: One, organizationally expected training and equipment that would enable
the Air Force lacks understanding of the cyber domain, me to contribute to homeland defense or project
and, two, it has failed to take cyberspace operations power in current conflicts around the globe. The reality
seriously as a warfighting discipline.” was very basic training which was worse than most
“During my career, I learned that making cyber industry offerings and equipment worse than what I
operations look like the rest of the Air Force was had purchased for myself to use at home. Additionally,
more important than mission success. For the sake of the training itself was disjointed and lacked focus -
the mission and the people, we need a separate cyber covering everything from space-based platforms to
service and we must understand that lives depend loading pallets with only a few weeks of actual offensive
on operational success in cyberspace. A general once or defensive cyber training.”
Page 34
Appendix B: Historical Case Studies: The Air Force and Space Force
In the past, when the DoD has faced force-generation Board’s recommendation. The National Security Act of
or force-employment challenges, the U.S. military has 1947 established the U.S. Air Force as an independent,
undergone significant reorganization. uniformed service, 30 years after Congress began
documenting officers raising that the domain could not
World War I firmly demonstrated the ability of aircraft be effectively handled by the compartmentalized efforts
to “impact an enemy beyond a depth that could be of the U.S. Army and U.S. Navy.
readily imagined by those operating in [land and sea].”103
After the war, the War Department (the predecessor to In 1982, the Air Force established the first Air
DoD) and congressional leaders began to evaluate the Force Space Command. In 1985, the United States
implications of flying for future military operations and established a unified U.S. Space Command,106 tasked
subsequently renamed the Air Service the U.S. Army Air with coordinating Army, Naval, and Air Force space
Corps. While the Corps was not an independent service, forces and providing “space-based missile warning,
it “strengthen[ed] the conception of military aviation communications, navigation, weather, and imagery
as an offensive, striking arm rather than an auxiliary capabilities.”107 The 2001 Rumsfeld Commission first
Service.”104 Each service began investing in its own proposed the establishment of a Space Force.108 But a year
aviation capabilities. later, DoD disbanded the U.S. Space Command and
gave its responsibilities to U.S. Strategic Command.109
During the interwar period, multiple boards examined
the country’s readiness for, and resources dedicated Over the next 16 years, however, DoD leaders began to
to, military flying missions. Most notably, the 1919 recognize that no one military entity was placing sufficient
Menoher Board found the “best way to take advantage emphasis on space security. China’s demonstration of
of the new technology in aviation was to create a new its anti-satellite capabilities, along with other threats,
military organization.”105 ignited conversations among policymakers that mirrored
those prior to the establishment of the Air Force.110
By the end of World War II, air power had emerged as DoD leaders also began realizing that U.S. Strategic
a pivotal force, affirming the wisdom of the Menoher
103. John Venable, “How the Air Force Got Its Start 72 Years Ago,” Heritage Foundation, September 18, 2019. (https://www.heritage.org/
defense/commentary/how-the-air-force-got-its-start-72-years-ago)
104. “1926 – The US Army Air Corps Act,” Air Force Historical Support Division, accessed March 9, 2024. (https://www.afhistory.af.mil/
FAQs/Fact-Sheets/Article/459017/1926-the-us-army-air-corps-act)
105. Dr. James P. Tate, “The Army and Its Air Corps: Army Policy Toward Aviation 1919-1941,” Air University Press, June 1998. (https://
media.defense.gov/2017/Apr/07/2001728467/-1/-1/0/B_0062_TATE_ARMY_AIR_CORPS.PDF)
106. Benjamin S. Lambeth, “A Short History of Military Space,” Air & Space Forces Magazine, December 1, 2004. (https://www.
airandspaceforces.com/article/1204space)
107. Frank A. Rose, “Re-establishing US Space Command is a great idea,” Brookings Institution, January 7, 2019. (https://www.brookings.
edu/blog/order-from-chaos/2019/01/07/re-establishing-u-s-space-command-is-a-great-idea)
108. Marcia S. Smith, “Military Space Activities: Highlights of the Rumsfeld Commission Report and Key Organization and Management
Issues,” Congressional Research Service, February 21, 2001. (https://digital.library.unt.edu/ark:/67531/metadc806331/m2/1/high_res_d/
RS20824_2001Feb21.pdf )
110. Everett Carl Dolman, “New Frontiers, Old Realities,” Strategic Studies Quarterly, Spring 2012. (https://www.airuniversity.af.edu/
Portals/10/SSQ/documents/Volume-06_Issue-1/dolman.pdf ); Terri Moon Cronk, “Space-Based Capabilities Critical to US National Security,
DOD Officials Say,” DOD News, May 24, 2021. (https://www.defense.gov/News/News-Stories/Article/Article/2629675/space-based-
capabilities-critical-to-us-national-security-dod-officials-say); Tom Roeder and Tony Peck, “Space Force: A timeline of change,” The Gazette,
July 26, 2018. (https://gazette.com/military/space-force-a-timeline-of-change/article_44285b42-7573-11e8-b983-e3bc886964a1.html)
Page 35
Command’s responsibilities were becoming “too big for for force employment in space. In the FY 2020 NDAA,
one combatant commander to manage.”111 Congress then established an independent U.S. Space
Force to man, train, and equip personnel for U.S. Space
In 2008, Congress commissioned the Institute for Command. Articulating the connection between these
Defense Analyses to write a report on “Leadership, two entities, then commander of U.S. Space Command
Management, and Organization for National Security Air Force Gen. John “Jay” Raymond noted, “U.S. Space
Space.” It highlighted the need for a greater number of Command will only be as strong as the capabilities it is
operators who are “steeped in space.”112 Over the next provided by the United States Space Force.”113
decade, the U.S. military increased its capabilities in space
and focused on specializing organizational, acquisitions, Ultimately, it took congressional intervention to
and personnel training structures. establish independent uniformed services for air and
space. Congressional intervention is again needed to
In December 2018, President Donald Trump signed an address the significant readiness challenges stemming
executive order authorizing DoD to reinstate U.S. Space from the current organization and structure of
Command as a unified combatant command responsible U.S. cyber forces.
Figure 9: The Space Force vs. Space Command
What It Is What It Does Composition
Provides the people

