Cyber Command working to create an intelligence center
Cyber Command is establishing its own cyber intelligence center, on par with other similar centers across the military services and domains of warfare.
“Congress asked us ‘do we need a center that is focused on all-source intelligence to support Cyber Command in the cyber domain?’ The answer was a resounding yes,” Col. Candice Frost, commander of the Joint Intelligence Operations Center at Cybercom, said Tuesday at an event hosted by Billington Cybersecurity. “My small but hearty brigade-worth of people are unable to do that … as is done in the Army by National Ground Intelligence Center and the Air Force for their Air and Space Center. We’re going to stand that up.”
The idea for the center, dubbed the Cyber Intelligence Center, was first described in November by Maj. Gen. Matteo Martemucci, Cybercom’s director for intelligence.
For years, dating back to when Cybercom was created, there have been discussions surrounding building the capability and capacity for developing organic cyber intelligence. Relatedly, as cyber has grown in importance, there have been increasing discussions for years at the Defense Intelligence Agency regarding what foundational cyber intelligence is.
“We think that there’s room for discussion about what’s the future of cyber intelligence really is in partnership with Cyber Command, NSA and others across the community to really define where we need to go,” Lt. Gen. Scott Berrier, director of the Defense Intelligence Agency, said in September.
DIA is responsible for providing intel on foreign militaries and owning all the intelligence directorates, or J2s, at the combatant commands.
When it comes to foundational intelligence, much is known about the physical world and the platforms like tanks and airplanes that forces have been using for decades. But that still doesn’t exist in the cyber or network realm.
“If you think about foundational military intelligence, it’s based on understanding what the foreign militaries have, what the capabilities are based on the physical presence of these things. It’s harder in cyber, because you may know where a cyber facility physically is located, but you really don’t know what activity is going on inside that facility. You don’t know what tools are being taken advantage of. You don’t know what networks are being operated on,” Berrier said.
Frost explained that as Cybercom looked at its collection platform, it noticed there were some real gaps that existed.
While Cyber Command has a tight linkage with the National Security Agency and the signals intelligence it produces, Frost noted that as a combatant command, Cybercom truly needs all-source intelligence.
“We have found, unfortunately, that that foundational layer in cybersecurity just wasn’t there,” she said. “We know everything about a T-72 tank all the way to every nut and bolt in there for the Army. Well, we don’t have that for networks, with respect to my all-source capability.”
For the workforce that will support the center, Frost said it will primarily come from DIA. But, the key priority is building a workforce that can marry the traditional side of intelligence with the more technical side of hardware and software systems.
“We have a workforce of amazing all-source analysts, but they’re kind of like me, political science majors, and I need some that are really in the nuts and bolts, they can get down to understanding hardware, software,” she said. “We’ve got to build that workforce and then combine those together to build this Cyber Intelligence Center. That is our future vision of what we’re seeing going forward.”
Frost said they’re “building the plane in-flight” when it comes to personnel and cyber intelligence for such a center, an analogy officials often used to describe the creation and stand up of Cybercom.
There is no specific date for the stand up of the center yet, she said, offering that “things take time in the government” and it will work its way through Congress soon.
