BY: David A. Fulghum , AviationWeek.com
04/08/2010
http://www.aviationweek.com/aw/generic/story_channel.jsp?channel=defense&id=news/awst/2010/03/29/AW_03_29_2010_p48-210775.xml&headline=Cyber-Warriors%20Begin%20Training
A new cadre of 1,000 U.S. Air Force special operations warriors will be trained
for combat on an invisible battlefield.
The individuals will be selected for their creativity and intellectual
flexibility. The group must then devise rigid standards, predictable procedures
and rules of conduct for their battleground.
There will be staggering obstacles: War is constant, weapons quickly become
obsolete, fratricide is a major threat, and long-term victory is illusory.
Moreover, these hand-picked combatants must identify anonymous assailants,
analyze the scenes of civil crimes and military aggression, examine bugs,
viruses and worms, and—above
all—keep the Air Force
generating its airborne and space missions in the face of unrelenting and
increasingly sophisticated cyber-assault.
This elite group will form the innovative, specialist core of the 24th Air
Force. In June, the first two classes of cyber-experts—about
30 enlisted troops and 30 officers—will
start their undergraduate training at Keesler AFB, Miss. Some of them will go on
to advanced studies at NAS Pensacola, Fla. All will form the cyber-warrior
portion of what is eventually expected to be a 6,000-strong force structure. “I
think that is as big as it needs to be until we figure out what the demand is,”
says Lt. Gen. William Lord, the Air Force’s chief information officer.
In the meantime, the new unit should benefit from ¬changes in the service’s
priorities. It will be partly funded from spending cuts on airlift and fighter
units, says Air Force Secretary Michael Donley. For example, a move to end C-17
production is seen as an internal source of cash.
The slowing of airlift growth and simultaneous tactical fighter force reductions
will allow the buildup of “head space for growing career fields” such as
cyber-combat and the operation of remotely piloted aircraft, says Donley.
“The ultimate personnel requirement in this area is still to be determined,” he
says. “We’re generally pleased with the quality of airman that we have. I
believe the changes we have made over the last year—such
as establishing 24th Air Force as the component command of U.S. Cyber Command—are
the right steps.”
The 24th Air Force will organize the service’s network defenses, codify
cyber-policy, and train and equip cyber-forces. The recently created
organization also will field the service’s cyber-strike and defensive
warfighting capabilities. Combatant commanders around the world will send their
requirements to the 24th, which will then focus the Air Force’s response to that
need.
“Not everybody has to be a computer scientist or an electrical engineer,” says
Lord. “There are behavioral scientists who could tell us how data can be changed
in the enemy command-and-control system to create a response we want.
“Monkeying with the network is not just about turning systems on or off,” he
says. “It’s about the message. How, when and where do you deliver it—to
his house or office? [Cyber-technology] is an instrument that we could use to
change the behavior of a belligerent. A demarche, a well-placed e-mail or a
telephone call from a head of state may create that change.”
The battlefield will encompass not only desktop personal computers but also
laptops, cell phones and whatever replaces the next generation of communication
devices.
“As the Air Force looks to the next generation of devices, we think that will be
droids and i-phones with the ubiquitous ability to talk to anyone in the world
from the battlefield,” Lord says. “That device will have the applications that
you need for your role. If you are a deployed finance guy, you will need access
to the financial system. If you are ordering bombs from the flight line, you get
access to the combat ammunition portal. . . . We’ll become more mobile users on
both the unclassified networks and the classified nets, but with a whole
different security architecture as you go wireless.”
The new school system “begins to get us to the kind of trained force that
combatant commanders believe they need, but it doesn’t get us enough,” he says.
“So, the next issue is throughput.”
Again there is a lineup of acknowledged problems. Recruiters will have to look
for those who value service to the nation, although not necessarily in uniform.
(The cyber-force will eventually comprise contractors, government employees and
those in the military.)
“We’re still constrained by who can do things under Title 10 [warfighting
conventions],” says Lord. “That’s primarily people in uniform—not
contractors and government civilians. We’ve reached the point that there is
basic cyber-knowledge that we teach to everybody,” he says. “There are rules and
responsibilities for everyone who is going to put their fingers on a keyboard.”
