Prospective service chiefs pledge to address cyber mission force readiness concerns of Congress
Amid concerns from lawmakers regarding the state of the U.S. military’s digital warriors, President Biden’s picks to lead the Air Force, Navy and Army have pledged to make cyber force readiness a top priority.
“I understand the Air Force has struggled — as have other services — with its cyber readiness. This shortfall is due primarily to difficulties in training and retaining cyber personnel with specialized skills,” Sen. Jack Reed (D-R.I.) said at the kickoff of Gen. David Allvin’s confirmation hearing Tuesday to be the next Air Force chief of staff. “The private sector has realized the immense value of our cyber operators, and is offering them very high compensation to leave the military. The Air Force must adjust accordingly by providing a creative combination of incentives to compete for and retain these personnel. This should include competitive compensation and a professionalized military career path. General, I would like to know how you would plan to address this challenge.”
Congress has been concerned for some time regarding the preparedness of the joint cyber mission force.
“The readiness of the Cyber Mission Forces assigned to U.S. Cyber Command is substantially below acceptable levels. This shortfall is due primarily to the lack of sufficient numbers of personnel in each of the services in three critical work roles that are especially demanding: tool developers, exploitation analysts, and interactive on-net operators,” senators wrote in multiple questionaries to prospective service chiefs this summer during their confirmation processes.
The military services are each responsible for providing personnel for a set number of teams to U.S. Cyber Command, which then employs those forces in operations for the other geographic combatant commands. But each service has its own identity, culture, and way of classifying and providing forces to Cybercom — and many observers argue this service-centric setup has been to the detriment of cyber warriors.
Some say this arrangement has led to incongruence in how the teams are filled and personnel cycling in and out too quickly.
“The Air Force recognized the challenges outlined above and if confirmed, I will continue to emphasize progress in our plan moving forward to bolster readiness within our cyberspace forces. Our Career Field Management Team recently completed an enterprise-wide review of all our cyberspace forces personnel ensuring we have the right Airmen with the right training in the right spot,” Allvin wrote in response to questions posed by senators ahead of his confirmation hearing. “This will be a continuous effort to ensure we are meeting the needs of the cyberspace forces for the fight tonight and into the future. Furthermore, we are moving forward with consecutive tours for Airmen assigned to the cyberspace forces, which allows them the ability to deepen their technical expertise which raises the readiness levels of our force.”
Allvin also noted that the Air Force’s cyber component is diverse and each career field — which encompasses cyber effects, intelligence and others – have their own unique set of training and retention challenges. However, there is some commonality across the board.
One of the recent changes made within the Air Force is all of its cyber units — offensive and defensive — now exist under one wing, the 67th Cyberspace Wing, which has benefits from an organizational perspective.
“I have a singular leader in the wing commander and their team that now is responsible for the organize, train and equipment functions,” Lt. Gen. Kevin Kennedy, commander of 16th Air Force and Air Forces Cyber, told DefenseScoop this week in an interview at AFA’s Air, Space and Cyber conference.
He noted there are operational activities where leadership chains can be pulled in to support different activities occurring at different levels of Cybercom, such as its Cyber National Mission Force — a sub-unified command responsible for defending the homeland — or Joint Force Headquarters-Cyber Air Force, which conducts cyber operations on behalf of U.S. European Command, Strategic Command and Space Command.
“That is one of the benefits that I’ve seen firsthand is bringing them together in a singular way,” Kennedy said.
Prior to placing these forces under one wing and prior to the creation of 16th Air Force, cyber forces were spread across two separate numbered air forces, which created difficulties with command relationships and oversight of teams given intelligence operators served beneath a separate Air Force command and a separate commander.
This streamlining has helped improve readiness as well as the organize, train and equip function for which the Air Force is responsible to Cybercom.
Allvin, in his answers to lawmakers’ questions, also recognized that the service cannot compete with the salaries offered in the private sector.
“Lack of parity with industry financial incentives with high demand, low density skillsets is one common factor impacting retention. The Department of Defense will never keep pace with commercial sector pay, but we will consistently attract top tier personnel passionate about the mission of serving their nation. Furthermore, we identified opportunities in our development track of these talented Airmen that required adjustment from the quality of training to deliberate placement in CMF roles,” he wrote.
“We are launching the Cyber Assignment Incentive Pay (CAIP), which provides members in critical roles on the CMF teams with up to an extra $1,500 a month. Additionally, CAIP is on top of the Special Duty Assignment Pay (SDAP) that our cyberspace Airmen receive today. Going into this upcoming Fiscal Year, these Airmen will move into the top-tier pay rate under the SDAP program. While the Department of Defense will continually struggle to match the pay from the commercial sector, this helps close the gap and reinforces that we value their skillset. If confirmed, I remain committed to following this through to ensure we are providing cyber ready Airmen to defend our nations critical assets,” he added.
However, Allvin also noted that congressional action has “better equipped” the Air Force to compete with industry.