and technology
A military service that protect the
SPACE that trains members
and acquires
space-enabled
advantages (GPS,
Only
Space Force
FORCE systems for specific communications, members
warfighting areas. etc.) on which
America and
its allies rely.
A combat command
that uses the military
SPACE services’ people
and technology to
Plans, operates, and
directs the forces for
Members from all
service branches
COMMAND conduct worldwide space warfighting.
operations in times
of war and peace.
112. A. Thomas Young, Edward Anderson, Lyle Bien, Ronald R. Fogleman, Keith Hall, Lester Lyles, and Dr. Hans Mark, “Leadership,
Management, and Organization for National Security Space,” Institute for Defense Analyses, July 2008. (https://aerospace.csis.org/
wp-content/uploads/2018/09/AllardCommission.pdf )
113. Jim Garamone, “Trump Signs Law Establishing US Space Force,” DoD News, December 20, 2019. (https://www.defense.gov/News/
News-Stories/Article/Article/2046035/trump-signs-law-establishing-us-space-force)
Page 36
Appendix C: The History of U.S. Information Operations

and the Creation of CYBERCOM
The concept of “cyber” in the military lexicon did not marked the “first large-scale cyberespionage attack by a
appear until well after the military established doctrinal well-funded and well-organized state actor.”117 The next
concepts for information operations, psychological year, the Joint Chiefs of Staff defined cyberspace as a
operations, and computer network operations warfighting domain.118 DoD released its first National
(both offensive and defensive).114 Information and Military Strategy for Cyberspace Operations in 2006.119
psychological operations have been around for centuries,
long predating wired and wireless communications. Two years prior to that strategy’s release, DoD
The notion that computer networks could multiply the reorganized JTF-CNO under U.S. Strategic
effects of these operations, however, began to take hold Command. The Joint Task Force-Global Network
in the late 1980s and early 1990s. As DoD became Operations (JTF-GNO) handled cyber defense,
more dependent on information systems for command and the Joint Functional Component Command-
and control, it created the Joint Task Force-Computer Network Warfare (JFCC-NW) handled offensive
Network Defense in 1988. After the Gulf War, during missions. However, after additional significant cyber
which the U.S. military exploited technological espionage campaigns by U.S. adversaries, DoD
advantages to ensure fast, efficient battlefield combined the two and established CYBERCOM
victories,115 the task force evolved into the Joint Task as a sub-unified combatant command under U.S.
Force-Computer Network Operations (JTF-CNO).116 Strategic Command in 2010, led by a commander
dual hatted as the director of NSA. CYBERCOM
The U.S. military began developing cyber doctrine in was tasked with “direct[ing], synchroniz[ing], and
earnest in 2003 following the discovery of “Moonlight coordinat[ing] cyberspace planning and operations to
Maze,” a multi-year Russian cyber espionage operation defend and advance national interests in collaboration
against U.S. systems. This campaign, which stole with domestic and international partners” as well as
sensitive documents from U.S. government agencies,
114. U.S. Cyber Command, Public Affairs, “Cyber 101 - US Cyber Command History,” U.S. Cyber Command, October 4, 2022.
(Archived version available at https://web.archive.org/web/20221011152417/https://www.cybercom.mil/Media/News/Article/3179270/
cyber-101-us-cyber-command-history); For a history of information operations in the U.S. Army, see: Sarah P. White, “The Organizational
Determinants of Military Doctrine: A History of Army Information Operations,” Texas National Security Review, Winter 2022/2023.
(https://tnsr.org/2023/01/the-organizational-determinants-of-military-doctrine-a-history-of-army-information-operations); For cyber, see,
Sarah P. White, “Subcultural Influence on Military Innovation: The Development of U.S. Military Cyber Doctrine,” Doctoral dissertation,
