Cyber Command now building a warfighting platform, not just a capability architecture
For more than a decade, U.S. Cyber Command and its digital warriors spread across the joint services have been building the proverbial airplane while they’ve been flying it. Creating a military cyber force, the Department of Defense relied heavily on intelligence personnel, infrastructure platforms and tradecraft to build its enterprise. But just like the Army needs tanks and the Air Force needs planes to conduct missions, cyber troops need their own platforms separate from the National Security Agency, which conducts foreign intelligence.
Enter the Joint Cyber Warfighting Architecture (JCWA). Created around 2019 by Cybercom Commander Gen. Paul Nakasone, this architecture was designed to get a better handle on the capabilities, platforms and programs the command is designing, and set priorities for DOD as well as the industry partners that would be building them.
As initially laid out, it included four main programs: the Persistent Cyber Training Environment for conducting training and mission rehearsal, Unified Platform — considered the centerpiece where data is ingested, analyzed and shared — Joint Cyber Command and Control to command cyber forces and the larger cyber environment, and the Joint Common Access Platform for executing offensive operations. It also included a category for tools and sensors.
A Cybercom spokesperson said the ultimate vision for JCWA has not changed since it was laid out in 2019, adding “the development of JCWA capabilities focuses on building a living architecture … By maximizing innovation, JCWA can address evolving threats, adapt to changing technologies and implements new tactics, techniques, and procedures to make timely decisions and take decisive action to defeat U.S. adversaries at speed and scale.”
The services, on behalf of Cybercom — which sets the requirements and standards — and the cyber mission force procure these systems as executive agents. This creates potential integration challenges given all these capabilities must be able to interact and be compatible with each other at the joint level with joint cyber teams.
“I think it’s definitely a large feat of trying to bring together all of these service level elements into this converge warfighting platform,” Chris Benney, vice president at Parsons, said in an interview. “If we can’t integrate these great, amazing capabilities together, we’re not going to be able to achieve that end state of this unified system-of-systems weapons platform and really be part of that multi-domain operations view that we have from a unified Department of Defense strategy.”
Creating the architecture has been beneficial to contractors.
“I’m really excited about that architecture and that framework, specifically because it allows the industrial base to deliver capabilities at speed and scale in support of the command,” Janelle Romero, vice president for cyberspace operations at CACI, said in an interview.
Her colleague, Pete Gallagher, senior vice president for technology solutions at CACI, echoed these sentiments explaining it helps partners organize their approach toward software and hardware.
Aside from the major contractors that are acting as primes to develop systems such as Northrop Grumman for Unified Platform, ManTech for JCAP, Cole Engineering for PCTE’s larger Cyber TRIDENT effort and Two Six Technologies, whose Ike platform is a key component for JCC2, several other companies are supporting the JCWA from a tools or integration standpoint.
“We’re actually actively engaged in several of the development integration of the JCWA core components across not only at the joint-like U.S. Cybercom level, but also down at the DoD service executive agent level,” Benney said. “We’re currently supporting the integration of our enterprise network mapping capability into the Unified Platform component, as well as the JCAP or that firing platform with our access management system for the automated configuration and orchestration of the access operations.”
Benney also said Parsons is working at the strategic level to help integrate systems together, engaging with working groups and the Rapid Development and Integration office within Cybercom’s J9 acquisition and technology directorate.
Others are also looking at supporting the initiative when it comes to tools and access capabilities.
“Our customers need to [have] new and novel approaches to ‘arrive on target,’ evolving beyond current capabilities and current delivery infrastructure to account for defensive features seen in hard-target environments. And we find our customers looking for tools that will allow them to project power against all types of network targets,” said Kevin Fogarty, group chief technology officer for aerospace, defense and civil operations at Dynetics, a Leidos subsidiary. “Dynetics is able to combine our experience and expertise in platform development and systems analysis to create research projects that result in prototype and demonstrated next-generation access capabilities and tools.”
Sources who spoke to DefenseScoop could not think of a completely analogous setup across the DOD that resembles the JCWA. The cyber enterprise within DOD is quite unique, and it includes a combatant command with service-like authorities to train and oversee joint cyber operators and operations.
Some pointed to the Special Operations Command model, others pointed to the F-35 Joint Strike Fighter program, but most recognized that there isn’t an exact replica for procuring capabilities and priorities within the DOD.
“You can search for analogues, but in some ways, I think it is a very unique approach that is again, oriented with U.S. Cybercom specific and unique Title 10 mission,” Dan Haas, director in Peraton’s cyber mission sector, said in an interview. “They, the [combatant command], is creating the major warfighting platform that then they can move out to the service components who are going to be executing some of the missions and allow them to make limited modifications that are operationally relevant or necessary to conduct operations in this specific environment that they will be operating in.”
A weapons platform
Having initially laid out an architecture for programs, Cybercom has shifted its strategic thinking recently, referring now to the architecture as a whole as a weapons platform, not just an architecture of disparately connected systems.
