Pentagon to boost cybersecurity force

nnttttt

WASHINGTON – The Pentagon has approved a major expansion of its cybersecurity force over the next several years, more than quadrupling its size to bolster the nation’s ability to defend critical computer systems and conduct offensive computer operations against foreign adversaries, according to U.S. officials.

The move, requested by the head of the Defense Department’s Cyber Command, is part of an effort to build an organization that until now has focused largely on defensive measures into the equivalent of an Internet-era fighting force. The command, made up of about 900 personnel, will expand to include 4,900 troops and civilians.

n

Details of the plan have not been finalized, but the decision to expand the Cyber Command was made by senior Pentagon officials late last year in recognition of a growing threat in cyberspace, said officials, who spoke on condition of anonymity because the expansion has not been formally announced. The gravity of that threat, they said, has been highlighted by a string of sabotage attacks, including one in which a virus was used to wipe data from more than 30,000 computers at a Saudi Arabian state oil company last summer.

The plan calls for the creation of three types of forces under the Cyber Command: “national mission forces” to protect computer systems that undergird electrical grids, power plants and other infrastructure deemed critical to national and economic security; “combat mission forces” to help commanders abroad plan and execute attacks or other offensive operations, and “cyber protection forces” to harden the Defense Department’s networks.

Although the command was established three years ago for some of these purposes, it has largely been consumed by the need to develop policy and legal frameworks and ensure that the military networks are defended. Defense officials said the plan will allow the command to better fulfill its mission.

“Given the malicious actors that are out there and the development of the technology, in my mind, there’s little doubt that some adversary is going to attempt a significant cyber-attack on the United States at some point,” said William Lynn, a former deputy defense secretary who helped fashion the Pentagon’s cybersecurity strategy. “The only question is whether we’re going to take the necessary steps like this one to deflect the impact of the attack in advance or . . . read about the steps we should have taken in some postattack commission report.”

Although generally agreed to by the military’s service chiefs, the plan has raised concerns about how the army, navy, marines and air force will find and train so many qualified cybersecurity personnel. It also raises deeper issues — which are likely to intensify as the Cyber Command grows over the years — about how closely it should be aligned with the National Security Agency, the giant electronic-spying agency that provides much of its intelligence support.

The head of the Cyber Command, Gen. Keith Alexander, is also the director of NSA, which employs some of the nation’s most advanced cyber-operations specialists.

The new force structure was alluded to last fall in a major speech by Defense Secretary Leon Panetta, who declared, “Our mission is to defend the nation,” and noted that the department was “putting in place the policies and organizations to execute the mission.”

In an interview, a senior defense official said that the “national mission” teams will focus their efforts overseas and that any actions they take will be directed outside U.S. networks — unless the teams are asked to provide assistance to another agency with domestic authority, such as the FBI.

“There’s no intent to have the military crawl inside industry or private networks,” the official said. He stressed that the military will act only in cases in which there is a threat of an attack that could “really hurt,” adding: “We’re not talking about doing something to make sure that Mrs. Smith’s bank account didn’t get hijacked by somebody.”

The plan to expand the Cyber Command comes at a time when the military’s services are being ordered to cut spending, a reflection of how important senior military officials see the need to improve the nation’s cybersecurity footing. Some military officials have grudgingly accepted the need to contribute personnel to an expanded cybersecurity force. There are also differences over how much control the combatant commands will have over cyberteams.

The “combat mission” teams may help commanders in operations such as a cybercomponent to disable an enemy’s command-and-control system before a conventional attack. Each region will have teams that focus on particular threats — say, from China or Iran.

“You get the resource guys sucking a lot of air through their teeth because they know their service chiefs have backed it,” one navy official said. “So they have to find the resources to pay for the people.”

Some military and defense officials question whether the Cyber Command can reach its full potential as a military command as long as it is so dependent on the NSA and is led by the NSA’s director. The close relationship between the two has had its advantages, officials say: The agency can peer into foreign networks and provide the command with intelligence, including in cases in which an adversary is suspected of planning a computer attack or developing a potent virus.

“That gives you an advantage of being able to plan for and be prepared to react,” the defense official said.

But the NSA is so intertwined with the Cyber Command — the two operations centers are side by side and, until recently, some Cyber Command personnel had nsa.gov email addresses — that some current and former officials wonder whether the military command can create an independent, strategic doctrine. The concern is that the intelligence agency’s priorities will dominate, with an emphasis on the development of tools that are useful for surveillance but not necessarily for disrupting adversaries.

But, in fact, said one former intelligence official, the NSA uses military personnel to do much of its work, and pays for a good portion of the services’ cyber-operators. “That’s been the plan all along,” the former official said. “Take the talent resident in NSA, turn it into attack talent.”

ntnttnttntntnttnttntntnttnttntnnnt

In a time of both misinformation and too much information, quality journalism is more crucial than ever.
By subscribing, you can help us get the story right.

ntSUBSCRIBE NOWnnnntnttKEYWORDSntntU.S., military, computersnn n n tn tttt