Harvard University, Graduate School of Arts & Sciences, 2019. (https://dash.harvard.edu/handle/1/42013038)
115. Joshua Rovner, “Warfighting in Cyberspace,” War on the Rocks, March 17, 2021. (https://warontherocks.com/2021/03/warfighting-
in-cyberspace)
cyber-101-us-cyber-command-history)
117. Omry Haizler, “The United States’ Cyber Warfare History: Implications on Modern Cyber Operational Structures and Policymaking,”
Cyber, Intelligence, and Security, January 2017. (https://www.inss.org.il/wp-content/uploads/2017/03/The-United-States%E2%80%99-
Cyber-Warfare-History-Implications-on.pdf )
118. The Joint Chiefs of Staff, “The National Military Strategy of the United States of America,” 2004. (https://nssarchive.us/wp-content/
uploads/library/nms/nms2004); Michael Warner, “US Cyber Command’s First Decade,” Hoover Institution, 2008. (https://www.hoover.org/
sites/default/files/research/docs/warner_webready.pdf )
119. U.S. Department of Defense, “National Military Strategy for Cyberspace Operations (NMS-CO),” December 11, 2005. (https://
nsarchive2.gwu.edu/NSAEBB/NSAEBB424/docs/Cyber-023.pdf )
Page 37
defending DoD information systems and the nation offensive operations in cyberspace “subject to the …
from significant cyberattacks.120 legal regimes that the Department follows for kinetic
capabilities, including the law of armed conflict and
CYBERCOM inherited the missions of defending the War Powers Resolution.”122
DoD information systems, supporting joint force
commanders in cyberspace, and advancing national The FY 2019 NDAA stated that clandestine cyber
interests in and through cyberspace. The services operations may be launched short of hostilities.
became responsible for force generation and force The law also gave DoD the authority “to take
development. They also developed their own appropriate and proportional action in foreign
components responsible for information and cyber cyberspace to disrupt, defeat, and deter” in response
operations in support of operations in their respective to “an active, systematic, and ongoing campaign of
warfighting domains. attacks against the Government or people of the
United States in cyberspace, including attempting to
In 2018, the president ordered the elevation of influence American elections and democratic political
CYBERCOM to a unified combatant command. processes.” The law further authorized CYBERCOM
Compared to a sub-unified command, each unified to disrupt and respond to attacks in cyberspace,
combatant command has additional support redefining cyber as a “traditional military activity.”123
mechanisms, a direct line of communication to the
secretary of defense through a four-star general, These new authorities largely aligned with the Trump
greater authority to request budgetary resources, and administration’s National Security Presidential
a distinct geographical or functional responsibility.121 Memorandum-13, which officials say streamlined the
CYBERCOM also has dedicated combatant command process for authorizing military cyber operations.124
staff, mirroring the organizational structure of the Joint These changes also coincided with CYBERCOM’s
Staff at the Pentagon. publication of its first command vision, “Achieve and
Maintain Cyberspace Superiority,” as well as DoD’s
In parallel, CYBERCOM gained additional authorities release of the 2018 DoD Cyber Strategy.125
to conduct military cyberspace operations short of
armed conflict to persistently engage and contest Finally, in the FY 2022 NDAA, Congress granted
adversaries outside of DoD-controlled cyberspace. In CYBERCOM Enhanced Budgetary Control (EBC).
FY 2012, the NDAA affirmed that DoD can conduct These authorities will take full effect in 2024, allowing
cyber-101-us-cyber-command-history)
121. Andrew Feickert, “The Unified Command Plan and Combatant Commands: Background and Issues for Congress,” Congressional
Research Service, updated January 3, 2013. (https://crsreports.congress.gov/product/pdf/R/R42077/11)
bill/112th-congress/house-bill/1540)