Many see this as a positive step, given cyber warriors will be conducting operations from this platform in support of combatant commanders and national objectives.
“The way I see that it’s more of analogous to these larger weapons platforms we have throughout the DOD. That’s really in my opinion repositioning the focus of what the intention of it really is,” Benney said.
Sources indicated that one of driving forces behind this shift was the naming of Michael Clark as the new director for the J9. Clark has a rich history with the command dating back to its predecessor organization, Joint Functional Component Command – Network Warfare.
“I’m not sure everybody outside the command recognizes the importance of doing that,” one industry source, who requested to not be named, said of Clark’s appointment to the position. “He’s been with the command the longest, he’s got the most experience in the command all on the ops side. Bringing Mike over to make him the [J9] was pretty significant … it makes a lot of sense because he knows JCWA from before it started. He knows the command.”
Sources also indicated one of Clark’s goals has been to help clarify what the JCWA is in both vision and practical terms. Additionally, Lt. Gen. Timothy Haugh, who recently assumed the Cybercom deputy commander role from 16th Air Force — the Air Force’s information warfare command and service component to Cybercom — will turn his priority to the JCWA.
Haugh’s background, recently as a commander in the fight and previously leading the elite cyber national mission force for Cybercom, along with Clark’s vision will “bring in a renewed energy and perspective to what the command can do to synchronize JCWA within the headquarters,” the source believes.
Some are already starting to see a change in both clarity and consolidation.
“It is positive that U.S. Cybercom is making some deliberate actions to centralize their efforts, their resourcing and their control over the development of the JWCA and its elements in a way to address the complexity and the challenges they have had so far,” Haas said. “The cyber domain is an extremely dynamic domain. It is a domain where we are in contact with our adversary every day. It is moving at a pace, oftentimes, it is more rapidly developing and evolving than the other physical domains. I think what you see in the evolution of the JCWA is a reflection of that reality.”
If the JCWA is to be a warfighting platform, it also has to be outcomes focused, meaning Cybercom has to focus on more than just the technical requirements when communicating to industry, sources say.
“It is operational integration of the elements of the JCWA with a focus on achieving outcomes not just achieving an architecture. That is the way we design a platform. That’s the way we design any large complex warfighting platform, be it a bomber, a fighter, aircraft carrier, etc.,” Haas said. “It’s got to be integration focused on operational outcomes. It has to move beyond the technical.”
Improved coordination with contractors
Cybercom is still a relatively new organization as far as DOD goes, especially when it comes to building its own acquisition prowess that is poised to manage $3 billion.
Industry sources indicated that the command’s communication on priorities and needs is getting better from where it was years ago, but there is still room for more improvement.
“The interaction with industry over the past couple of years has been challenging, but I’m very encouraged by the recent deliberate engagements with industry,” Haas said.
The command is hosting industry days where members of the contracting community can interact with procurement officials and hear what the command desires for support.
A Cybercom spokesperson noted the command holds various forums such as procurement forums and academic engagement network efforts through its DreamPort facility.
“At the top level, [the command] and its partners have done a good job of articulating JCWA vision. From our company’s business, we see well-articulated requirements and use cases at a contract level,” Fogarty said.
These types of engagements have provided for more of a dialogue, allowing industry to provide feedback to Cybercom.
“I think we’ve started to get back to a different state where they opened the doors slowly into that engagement and giving us those opportunities to have a two-way conversation,” Benney said. “That type of level of engagement with industry and even some of our leaders that are involved in so many different elements of this gave us an opportunity to provide them real and honest feedback with where they’re going, what they’re doing and where we think, and giving them suggestions on where they need to go.”
The Cybercom spokesperson said as emerging and innovative capabilities are identified, the command ensures associated requirements and needs are incorporated into the JCWA integration efforts.
Others indicated some of the most important dialogues occur in classified spaces, indicating they’d like to see more of these.
“When we could have the classified discussions and really understand the threat and really understand what … they need from us, I think those are critical,” Gallagher said. “The threat-based understanding of what the demands are, I think, from Cybercom is helpful to all of industry.”
Others have suggested more unclassified sessions to attract more participation, especially since many tools that underpin the technologies for the JCWA components are unclassified.
Fogarty said the most important relationship is threefold: the government acquisition element purchasing a capability, industry, and operators who will use the technology.
“We have seen success when all three parties are in close collaboration, the feedback loop between operator and technology developer allows for the right capabilities to be developed and delivered in the right form factor for operational use. Ensuring this collaboration continues to the greatest extent possible will go a long way in ensuring the operational utility of the JCWA over time,” he said.
Ultimately, the biggest area the command needs to improve upon is integration to ensure success, sources say.
“Given that they are moving in the right direction on some of the consolidation, as we’ve discussed in viewing this as a platform, I think that the biggest room for improvement lies … in that integration piece,” Haas said, reiterating it’s “not technically integrate, because technical integration is necessary, but insufficient to achieving operational outcomes.”