“Direct appointment authority, constructive credit for cyber and other critical line officers and other pay flexibilities, such as cyber assignment incentive pay, allows the Air Force to recruit better and retain these in-demand skilled personnel. If confirmed, I will continue to advocate for flexibility to grow and advance our workforce, ensuring we have the right skills in sufficient numbers to maintain competitive advantage in a high-end fight,” he wrote.
President Biden’s pick to be the next chief of naval operations, Adm. Lisa Franchetti, echoed similar sentiments to Allvin.
“The Navy remains fully committed to meeting DOD and USCYBERCOM Cyber Mission Force (CMF) requirements both in readiness and directed growth. We have prioritized fixing readiness while still aggressively working to grow the force. To do this, Navy established Cyber Qualification Training Teams (CQTT) and implemented improvements in Force Generation to streamline training and to fix processes prior to growing the Navy CMF from 40 to 44 teams,” she wrote in response to senators’ advance policy questions.
The Navy has been one of the biggest culprits of the readiness issue, drawing the ire from Congress, which has even questioned whether the Navy should be part of providing personnel to the cyber mission force and cyber operations at all. It had been the only service that did not have a dedicated military role for cyber. Its cyber personnel were primarily resourced from its cryptologic warfare community — which is also responsible for signals intelligence, electronic warfare and information operations, among several mission sets — with additional roles resourced from information specialists and cyber warfare engineers. Cyber warfare engineers are not operators, but specialize in highly technical skills and development of tools.
In fact, the Navy was forced to adjust and scale back four additional teams it was slated to provide to the cyber mission force as part of authorized growth to the overall force, which Franchetti was alluding to in her statements to senators. Created in 2013, the military has not added any teams beyond the initial 133 envisioned at that time and built out in the coming years, culminating in full capability in 2018.
The Department of Defense has authorized an additional 14 teams over five years, for which the Navy was to provide four. However, readiness issues have forced the Navy to cut back and instead focus on training.
The Navy, in response to congressional direction, created specific cyber work roles for officers and enlisted personnel.
“Our aggressive action to correct has turned the tide, and Navy readiness for Cyber is rapidly improving in order to meet the demands of U.S. Cyber Command,” Franchetti wrote.
She also pledged to senators to make the readiness of the force a big priority.
“If confirmed, I will continue to work to meet our Navy cyber responsibilities. As you may be aware, we just created a cyber designator for our officers and a rating for our enlisted people. If confirmed, I want to ensure that these people are focused on cyber warfare all the time. This is what they joined the Navy to do, this is what they want to do. We need to make sure they have the training and the tools needed to be able to do their jobs and meet the mission requirements for both offensive and defensive cyber,” she told senators Thursday during her confirmation hearing. “If confirmed, I will continue to focus on this area to make sure we have the right incentives in place to retain them and also that they have good work environments to be able to do this job … I’m very committed to working in the joint environment with Cybercom on this.”
The nominee to lead the Army faced similar questions during his confirmation hearing. Gen. Randy George, tapped to be the service’s next chief of staff, seeks to augment shortfalls and readiness issues with uniformed cyber warriors by supplementing them with civilian personnel and increasing the length of their tours of duty.
While an [Office of the Secretary of Defense]-led force-generation study is ongoing to recommend cross-[Department of Defense] opportunities to correct readiness shortfalls across the Cyber Mission Force, the Army is looking to expand the application of the Cyber Excepted Service to provide expedited recruiting and more flexible retention options for civilians,” George wrote in response to questions from senators. “The Army will also assess the length of tours to ensure the Army realizes the full return on its investment in those personnel who have been through the most rigorous training. Finally, the Army will always look to expand and offer other broadening retention opportunities.”
Officials have maintained that Cybercom will have better oversight and ability to control the readiness of the forces within the services once it gains enhanced budget authority Oct 1. Beginning in fiscal 2024, Congress has granted the command enhanced budget authority, meaning it has greater oversight over the dollars involved in the capabilities and platforms the services are building on its behalf. This is viewed as a critical step regarding Cybercom’s maturation and maturity as it continues to grow since its creation in 2010.
“We think about the authorities that now have been given to Gen. [Paul] Nakasone so that when the budget passes for FY ’24, he will now have enhanced budget control, meaning the responsibility to execute the entire department’s budget for the cyber mission force. Where has he initially invested that budget? Back into our people and into our readiness, our training environments, our ranges, our ability to integrate our Guard and Reserve,” Lt. Gen. Timothy Haugh, Cybercom’s deputy commander and nominee to succeed Nakasone, said at AFA’s Air, Space and Cyber conference.
“As U.S. Cyber Command and underneath unified command plan, there are a number of sets of authorities that the president has given to Gen. Nakasone and the Congress. And one of those is to evaluate the services’ readiness — the ability to retain, the ability to promote and to be able to communicate back to the department, the strength and health of the cyberspace workforce,” Haugh added.