123. Catherine A. Theohary, “Defense Primer: Cyberspace Operations,” Congressional Research Service, updated December 14, 2022.
(https://sgp.fas.org/crs/natsec/IF10537.pdf ); Robert Chesney, “The Law of Military Cyber Operations and the New NDAA,” Lawfare, July
26, 2018. (https://www.lawfareblog.com/law-military-cyber-operations-and-new-ndaa)
124. Mark Pomerleau, “What good are ‘exceptional’ cyber capabilities without authority?” C4ISRNET, July 16, 2019. (https://www.
c4isrnet.com/dod/2019/07/16/what-good-are-exceptional-cyber-capabilities-without-authority)
125. U.S. Cyber Command, “Achieve and Maintain Cyberspace Superiority: Command Vision for US Cyber Command,” April 2018.
(https://www.cybercom.mil/Portals/56/Documents/USCYBERCOM%20Vision%20April%202018.pdf ); U.S. Department of Defense,
“Cyber Strategy: Summary,” September 18, 2018. (https://media.defense.gov/2018/Sep/18/2002041658/-1/-1/1/CYBER_STRATEGY_
SUMMARY_FINAL.PDF)
Page 38
CYBERCOM to directly control resources for In 2022, the secretary of defense elevated the CNMF
equipping the Cyber Mission Force.126 As General (within CYBERCOM) to a sub-unified combatant
Paul Nakasone testified to Congress in March 2023, command, providing it with additional authorities and
the objective is to better harmonize CYBERCOM’s responsibilities. After more than a decade, CYBERCOM
responsibilities and cyberspace operations by providing now has the Traditional Military Activities authority
the command with control over funding for major to conduct overt and clandestine action in support
acquisition programs that the services were previously of U.S. armed conflict.128 CYBERCOM also has
directing. In anticipation of these responsibilities, acquisition authority and statutory responsibility for
CYBERCOM has stood up a joint cyber weapons managing its personnel.
program management office.127
127. Mark Pomerleau, “Cyber Command prepares to gain significant budget control,” FedScoop, March 14, 2022. (https://
fedscoop.com/cyber-command-budget-control-preparations-pom); Alexandra Lohr, “CYBERCOM Acquisition has the money,
now it needs the manpower,” Federal News Network, May 8, 2023. (https://federalnewsnetwork.com/acquisition/2023/05/
cybercom-acquisition-has-the-money-now-it-needs-the-manpower)
128. Robert Chesney, “Traditional Military Activities in Cyberspace: Clarifying DOD’s Authority and the Line Between T10 and
T50 Activities?” Lawfare, May 9, 2011. (https://www.lawfaremedia.org/article/traditional-military-activities-cyberspace-clarifying-
dods-authority-and-line-between-t10-and-t50); Paul C. Ney Jr., “DOD General Counsel Remarks at U.S. Cyber Command Legal
Conference,” U.S. Department of Defense, March 2, 2020. (https://www.defense.gov/News/Speeches/speech/article/2099378/
dod-general-counsel-remarks-at-us-cyber-command-legal-conference)
Page 39
Acknowledgements
The authors would like to thank Logan Weber, who served as the principal researcher on this study while he
was a research analyst at FDD’s Center on Cyber and Technology Innovation. His spadework was critical to the
analysis and recommendations in this paper. Additionally, the authors would like to thank Mike Klipstein, Michael
McLaughlin, Derek Bernsen, Casey Miller, Alexei Bulazel, Rebecca Lively, Todd Arnold, Shawn Lonergan, and the
“operationally brilliant maverick” Navy lieutenant commander for sharing their insights and expertise. The authors
also wish to express their deepest gratitude to the men and women, both in and out of uniform, who courageously
offered their perspectives, views, and choice words to this report. The nation is indebted to these warfighters trying
daily to hold the country’s adversaries at risk and keep us safe in cyberspace. While many experts helped refine the
conclusions, any errors in fact or judgment are the authors’ alone. The authors are also grateful to Annie Fixler and
John Hardie for their careful edits to the draft and to Erin Blumenthal and Daniel Ackerman for the design and
production of this monograph.
Cover Illustration by Daniel Ackerman/FDD