This is appropriate, because analyses have shown that the most insidious threat
to Air Force networks is its own cyber-training. The solution, planners believe,
is to ensure that cyber-operators apply the same rigor to manage and maintain
their network as an F-16 crew chief or pilot does.
Moreover, it requires common training, tools, technical orders and safety
equipment. But so far in the network environment, there are too few technical
orders, tactics, standardization and evaluation for managing the networks.
“We’re going to send them off to undergraduate cyber-training, initial
qualification training and mission qualification training, and they will be
evaluated with a similar construct to that of today’s pilots,” says Lord.
And there are plans to find those with an aptitude for creative cyber-ops.
“[Recruiters] are looking at things like gaming,” he says. “Who gets on the
recruiting web site, gets into a game and is successful might be a good
candidate for the cyber-career field.”
Once a cyber-ace is signed up and trained, he or she must be retained.
“We want to keep them in the force longer,” says Lord. “We’re evaluating whether
there should be special pay incentives. Maybe there is a re-enlistment bonus. We
have not looked at accelerated promotions, which might create a force of haves
and have-nots. Right now, it’s very hard to become a staff sergeant [E-5] in the
Air Force within four years. The warrant officer [and specialist limited-duty
officer] option is one that is interesting. [Many Army pilots are warrant
officers.] But I don’t think there is any appetite for that in the Air Force.”
A route to improved compensation for high-demand specialists may have been
blazed with a Feb. 24 decision by Air Force policy officials to give incentive
pay to specialist aircrew who commit to flying remotely piloted aircraft (RPA).
The pay is equivalent to current manned aviation inventive pay, and it is based
on an airman’s time within the specialist field. There are more than 400 airmen
in RPA career fields, a number that is expected to reach 1,000 during the next
few years.
Finally, the Air Force will have to create mid-level cyber-management from
“people already embedded in the [Air Force], regardless of grade, who have had
the right assignments, leadership opportunities, training and aptitude to lead
these kinds of organizations,” says Lord.
The initial task of retooling the schools is completed.
“The first thing we do is to establish the domain—to
build it with routers, switches, hubs, antennas and computers,” says Lord. “Then
the job is to maintain and operate it. Finally, you have to be able to exploit
it and, potentially, to attack. But 95% of this business is to establish,
maintain, operate and defend. There is very little of the other piece.”
However, there are examples of successful cyber-attacks, including some made in
combination with conventional warfare. Russia has targeted Estonia and Georgia.
The U.S. is under daily probes from Chinese IP addresses. The U.S. used
information warfare, denial of service and network attacks against Iraq and
Serbia.
There are also laboratory examples of anti-electronic attacks. Electrical
generators have been destroyed with a few lines of computer code, and a beam of
high-power microwaves gave the fly-by-wire system of an F-16 a “nervous
breakdown” that produced wildly fluttering control surfaces.
Another interesting cyber-operation was the Israeli attack in 2007 on a Syrian
facility suspected of being associated with nuclear enrichment. The Syrian air
defense went down, and the Israeli air force dropped its bombs. Experts say it
was an airborne computer network attack, while others contend it was basic but
well-carried-out electronic warfare jamming.
“The laboratories are working on lots of options [for network attack]—everything
from spaceborne to airborne to terrestrial,” says Lord. “The lesson is, if it is
true that the Israelis used network attack to get through the Syrian air defense
network, then it looks like a great model to emulate.
“But I think most of this business is basic blocking and tackling [with
standardized electronic warfare, analysis, procedures and techniques],” he says.
“There is a role for some exotic stuff. But most of the heavy lifting is the
day-to-day slogging [through the tactics, techniques and procedures].
You can’t use the same cyber-tricks time after time. A vulnerability that you
can exploit a couple of times is going to close up eventually. We’re patching
software in our own networks almost everyday.
“The future of cyber [training and manning] will be a function of how we think
of modern warfare,” he notes. “That will change in the next 15-20 years [with a
trend to greater use of nonkinetic and information operations]. And in my
business, it’s all defensive. So now what you need are people who can recognize
anomalies happening in the noise.”
That noise is essentially the exponentially growing volume of digital traffic.
“Everything in the future will have an IP address and that generates millions
more IP numbers,” says Lord. “We will have to sort out with the trash something
as mundane as groceries because they have an IP address. It’s not just e-mails.
Now it’s easier to hide in the noise of the network.”