About the Authors

Dr. Erica Lonergan (née Borghard) is an assistant professor in the School of International
and Public Affairs at Columbia University. Previously, Erica held several positions at the United
States Military Academy at West Point, including assistant professor in the Departments of
Social Science and Electrical Engineering and Computer Science, fellow at the Army Cyber
Institute, and executive director of the Rupert H. Johnson Grand Strategy Program. Beyond
her academic and research appointments, Erica has an extensive background in strategy and
policy. Previously, she was a lead writer of the 2023 U.S. Department of Defense Cyber
Strategy and the congressionally mandated Department of Defense Cyber Posture Review.
Prior to that, Erica served as a senior director on the Cyberspace Solarium Commission and
continues to serve as a senior advisor to CSC 2.0.
RADM (Ret.) Mark Montgomery serves as senior director of FDD’s Center on Cyber and
Technology Innovation and as an FDD senior fellow. He also directs CSC 2.0, an initiative
that works to implement the recommendations of the congressionally mandated Cyberspace
Solarium Commission, where he served as executive director. Previously, Mark served as policy
director for the Senate Armed Services Committee, coordinating policy efforts on national
security strategy, capabilities and requirements, and cyber policy. Mark served for 32 years in
the U.S. Navy as a nuclear-trained surface warfare officer, retiring as a rear admiral in 2017.
His flag officer assignments included director of operations (J3) at U.S. Pacific Command;
commander of Carrier Strike Group 5, embarked on the USS George Washington, stationed
in Japan; and deputy director for plans, policy, and strategy (J5) at U.S. European Command.
About the Foundation for Defense of Democracies

The Foundation for Defense of Democracies (FDD) is a Washington, DC-based, nonpartisan policy institute
focusing on foreign policy and national security. For more information, please visit www.fdd.org.
FDD’s Center on Cyber and Technology Innovation (CCTI)

CCTI seeks to advance U.S. prosperity and security through technology innovation while countering cyber
threats that seek to diminish it. CCTI promotes a greater understanding within the U.S. government, private
sector, and allied countries of the threats and opportunities to national security posed by the rapidly expanding
technological environment.
FDD’s Center on Military and Political Power (CMPP)

FDD’s Center on Military and Political Power promotes understanding of the defense strategies, policies, and
capabilities necessary to deter and defeat threats to the freedom, security, and prosperity of Americans and our allies,
by providing rigorous, timely, and relevant research and analysis.
FDD values diversity of opinion and the independent views of its scholars, fellows, and board members. The views of the
authors do not necessarily reflect the views of FDD, its staff, or its advisors.
P.O. Box 33249
Washington, DC 20033-3249
(202) 207-0190
www.fdd.org

Cyber Force A Defense Imperative

Uploaded by

Cyber Force A Defense Imperative

Uploaded by

United States Cyber Force

Dr. Erica Lonergan and RADM (Ret.) Mark Montgomery

Dr. Erica Lonergan

HISTORY AND CURRENT ORGANIZATION OF THE U.S. MILITARY IN CYBERSPACE....... 7

COUNTERARGUMENTS TO ESTABLISHING A U.S. CYBER FORCE ........................................ 25

WHAT SHOULD A CYBER FORCE LOOK LIKE?............................................................................ 28

History and Current

After discovering additional foreign cyber espionage

Figure 1: Cyberspace Operations Forces

Cyberspace Elements Not Part of the

DoD Business Function Elements

CYBERCOM Cyber Service-Retained Forces,

Joint Cyber Centers

DoD Component Intelligence Units and Personnel

Evolution of CYBERCOM’s Authorities executive agents for procurement for CYBERCOM,

In Their Own Words:

“Atfromroot, the current readiness issue stems

Inconsistent and Inadequate Training “different service-desired outcomes and minimal

In fact, it was not until February 2023 that the Navy

“Of the U.S. military’s more than 45 general

Intelligence Support If such a center were established, it would likely

Counterarguments streamlining these transfers, the Space Force acquired

Cyber Force Counterargument 2: The Space

Figure 3: SOCOM Structures

Special Operations Special Operations Special Operations Special Operations

United States Special Joint Special

U.S. Marine Corps Forces U.S. Marine Corps Forces

Service Component Commands

Figure 4: CMF Structures

Directed by Joint Force

Combat Mission Directed by

In this scenario, the commander of CYBERCOM What Should a

Figure 5: Initial Billets of a New Cyber Force

COF Cyber Force Non-COF

CYBERCOM Cyber Force Service-Retained Forces,

Some Personnel Trained and Equipped by Cyber Force,

U.S. Cyber Force Responsibilities Service-Retained Responsibilities

Man, train, equip for offensive cyberspace operations

Man, train, equip for defensive cyberspace operations clearly linked to

hundred-billion-dollar budgets of the Army, Navy,

Conclusion promised expansion of the CMF, and the delivery of

Appendix A: Select Quotations from Interviews

Lieutenant Colonel, Commander, United States Navy

Figure 9: The Space Force vs. Space Command

What It Is What It Does Composition

Provides the people

Appendix C: The History of U.S. Information Operations

Cover Illustration by Daniel Ackerman/FDD

About the Authors

About the Foundation for Defense of Democracies

FDD’s Center on Cyber and Technology Innovation (CCTI)

FDD’s Center on Military and Political Power (CMPP)

You might also like